5 changed files with 139 additions and 52 deletions
--- a/0001-build-properly-spell-provide-in-.wrap-files.patch
+++ b/0001-build-properly-spell-provide-in-.wrap-files.patch
@ -1,11 +0,0 @@
-diff -Nur a/subprojects/gssdp-1.6.wrap b/subprojects/gssdp-1.6.wrap
--- a/subprojects/gssdp-1.6.wrap	2023-07-01 23:39:34.000000000 +0800
-+++ b/subprojects/gssdp-1.6.wrap	2024-02-18 16:27:23.490690860 +0800
-@@ -3,6 +3,6 @@
- revision = master
- depth = 1
-  
-[provides]
-+[provide]
- dependency_name = gssdp-1.6
- 
--- a/CVE-2021-33516.patch
+++ b/CVE-2021-33516.patch
@ -0,0 +1,118 @@
+From 697ab5b579debf4b9e0f39143b352877e8af3aad Mon Sep 17 00:00:00 2001
+From: Jens Georg <mail@jensge.org>
+Date: Mon, 10 May 2021 10:34:36 +0200
+Subject: [PATCH] service: Validate host header
+
+Make sure that the host header matches the ip:port of the context.
+
+This is in line with UDA (Host header is required and must match the
+location url) and DLNA 7.2.24.1 (All communication has to use ip
+addresses and not names)
+
+Prevents DNS rebinding attacs against agains UPnP services
+---
+ libgupnp/gupnp-context-private.h |  3 ++
+ libgupnp/gupnp-context.c         | 51 ++++++++++++++++++++++++++++++++
+ libgupnp/gupnp-service.c         | 13 ++++++++
+ 3 files changed, 67 insertions(+)
+
+diff --git a/libgupnp/gupnp-context-private.h b/libgupnp/gupnp-context-private.h
+index 6aa1acd..2657c71 100644
+--- a/libgupnp/gupnp-context-private.h
+++ b/libgupnp/gupnp-context-private.h
+@@ -36,6 +36,9 @@ _gupnp_context_add_server_handler_with_data (GUPnPContext *context,
+                                              const char *path,
+                                              AclServerHandler *data);
+ 
+G_GNUC_INTERNAL gboolean
+gupnp_context_validate_host_header (GUPnPContext *context, const char *host);
+
+ G_GNUC_INTERNAL SoupURI *
+ gupnp_context_rewrite_uri_to_uri (GUPnPContext *context,
+                                   const char   *uri);
+diff --git a/libgupnp/gupnp-context.c b/libgupnp/gupnp-context.c
+index 460179e..1901798 100644
+--- a/libgupnp/gupnp-context.c
+++ b/libgupnp/gupnp-context.c
+@@ -1609,6 +1609,57 @@ gupnp_context_remove_server_handler (GUPnPContext *context, const char *path)
+         soup_server_remove_handler (priv->server, path);
+ }
+ 
+gboolean
+gupnp_context_validate_host_header (GUPnPContext *context,
+                                    const char *host_header)
+{
+        gboolean retval = FALSE;
+        // Be lazy and let GUri do the heavy lifting here, such as stripping the
+        // [] from v6 addresses, splitting of the port etc.
+        char *uri_from_host = g_strconcat ("http://", host_header, NULL);
+
+        char *host = NULL;
+        int port = 0;
+        GError *error = NULL;
+
+        g_uri_split_network (uri_from_host,
+                             G_URI_FLAGS_NONE,
+                             NULL,
+                             &host,
+                             &port,
+                             &error);
+
+        if (error != NULL) {
+                g_debug ("Failed to parse HOST header from request: %s",
+                         error->message);
+                goto out;
+        }
+
+        const char *host_ip = gssdp_client_get_host_ip (GSSDP_CLIENT (context));
+        gint context_port = gupnp_context_get_port (context);
+
+        if (!g_str_equal (host, host_ip)) {
+                g_debug ("Mismatch between host header and host IP (%s, "
+                         "expected: %s)",
+                         host,
+                         host_ip);
+        }
+
+        if (port != context_port) {
+                g_debug ("Mismatch between host header and host port (%d, "
+                         "expected %d)",
+                         port,
+                         context_port);
+        }
+
+        retval = g_str_equal (host, host_ip) && port == context_port;
+
+out:
+        g_clear_error (&error);
+        g_free (uri_from_host);
+        return retval;
+}
+
+ /**
+  * gupnp_context_rewrite_uri:
+  * @context: a #GUPnPContext
+diff --git a/libgupnp/gupnp-service.c b/libgupnp/gupnp-service.c
+index b061c34..ad9d40d 100644
+--- a/libgupnp/gupnp-service.c
+++ b/libgupnp/gupnp-service.c
+@@ -954,6 +954,19 @@ control_server_handler (SoupServer                      *server,
+ 
+         context = gupnp_service_info_get_context (GUPNP_SERVICE_INFO (service));
+ 
+        const char *host_header =
+                soup_message_headers_get_one (msg->request_headers, "Host");
+
+        if (!gupnp_context_validate_host_header (context, host_header)) {
+                g_warning ("Host header mismatch, expected %s:%d, got %s",
+                           gssdp_client_get_host_ip (GSSDP_CLIENT (context)),
+                           gupnp_context_get_port (context),
+                           host_header);
+
+                soup_message_set_status (msg, SOUP_STATUS_PRECONDITION_FAILED);
+                return;
+        }
+
+         /* Get action name */
+         soap_action = soup_message_headers_get_one (msg->request_headers,
+                                                     "SOAPAction");
--- a/gupnp-1.2.4.tar.xz
+++ b/gupnp-1.2.4.tar.xz
--- a/gupnp-1.6.4.tar.xz
+++ b/gupnp-1.6.4.tar.xz
--- a/gupnp.spec
+++ b/gupnp.spec
@ -1,19 +1,15 @@
-%global apiver 1.6
-%global gssdp_version 1.6.3
-
 Name:          gupnp
-Version:       1.6.4
-Release:       3
+Version:       1.2.4
+Release:       2
 Summary:       UPnP devices & control points creation framework
 License:       LGPLv2+
-URL:           https://www.gupnp.org/
-Source0:       https://download.gnome.org/sources/%{name}/1.6/%{name}-%{version}.tar.xz
-Patch0001:     0001-build-properly-spell-provide-in-.wrap-files.patch
+URL:           http://www.gupnp.org/
+Source0:       http://download.gnome.org/sources/%{name}/1.2/%{name}-%{version}.tar.xz
+Patch0:        CVE-2021-33516.patch

-BuildRequires: gssdp-devel >= %{gssdp_version} gtk-doc gobject-introspection-devel docbook-style-xsl
-BuildRequires: libsoup-devel libxml2-devel libuuid-devel vala meson cmake gi-docgen
+BuildRequires: gssdp-devel >= 1.2.3 gtk-doc gobject-introspection-devel >= 1.36 glib2-devel >= 2.66
+BuildRequires: libsoup-devel libxml2-devel libuuid-devel vala meson
 Requires:      dbus
-Requires:      gssdp%{?_isa} >= %{gssdp_version}

 %description
 GUPnP is an elegant, object-oriented open source framework for creating UPnP
@ -44,9 +40,7 @@ This package contains help file and developer documentation for gupnp.
 %build
 %meson \
  -Dcontext_manager=network-manager \
-  -Dgtk_doc=true \
-  -Dexamples=false \
-  %{nil}
+  -Dgtk_doc=true
 %meson_build

 %install
@ -61,39 +55,25 @@ This package contains help file and developer documentation for gupnp.
 %postun -p /sbin/ldconfig

 %files
-%license COPYING	
-%{_libdir}/libgupnp-%{apiver}.so.0*
-%{_libdir}/girepository-1.0/GUPnP-%{apiver}.typelib
+%license COPYING
+%doc AUTHORS
+%{_libdir}/libgupnp-1.2.so.*
+%{_libdir}/girepository-1.0/GUPnP-1.2.typelib

-%files devel
-%{_bindir}/gupnp-binding-tool-%{apiver}
-%{_includedir}/gupnp-%{apiver}/
-%{_libdir}/libgupnp-%{apiver}.so
-%{_libdir}/pkgconfig/gupnp-%{apiver}.pc
-%{_datadir}/gir-1.0/GUPnP-%{apiver}.gir
+%files         devel
+%{_bindir}/gupnp-binding-tool-1.2
+%{_libdir}/pkgconfig/gupnp-1.2.pc
+%{_libdir}/libgupnp-1.2.so
+%{_includedir}/gupnp-1.2
+%{_datadir}/gir-1.0/GUPnP-1.2.gir
 %{_datadir}/vala/vapi/gupnp*

-%files help
-%doc AUTHORS README.md
+%files         help
+%doc README
+%doc %{_datadir}/gtk-doc/html/gupnp
 %{_mandir}/man1/gupnp-binding-tool-*
-%{_docdir}/gupnp-%{apiver}/

 %changelog
-* Thu Mar 07 2024 xu_ping <707078654@qq.com> - 1.6.4-3
- Remove Unuse files due to upgrading to 1.6.4
-
-* Sun Feb 18 2024 liyanan <liyanan61@h-partners.com> - 1.6.4-2
- Fix build error
-
-* Mon Aug 07 2023 xu_ping <707078654@qq.com> - 1.6.4-1
- Upgrade version to 1.6.4
-
-* Thu Jan 18 2023 xingxing <xingxing@xfusion.com> - 1.4.3-2
- Fix python script shebang
-
-* Mon Mar 28 2022 lin zhang <lin.zhang@turbolinux.com.cn> - 1.4.3-1
- Update to 1.4.3
-
 * Wed Jul 14 2021 Wenlong Ding <wenlong.ding@turbolinux.com.cn> - 1.2.4-2
 - Add missing BuildRequires version: glib2-devel >= 2.66