httpd_g.c

是一个常见路由器升级文件的效验和算法！参考此源码对一些路由器的升级文件（*.bin）进行分析．

			if (memcmp(p, pattern, pattern_len-i) == 0 &&
				memcmp(next->buf, pattern + pattern_len-i, i) == 0)
			{
				*content = current;
				return p;
			}
		}
		
		*prev_content = current;
		current = next;
		//p = p1;
		p = current->buf;
	}
	
	*content = current;
	return NULL;
}

void process_multipart(http_req *req)
{
	http_upload_content *content;
	http_upload_content *prev_content;
	char *startp, *strp;
	char *boundary;
	char *varname;
	
	boundary = strstr(req->content_type, "boundary=");
	boundary += 9;
    
	content = req->content;
	prev_content = NULL;
	startp = content->buf;
	
	while (content)
	{
		if ((startp = check_pattern1(&content, &prev_content, startp, boundary)) == NULL)
		{
			break;
		}
	
		strp = 0;
		if (startp-content->buf > 4)
		{
			strp = startp-4; /* \r\n-- */
		}
		else if (prev_content)
		{
			strp = prev_content->buf + prev_content->len - (4 - (startp - content->buf));
		}
		
		if (strp)
			*strp = '\0';
		
		if (startp < content->buf + content->len - strlen(boundary))
			startp += strlen(boundary);
		else
		{
			startp = content->next->buf + strlen(boundary) - (content->buf + content->len - startp);
			content = content->next;
		}
		
		strp = startp + 1;
		if (strp >= content->buf + content->len)
			strp = content->next->buf;
        
		if (*startp=='-' && *strp=='-')
		{
			break;  /* end */ /* Roger: This check method is right?? */
		}
		
		if (startp < content->buf + content->len - 2)
			startp += 2;
		else
		{
			startp = content->next->buf + 2 - (content->buf + content->len - startp);
			content = content->next;
		}
		
		//
		// XXX -- The following implementation assume the file begins at the first content node
		//
		if (!strncasecmp(startp, "Content-Disposition:", 20) ) 
		{
			if ((varname = check_pattern1(&content, &prev_content, startp, "name=\"")) != NULL)
			{
					
				/* find out begin of file */
				if ((strp = check_pattern1(&content, &prev_content, startp, "\r\n\r\n")) != NULL)
				{
					startp = strp+4;
				}
				else if ((strp = check_pattern1(&content, &prev_content, startp, "\n\n")) != NULL)
				{
					startp = strp+2;
				}
				else
				{
					diag_printf("Can not find value of %s\n", varname);
					return;
				}
				varname += 6;
				strp = strchr(varname, '"');	
				*strp = '\0';
				query_set(req, varname, startp);
			}
		}
	}
}

char *WEB_upload_file(http_req *req, char *filename, int *len)
{
	http_upload_content *content;
	http_upload_content *prev_content;
	http_upload_content *start_content, *end_content;
	char *file, *boundary, *endp;
	//int rlen;
	
	file = query_getvar(req, filename);
	
	if (!file)
		return NULL;
		
	boundary = strstr(req->content_type, "boundary=");
	boundary += 9;
	
	content = req->content;
	prev_content = NULL;
    
	start_content = content;
	while (start_content)
	{
		if (file >= start_content->buf && file < (start_content->buf+start_content->len))
			break;
		start_content = start_content->next;
	}
    
	end_content = start_content;
	if ((endp = check_pattern1(&end_content, &prev_content, file, boundary)) != NULL)
	{
		if (start_content == end_content)
		{
			*len = endp - file;
		}
		else
		{
			*len = start_content->len - (file - start_content->buf);
			start_content = start_content->next;
			while (start_content != end_content)
			{
				*len += start_content->len;
				start_content = start_content->next;
			}
			*len += (endp - start_content->buf);
		}
	
		*len -= 4;
		diag_printf("WEB_upload_file: len=%u\n", *len);
	
		return file;
	}
	else
		return NULL;
}

extern int cfg_chk_header(int id, char * file);
extern void cfg_init_header();
extern int CFG_read_prof(char * file, int size);
extern int cfg_load_static();

static unsigned int unalign_chk_sum2(http_upload_content* content, char *file, int len)
{
	unsigned int sum=0;
	unsigned int d,i;
	http_upload_content *current = content;
	char *p = file;
	char buf[4];
	int remain;

	while (current)
	{
		if (p >= current->buf && p < current->buf+current->len)
			break;
		current = current->next;
	}
    
	for (i=0; i<len; i+=4)
	{
		if (p + 4 < current->buf+current->len)
		{
			memcpy(&d, p, 4);
			p += 4;
		}
		else
		{
			remain = (current->buf + current->len) - p;
			memcpy(buf, p, remain);
			current = current->next;
			p = current->buf;
			memcpy(buf+remain, p, 4-remain);
			p += (4-remain);
			memcpy(&d, buf, 4);
		}
		sum += d;
	}
	
    	return sum;
}

int flsh_write2(unsigned int addr, http_upload_content* content, char *file, int len)
{
    http_upload_content *current = content;
    char *src = file;
    char *dst = (char *)addr;
    int remain_len = len;
    int write_len;
    static int need_align = 0;
    char buf[2];
    
    while (current)
    {
        if (src >= current->buf && src < current->buf+current->len)
            break;
        current = current->next;
    }
    
    while (remain_len > 0)
    {
        if (need_align)
        {
            buf[1] = *src++;
            remain_len--;
            flsh_write((unsigned int)dst, (unsigned int)buf, 2);
            dst += 2;
            if (remain_len == 0)
                break;
        }
        if (current->buf + current->len - src < remain_len)
        {
            write_len = current->buf + current->len - src;
            if (write_len % 2 != 0)
            {
                write_len = write_len - 1;
                buf[0] = *(src+write_len);
                need_align = 1;
            }
            flsh_write((unsigned int)dst, (unsigned int)src, write_len);
            dst += write_len;
            current = current->next;
            src = current->buf;
        }
        else
        {
            write_len = remain_len;
            flsh_write((unsigned int)dst, (unsigned int)src, write_len);
        }
        remain_len -= write_len;
    }

    return 0;
}

int chk_fmw_hdr2(http_upload_content* content, char *file, int len)
{
	fmw_hdr hdr;
	int rc=0;
	extern int config_dl_cookie;
	extern char dl_cookie[];
	
	if (config_dl_cookie)
	{
		if (memcmp(file+68, dl_cookie, 20) != 0)
        {
            diag_printf("invalid cookie\n");
			return -3;
        }
	}
	
	memcpy(&hdr, file, sizeof(fmw_hdr));

	if (hdr.size < sizeof(fmw_hdr))	{
		diag_printf("Image length too short\n");
		return -3;
	}

	switch (hdr.flags.chksum)
	{
	case CHKSUM_NONE:
		break;
		
	case CHKSUM_SUM:
		rc=unalign_chk_sum2(content, file, len);
		if (rc)
			diag_printf("Error chksum=%x\n",rc);
		if (rc!=0) 
			rc=-3;
		break;
		
	default:
		rc=-3;
		break;
	}
    
	return rc;
}

int http_put_file(int id, http_upload_content* content, char * file, int len)
{
    int rc, ok=0;
    extern unsigned int flsh_cfg_fwm_off;
    extern unsigned int flsh_cfg_fwm_sz;
	
    if (content == NULL || file == NULL || len <= 0)
    {
        ok = -3;
        goto err_out;
    }
    
    if (0 != cfg_chk_header(id, file))
    {
        int i;
        diag_printf("[CFG] err header id=%d, dump:", id );
        for (i=0; i<8; i++)
            diag_printf("%02x ", file[i]&0xff);
        diag_printf("\n");
        ok = -3;      // file error
        goto err_out;
    }

    switch (id)
    {
    case 1:
        diag_printf("[CFG] FMW sz=%x ,max=%x!\n", len, flsh_cfg_fwm_sz);
        if (len > flsh_cfg_fwm_sz )
        {
            ok = -3;
            break;
        }

        if (chk_fmw_hdr2(content, file, len))
        {
            ok = -3;
            break;
        }
        diag_printf("[CFG] FMW upload\n");
        diag_printf("[CFG] FMW, sz %d B to flash:", len);

        cyg_scheduler_lock();
        rc = flsh_erase(flsh_cfg_fwm_off, len);
        cyg_scheduler_unlock();
        if (rc)
        {
            diag_printf("er err %d\n", rc);
            ok = -3;
            break;
        }
        
        cyg_scheduler_lock();
        rc=flsh_write2(flsh_cfg_fwm_off, content, file, len);
        cyg_scheduler_unlock();
        
        if (rc)
        {
            diag_printf("wr err %d\n", rc);
            ok = -3;
            break;
        }
        else
            diag_printf("OK!\n");
        break;

    case 0:
        diag_printf("[CFG] update profile!len=%d\n",len);
        cfg_init_header();
        ok = CFG_read_prof(file, len);     // reload to CFG
        cfg_load_static(); 
        if (ok == 0)
        {
            CFG_commit(CFG_DELAY_EVENT);
        }
        break;

    default:
        diag_printf("unknown");
        break;
    }
    
err_out:
    return ok;
}

void CGI_free_content(http_upload_content *content)
{
    http_upload_content *next;
    
    while (content)
    {
        next = content->next;
        if (content->buf)
        {
            if (content->type_mcl)
                MCLFREE(content->buf);
            else
                free(content->buf);
        }
        free(content);
        content = next;
    }
}

#endif