Implement TR-069 Upload method

lib/api-functions.ts

@@ -333,5 +333,6 @@ export async function deleteDevice(deviceId: string): Promise<void> {
       },
     }),
     cache.del(`${deviceId}_tasks_faults_operations`),
+    db.deleteDeviceUploads(deviceId),
   ]);
 }

lib/cwmp.ts

@@ -705,6 +705,11 @@ async function nextRpc(sessionContext: SessionContext): Promise<void> {
         ["download", task.fileType, task.fileName, task.targetFileName || ""],
       ]);
       break;
+    case "upload":
+      session.addProvisions(sessionContext, `task_${task._id}`, [
+        ["upload", task.fileType, task.fileName],
+      ]);
+      break;
     case "addObject":
       alias = (task.parameterValues || [])
         .map((p) => `${p[0]}:${JSON.stringify(p[1])}`)
@@ -850,6 +855,21 @@ async function sendAcsRequest(
     }
   }
 
+  if (acsRequest.name === "Upload") {
+    let prefix = "" + config.get("FS_URL_PREFIX");
+
+    if (!prefix) {
+      const FS_PORT = +config.get("FS_PORT");
+      const ssl = !!config.get("FS_SSL_CERT");
+      const origin = getRequestOrigin(sessionContext.httpRequest);
+      let hostname = origin.localAddress;
+      if (origin.host) [hostname] = origin.host.split(":", 1);
+      prefix = (ssl ? "https" : "http") + `://${hostname}:${FS_PORT}/`;
+    }
+
+    acsRequest.url = prefix + encodeURI(acsRequest.fileName);
+  }
+
   const rpc = {
     id: id,
     acsRequest: acsRequest,

lib/db.ts

@@ -17,7 +17,7 @@
  * along with GenieACS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { MongoClient, ObjectID, Collection, Db } from "mongodb";
+import { MongoClient, ObjectID, Collection, Db, GridFSBucket } from "mongodb";
 import { get } from "./config";
 import { encodeTag, escapeRegExp } from "./common";
 import { parse } from "./common/expression-parser";
@@ -39,10 +39,12 @@ export let tasksCollection: Collection,
   virtualParametersCollection: Collection,
   faultsCollection: Collection,
   filesCollection: Collection,
+  uploadsCollection: Collection,
   operationsCollection: Collection,
   permissionsCollection: Collection,
   usersCollection: Collection,
-  configCollection: Collection;
+  configCollection: Collection,
+  uploadsBucket: GridFSBucket;
 
 let clientPromise: Promise<MongoClient>;
 
@@ -77,6 +79,7 @@ onConnect(async (db) => {
   presetsCollection = db.collection("presets");
   objectsCollection = db.collection("objects");
   filesCollection = db.collection("fs.files");
+  uploadsCollection = db.collection("uploads.files");
   provisionsCollection = db.collection("provisions");
   virtualParametersCollection = db.collection("virtualParameters");
   faultsCollection = db.collection("faults");
@@ -84,6 +87,7 @@ onConnect(async (db) => {
   permissionsCollection = db.collection("permissions");
   usersCollection = db.collection("users");
   configCollection = db.collection("config");
+  uploadsBucket = new GridFSBucket(db, { bucketName: "uploads" });
 });
 
 export async function disconnect(): Promise<void> {
@@ -439,6 +443,17 @@ export async function saveDevice(
 
         break;
       default:
+        if (
+          diff[0].segments[0] === "Uploads" &&
+          diff[0].segments[2] === "LastFileName" &&
+          value1 &&
+          value1 !== value2
+        ) {
+          uploadsBucket.delete(value1 as any, () => {
+            // Ignore error due to mising files
+          });
+        }
+
         if (!diff[2]) {
           update["$unset"][path.toString()] = 1;
           continue;
@@ -788,3 +803,14 @@ interface User {
 export async function getUsers(): Promise<User[]> {
   return usersCollection.find().toArray();
 }
+
+export async function deleteDeviceUploads(deviceId: string): Promise<void> {
+  const files = await uploadsCollection
+    .find({
+      _id: {
+        $regex: `^${escapeRegExp(deviceId)}\\/`,
+      },
+    })
+    .toArray();
+  await Promise.all(files.map((f) => uploadsBucket.delete(f["_id"])));
+}

lib/default-provisions.ts

@@ -229,6 +229,44 @@ export function download(
   return true;
 }
 
+export function upload(
+  sessionContext: SessionContext,
+  provision: (string | number | boolean)[],
+  declarations: Declaration[]
+): boolean {
+  if (
+    provision.length !== 3 ||
+    typeof provision[1] !== "string" ||
+    typeof provision[2] !== "string"
+  )
+    throw new Error("Invalid arguments");
+
+  const alias = [
+    `FileType:${JSON.stringify(provision[1] || "")}`,
+    `FileName:${JSON.stringify(provision[2] || "")}`,
+  ].join(",");
+
+  declarations.push({
+    path: Path.parse(`Uploads.[${alias}]`),
+    pathGet: 1,
+    pathSet: 1,
+    attrGet: null,
+    attrSet: null,
+    defer: true,
+  });
+
+  declarations.push({
+    path: Path.parse(`Uploads.[${alias}].Upload`),
+    pathGet: 1,
+    pathSet: null,
+    attrGet: { value: 1 },
+    attrSet: { value: [sessionContext.timestamp] },
+    defer: true,
+  });
+
+  return true;
+}
+
 export function instances(
   sessionContext: SessionContext,
   provision: (string | number | boolean)[],

lib/fs.ts

@@ -20,23 +20,42 @@
 import * as url from "url";
 import * as querystring from "querystring";
 import { IncomingMessage, ServerResponse } from "http";
-import { Collection, GridFSBucket } from "mongodb";
-import { onConnect } from "./db";
+import { Collection, GridFSBucket, ObjectId } from "mongodb";
+import { onConnect, getOperations } from "./db";
 import * as logger from "./logger";
 import { getRequestOrigin } from "./forwarded";
 
 let filesCollection: Collection;
 let filesBucket: GridFSBucket;
+let uploadsBucket: GridFSBucket;
 
 onConnect(async (db) => {
   filesCollection = db.collection("fs.files");
   filesBucket = new GridFSBucket(db);
+  uploadsBucket = new GridFSBucket(db, { bucketName: "uploads" });
 });
 
-export function listener(
+async function canUpload(
+  deviceId: string,
+  fileName: string,
+  timeout = Date.now() + 5000
+): Promise<boolean> {
+  const operations = Object.values(await getOperations(deviceId));
+  for (const operation of operations) {
+    if (operation.name === "Upload" && operation.args.fileName === fileName)
+      return true;
+  }
+
+  if (Date.now() >= timeout) return false;
+  // Need to wait and retry in case upload was initiated before session was closed
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+  return canUpload(deviceId, fileName, timeout);
+}
+
+export async function listener(
   request: IncomingMessage,
   response: ServerResponse
-): void {
+): Promise<void> {
   const urlParts = url.parse(request.url, true);
   if (request.method === "GET") {
     const filename = querystring.unescape(urlParts.pathname.substring(1));
@@ -47,27 +66,58 @@ export function listener(
       remoteAddress: getRequestOrigin(request).remoteAddress,
     };
 
-    filesCollection.findOne({ _id: filename }, (err, file) => {
-      if (err) throw err;
+    const file = await filesCollection.findOne({ _id: filename });
+    if (!file) {
+      response.writeHead(404);
+      response.end();
+      log.message += " not found";
+      logger.accessError(log);
+      return;
+    }
 
-      if (!file) {
-        response.writeHead(404);
-        response.end();
-        log.message += " not found";
-        logger.accessError(log);
-        return;
-      }
-
-      response.writeHead(200, {
-        "Content-Type": file.contentType || "application/octet-stream",
-        "Content-Length": file.length,
-      });
-
-      const downloadStream = filesBucket.openDownloadStreamByName(filename);
-      downloadStream.pipe(response);
-
-      logger.accessInfo(log);
+    response.writeHead(200, {
+      "Content-Type": file.contentType || "application/octet-stream",
+      "Content-Length": file.length,
     });
+
+    const downloadStream = filesBucket.openDownloadStreamByName(filename);
+    downloadStream.pipe(response);
+
+    logger.accessInfo(log);
+  } else if (request.method === "PUT") {
+    const [, deviceId, ...filePath] = urlParts.pathname
+      .split("/")
+      .map(querystring.unescape);
+
+    const fileName = `${deviceId}/${filePath.join("/")}`;
+
+    if (!(await canUpload(deviceId, fileName))) {
+      response.writeHead(403);
+      response.end("403 Forbidden");
+      return;
+    }
+
+    try {
+      await uploadsBucket.delete((fileName as unknown) as ObjectId);
+    } catch (err) {
+      // File not found, do nothing
+    }
+    const uploadStream = uploadsBucket.openUploadStreamWithId(
+      fileName,
+      fileName
+    );
+
+    uploadStream.on("finish", () => {
+      response.writeHead(200);
+      response.end();
+    });
+
+    uploadStream.on("error", (err) => {
+      response.writeHead(500);
+      response.end(err.message);
+    });
+
+    request.pipe(uploadStream);
   } else {
     response.writeHead(405, { Allow: "GET" });
     response.end("405 Method Not Allowed");

lib/init.ts

@@ -108,6 +108,7 @@ export async function seed(options: Record<string, boolean>): Promise<void> {
       { role: "admin", resource: "devices", access: 3, validate: "true" },
       { role: "admin", resource: "faults", access: 3, validate: "true" },
       { role: "admin", resource: "files", access: 3, validate: "true" },
+      { role: "admin", resource: "uploads", access: 3, validate: "true" },
       { role: "admin", resource: "presets", access: 3, validate: "true" },
       { role: "admin", resource: "provisions", access: 3, validate: "true" },
       { role: "admin", resource: "config", access: 3, validate: "true" },

lib/mongodb-functions.ts

@@ -640,6 +640,14 @@ export function flattenFile(
   return f;
 }
 
+export function flattenUpload(
+  file: Record<string, unknown>
+): Record<string, unknown> {
+  const f = {};
+  f["_id"] = file["_id"];
+  return f;
+}
+
 export function preProcessPreset(
   data: Record<string, unknown>
 ): Record<string, unknown> {

lib/session.ts

@@ -53,6 +53,7 @@ import {
   AddObject,
   DeleteObject,
   Download,
+  Upload,
   Reboot,
   FactoryReset,
   AddObjectResponse,
@@ -292,14 +293,15 @@ export async function transferComplete(
     };
   }
 
-  const instance = operation.args.instance;
-
   delete sessionContext.operations[commandKey];
   if (!sessionContext.operationsTouched) sessionContext.operationsTouched = {};
   sessionContext.operationsTouched[commandKey] = 1;
 
   if (rpcReq.faultStruct && rpcReq.faultStruct.faultCode !== "0") {
-    revertDownloadParameters(sessionContext, operation.args.instance);
+    if (operation.name === "Download")
+      revertDownloadParameters(sessionContext, operation.args.instance);
+    else if (operation.name === "Upload")
+      revertUploadParameters(sessionContext, operation.args.instance);
 
     const fault: Fault = {
       code: `cwmp.${rpcReq.faultStruct.faultCode}`,
@@ -318,6 +320,44 @@ export async function transferComplete(
   let toClear = null;
   const timestamp = sessionContext.timestamp + sessionContext.iteration + 1;
 
+  if (operation.name === "Download") {
+    toClear = commitDownloadOperation(
+      sessionContext,
+      operation,
+      rpcReq,
+      timestamp,
+      toClear
+    );
+  } else if (operation.name === "Upload") {
+    toClear = commitUploadOperation(
+      sessionContext,
+      operation,
+      rpcReq,
+      timestamp,
+      toClear
+    );
+  }
+
+  if (toClear) {
+    for (const c of toClear)
+      device.clear(sessionContext.deviceData, c[0], c[1], c[2], c[3]);
+  }
+
+  return {
+    acsResponse: { name: "TransferCompleteResponse" },
+    operation: operation,
+    fault: null,
+  };
+}
+
+function commitDownloadOperation(
+  sessionContext: SessionContext,
+  operation: Operation,
+  rpcReq: TransferCompleteRequest,
+  timestamp: number,
+  toClear: Clear[]
+): Clear[] {
+  const instance = operation.args.instance;
   let p;
 
   p = sessionContext.deviceData.paths.add(
@@ -386,16 +426,110 @@ export async function transferComplete(
     toClear
   );
 
+  return toClear;
+}
+
+function commitUploadOperation(
+  sessionContext: SessionContext,
+  operation: Operation,
+  rpcReq: TransferCompleteRequest,
+  timestamp: number,
+  toClear: Clear[]
+): Clear[] {
+  const instance = operation.args.instance;
+
+  let p;
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.LastUpload`)
+  );
+  toClear = device.set(
+    sessionContext.deviceData,
+    p,
+    timestamp,
+    { value: [timestamp, [operation.timestamp, "xsd:dateTime"]] },
+    toClear
+  );
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.LastFileType`)
+  );
+  toClear = device.set(
+    sessionContext.deviceData,
+    p,
+    timestamp,
+    { value: [timestamp, [operation.args.fileType, "xsd:string"]] },
+    toClear
+  );
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.LastFileName`)
+  );
+  toClear = device.set(
+    sessionContext.deviceData,
+    p,
+    timestamp,
+    { value: [timestamp, [operation.args.fileName, "xsd:string"]] },
+    toClear
+  );
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.StartTime`)
+  );
+  toClear = device.set(
+    sessionContext.deviceData,
+    p,
+    timestamp,
+    { value: [timestamp, [+rpcReq.startTime, "xsd:dateTime"]] },
+    toClear
+  );
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.CompleteTime`)
+  );
+  toClear = device.set(
+    sessionContext.deviceData,
+    p,
+    timestamp,
+    { value: [timestamp, [+rpcReq.completeTime, "xsd:dateTime"]] },
+    toClear
+  );
+
+  return toClear;
+}
+
+function revertUploadParameters(
+  sessionContext: SessionContext,
+  instance
+): void {
+  const timestamp = sessionContext.timestamp + sessionContext.iteration + 1;
+
+  let p;
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.LastUpload`)
+  );
+
+  const lastUpload = sessionContext.deviceData.attributes.get(p);
+
+  p = sessionContext.deviceData.paths.add(
+    Path.parse(`Uploads.${instance}.Upload`)
+  );
+
+  const toClear = device.set(sessionContext.deviceData, p, timestamp, {
+    value: [
+      timestamp,
+      [
+        lastUpload && lastUpload.value[1] ? lastUpload.value[1][0] : 0,
+        "xsd:dateTime",
+      ],
+    ],
+  });
+
   if (toClear) {
     for (const c of toClear)
       device.clear(sessionContext.deviceData, c[0], c[1], c[2], c[3]);
   }
-
-  return {
-    acsResponse: { name: "TransferCompleteResponse" },
-    operation: operation,
-    fault: null,
-  };
 }
 
 function revertDownloadParameters(
@@ -445,33 +579,62 @@ export async function timeoutOperations(
   for (const [commandKey, operation] of Object.entries(
     sessionContext.operations
   )) {
-    if (operation.name !== "Download")
+    if (operation.name === "Download") {
+      const DOWNLOAD_TIMEOUT =
+        +localCache.getConfig(
+          sessionContext.cacheSnapshot,
+          "cwmp.downloadTimeout",
+          {},
+          sessionContext.timestamp,
+          (e) => configContextCallback(sessionContext, e)
+        ) * 1000;
+
+      if (sessionContext.timestamp > operation.timestamp + DOWNLOAD_TIMEOUT) {
+        delete sessionContext.operations[commandKey];
+        if (!sessionContext.operationsTouched)
+          sessionContext.operationsTouched = {};
+        sessionContext.operationsTouched[commandKey] = 1;
+
+        faults.push({
+          code: "timeout",
+          message: "Download operation timed out",
+          timestamp: operation.timestamp,
+        });
+
+        operations.push(operation);
+
+        revertDownloadParameters(sessionContext, operation.args.instance);
+      }
+    } else if (operation.name === "Upload") {
+      const UPLOAD_TIMEOUT =
+        +(
+          localCache.getConfig(
+            sessionContext.cacheSnapshot,
+            "cwmp.uploadTimeout",
+            {},
+            sessionContext.timestamp,
+            (e) => configContextCallback(sessionContext, e)
+          ) || 3600
+        ) * 1000;
+
+      if (sessionContext.timestamp > operation.timestamp + UPLOAD_TIMEOUT) {
+        delete sessionContext.operations[commandKey];
+        if (!sessionContext.operationsTouched)
+          sessionContext.operationsTouched = {};
+        sessionContext.operationsTouched[commandKey] = 1;
+
+        faults.push({
+          code: "timeout",
+          message: "Upload operation timed out",
+          timestamp: operation.timestamp,
+        });
+
+        operations.push(operation);
+
+        revertUploadParameters(sessionContext, operation.args.instance);
+      }
+    } else {
       throw new Error(`Unknown operation name ${operation.name}`);
-
-    const DOWNLOAD_TIMEOUT =
-      +localCache.getConfig(
-        sessionContext.cacheSnapshot,
-        "cwmp.downloadTimeout",
-        {},
-        sessionContext.timestamp,
-        (e) => configContextCallback(sessionContext, e)
-      ) * 1000;
-
-    if (sessionContext.timestamp > operation.timestamp + DOWNLOAD_TIMEOUT) {
-      delete sessionContext.operations[commandKey];
-      if (!sessionContext.operationsTouched)
-        sessionContext.operationsTouched = {};
-      sessionContext.operationsTouched[commandKey] = 1;
-
-      faults.push({
-        code: "timeout",
-        message: "Download operation timed out",
-        timestamp: operation.timestamp,
-      });
-
-      operations.push(operation);
-
-      revertDownloadParameters(sessionContext, operation.args.instance);
     }
   }
 
@@ -793,6 +956,10 @@ function runDeclarations(
       downloadsToCreate: new InstanceSet(),
       downloadsValues: new Map(),
       downloadsDownload: new Map(),
+      uploadsToDelete: new Set(),
+      uploadsToCreate: new InstanceSet(),
+      uploadsValues: new Map(),
+      uploadsUpload: new Map(),
       reboot: 0,
       factoryReset: 0,
     };
@@ -1304,7 +1471,7 @@ export async function rpcRequest(
       }
 
       // Downloads
-      let index;
+      let index: number;
       for (const instance of sessionContext.syncState.downloadsToCreate) {
         if (index == null) {
           index = 0;
@@ -1426,6 +1593,9 @@ export async function rpcRequest(
         }
       }
 
+      // Uploads
+      toClear = syncUploads(sessionContext, timestamp, toClear);
+
       if (toClear || sessionContext.deviceData.changes.has("prerequisite")) {
         if (toClear) {
           for (const c of toClear)
@@ -1503,6 +1673,129 @@ export async function rpcRequest(
   return rpcRequest(sessionContext, null);
 }
 
+function syncUploads(
+  sessionContext: SessionContext,
+  timestamp: number,
+  toClear: Clear[]
+): Clear[] {
+  let index: number;
+  for (const instance of sessionContext.syncState.uploadsToCreate) {
+    if (index == null) {
+      index = 0;
+      for (const p of sessionContext.deviceData.paths.find(
+        Path.parse("Uploads.*"),
+        false,
+        true
+      )) {
+        if (
+          +p.segments[1] > index &&
+          sessionContext.deviceData.attributes.has(p)
+        )
+          index = +p.segments[1];
+      }
+    }
+
+    ++index;
+
+    toClear = device.set(
+      sessionContext.deviceData,
+      Path.parse("Uploads"),
+      timestamp,
+      { object: [timestamp, 1], writable: [timestamp, 1] },
+      toClear
+    );
+
+    toClear = device.set(
+      sessionContext.deviceData,
+      Path.parse(`Uploads.${index}`),
+      timestamp,
+      { object: [timestamp, 1], writable: [timestamp, 1] },
+      toClear
+    );
+
+    const params = {
+      FileType: {
+        writable: 1,
+        value: [instance.FileType || "", "xsd:string"],
+      },
+      FileName: {
+        writable: 1,
+        value: [instance.FileName || "", "xsd:string"],
+      },
+      Upload: {
+        writable: 1,
+        value: [instance.Upload || 0, "xsd:dateTime"],
+      },
+      LastFileType: { writable: 0, value: ["", "xsd:string"] },
+      LastFileName: { writable: 0, value: ["", "xsd:string"] },
+      LastTargetFileName: { writable: 0, value: ["", "xsd:string"] },
+      LastUpload: { writable: 0, value: [0, "xsd:dateTime"] },
+      StartTime: { writable: 0, value: [0, "xsd:dateTime"] },
+      CompleteTime: { writable: 0, value: [0, "xsd:dateTime"] },
+    };
+
+    for (const [k, v] of Object.entries(params)) {
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${index}.${k}`),
+        timestamp,
+        {
+          object: [timestamp, 0],
+          writable: [timestamp, v.writable as 0 | 1],
+          value: [timestamp, v.value as [string | number | boolean, string]],
+        },
+        toClear
+      );
+    }
+
+    toClear = device.set(
+      sessionContext.deviceData,
+      Path.parse(`Uploads.${index}.*`),
+      timestamp,
+      null,
+      toClear
+    );
+  }
+
+  sessionContext.syncState.uploadsToCreate.clear();
+
+  for (const instance of sessionContext.syncState.uploadsToDelete) {
+    toClear = device.set(
+      sessionContext.deviceData,
+      instance,
+      timestamp,
+      null,
+      toClear
+    );
+    for (const p of sessionContext.syncState.uploadsValues.keys()) {
+      if (p.segments[1] === instance.segments[1])
+        sessionContext.syncState.uploadsValues.delete(p);
+    }
+  }
+
+  sessionContext.syncState.uploadsToDelete.clear();
+
+  for (const [p, v] of sessionContext.syncState.uploadsValues) {
+    const attrs = sessionContext.deviceData.attributes.get(p);
+    if (attrs) {
+      if (attrs.writable && attrs.writable[1] && attrs.value) {
+        const val = device.sanitizeParameterValue([v, attrs.value[1][1]]);
+        if (val[0] !== attrs.value[1][0]) {
+          toClear = device.set(
+            sessionContext.deviceData,
+            p,
+            timestamp,
+            { value: [timestamp, val] },
+            toClear
+          );
+        }
+      }
+    }
+  }
+
+  return toClear;
+}
+
 function generateGetRpcRequest(
   sessionContext: SessionContext
 ): GetParameterNames | GetParameterValues | GetParameterAttributes {
@@ -1728,6 +2021,7 @@ function generateSetRpcRequest(
   | FactoryReset
   | Reboot
   | Download
+  | Upload
 ) & { next?: string } {
   const syncState = sessionContext.syncState;
   if (!syncState) return null;
@@ -1906,6 +2200,36 @@ function generateSetRpcRequest(
     }
   }
 
+  // Uploads
+  for (const [p, t] of syncState.uploadsUpload) {
+    const attrs = deviceData.attributes.get(p);
+    if (!(attrs && attrs.value && t <= attrs.value[1][0])) {
+      const fileTypeAttrs = deviceData.attributes.get(
+        deviceData.paths.get(p.slice(0, -1).concat(Path.parse("FileType")))
+      );
+      const fileNameAttrs = deviceData.attributes.get(
+        deviceData.paths.get(p.slice(0, -1).concat(Path.parse("FileName")))
+      );
+
+      if (fileNameAttrs && fileNameAttrs.value) {
+        return {
+          name: "Upload",
+          commandKey: generateRpcId(sessionContext),
+          instance: p.segments[1] as string,
+          fileType: fileTypeAttrs
+            ? fileTypeAttrs.value
+              ? (fileTypeAttrs.value[1][0] as string)
+              : null
+            : null,
+          fileName:
+            sessionContext.deviceId +
+            "/" +
+            (fileNameAttrs.value[1][0] as string),
+        };
+      }
+    }
+  }
+
   // Reboot
   if (syncState.reboot) {
     const p = sessionContext.deviceData.paths.get(Path.parse("Reboot"));
@@ -2187,6 +2511,26 @@ function processDeclarations(
           }
         }
         break;
+      case "Uploads":
+        if (
+          currentPath.length === 3 &&
+          currentPath.wildcard === 0 &&
+          declareAttributeValues &&
+          declareAttributeValues.value
+        ) {
+          if (currentPath.segments[2] === "Upload") {
+            syncState.uploadsUpload.set(
+              currentPath,
+              declareAttributeValues.value[0]
+            );
+          } else {
+            syncState.uploadsValues.set(
+              currentPath,
+              declareAttributeValues.value[0]
+            );
+          }
+        }
+        break;
       case "VirtualParameters":
         if (currentPath.length <= 2) {
           let d;
@@ -2357,6 +2701,10 @@ function processInstances(
     if (parent.length !== 1) return;
     instancesToDelete = sessionContext.syncState.downloadsToDelete;
     instancesToCreate = sessionContext.syncState.downloadsToCreate;
+  } else if (parent.segments[0] === "Uploads") {
+    if (parent.length !== 1) return;
+    instancesToDelete = sessionContext.syncState.uploadsToDelete;
+    instancesToCreate = sessionContext.syncState.uploadsToCreate;
   } else {
     instancesToDelete = sessionContext.syncState.instancesToDelete.get(parent);
     if (instancesToDelete == null) {
@@ -2578,6 +2926,7 @@ export async function rpcResponse(
         "FactoryReset",
         "VirtualParameters",
         "Downloads",
+        "Uploads",
       ]) {
         const p = sessionContext.deviceData.paths.get(Path.parse(n));
         if (p && sessionContext.deviceData.attributes.has(p))
@@ -2788,6 +3137,84 @@ export async function rpcResponse(
           operation.retries[channel] = sessionContext.retries[channel];
       }
 
+      sessionContext.operations[rpcReq.commandKey] = operation;
+      if (!sessionContext.operationsTouched)
+        sessionContext.operationsTouched = {};
+      sessionContext.operationsTouched[rpcReq.commandKey] = 1;
+    }
+  } else if (rpcRes.name === "UploadResponse") {
+    if (rpcReq.name !== "Upload")
+      throw new Error("Response name does not match request name");
+
+    toClear = device.set(
+      sessionContext.deviceData,
+      Path.parse(`Uploads.${rpcReq.instance}.Upload`),
+      timestamp + 1,
+      { value: [timestamp + 1, [sessionContext.timestamp, "xsd:dateTime"]] },
+      toClear
+    );
+
+    if (rpcRes.status === 0) {
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${rpcReq.instance}.LastUpload`),
+        timestamp + 1,
+        {
+          value: [timestamp + 1, [sessionContext.timestamp, "xsd:dateTime"]],
+        },
+        toClear
+      );
+
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${rpcReq.instance}.LastFileType`),
+        timestamp + 1,
+        { value: [timestamp + 1, [rpcReq.fileType, "xsd:string"]] },
+        toClear
+      );
+
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${rpcReq.instance}.LastFileName`),
+        timestamp + 1,
+        { value: [timestamp + 1, [rpcReq.fileType, "xsd:string"]] },
+        toClear
+      );
+
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${rpcReq.instance}.StartTime`),
+        timestamp + 1,
+        { value: [timestamp + 1, [+rpcRes.startTime, "xsd:dateTime"]] },
+        toClear
+      );
+
+      toClear = device.set(
+        sessionContext.deviceData,
+        Path.parse(`Uploads.${rpcReq.instance}.CompleteTime`),
+        timestamp + 1,
+        { value: [timestamp + 1, [+rpcRes.completeTime, "xsd:dateTime"]] },
+        toClear
+      );
+    } else {
+      const operation = {
+        name: "Upload",
+        timestamp: sessionContext.timestamp,
+        provisions: sessionContext.provisions,
+        channels: sessionContext.channels,
+        retries: {},
+        args: {
+          instance: rpcReq.instance,
+          fileType: rpcReq.fileType,
+          fileName: rpcReq.fileName,
+        },
+      };
+
+      for (const channel of Object.keys(sessionContext.channels)) {
+        if (sessionContext.retries[channel] != null)
+          operation.retries[channel] = sessionContext.retries[channel];
+      }
+
       sessionContext.operations[rpcReq.commandKey] = operation;
       if (!sessionContext.operationsTouched)
         sessionContext.operationsTouched = {};

lib/soap.ts

@@ -45,6 +45,7 @@ import {
   RebootResponse,
   FactoryResetResponse,
   DownloadResponse,
+  UploadResponse,
   GetRPCMethodsRequest,
   RequestDownloadRequest,
   AcsResponse,
@@ -496,6 +497,24 @@ function Download(methodRequest): string {
   )}</FailureURL></cwmp:Download>`;
 }
 
+function Upload(methodRequest): string {
+  return `<cwmp:Upload><CommandKey>${
+    methodRequest.commandKey || ""
+  }</CommandKey><FileType>${methodRequest.fileType}</FileType><URL>${
+    methodRequest.url
+  }</URL><Username>${encodeEntities(
+    methodRequest.username || ""
+  )}</Username><Password>${encodeEntities(
+    methodRequest.password || ""
+  )}</Password><DelaySeconds>${
+    methodRequest.delaySeconds || "0"
+  }</DelaySeconds><SuccessURL>${encodeEntities(
+    methodRequest.successUrl || ""
+  )}</SuccessURL><FailureURL>${encodeEntities(
+    methodRequest.failureUrl || ""
+  )}</FailureURL></cwmp:Upload>`;
+}
+
 function DownloadResponse(xml: Element): DownloadResponse {
   let status: number, startTime: number, completeTime: number;
   for (const c of xml.children) {
@@ -544,6 +563,35 @@ function DownloadResponse(xml: Element): DownloadResponse {
   };
 }
 
+function UploadResponse(xml: Element): UploadResponse {
+  let status: number, startTime: number, completeTime: number;
+  for (const c of xml.children) {
+    switch (c.localName) {
+      case "Status":
+        status = parseInt(c.text);
+        break;
+      case "StartTime":
+        startTime = Date.parse(c.text);
+        break;
+      case "CompleteTime":
+        completeTime = Date.parse(c.text);
+        break;
+    }
+  }
+
+  if (!(status >= 0)) {
+    warnings.push({ message: "Invalid UploadResponse status" });
+    status = 0;
+  }
+
+  return {
+    name: "UploadResponse",
+    status: status,
+    startTime: startTime,
+    completeTime: completeTime,
+  };
+}
+
 function Inform(xml: Element): InformRequest {
   let retryCount: number, evnt: string[];
   let parameterList: [Path, string | number | boolean, string][];
@@ -927,6 +975,9 @@ export function request(
     case "DownloadResponse":
       rpc.cpeResponse = DownloadResponse(methodElement);
       break;
+    case "UploadResponse":
+      rpc.cpeResponse = UploadResponse(methodElement);
+      break;
     case "Fault":
       rpc.cpeFault = fault(methodElement);
       break;
@@ -1022,6 +1073,9 @@ export function response(rpc: {
       case "Download":
         body = Download(rpc.acsRequest);
         break;
+      case "Upload":
+        body = Upload(rpc.acsRequest);
+        break;
       default:
         throw new Error(
           `Unknown method request ${(rpc.acsRequest as AcsRequest).name}`

lib/types.ts

@@ -121,6 +121,10 @@ export interface SyncState {
   downloadsToCreate: InstanceSet;
   downloadsValues: Map<Path, string | number>;
   downloadsDownload: Map<Path, number>;
+  uploadsToDelete: Set<Path>;
+  uploadsToCreate: InstanceSet;
+  uploadsValues: Map<Path, string | number>;
+  uploadsUpload: Map<Path, number>;
   reboot: number;
   factoryReset: number;
 }
@@ -193,7 +197,7 @@ export interface Operation {
     instance: string;
     fileType: string;
     fileName: string;
-    targetFileName: string;
+    targetFileName?: string;
   };
 }
 
@@ -207,7 +211,8 @@ export type AcsRequest =
   | DeleteObject
   | FactoryReset
   | Reboot
-  | Download;
+  | Download
+  | Upload;
 
 export interface GetParameterNames {
   name: "GetParameterNames";
@@ -277,6 +282,20 @@ export interface Download {
   failureUrl?: string;
 }
 
+export interface Upload {
+  name: "Upload";
+  commandKey: string;
+  instance: string;
+  fileType: string;
+  fileName?: string;
+  url?: string;
+  username?: string;
+  password?: string;
+  delaySecods?: number;
+  successUrl?: string;
+  failureUrl?: string;
+}
+
 export interface SpvFault {
   parameterName: string;
   faultCode: string;
@@ -305,7 +324,8 @@ export type CpeResponse =
   | DeleteObjectResponse
   | RebootResponse
   | FactoryResetResponse
-  | DownloadResponse;
+  | DownloadResponse
+  | UploadResponse;
 
 export interface GetParameterNamesResponse {
   name: "GetParameterNamesResponse";
@@ -357,6 +377,13 @@ export interface DownloadResponse {
   completeTime?: number;
 }
 
+export interface UploadResponse {
+  name: "UploadResponse";
+  status: number;
+  startTime?: number;
+  completeTime?: number;
+}
+
 export type CpeRequest =
   | InformRequest
   | TransferCompleteRequest

lib/ui/api-functions.ts

@@ -58,6 +58,10 @@ export async function deleteResource(
       await db.deleteFile(id);
       break;
 
+    case "uploads":
+      await db.deleteUpload(id);
+      break;
+
     case "faults":
       await deleteFault(id);
       break;

lib/ui/api.ts

@@ -49,6 +49,7 @@ const RESOURCE_IDS = {
   presets: "_id",
   provisions: "_id",
   files: "_id",
+  uploads: "_id",
   virtualParameters: "_id",
   config: "_id",
   permissions: "_id",
@@ -62,6 +63,7 @@ const resources = {
   presets: 0 | RESOURCE_DELETE | RESOURCE_PUT,
   provisions: 0 | RESOURCE_DELETE | RESOURCE_PUT,
   files: 0 | RESOURCE_DELETE,
+  uploads: 0 | RESOURCE_DELETE,
   virtualParameters: 0 | RESOURCE_DELETE | RESOURCE_PUT,
   config: 0 | RESOURCE_DELETE | RESOURCE_PUT,
   permissions: 0 | RESOURCE_DELETE | RESOURCE_PUT,
@@ -361,7 +363,7 @@ for (const [resource, flags] of Object.entries(resources)) {
   });
 
   if (flags & RESOURCE_DELETE) {
-    router.delete(`/${resource}/:id`, async (ctx) => {
+    router.delete(`/${resource}/:id(.+)`, async (ctx) => {
       const authorizer: Authorizer = ctx.state.authorizer;
       const log = {
         message: `Delete ${resource}`,
@@ -478,6 +480,41 @@ router.put("/files/:id", async (ctx) => {
   ctx.body = "";
 });
 
+router.get("/uploads/blob/:id(.+)", async (ctx) => {
+  const authorizer: Authorizer = ctx.state.authorizer;
+  const resource = "uploads";
+  const id = ctx.params.id;
+
+  const log = {
+    message: `Download ${resource} blob`,
+    context: ctx,
+    id: id,
+  };
+  1;
+
+  const filter = and(authorizer.getFilter(resource, 2), [
+    "=",
+    ["PARAM", RESOURCE_IDS[resource]],
+    id,
+  ]);
+
+  if (!authorizer.hasAccess(resource, 2)) {
+    logUnauthorizedWarning(log);
+    return void (ctx.status = 403);
+  }
+
+  const res = await db.query(resource, filter);
+  if (!res[0]) return void (ctx.status = 404);
+
+  ctx.type = "application/octet-stream";
+  ctx.attachment(id.replace(/\//g, "_"));
+  ctx.body = new stream.PassThrough();
+
+  const downloadStream = await db.getUploadBlob(id);
+  downloadStream.pipe(ctx.body);
+  logger.accessInfo(log);
+});
+
 router.post("/devices/:id/tasks", async (ctx) => {
   const authorizer: Authorizer = ctx.state.authorizer;
   const log = {

lib/ui/db.ts

@@ -28,6 +28,7 @@ import { minimize } from "../common/boolean-expression";
 
 const RESOURCE_COLLECTION = {
   files: "fs.files",
+  uploads: "uploads.files",
 };
 
 let db: Db;
@@ -112,6 +113,8 @@ export function query(
           docs = docs.map((d) => mongodbFunctions.flattenPreset(d));
         else if (resource === "files")
           docs = docs.map((d) => mongodbFunctions.flattenFile(d));
+        else if (resource === "uploads")
+          docs = docs.map((d) => mongodbFunctions.flattenUpload(d));
         return resolve(docs);
       });
     } else {
@@ -126,6 +129,8 @@ export function query(
             doc = mongodbFunctions.flattenPreset(doc);
           else if (resource === "files")
             doc = mongodbFunctions.flattenFile(doc);
+          else if (resource === "uploads")
+            doc = mongodbFunctions.flattenUpload(doc);
           callback(doc);
         },
         (err) => {
@@ -326,6 +331,16 @@ export function deleteFile(filename: string): Promise<void> {
   });
 }
 
+export async function deleteUpload(filename: string): Promise<void> {
+  const bucket = new GridFSBucket(db, { bucketName: "uploads" });
+  await bucket.delete(filename as any);
+}
+
+export async function getUploadBlob(filename: string): Promise<Readable> {
+  const bucket = new GridFSBucket(db, { bucketName: "uploads" });
+  return bucket.openDownloadStreamByName(filename);
+}
+
 export function deleteFault(id: string): Promise<void> {
   return deleteResource("faults", id);
 }