UPnP database plugin

[mk: renamed source files, applied coding style, reduced bloat, using
MPD's threading library, using MPD's error reporting and logging
library and refactoring, fixed lots of bugs]

25 files changed, 3292 insertions, 0 deletions

diff --git a/Makefile.am b/Makefile.am
index 7db87fd98..bcd251cca 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -407,6 +407,24 @@ DB_LIBS = \
 	libdb_plugins.a \
 	$(LIBMPDCLIENT_LIBS)
 
+if HAVE_LIBUPNP
+libdb_plugins_a_SOURCES += \
+	src/db/UpnpDatabasePlugin.cxx src/db/UpnpDatabasePlugin.hxx \
+	src/db/upnp/ContentDirectoryService.cxx src/db/upnp/ContentDirectoryService.hxx \
+	src/db/upnp/Device.cxx src/db/upnp/Device.hxx \
+	src/db/upnp/Directory.cxx src/db/upnp/Directory.hxx \
+	src/db/upnp/Discovery.cxx src/db/upnp/Discovery.hxx \
+	src/db/upnp/Domain.cxx src/db/upnp/Domain.hxx \
+	src/db/upnp/ixmlwrap.cxx src/db/upnp/ixmlwrap.hxx \
+	src/db/upnp/upnpplib.cxx src/db/upnp/upnpplib.hxx \
+	src/db/upnp/Util.cxx src/db/upnp/Util.hxx \
+	src/db/upnp/WorkQueue.hxx \
+	src/db/upnp/Object.hxx
+DB_LIBS += \
+	$(EXPAT_LIBS) \
+	$(UPNP_LIBS)
+endif
+
 # archive plugins
 
 if ENABLE_ARCHIVE
@@ -1200,6 +1218,10 @@ test_DumpDatabase_SOURCES = test/DumpDatabase.cxx \
 	src/TagSave.cxx \
 	src/SongFilter.cxx
 
+if HAVE_LIBUPNP
+test_DumpDatabase_SOURCES += src/Expat.cxx
+endif
+
 test_run_input_LDADD = \
 	$(INPUT_LIBS) \
 	$(ARCHIVE_LIBS) \
diff --git a/NEWS b/NEWS
index 471998cbc..2e30adb2c 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ ver 0.19 (not yet released)
 * protocol
   - new commands "addtagid", "cleartagid"
   - "lsinfo" and "readcomments" allowed for remote files
+* database
+  - upnp: new plugin
 * playlist
   - soundcloud: use https instead of http
 * archive
diff --git a/configure.ac b/configure.ac
index 0af602fe4..5e0e054a5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -234,6 +234,11 @@ AC_ARG_ENABLE(expat,
 		[enable the expat XML parser]),,
 	enable_expat=auto)
 
+AC_ARG_ENABLE(upnp,
+	AS_HELP_STRING([--enable-upnp],
+		[enable UPnP client support (default: auto)]),,
+	enable_upnp=auto)
+
 AC_ARG_ENABLE(adplug,
 	AS_HELP_STRING([--enable-adplug],
 		[enable the AdPlug decoder plugin (default: auto)]),,
@@ -900,6 +905,24 @@ fi
 
 AM_CONDITIONAL(ENABLE_BZIP2_TEST, test x$BZIP2 != xno)
 
+dnl ---------------------------------- libupnp ---------------------------------
+
+if test x$enable_expat = xno; then
+	if test x$enable_upnp = xauto; then
+		AC_MSG_WARN([expat disabled -- disabling UPnP])
+		enable_upnp=no
+	elif test x$enable_upnp = xyes; then
+		AC_MSG_ERROR([expat disabled -- required for UPnP])
+	fi
+fi
+
+MPD_AUTO_PKG(upnp, UPNP, [libupnp],
+	[UPnP client support], [libupnp not found])
+if test x$enable_upnp = xyes; then
+	AC_DEFINE(HAVE_LIBUPNP, 1, [Define when libupnp is used])
+fi
+AM_CONDITIONAL(HAVE_LIBUPNP, test x$enable_upnp = xyes)
+
 dnl --------------------------------- libzzip ---------------------------------
 MPD_AUTO_PKG(zzip, ZZIP, [zziplib >= 0.13],
 	[libzzip archive library], [libzzip not found])
diff --git a/src/DatabaseRegistry.cxx b/src/DatabaseRegistry.cxx
index 4ce4a62cb..6937d51c1 100644
--- a/src/DatabaseRegistry.cxx
+++ b/src/DatabaseRegistry.cxx
@@ -21,6 +21,7 @@
 #include "DatabaseRegistry.hxx"
 #include "db/SimpleDatabasePlugin.hxx"
 #include "db/ProxyDatabasePlugin.hxx"
+#include "db/UpnpDatabasePlugin.hxx"
 
 #include <string.h>
 
@@ -29,6 +30,9 @@ const DatabasePlugin *const database_plugins[] = {
 #ifdef HAVE_LIBMPDCLIENT
 	&proxy_db_plugin,
 #endif
+#ifdef HAVE_LIBUPNP
+	&upnp_db_plugin,
+#endif
 	nullptr
 };
 
diff --git a/src/db/UpnpDatabasePlugin.cxx b/src/db/UpnpDatabasePlugin.cxx
new file mode 100644
index 000000000..c619316ef
--- /dev/null
+++ b/src/db/UpnpDatabasePlugin.cxx
@@ -0,0 +1,923 @@
+/*
+ * Copyright (C) 2003-2012 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "UpnpDatabasePlugin.hxx"
+#include "upnp/Domain.hxx"
+#include "upnp/upnpplib.hxx"
+#include "upnp/Discovery.hxx"
+#include "upnp/ContentDirectoryService.hxx"
+#include "upnp/Directory.hxx"
+#include "DatabasePlugin.hxx"
+#include "DatabaseSelection.hxx"
+#include "DatabaseError.hxx"
+#include "PlaylistVector.hxx"
+#include "Directory.hxx"
+#include "Song.hxx"
+#include "ConfigData.hxx"
+#include "tag/TagBuilder.hxx"
+#include "tag/TagTable.hxx"
+#include "util/Error.hxx"
+#include "util/Domain.hxx"
+#include "Log.hxx"
+#include "SongFilter.hxx"
+
+#include <string>
+#include <vector>
+#include <map>
+#include <set>
+
+#include <assert.h>
+#include <string.h>
+
+static const char *const rootid = "0";
+
+class UpnpDatabase : public Database {
+	LibUPnP *m_lib;
+	UPnPDeviceDirectory *m_superdir;
+	Directory *m_root;
+	std::string m_upnplog;
+
+public:
+	UpnpDatabase()
+		: m_lib(0), m_superdir(0), m_root(0)
+	{}
+
+	static Database *Create(const config_param &param,
+				Error &error);
+
+	virtual bool Open(Error &error) override;
+	virtual void Close() override;
+	virtual Song *GetSong(const char *uri_utf8,
+			      Error &error) const override;
+	virtual void ReturnSong(Song *song) const;
+
+	virtual bool Visit(const DatabaseSelection &selection,
+			   VisitDirectory visit_directory,
+			   VisitSong visit_song,
+			   VisitPlaylist visit_playlist,
+			   Error &error) const override;
+
+	virtual bool VisitUniqueTags(const DatabaseSelection &selection,
+				     TagType tag_type,
+				     VisitString visit_string,
+				     Error &error) const override;
+
+	virtual bool GetStats(const DatabaseSelection &selection,
+			      DatabaseStats &stats,
+			      Error &error) const override;
+	virtual time_t GetUpdateStamp() const {return 0;}
+
+protected:
+	bool Configure(const config_param &param, Error &error);
+
+private:
+	bool reallyOpen(Error &error);
+	bool VisitServer(ContentDirectoryService* server,
+			 const std::vector<std::string> &vpath,
+			 const DatabaseSelection &selection,
+			 VisitDirectory visit_directory,
+			 VisitSong visit_song,
+			 VisitPlaylist visit_playlist,
+			 Error &error) const;
+
+	/**
+	 * Run an UPnP search according to MPD parameters, and
+	 * visit_song the results.
+	 */
+	bool SearchSongs(ContentDirectoryService* server,
+			 const char *objid,
+			 const DatabaseSelection &selection,
+			 VisitSong visit_song,
+			 Error &error) const;
+
+	bool SearchSongs(ContentDirectoryService* server,
+			 const char *objid,
+			 const DatabaseSelection &selection,
+			 UPnPDirContent& dirbuf,
+			 Error &error) const;
+
+	bool Namei(ContentDirectoryService* server,
+		   const std::vector<std::string> &vpath,
+		   std::string &oobjid, UPnPDirObject &dirent,
+		   Error &error) const;
+
+	/**
+	 * Take server and objid, return metadata.
+	 */
+	bool ReadNode(ContentDirectoryService* server,
+		      const char *objid, UPnPDirObject& dirent,
+		      Error &error) const;
+
+	/**
+	 * Get the path for an object Id. This works much like pwd,
+	 * except easier cause our inodes have a parent id. Not used
+	 * any more actually (see comments in SearchSongs).
+	 */
+	bool BuildPath(ContentDirectoryService* server,
+		       const UPnPDirObject& dirent, std::string &idpath,
+		       Error &error) const;
+};
+
+gcc_pure
+static std::vector<std::string>
+stringToTokens(const std::string &str,
+	       const char *delims = "/", bool skipinit = true)
+{
+	std::vector<std::string> tokens;
+
+	std::string::size_type startPos = 0;
+
+	// Skip initial delims, return empty if this eats all.
+	if (skipinit &&
+	    (startPos = str.find_first_not_of(delims, 0)) == std::string::npos)
+		return tokens;
+
+	while (startPos < str.size()) {
+		// Find next delimiter or end of string (end of token)
+		auto pos = str.find_first_of(delims, startPos);
+
+		// Add token to the vector and adjust start
+		if (pos == std::string::npos) {
+			tokens.push_back(str.substr(startPos));
+			break;
+		} else if (pos == startPos) {
+			// Dont' push empty tokens after first
+			if (tokens.empty())
+				tokens.push_back(std::string());
+			startPos = ++pos;
+		} else {
+			tokens.push_back(str.substr(startPos, pos - startPos));
+			startPos = ++pos;
+		}
+	}
+
+	return tokens;
+}
+
+Database *
+UpnpDatabase::Create(const config_param &param, Error &error)
+{
+	UpnpDatabase *db = new UpnpDatabase();
+	if (db && !db->Configure(param, error)) {
+		delete db;
+		db = nullptr;
+	}
+	return db;
+}
+
+bool
+UpnpDatabase::Configure(const config_param& param, Error&)
+{
+	m_upnplog = param.GetBlockValue("upnplog", "");
+	return true;
+}
+
+// Open is called before mpd daemonizes, and daemonizing messes with
+// the UpNP lib (it loses its ability to receive mcast messages
+// apparently).
+// So we delay actual opening until the first client call.
+//
+// Unfortunately the servers may take a few seconds to answer the
+// first search on the network, so we would either have to sleep for a
+// relatively long time (maybe 5S), or accept that the directory may
+// not be complete on the first client call. There is no simple
+// solution to this issue, we would need a call from mpd after daemonizing.
+bool
+UpnpDatabase::Open(Error &)
+{
+	return true;
+}
+
+bool UpnpDatabase::reallyOpen(Error &error)
+{
+	if (m_root)
+		return true;
+
+	m_lib = LibUPnP::getLibUPnP(error);
+	if (!m_lib)
+		return false;
+
+	if (!m_upnplog.empty()) {
+		m_lib->setLogFileName(m_upnplog);
+	}
+	m_superdir = UPnPDeviceDirectory::getTheDir();
+	if (!m_superdir || !m_superdir->ok()) {
+		error.Set(upnp_domain, "Discovery services startup failed");
+		return false;
+	}
+
+	m_root = Directory::NewRoot();
+	// Wait for device answers. This should be consistent with the value set
+	// in the lib (currently 2)
+	sleep(2);
+	return true;
+}
+
+void
+UpnpDatabase::Close()
+{
+	if (m_root)
+		delete m_root;
+	// TBD decide what we do with the lib and superdir objects
+}
+
+void
+UpnpDatabase::ReturnSong(Song *song) const
+{
+	assert(song != nullptr);
+
+	song->Free();
+}
+
+/**
+ * Transform titles to turn '/' into '_' to make them acceptable path
+ * elements. There is a very slight risk of collision in doing
+ * this. Twonky returns directory names (titles) like 'Artist/Album'.
+ */
+gcc_pure
+static std::string
+titleToPathElt(const std::string &in)
+{
+	std::string out;
+	for (auto it = in.begin(); it != in.end(); it++) {
+		if (*it == '/') {
+			out += '_';
+		} else {
+			out += *it;
+		}
+	}
+	return out;
+}
+
+gcc_pure
+static int
+upnpDurationToSeconds(const std::string &duration)
+{
+	const auto v = stringToTokens(duration, ":");
+	if (v.size() != 3)
+		return 0;
+	return atoi(v[0].c_str())*3600 + atoi(v[1].c_str())*60 + atoi(v[2].c_str());
+}
+
+// Upnp element to mpd tag number correspondance.
+// Don't know the upnp equivalent if any: TAG_ALBUM_ARTIST TAG_NAME
+// TAG_DATE TAG_COMPOSER TAG_PERFORMER TAG_COMMENT TAG_DISC
+static std::map<std::string, TagType> propToTag = {
+	{"upnp:artist", TAG_ARTIST},
+	{"upnp:album", TAG_ALBUM},
+	{"upnp:originalTrackNumber", TAG_TRACK},
+	{"upnp:genre", TAG_GENRE},
+	{"dc:title", TAG_TITLE},
+};
+
+// If uri is empty, we use the object's url instead. This happens
+// when the target of a Visit() is a song, which  only happens when
+// "add"ing AFAIK. Visit() calls us with a null uri so that the url
+// appropriate for fetching is used instead.
+static Song *
+upnpItemToSong(const UPnPDirObject &dirent, const char *uri)
+{
+	std::string url(uri);
+	if (url.empty())
+		dirent.getprop("url", url);
+
+	Song *s = Song::NewFile(url.c_str(), nullptr);
+
+	// I don't think that upnp returns this.
+	s->mtime = time(0);
+
+	s->start_ms = 0;
+	std::string sprop("0:0:0");
+	dirent.getprop("duration", sprop);
+	int seconds = upnpDurationToSeconds(sprop);
+	s->end_ms = seconds * 1000;
+
+	TagBuilder tag;
+	tag.SetTime(seconds);
+
+	tag.AddItem(TAG_TITLE, titleToPathElt(dirent.m_title).c_str());
+
+	for (auto &pt : propToTag)
+		if (dirent.getprop(pt.first, sprop))
+			tag.AddItem(pt.second, sprop.c_str());
+
+	s->tag = tag.CommitNew();
+	return s;
+}
+
+// Get song info by path. We can receive either the id path, or the titles
+// one
+Song *
+UpnpDatabase::GetSong(const char *uri, Error &error) const
+{
+	if (!const_cast<UpnpDatabase *>(this)->reallyOpen(error))
+		return nullptr;
+
+	if (!m_superdir || !m_superdir->ok()) {
+		error.Set(upnp_domain,
+			  "UpnpDatabase::GetSong() superdir is sick");
+		return nullptr;
+	}
+
+	Song *song = nullptr;
+	auto vpath = stringToTokens(uri, "/", true);
+	if (vpath.size() >= 2) {
+		ContentDirectoryService server;
+		if (!m_superdir->getServer(vpath[0].c_str(), server)) {
+			error.Set(upnp_domain, "server not found");
+			return nullptr;
+		}
+
+		vpath.erase(vpath.begin());
+		UPnPDirObject dirent;
+		if (vpath[0].compare(rootid)) {
+			std::string objid;
+			if (!Namei(&server, vpath, objid, dirent, error))
+				return nullptr;
+		} else {
+			if (!ReadNode(&server, vpath.back().c_str(), dirent,
+				      error))
+				return nullptr;
+		}
+		song = upnpItemToSong(dirent, "");
+	}
+	if (song == nullptr)
+		error.Format(db_domain, DB_NOT_FOUND, "No such song: %s", uri);
+
+	return song;
+}
+
+static const struct tag_table upnp_tags[] = {
+	{ "upnp:artist", TAG_ARTIST },
+	{ "upnp:album", TAG_ALBUM },
+	{ "upnp:originalTrackNumber", TAG_TRACK },
+	{ "upnp:genre", TAG_GENRE },
+	{ "dc:title", TAG_TITLE },
+
+	/* sentinel */
+	{ nullptr, TAG_NUM_OF_ITEM_TYPES }
+};
+
+/**
+ * Retrieve the value for an MPD tag from an object entry.
+ */
+static bool
+getTagValue(UPnPDirObject& dirent, TagType tag,
+	    std::string &tagvalue)
+{
+	if (tag == TAG_TITLE) {
+		if (!dirent.m_title.empty()) {
+			tagvalue = titleToPathElt(dirent.m_title);
+			return true;
+		}
+		return false;
+	}
+
+	const char *name = tag_table_lookup(upnp_tags, tag);
+	if (name == nullptr)
+		return false;
+
+	std::string propvalue;
+	dirent.getprop(name, propvalue);
+	if (propvalue.empty())
+		return false;
+	tagvalue = propvalue;
+	return true;
+}
+
+/**
+ * Double-quote a string, adding internal backslash escaping.
+ */
+static void
+dquote(std::string &out, const char *in)
+{
+	out.append(1, '"');
+
+	for (; *in != 0; ++in) {
+		switch(*in) {
+		case '\\':
+		case '"':
+			out.append(1, '\\');
+			out.append(1, *in);
+			break;
+
+		default:
+			out.append(1, *in);
+		}
+	}
+
+	out.append(1, '"');
+}
+
+// Run an UPnP search, according to MPD parameters. Return results as
+// UPnP items
+bool
+UpnpDatabase::SearchSongs(ContentDirectoryService* server,
+			  const char *objid,
+			  const DatabaseSelection &selection,
+			  UPnPDirContent &dirbuf,
+			  Error &error) const
+{
+	const SongFilter *filter = selection.filter;
+	if (selection.filter == nullptr)
+		return true;
+
+	std::set<std::string> searchcaps;
+	if (!server->getSearchCapabilities(searchcaps, error))
+		return false;
+
+	if (searchcaps.empty())
+		return true;
+
+	std::string cond;
+	for (const auto &item : filter->GetItems()) {
+		switch (auto tag = item.GetTag()) {
+		case LOCATE_TAG_ANY_TYPE:
+			{
+				if (!cond.empty()) {
+					cond += " and ";
+				}
+				cond += "(";
+				bool first(true);
+				for (const auto& cap : searchcaps) {
+					if (first)
+						first = false;
+					else
+						cond += " or ";
+					cond += cap;
+					if (item.GetFoldCase()) {
+						cond += " contains ";
+					} else {
+						cond += " = ";
+					}
+					dquote(cond, item.GetValue().c_str());
+				}
+				cond += ")";
+			}
+			break;
+
+		default:
+			/* Unhandled conditions like
+			   LOCATE_TAG_BASE_TYPE or
+			   LOCATE_TAG_FILE_TYPE won't have a
+			   corresponding upnp prop, so they will be
+			   skipped */
+			if (tag == TAG_ALBUM_ARTIST)
+				tag = TAG_ARTIST;
+
+			// TODO: support LOCATE_TAG_ANY_TYPE etc.
+			const char *name = tag_table_lookup(upnp_tags,
+							    TagType(tag));
+			if (name == nullptr)
+				continue;
+
+			if (!cond.empty()) {
+				cond += " and ";
+			}
+			cond += name;
+
+			/* FoldCase doubles up as contains/equal
+			   switch. UpNP search is supposed to be
+			   case-insensitive, but at least some servers
+			   have the same convention as mpd (e.g.:
+			   minidlna) */
+			if (item.GetFoldCase()) {
+				cond += " contains ";
+			} else {
+				cond += " = ";
+			}
+			dquote(cond, item.GetValue().c_str());
+		}
+	}
+
+	return server->search(objid, cond.c_str(), dirbuf, error);
+}
+
+static bool
+visitSong(const UPnPDirObject& meta, const char *path,
+	  const DatabaseSelection &selection,
+	  VisitSong visit_song, Error& error)
+{
+	if (!visit_song)
+		return true;
+	Song *s = upnpItemToSong(meta, path);
+	if (!selection.Match(*s))
+		return true;
+	bool success = visit_song(*s, error);
+	s->Free();
+	return success;
+}
+
+/**
+ * Build synthetic path based on object id for search results. The use
+ * of "rootid" is arbitrary, any name that is not likely to be a top
+ * directory name would fit.
+ */
+static const std::string
+songPath(const std::string &servername,
+	 const std::string &objid)
+{
+	return servername + "/" + rootid + "/" + objid;
+}
+
+bool
+UpnpDatabase::SearchSongs(ContentDirectoryService* server,
+			  const char *objid,
+			  const DatabaseSelection &selection,
+			  VisitSong visit_song,
+			  Error &error) const
+{
+	UPnPDirContent dirbuf;
+	if (!visit_song)
+		return true;
+	if (!SearchSongs(server, objid, selection, dirbuf, error))
+		return false;
+
+	for (const auto &dirent : dirbuf.m_items) {
+		// We get song ids as the result of the UPnP search. But our
+		// client expects paths (e.g. we get 1$4$3788 from minidlna,
+		// but we need to translate to /Music/All_Music/Satisfaction).
+		// We can do this in two ways:
+		//  - Rebuild a normal path using BuildPath() which is a kind of pwd
+		//  - Build a bogus path based on the song id.
+		// The first method is nice because the returned paths are pretty, but
+		// it has two big problems:
+		//  - The song paths are ambiguous: e.g. minidlna returns all search
+		//    results as being from the "All Music" directory, which can
+		//    contain several songs with the same title (but different objids)
+		//  - The performance of BuildPath() is atrocious on very big
+		//    directories, even causing timeouts in clients. And of
+		//    course, 'All Music' is very big.
+		// So we return synthetic and ugly paths based on the object id,
+		// which we later have to detect.
+		std::string path = songPath(server->getFriendlyName(),
+					    dirent.m_id);
+		//BuildPath(server, dirent, path);
+		if (!visitSong(dirent, path.c_str(), selection, visit_song,
+			       error))
+			return false;
+	}
+
+	return true;
+}
+
+bool
+UpnpDatabase::ReadNode(ContentDirectoryService *server,
+		       const char *objid, UPnPDirObject &dirent,
+		       Error &error) const
+{
+	UPnPDirContent dirbuf;
+	if (!server->getMetadata(objid, dirbuf, error))
+		return false;
+
+	if (dirbuf.m_containers.size() == 1) {
+		dirent = dirbuf.m_containers[0];
+	} else if (dirbuf.m_items.size() == 1) {
+		dirent = dirbuf.m_items[0];
+	} else {
+		error.Format(upnp_domain, "Bad resource");
+		return false;
+	}
+
+	return true;
+}
+
+bool
+UpnpDatabase::BuildPath(ContentDirectoryService *server,
+			const UPnPDirObject& idirent,
+			std::string &path,
+			Error &error) const
+{
+	const char *pid = idirent.m_id.c_str();
+	path.clear();
+	UPnPDirObject dirent;
+	while (strcmp(pid, rootid) != 0) {
+		if (!ReadNode(server, pid, dirent, error))
+			return false;
+		pid = dirent.m_pid.c_str();
+		path = titleToPathElt(dirent.m_title) + (path.empty()? "" : "/" + path);
+	}
+	path = std::string(server->getFriendlyName()) + "/" + path;
+	return true;
+}
+
+// Take server and internal title pathname and return objid and metadata.
+bool
+UpnpDatabase::Namei(ContentDirectoryService* server,
+		    const std::vector<std::string> &vpath,
+		    std::string &oobjid, UPnPDirObject &odirent,
+		    Error &error) const
+{
+	oobjid.clear();
+	std::string objid(rootid);
+
+	if (vpath.empty()) {
+		// looking for root info
+		if (!ReadNode(server, rootid, odirent, error))
+			return false;
+
+		oobjid = rootid;
+		return true;
+	}
+
+	// Walk the path elements, read each directory and try to find the next one
+	for (unsigned int i = 0; i < vpath.size(); i++) {
+		UPnPDirContent dirbuf;
+		if (!server->readDir(objid.c_str(), dirbuf, error))
+			return false;
+
+		bool found = false;
+
+		// Look for the name in the sub-container list
+		for (auto& dirent : dirbuf.m_containers) {
+			if (!vpath[i].compare(titleToPathElt(dirent.m_title.c_str()))) {
+				objid = dirent.m_id; // Next readdir target
+				found = true;
+				if (i == vpath.size() - 1) {
+					// The last element in the path was found and it's
+					// a container, we're done
+					oobjid = objid;
+					odirent = dirent;
+					return true;
+				}
+				break;
+			}
+		}
+		if (found)
+			continue;
+
+		// Path elt was not a container, look at the items list
+		for (auto& dirent : dirbuf.m_items) {
+			if (!vpath[i].compare(titleToPathElt(dirent.m_title.c_str()))) {
+				// If this is the last path elt, we found the target,
+				// else it does not exist
+				if (i == vpath.size() - 1) {
+					oobjid = objid;
+					odirent = dirent;
+					return true;
+				} else {
+					return true;
+				}
+			}
+		}
+
+		// Neither container nor item, we're done.
+		if (!found)
+			break;
+	}
+
+	return true;
+}
+
+// vpath is a parsed and writeable version of selection.uri. There is
+// really just one path parameter.
+bool
+UpnpDatabase::VisitServer(ContentDirectoryService* server,
+			  const std::vector<std::string> &vpath,
+			  const DatabaseSelection &selection,
+			  VisitDirectory visit_directory,
+			  VisitSong visit_song,
+			  VisitPlaylist visit_playlist,
+			  Error &error) const
+{
+	/* If the path begins with rootid, we know that this is a
+	   song, not a directory (because that's how we set things
+	   up). Just visit it. Note that the choice of rootid is
+	   arbitrary, any value not likely to be the name of a top
+	   directory would be ok. */
+	/* !Note: this *can't* be handled by Namei further down,
+	   because the path is not valid for traversal. Besides, it's
+	   just faster to access the target node directly */
+	if (!vpath.empty() && !vpath[0].compare(rootid)) {
+		if (visit_song) {
+			UPnPDirObject dirent;
+			if (!ReadNode(server, vpath.back().c_str(), dirent,
+				      error))
+				return false;
+
+			if (!visitSong(dirent, "", selection,
+				       visit_song, error))
+				return false;
+		}
+		return true;
+	}
+
+	// Translate the target path into an object id and the associated metadata.
+	std::string objid;
+	UPnPDirObject tdirent;
+	if (!Namei(server, vpath, objid, tdirent, error))
+		return false;
+
+	if (objid.empty())
+		// Not found, not a fatal error
+		return true;
+
+	/* If recursive is set, this is a search... No use sending it
+	   if the filter is empty. In this case, we implement limited
+	   recursion (1-deep) here, which will handle the "add dir"
+	   case. */
+	if (selection.recursive && selection.filter)
+		return SearchSongs(server, objid.c_str(), selection,
+				   visit_song, error);
+
+	if (tdirent.m_type == UPnPDirObject::item) {
+		// Target is a song. Not too sure we ever get there actually, maybe
+		// this is always catched by the special uri test above.
+		if (visit_song &&
+		    tdirent.m_iclass == UPnPDirObject::audioItem_musicTrack) {
+			return visitSong(tdirent, "", selection, visit_song,
+					 error);
+		} else if (visit_playlist &&
+			   tdirent.m_iclass == UPnPDirObject::audioItem_playlist) {
+			// Note: I've yet to see a playlist item (playlists
+			// seem to be usually handled as containers, so I'll
+			// decide what to do when I see one...
+		}
+
+		return true;
+	}
+
+	/* Target was a a container. Visit it. We could read slices
+	   and loop here, but it's not useful as mpd will only return
+	   data to the client when we're done anyway. */
+	UPnPDirContent dirbuf;
+	if (!server->readDir(objid.c_str(), dirbuf, error))
+		return false;
+
+	if (visit_directory) {
+		for (auto& dirent : dirbuf.m_containers) {
+			Directory d((selection.uri + "/" +
+				     titleToPathElt(dirent.m_title)).c_str(),
+				    m_root);
+			if (!visit_directory(d, error))
+				return false;
+		}
+	}
+
+	if (visit_song || visit_playlist) {
+		for (const auto &dirent : dirbuf.m_items) {
+			if (visit_song &&
+			    dirent.m_iclass == UPnPDirObject::audioItem_musicTrack) {
+				/* We identify songs by giving them a
+				   special path. The Id is enough to
+				   fetch them from the server
+				   anyway. */
+
+				std::string p;
+				if (!selection.recursive)
+					p = selection.uri + "/" +
+						titleToPathElt(dirent.m_title);
+
+				if (!visitSong(dirent, p.c_str(),
+					       selection, visit_song, error))
+					return false;
+			} else if (visit_playlist &&
+				   dirent.m_iclass == UPnPDirObject::audioItem_playlist) {
+				/* Note: I've yet to see a playlist
+				   item (playlists seem to be usually
+				   handled as containers, so I'll
+				   decide what to do when I see
+				   one... */
+			}
+		}
+	}
+
+	return true;
+}
+
+// Deal with the possibly multiple servers, call VisitServer if needed.
+bool
+UpnpDatabase::Visit(const DatabaseSelection &selection,
+		    VisitDirectory visit_directory,
+		    VisitSong visit_song,
+		    VisitPlaylist visit_playlist,
+		    Error &error) const
+{
+	if (!const_cast<UpnpDatabase *>(this)->reallyOpen(error))
+		return false;
+
+	std::vector<ContentDirectoryService> servers;
+	if (!m_superdir || !m_superdir->ok() ||
+	    !m_superdir->getDirServices(servers)) {
+		error.Set(upnp_domain,
+			  "UpnpDatabase::Visit() superdir is sick");
+		return false;
+	}
+
+	auto vpath = stringToTokens(selection.uri, "/", true);
+	if (vpath.empty()) {
+		if (!selection.recursive) {
+			// If the path is empty and recursive is not set, synthetize a
+			// pseudo-directory from the list of servers.
+			if (visit_directory) {
+				for (auto& server : servers) {
+					Directory d(server.getFriendlyName(), m_root);
+					if (!visit_directory(d, error))
+						return false;
+				}
+			}
+		} else {
+			// Recursive is set: visit each server
+			for (auto& server : servers) {
+				if (!VisitServer(&server, std::vector<std::string>(), selection,
+						 visit_directory, visit_song, visit_playlist, error))
+					return false;
+			}
+		}
+		return true;
+	}
+
+	// We do have a path: the first element selects the server
+	std::string servername(vpath[0]);
+	vpath.erase(vpath.begin());
+
+	ContentDirectoryService* server = 0;
+	for (auto& dir : servers) {
+		if (!servername.compare(dir.getFriendlyName())) {
+			server = &dir;
+			break;
+		}
+	}
+	if (server == 0) {
+		FormatDebug(db_domain, "UpnpDatabase::Visit: server %s not found\n",
+			    vpath[0].c_str());
+		return true;
+	}
+	return VisitServer(server, vpath, selection,
+			   visit_directory, visit_song, visit_playlist, error);
+}
+
+bool
+UpnpDatabase::VisitUniqueTags(const DatabaseSelection &selection,
+			      TagType tag,
+			      VisitString visit_string,
+			      Error &error) const
+{
+	if (!const_cast<UpnpDatabase *>(this)->reallyOpen(error))
+		return false;
+
+	if (!visit_string)
+		return true;
+
+	std::vector<ContentDirectoryService> servers;
+	if (!m_superdir || !m_superdir->ok() ||
+	    !m_superdir->getDirServices(servers)) {
+		error.Set(upnp_domain,
+			  "UpnpDatabase::Visit() superdir is sick");
+		return false;
+	}
+
+	std::set<std::string> values;
+	for (auto& server : servers) {
+		UPnPDirContent dirbuf;
+		if (!SearchSongs(&server, rootid, selection, dirbuf, error))
+			return false;
+
+		for (auto &dirent : dirbuf.m_items) {
+			std::string tagvalue;
+			if (getTagValue(dirent, tag, tagvalue))
+				values.emplace(std::move(tagvalue));
+		}
+	}
+
+	for (const auto& value : values)
+		if (!visit_string(value.c_str(), error))
+			return false;
+
+	return true;
+}
+
+bool
+UpnpDatabase::GetStats(const DatabaseSelection &,
+		       DatabaseStats &stats, Error &) const
+{
+	/* Note: this gets called before the daemonizing so we can't
+	   reallyopen this would be a problem if we had real stats */
+	stats.song_count = 0;
+	stats.total_duration = 0;
+	stats.artist_count = 0;
+	stats.album_count = 0;
+	return true;
+}
+
+const DatabasePlugin upnp_db_plugin = {
+	"upnp",
+	UpnpDatabase::Create,
+};
diff --git a/src/db/UpnpDatabasePlugin.hxx b/src/db/UpnpDatabasePlugin.hxx
new file mode 100644
index 000000000..7fe2dde60
--- /dev/null
+++ b/src/db/UpnpDatabasePlugin.hxx
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2003-2011 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef MPD_UPNP_DATABASE_PLUGIN_HXX
+#define MPD_UPNP_DATABASE_PLUGIN_HXX
+
+struct DatabasePlugin;
+
+extern const DatabasePlugin upnp_db_plugin;
+
+#endif
diff --git a/src/db/upnp/ContentDirectoryService.cxx b/src/db/upnp/ContentDirectoryService.cxx
new file mode 100644
index 000000000..b40f55c54
--- /dev/null
+++ b/src/db/upnp/ContentDirectoryService.cxx
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "ContentDirectoryService.hxx"
+#include "Domain.hxx"
+#include "Device.hxx"
+#include "ixmlwrap.hxx"
+#include "Directory.hxx"
+#include "Util.hxx"
+#include "upnpplib.hxx"
+#include "util/Error.hxx"
+
+#include <stdio.h>
+
+#include <upnp/upnp.h>
+#include <upnp/upnptools.h>
+
+ContentDirectoryService::ContentDirectoryService(const UPnPDevice &device,
+						 const UPnPService &service)
+	:m_actionURL(caturl(device.URLBase, service.controlURL)),
+	 m_serviceType(service.serviceType),
+	 m_deviceId(device.UDN),
+	 m_friendlyName(device.friendlyName),
+	 m_manufacturer(device.manufacturer),
+	 m_modelName(device.modelName),
+	 m_rdreqcnt(200)
+{
+	if (!m_modelName.compare("MediaTomb")) {
+		// Readdir by 200 entries is good for most, but MediaTomb likes
+		// them really big. Actually 1000 is better but I don't dare
+		m_rdreqcnt = 500;
+	}
+}
+
+class DirBResFree {
+public:
+	IXML_Document **rqpp, **rspp;
+	DirBResFree(IXML_Document** _rqpp, IXML_Document **_rspp)
+		:rqpp(_rqpp), rspp(_rspp) {}
+	~DirBResFree()
+	{
+		if (*rqpp)
+			ixmlDocument_free(*rqpp);
+		if (*rspp)
+			ixmlDocument_free(*rspp);
+	}
+};
+
+bool
+ContentDirectoryService::readDirSlice(const char *objectId, int offset,
+				      int count, UPnPDirContent &dirbuf,
+				      int *didreadp, int *totalp,
+				      Error &error)
+{
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return false;
+
+	UpnpClient_Handle hdl = lib->getclh();
+
+	IXML_Document *request(0);
+	IXML_Document *response(0);
+	DirBResFree cleaner(&request, &response);
+
+	// Create request
+	char ofbuf[100], cntbuf[100];
+	sprintf(ofbuf, "%d", offset);
+	sprintf(cntbuf, "%d", count);
+	int argcnt = 6;
+	// Some devices require an empty SortCriteria, else bad params
+	request = UpnpMakeAction("Browse", m_serviceType.c_str(), argcnt,
+				 "ObjectID", objectId,
+				 "BrowseFlag", "BrowseDirectChildren",
+				 "Filter", "*",
+				 "SortCriteria", "",
+				 "StartingIndex", ofbuf,
+				 "RequestedCount", cntbuf,
+				 nullptr, nullptr);
+	if (request == nullptr) {
+		error.Set(upnp_domain, "UpnpMakeAction() failed");
+		return false;
+	}
+
+	int code = UpnpSendAction(hdl, m_actionURL.c_str(), m_serviceType.c_str(),
+				  0 /*devUDN*/, request, &response);
+	if (code != UPNP_E_SUCCESS) {
+		error.Format(upnp_domain, code,
+			     "UpnpSendAction() failed: %s",
+			     UpnpGetErrorMessage(code));
+		return false;
+	}
+
+	int didread = -1;
+	std::string tbuf = ixmlwrap::getFirstElementValue(response, "NumberReturned");
+	if (!tbuf.empty())
+		didread = atoi(tbuf.c_str());
+
+	if (count == -1 || count == 0) {
+		// TODO: what's this?
+		error.Set(upnp_domain, "got -1 or 0 entries");
+		return false;
+	}
+
+	tbuf = ixmlwrap::getFirstElementValue(response, "TotalMatches");
+	if (!tbuf.empty())
+		*totalp = atoi(tbuf.c_str());
+
+	tbuf = ixmlwrap::getFirstElementValue(response, "Result");
+
+	if (!dirbuf.parse(tbuf, error))
+		return false;
+
+	*didreadp = didread;
+	return true;
+}
+
+bool
+ContentDirectoryService::readDir(const char *objectId,
+				 UPnPDirContent &dirbuf,
+				 Error &error)
+{
+	int offset = 0;
+	int total = 1000;// Updated on first read.
+
+	while (offset < total) {
+		int count;
+		if (!readDirSlice(objectId, offset, m_rdreqcnt, dirbuf,
+				  &count, &total, error))
+			return false;
+
+		offset += count;
+	}
+
+	return true;
+}
+
+bool
+ContentDirectoryService::search(const char *objectId,
+				const char *ss,
+				UPnPDirContent &dirbuf,
+				Error &error)
+{
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return false;
+
+	UpnpClient_Handle hdl = lib->getclh();
+
+	IXML_Document *request(0);
+	IXML_Document *response(0);
+
+	int offset = 0;
+	int total = 1000;// Updated on first read.
+
+	while (offset < total) {
+		DirBResFree cleaner(&request, &response);
+		char ofbuf[100];
+		sprintf(ofbuf, "%d", offset);
+		// Create request
+		int argcnt = 6;
+		request = UpnpMakeAction("Search", m_serviceType.c_str(), argcnt,
+					 "ContainerID", objectId,
+					 "SearchCriteria", ss,
+					 "Filter", "*",
+					 "SortCriteria", "",
+					 "StartingIndex", ofbuf,
+					 "RequestedCount", "0", // Setting a value here gets twonky into fits
+					 nullptr, nullptr);
+		if (request == 0) {
+			error.Set(upnp_domain, "UpnpMakeAction() failed");
+			return false;
+		}
+
+		auto code = UpnpSendAction(hdl, m_actionURL.c_str(),
+					   m_serviceType.c_str(),
+					   0 /*devUDN*/, request, &response);
+		if (code != UPNP_E_SUCCESS) {
+			error.Format(upnp_domain, code,
+				     "UpnpSendAction() failed: %s",
+				     UpnpGetErrorMessage(code));
+			return false;
+		}
+
+		int count = -1;
+		std::string tbuf =
+			ixmlwrap::getFirstElementValue(response, "NumberReturned");
+		if (!tbuf.empty())
+			count = atoi(tbuf.c_str());
+
+		if (count == -1 || count == 0) {
+			// TODO: what's this?
+			error.Set(upnp_domain, "got -1 or 0 entries");
+			return false;
+		}
+
+		offset += count;
+
+		tbuf = ixmlwrap::getFirstElementValue(response, "TotalMatches");
+		if (!tbuf.empty())
+			total = atoi(tbuf.c_str());
+
+		tbuf = ixmlwrap::getFirstElementValue(response, "Result");
+
+		if (!dirbuf.parse(tbuf, error))
+			return false;
+	}
+
+	return true;
+}
+
+bool
+ContentDirectoryService::getSearchCapabilities(std::set<std::string> &result,
+					       Error &error)
+{
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return false;
+
+	UpnpClient_Handle hdl = lib->getclh();
+
+	IXML_Document *request(0);
+	IXML_Document *response(0);
+
+	request = UpnpMakeAction("GetSearchCapabilities", m_serviceType.c_str(),
+				 0,
+				 nullptr, nullptr);
+	if (request == 0) {
+		error.Set(upnp_domain, "UpnpMakeAction() failed");
+		return false;
+	}
+
+	auto code = UpnpSendAction(hdl, m_actionURL.c_str(),
+				   m_serviceType.c_str(),
+				   0 /*devUDN*/, request, &response);
+	if (code != UPNP_E_SUCCESS) {
+		error.Format(upnp_domain, code,
+			     "UpnpSendAction() failed: %s",
+			     UpnpGetErrorMessage(code));
+		return false;
+	}
+
+	std::string tbuf = ixmlwrap::getFirstElementValue(response, "SearchCaps");
+
+	result.clear();
+	if (!tbuf.compare("*")) {
+		result.insert(result.end(), "*");
+	} else if (!tbuf.empty()) {
+		if (!csvToStrings(tbuf, result)) {
+			error.Set(upnp_domain, "Bad response");
+			return false;
+		}
+	}
+
+	return true;
+}
+
+bool
+ContentDirectoryService::getMetadata(const char *objectId,
+				     UPnPDirContent &dirbuf,
+				     Error &error)
+{
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return false;
+
+	UpnpClient_Handle hdl = lib->getclh();
+
+	IXML_Document *response(0);
+
+	// Create request
+	int argcnt = 6;
+	IXML_Document *request =
+		UpnpMakeAction("Browse", m_serviceType.c_str(), argcnt,
+			       "ObjectID", objectId,
+			       "BrowseFlag", "BrowseMetadata",
+			       "Filter", "*",
+			       "SortCriteria", "",
+			       "StartingIndex", "0",
+			       "RequestedCount", "1",
+			       nullptr, nullptr);
+	DirBResFree cleaner(&request, &response);
+	if (request == nullptr) {
+		error.Set(upnp_domain, "UpnpMakeAction() failed");
+		return false;
+	}
+
+	auto code = UpnpSendAction(hdl, m_actionURL.c_str(),
+				   m_serviceType.c_str(),
+				   0 /*devUDN*/, request, &response);
+	if (code != UPNP_E_SUCCESS) {
+		error.Format(upnp_domain, code,
+			     "UpnpSendAction() failed: %s",
+			     UpnpGetErrorMessage(code));
+		return false;
+	}
+
+	std::string tbuf = ixmlwrap::getFirstElementValue(response, "Result");
+	return dirbuf.parse(tbuf, error);
+}
diff --git a/src/db/upnp/ContentDirectoryService.hxx b/src/db/upnp/ContentDirectoryService.hxx
new file mode 100644
index 000000000..8fc28c382
--- /dev/null
+++ b/src/db/upnp/ContentDirectoryService.hxx
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _UPNPDIR_HXX_INCLUDED_
+#define _UPNPDIR_HXX_INCLUDED_
+
+#include <string>
+#include <set>
+
+class Error;
+class UPnPDevice;
+struct UPnPService;
+class UPnPDirContent;
+
+/**
+ * Content Directory Service class.
+ *
+ * This stores identity data from a directory service
+ * and the device it belongs to, and has methods to query
+ * the directory, using libupnp for handling the UPnP protocols.
+ *
+ * Note: m_rdreqcnt: number of entries requested per directory read.
+ * 0 means all entries. The device can still return less entries than
+ * requested, depending on its own limits. In general it's not optimal
+ * becauses it triggers issues, and is sometimes actually slower, e.g. on
+ * a D-Link NAS 327
+ *
+ * The value chosen may affect by the UpnpSetMaxContentLength
+ * (2000*1024) done during initialization, but this should be ample
+ */
+class ContentDirectoryService {
+	std::string m_actionURL;
+	std::string m_serviceType;
+	std::string m_deviceId;
+	std::string m_friendlyName;
+	std::string m_manufacturer;
+	std::string m_modelName;
+
+	int m_rdreqcnt; // Slice size to use when reading
+
+public:
+	/**
+	 * Construct by copying data from device and service objects.
+	 *
+	 * The discovery service does this: use getDirServices()
+	 */
+	ContentDirectoryService(const UPnPDevice &device,
+				const UPnPService &service);
+
+	/** An empty one */
+	ContentDirectoryService() = default;
+
+	/** Read a container's children list into dirbuf.
+	 *
+	 * @param objectId the UPnP object Id for the container. Root has Id "0"
+	 * @param[out] dirbuf stores the entries we read.
+	 */
+	bool readDir(const char *objectId, UPnPDirContent &dirbuf,
+		     Error &error);
+
+	bool readDirSlice(const char *objectId, int offset,
+			  int count, UPnPDirContent& dirbuf,
+			  int *didread, int *total,
+			  Error &error);
+
+	/** Search the content directory service.
+	 *
+	 * @param objectId the UPnP object Id under which the search
+	 * should be done. Not all servers actually support this below
+	 * root. Root has Id "0"
+	 * @param searchstring an UPnP searchcriteria string. Check the
+	 * UPnP document: UPnP-av-ContentDirectory-v1-Service-20020625.pdf
+	 * section 2.5.5. Maybe we'll provide an easier way some day...
+	 * @param[out] dirbuf stores the entries we read.
+	 */
+	bool search(const char *objectId, const char *searchstring,
+		    UPnPDirContent &dirbuf,
+		    Error &error);
+
+	/** Read metadata for a given node.
+	 *
+	 * @param objectId the UPnP object Id. Root has Id "0"
+	 * @param[out] dirbuf stores the entries we read. At most one entry will be
+	 *   returned.
+	 */
+	bool getMetadata(const char *objectId, UPnPDirContent &dirbuf,
+			 Error &error);
+
+	/** Retrieve search capabilities
+	 *
+	 * @param[out] result an empty vector: no search, or a single '*' element:
+	 *     any tag can be used in a search, or a list of usable tag names.
+	 */
+	bool getSearchCapabilities(std::set<std::string> &result,
+				   Error &error);
+
+	/** Retrieve the "friendly name" for this server, useful for display. */
+	const char *getFriendlyName() const {
+		return m_friendlyName.c_str();
+	}
+};
+
+#endif /* _UPNPDIR_HXX_INCLUDED_ */
diff --git a/src/db/upnp/Device.cxx b/src/db/upnp/Device.cxx
new file mode 100644
index 000000000..c1cfab07a
--- /dev/null
+++ b/src/db/upnp/Device.cxx
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "Device.hxx"
+#include "Util.hxx"
+#include "Expat.hxx"
+#include "Log.hxx"
+#include "util/Error.hxx"
+
+#include <stdlib.h>
+
+#include <string.h>
+
+/**
+ * An XML parser which constructs an UPnP device object from the
+ * device descriptor.
+ */
+class UPnPDeviceParser final : public CommonExpatParser {
+	UPnPDevice &m_device;
+	std::string m_tabs;
+	std::vector<std::string> m_path;
+	UPnPService m_tservice;
+
+public:
+	UPnPDeviceParser(UPnPDevice& device)
+		:m_device(device) {}
+
+protected:
+	virtual void StartElement(const XML_Char *name, const XML_Char **) {
+		m_tabs.push_back('\t');
+		m_path.push_back(name);
+	}
+
+	virtual void EndElement(const XML_Char *name) {
+		if (!strcmp(name, "service")) {
+			m_device.services.push_back(m_tservice);
+			m_tservice.clear();
+		}
+		if (m_tabs.size())
+			m_tabs.erase(m_tabs.size()-1);
+		m_path.pop_back();
+	}
+
+	virtual void CharacterData(const XML_Char *s, int len) {
+		if (len == 0)
+			return;
+
+		std::string str(s, len);
+		trimstring(str);
+		switch (m_path.back()[0]) {
+		case 'c':
+			if (!m_path.back().compare("controlURL"))
+				m_tservice.controlURL += str;
+			break;
+		case 'd':
+			if (!m_path.back().compare("deviceType"))
+				m_device.deviceType += str;
+			break;
+		case 'e':
+			if (!m_path.back().compare("eventSubURL"))
+				m_tservice.eventSubURL += str;
+			break;
+		case 'f':
+			if (!m_path.back().compare("friendlyName"))
+				m_device.friendlyName += str;
+			break;
+		case 'm':
+			if (!m_path.back().compare("manufacturer"))
+				m_device.manufacturer += str;
+			else if (!m_path.back().compare("modelName"))
+				m_device.modelName += str;
+			break;
+		case 's':
+			if (!m_path.back().compare("serviceType"))
+				m_tservice.serviceType = str;
+			else if (!m_path.back().compare("serviceId"))
+				m_tservice.serviceId += str;
+		case 'S':
+			if (!m_path.back().compare("SCPDURL"))
+				m_tservice.SCPDURL = str;
+			break;
+		case 'U':
+			if (!m_path.back().compare("UDN"))
+				m_device.UDN = str;
+			else if (!m_path.back().compare("URLBase"))
+				m_device.URLBase += str;
+			break;
+		}
+	}
+};
+
+UPnPDevice::UPnPDevice(const std::string &url, const std::string &description)
+	:ok(false)
+{
+	UPnPDeviceParser mparser(*this);
+	Error error;
+	if (!mparser.Parse(description.data(), description.length(), true,
+			   error)) {
+		// TODO: pass Error to caller
+		LogError(error);
+		return;
+	}
+
+	if (URLBase.empty()) {
+		// The standard says that if the URLBase value is empty, we should use
+		// the url the description was retrieved from. However this is
+		// sometimes something like http://host/desc.xml, sometimes something
+		// like http://host/
+
+		if (url.size() < 8) {
+			// ???
+			URLBase = url;
+		} else {
+			auto hostslash = url.find_first_of("/", 7);
+			if (hostslash == std::string::npos || hostslash == url.size()-1) {
+				URLBase = url;
+			} else {
+				URLBase = path_getfather(url);
+			}
+		}
+	}
+	ok = true;
+}
diff --git a/src/db/upnp/Device.hxx b/src/db/upnp/Device.hxx
new file mode 100644
index 000000000..53e1c4964
--- /dev/null
+++ b/src/db/upnp/Device.hxx
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _UPNPDEV_HXX_INCLUDED_
+#define _UPNPDEV_HXX_INCLUDED_
+
+#include <vector>
+#include <string>
+
+class Error;
+
+/**
+ * UPnP Description phase: interpreting the device description which we
+ * downloaded from the URL obtained by the discovery phase.
+ */
+
+/**
+ * Data holder for a UPnP service, parsed from the XML description
+ * downloaded after discovery yielded its URL.
+ */
+struct UPnPService {
+	// e.g. urn:schemas-upnp-org:service:ConnectionManager:1
+	std::string serviceType;
+	// Unique Id inside device: e.g here THE ConnectionManager
+	std::string serviceId; // e.g. urn:upnp-org:serviceId:ConnectionManager
+	std::string SCPDURL; // Service description URL. e.g.: cm.xml
+	std::string controlURL; // e.g.: /upnp/control/cm
+	std::string eventSubURL; // e.g.: /upnp/event/cm
+
+	void clear()
+	{
+		serviceType.clear();
+		serviceId.clear();
+		SCPDURL.clear();
+		controlURL.clear();
+		eventSubURL.clear();
+	}
+};
+
+/**
+ * Data holder for a UPnP device, parsed from the XML description obtained
+ * during discovery.
+ * A device may include several services. To be of interest to us,
+ * one of them must be a ContentDirectory.
+ */
+class UPnPDevice {
+public:
+	bool ok;
+	// e.g. urn:schemas-upnp-org:device:MediaServer:1
+	std::string deviceType;
+	// e.g. MediaTomb
+	std::string friendlyName;
+	// Unique device number. This should match the deviceID in the
+	// discovery message. e.g. uuid:a7bdcd12-e6c1-4c7e-b588-3bbc959eda8d
+	std::string UDN;
+	// Base for all relative URLs. e.g. http://192.168.4.4:49152/
+	std::string URLBase;
+	// Manufacturer: e.g. D-Link, PacketVideo ("manufacturer")
+	std::string manufacturer;
+	// Model name: e.g. MediaTomb, DNS-327L ("modelName")
+	std::string modelName;
+	// Services provided by this device.
+	std::vector<UPnPService> services;
+
+	/** Build device from xml description downloaded from discovery
+	 * @param url where the description came from
+	 * @param description the xml device description
+	 */
+	UPnPDevice(const std::string &url, const std::string &description);
+
+	UPnPDevice() : ok(false) {}
+};
+
+typedef std::vector<UPnPService>::iterator DevServIt;
+
+#endif /* _UPNPDEV_HXX_INCLUDED_ */
diff --git a/src/db/upnp/Directory.cxx b/src/db/upnp/Directory.cxx
new file mode 100644
index 000000000..895e767be
--- /dev/null
+++ b/src/db/upnp/Directory.cxx
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "Directory.hxx"
+#include "Util.hxx"
+#include "Expat.hxx"
+
+#include <string>
+#include <vector>
+#include <map>
+
+#include <string.h>
+
+static const char *const upnptags[] = {
+	"upnp:artist",
+	"upnp:album",
+	"upnp:genre",
+	"upnp:originalTrackNumber",
+	"upnp:class",
+};
+static const int nupnptags = sizeof(upnptags) / sizeof(char*);
+
+/**
+ * An XML parser which builds directory contents from DIDL lite input.
+ */
+class UPnPDirParser final : public CommonExpatParser {
+	struct StackEl {
+		StackEl(const std::string& nm) : name(nm) {}
+		std::string name;
+		std::map<std::string,std::string> attributes;
+	};
+
+	std::vector<StackEl> m_path;
+	UPnPDirObject m_tobj;
+	std::map<std::string, UPnPDirObject::ItemClass> m_okitems;
+
+public:
+	UPnPDirParser(UPnPDirContent& dir)
+		:m_dir(dir)
+	{
+		m_okitems["object.item.audioItem.musicTrack"] =
+			UPnPDirObject::audioItem_musicTrack;
+		m_okitems["object.item.playlistItem"] =
+			UPnPDirObject::audioItem_playlist;
+	}
+	UPnPDirContent& m_dir;
+
+protected:
+	virtual void StartElement(const XML_Char *name, const XML_Char **attrs)
+	{
+		m_path.push_back(StackEl(name));
+		for (int i = 0; attrs[i] != 0; i += 2) {
+			m_path.back().attributes[attrs[i]] = attrs[i+1];
+		}
+
+		switch (name[0]) {
+		case 'c':
+			if (!strcmp(name, "container")) {
+				m_tobj.clear();
+				m_tobj.m_type = UPnPDirObject::container;
+				m_tobj.m_id = m_path.back().attributes["id"];
+				m_tobj.m_pid = m_path.back().attributes["parentID"];
+			}
+			break;
+		case 'i':
+			if (!strcmp(name, "item")) {
+				m_tobj.clear();
+				m_tobj.m_type = UPnPDirObject::item;
+				m_tobj.m_id = m_path.back().attributes["id"];
+				m_tobj.m_pid = m_path.back().attributes["parentID"];
+			}
+			break;
+		default:
+			break;
+		}
+	}
+
+	bool checkobjok() {
+		bool ok =  !m_tobj.m_id.empty() && !m_tobj.m_pid.empty() &&
+			!m_tobj.m_title.empty();
+
+		if (ok && m_tobj.m_type == UPnPDirObject::item) {
+			auto it = m_okitems.find(m_tobj.m_props["upnp:class"]);
+			if (it == m_okitems.end()) {
+				PLOGINF("checkobjok: found object of unknown class: [%s]\n",
+					m_tobj.m_props["upnp:class"].c_str());
+				ok = false;
+			} else {
+				m_tobj.m_iclass = it->second;
+			}
+		}
+
+		if (!ok) {
+			PLOGINF("checkobjok: skip: id [%s] pid [%s] clss [%s] tt [%s]\n",
+				m_tobj.m_id.c_str(), m_tobj.m_pid.c_str(),
+				m_tobj.m_props["upnp:class"].c_str(),
+				m_tobj.m_title.c_str());
+		}
+		return ok;
+	}
+
+	virtual void EndElement(const XML_Char *name)
+	{
+		if (!strcmp(name, "container")) {
+			if (checkobjok()) {
+				m_dir.m_containers.push_back(m_tobj);
+			}
+		} else if (!strcmp(name, "item")) {
+			if (checkobjok()) {
+				m_dir.m_items.push_back(m_tobj);
+			}
+		} else if (!strcmp(name, "res")) {
+			// <res protocolInfo="http-get:*:audio/mpeg:*" size="5171496"
+			// bitrate="24576" duration="00:03:35" sampleFrequency="44100"
+			// nrAudioChannels="2">
+			std::string s;
+			s="protocolInfo";m_tobj.m_props[s] = m_path.back().attributes[s];
+			s="size";m_tobj.m_props[s] = m_path.back().attributes[s];
+			s="bitrate";m_tobj.m_props[s] = m_path.back().attributes[s];
+			s="duration";m_tobj.m_props[s] = m_path.back().attributes[s];
+			s="sampleFrequency";m_tobj.m_props[s] = m_path.back().attributes[s];
+			s="nrAudioChannels";m_tobj.m_props[s] = m_path.back().attributes[s];
+		}
+
+		m_path.pop_back();
+	}
+
+	virtual void CharacterData(const XML_Char *s, int len)
+	{
+		if (s == 0 || *s == 0)
+			return;
+		std::string str(s, len);
+		trimstring(str);
+		switch (m_path.back().name[0]) {
+		case 'd':
+			if (!m_path.back().name.compare("dc:title"))
+				m_tobj.m_title += str;
+			break;
+		case 'r':
+			if (!m_path.back().name.compare("res")) {
+				m_tobj.m_props["url"] += str;
+			}
+			break;
+		case 'u':
+			for (int i = 0; i < nupnptags; i++) {
+				if (!m_path.back().name.compare(upnptags[i])) {
+					m_tobj.m_props[upnptags[i]] += str;
+				}
+			}
+			break;
+		}
+	}
+};
+
+bool
+UPnPDirContent::parse(const std::string &input, Error &error)
+{
+	UPnPDirParser parser(*this);
+	return parser.Parse(input.data(), input.length(), true, error);
+}
diff --git a/src/db/upnp/Directory.hxx b/src/db/upnp/Directory.hxx
new file mode 100644
index 000000000..55dc09c71
--- /dev/null
+++ b/src/db/upnp/Directory.hxx
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef MPD_UPNP_DIRECTORY_HXX
+#define MPD_UPNP_DIRECTORY_HXX
+
+#include "Object.hxx"
+
+#include <string>
+#include <vector>
+
+class Error;
+
+/**
+ * Image of a MediaServer Directory Service container (directory),
+ * possibly containing items and subordinate containers.
+ */
+class UPnPDirContent {
+public:
+	std::vector<UPnPDirObject> m_containers;
+	std::vector<UPnPDirObject> m_items;
+
+	/**
+	 * Parse from DIDL-Lite XML data.
+	 *
+	 * Normally only used by ContentDirectoryService::readDir()
+	 * This is cumulative: in general, the XML data is obtained in
+	 * several documents corresponding to (offset,count) slices of the
+	 * directory (container). parse() can be called repeatedly with
+	 * the successive XML documents and will accumulate entries in the item
+	 * and container vectors. This makes more sense if the different
+	 * chunks are from the same container, but given that UPnP Ids are
+	 * actually global, nothing really bad will happen if you mix
+	 * up...
+	 */
+	bool parse(const std::string &didltext, Error &error);
+};
+
+#endif /* _UPNPDIRCONTENT_H_X_INCLUDED_ */
diff --git a/src/db/upnp/Discovery.cxx b/src/db/upnp/Discovery.cxx
new file mode 100644
index 000000000..4065874a6
--- /dev/null
+++ b/src/db/upnp/Discovery.cxx
@@ -0,0 +1,326 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "Discovery.hxx"
+#include "Device.hxx"
+#include "Domain.hxx"
+#include "ContentDirectoryService.hxx"
+#include "WorkQueue.hxx"
+#include "upnpplib.hxx"
+#include "thread/Mutex.hxx"
+
+#include <upnp/upnp.h>
+#include <upnp/upnptools.h>
+
+#include <string.h>
+
+#include <map>
+
+// The service type string we are looking for.
+static const std::string ContentDirectorySType("urn:schemas-upnp-org:service:ContentDirectory:1");
+
+// We don't include a version in comparisons, as we are satisfied with
+// version 1
+static bool
+isCDService(const std::string &st)
+{
+	const std::string::size_type sz(ContentDirectorySType.size()-2);
+	return !ContentDirectorySType.compare(0, sz, st, 0, sz);
+}
+
+// The type of device we're asking for in search
+static const std::string MediaServerDType("urn:schemas-upnp-org:device:MediaServer:1") ;
+
+static bool
+isMSDevice(const std::string &st)
+{
+	const std::string::size_type sz(MediaServerDType.size()-2);
+	return !MediaServerDType.compare(0, sz, st, 0, sz);
+}
+
+/**
+ * Each appropriate discovery event (executing in a libupnp thread
+ * context) queues the following task object for processing by the
+ * discovery thread.
+ */
+struct DiscoveredTask {
+	bool alive;
+	std::string url;
+	std::string deviceId;
+	int expires; // Seconds valid
+
+	DiscoveredTask(bool _alive, const Upnp_Discovery *disco)
+		: alive(_alive), url(disco->Location),
+		  deviceId(disco->DeviceId),
+		  expires(disco->Expires) {}
+
+};
+static WorkQueue<DiscoveredTask *> discoveredQueue("DiscoveredQueue");
+
+// Descriptor for one device having a Content Directory service found
+// on the network.
+class ContentDirectoryDescriptor {
+public:
+	ContentDirectoryDescriptor(const std::string &url,
+				   const std::string &description,
+				   time_t last, int exp)
+		:device(url, description), last_seen(last), expires(exp+20) {}
+	UPnPDevice device;
+	time_t last_seen;
+	int expires; // seconds valid
+};
+
+// A ContentDirectoryPool holds the characteristics of the servers
+// currently on the network.
+// The map is referenced by deviceId (==UDN)
+// The class is instanciated as a static (unenforced) singleton.
+class ContentDirectoryPool {
+public:
+	Mutex m_mutex;
+	std::map<std::string, ContentDirectoryDescriptor> m_directories;
+};
+
+static ContentDirectoryPool contentDirectories;
+
+// Worker routine for the discovery queue. Get messages about devices
+// appearing and disappearing, and update the directory pool
+// accordingly.
+static void *
+discoExplorer(void *)
+{
+	for (;;) {
+		DiscoveredTask *tsk = 0;
+		size_t qsz;
+		if (!discoveredQueue.take(&tsk, &qsz)) {
+			discoveredQueue.workerExit();
+			return (void*)1;
+		}
+
+		const ScopeLock protect(contentDirectories.m_mutex);
+		if (!tsk->alive) {
+			// Device signals it is going off.
+			auto it = contentDirectories.m_directories.find(tsk->deviceId);
+			if (it != contentDirectories.m_directories.end()) {
+				contentDirectories.m_directories.erase(it);
+			}
+		} else {
+			// Device signals its existence and well-being. Perform the
+			// UPnP "description" phase by downloading and decoding the
+			// description document.
+			char *buf;
+			// LINE_SIZE is defined by libupnp's upnp.h...
+			char contentType[LINE_SIZE];
+			int code = UpnpDownloadUrlItem(tsk->url.c_str(), &buf, contentType);
+			if (code != UPNP_E_SUCCESS) {
+				continue;
+			}
+			std::string sdesc(buf);
+
+			// Update or insert the device
+			ContentDirectoryDescriptor d(tsk->url, sdesc,
+						     time(0), tsk->expires);
+			if (!d.device.ok) {
+				continue;
+			}
+
+			auto e = contentDirectories.m_directories.emplace(tsk->deviceId, d);
+			if (!e.second)
+				e.first->second = d;
+		}
+		delete tsk;
+	}
+}
+
+// This gets called for all libupnp asynchronous events, in a libupnp
+// thread context.
+// Example: ContentDirectories appearing and disappearing from the network
+// We queue a task for our worker thread(s)
+// It seems that this can get called by several threads. We have a
+// mutex just for clarifying the message printing, the workqueue is
+// mt-safe of course.
+static int
+cluCallBack(Upnp_EventType et, void *evp, void *)
+{
+	static Mutex cblock;
+	const ScopeLock protect(cblock);
+
+	switch (et) {
+	case UPNP_DISCOVERY_SEARCH_RESULT:
+	case UPNP_DISCOVERY_ADVERTISEMENT_ALIVE:
+		{
+			Upnp_Discovery *disco = (Upnp_Discovery *)evp;
+			if (isMSDevice(disco->DeviceType) ||
+			    isCDService(disco->ServiceType)) {
+				DiscoveredTask *tp = new DiscoveredTask(1, disco);
+				if (discoveredQueue.put(tp))
+					return UPNP_E_FINISH;
+			}
+			break;
+		}
+
+	case UPNP_DISCOVERY_ADVERTISEMENT_BYEBYE:
+		{
+			Upnp_Discovery *disco = (Upnp_Discovery *)evp;
+
+			if (isMSDevice(disco->DeviceType) ||
+			    isCDService(disco->ServiceType)) {
+				DiscoveredTask *tp = new DiscoveredTask(0, disco);
+				if (discoveredQueue.put(tp))
+					return UPNP_E_FINISH;
+			}
+			break;
+		}
+
+	default:
+		// Ignore other events for now
+		break;
+	}
+
+	return UPNP_E_SUCCESS;
+}
+
+void
+UPnPDeviceDirectory::expireDevices()
+{
+	const ScopeLock protect(contentDirectories.m_mutex);
+	time_t now = time(0);
+	bool didsomething = false;
+
+	for (auto it = contentDirectories.m_directories.begin();
+	     it != contentDirectories.m_directories.end();) {
+		if (now - it->second.last_seen > it->second.expires) {
+			it = contentDirectories.m_directories.erase(it);
+			didsomething = true;
+		} else {
+			it++;
+		}
+	}
+
+	if (didsomething)
+		search();
+}
+
+UPnPDeviceDirectory::UPnPDeviceDirectory()
+	:m_searchTimeout(2), m_lastSearch(0)
+{
+	if (!discoveredQueue.start(1, discoExplorer, 0)) {
+		error.Set(upnp_domain, "Discover work queue start failed");
+		return;
+	}
+
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return;
+
+	lib->registerHandler(UPNP_DISCOVERY_SEARCH_RESULT, cluCallBack, this);
+	lib->registerHandler(UPNP_DISCOVERY_ADVERTISEMENT_ALIVE,
+			     cluCallBack, this);
+	lib->registerHandler(UPNP_DISCOVERY_ADVERTISEMENT_BYEBYE,
+			     cluCallBack, this);
+
+	search();
+}
+
+bool
+UPnPDeviceDirectory::search()
+{
+	time_t now = time(0);
+	if (now - m_lastSearch < 10)
+		return true;
+	m_lastSearch = now;
+
+	LibUPnP *lib = LibUPnP::getLibUPnP(error);
+	if (lib == nullptr)
+		return false;
+
+	// We search both for device and service just in case.
+	int code = UpnpSearchAsync(lib->getclh(), m_searchTimeout,
+				   ContentDirectorySType.c_str(), lib);
+	if (code != UPNP_E_SUCCESS) {
+		error.Format(upnp_domain, code,
+			     "UpnpSearchAsync() failed: %s",
+			     UpnpGetErrorMessage(code));
+		return false;
+	}
+
+	code = UpnpSearchAsync(lib->getclh(), m_searchTimeout,
+			       MediaServerDType.c_str(), lib);
+	if (code != UPNP_E_SUCCESS) {
+		error.Format(upnp_domain, code,
+			     "UpnpSearchAsync() failed: %s",
+			     UpnpGetErrorMessage(code));
+		return false;
+	}
+
+	return true;
+}
+
+UPnPDeviceDirectory *UPnPDeviceDirectory::getTheDir()
+{
+	// TODO: elimate static variable
+	static UPnPDeviceDirectory *theDevDir;
+	if (theDevDir == nullptr)
+		theDevDir = new UPnPDeviceDirectory();
+	if (theDevDir && !theDevDir->ok())
+		return 0;
+	return theDevDir;
+}
+
+bool
+UPnPDeviceDirectory::getDirServices(std::vector<ContentDirectoryService> &out)
+{
+	if (!ok())
+		return false;
+
+	// Has locking, do it before our own lock
+	expireDevices();
+
+	const ScopeLock protect(contentDirectories.m_mutex);
+
+	for (auto dit = contentDirectories.m_directories.begin();
+	     dit != contentDirectories.m_directories.end(); dit++) {
+		for (const auto &service : dit->second.device.services) {
+			if (isCDService(service.serviceType)) {
+				out.emplace_back(dit->second.device, service);
+			}
+		}
+	}
+
+	return true;
+}
+
+bool
+UPnPDeviceDirectory::getServer(const char *friendlyName,
+			       ContentDirectoryService &server)
+{
+	std::vector<ContentDirectoryService> ds;
+	if (!getDirServices(ds)) {
+		return false;
+	}
+
+	for (const auto &i : ds) {
+		if (strcmp(friendlyName, i.getFriendlyName()) == 0) {
+			server = i;
+			return true;
+		}
+	}
+
+	return false;
+}
diff --git a/src/db/upnp/Discovery.hxx b/src/db/upnp/Discovery.hxx
new file mode 100644
index 000000000..899ac83ab
--- /dev/null
+++ b/src/db/upnp/Discovery.hxx
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _UPNPPDISC_H_X_INCLUDED_
+#define _UPNPPDISC_H_X_INCLUDED_
+
+#include "util/Error.hxx"
+
+#include <vector>
+
+#include <time.h>
+
+class ContentDirectoryService;
+
+/**
+ * Manage UPnP discovery and maintain a directory of active devices. Singleton.
+ *
+ * We are only interested in MediaServers with a ContentDirectory service
+ * for now, but this could be made more general, by removing the filtering.
+ */
+class UPnPDeviceDirectory {
+	Error error;
+
+	/**
+	 * The UPnP device search timeout, which should actually be
+	 * called delay because it's the base of a random delay that
+	 * the devices apply to avoid responding all at the same time.
+	 */
+	int m_searchTimeout;
+
+	time_t m_lastSearch;
+
+	UPnPDeviceDirectory();
+public:
+	UPnPDeviceDirectory(const UPnPDeviceDirectory &) = delete;
+	UPnPDeviceDirectory& operator=(const UPnPDeviceDirectory &) = delete;
+
+	/** This class is a singleton. Get the instance here */
+	static UPnPDeviceDirectory *getTheDir();
+
+	/** Retrieve the directory services currently seen on the network */
+	bool getDirServices(std::vector<ContentDirectoryService> &);
+
+	/**
+	 * Get server by friendly name. It's a bit wasteful to copy
+	 * all servers for this, we could directly walk the list. Otoh
+	 * there isn't going to be millions...
+	 */
+	bool getServer(const char *friendlyName,
+		       ContentDirectoryService &server);
+
+	/** My health */
+	bool ok() const {
+		return !error.IsDefined();
+	}
+
+	/** My diagnostic if health is bad */
+	const Error &GetError() const {
+		return error;
+	}
+
+private:
+	bool search();
+
+	/**
+	 * Look at the devices and get rid of those which have not
+	 * been seen for too long. We do this when listing the top
+	 * directory.
+	 */
+	void expireDevices();
+};
+
+
+#endif /* _UPNPPDISC_H_X_INCLUDED_ */
diff --git a/src/db/upnp/Domain.cxx b/src/db/upnp/Domain.cxx
new file mode 100644
index 000000000..12984bd19
--- /dev/null
+++ b/src/db/upnp/Domain.cxx
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2003-2013 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "Domain.hxx"
+#include "util/Domain.hxx"
+
+const Domain upnp_domain("upnp");
diff --git a/src/db/upnp/Domain.hxx b/src/db/upnp/Domain.hxx
new file mode 100644
index 000000000..e249aa5dc
--- /dev/null
+++ b/src/db/upnp/Domain.hxx
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2003-2013 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef MPD_UPNP_DOMAIN_HXX
+#define MPD_UPNP_DOMAIN_HXX
+
+class Domain;
+
+extern const Domain upnp_domain;
+
+#endif
diff --git a/src/db/upnp/Object.hxx b/src/db/upnp/Object.hxx
new file mode 100644
index 000000000..c05f39e47
--- /dev/null
+++ b/src/db/upnp/Object.hxx
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef MPD_UPNP_OBJECT_HXX
+#define MPD_UPNP_OBJECT_HXX
+
+#include <string>
+#include <map>
+
+/**
+ * UpnP Media Server directory entry, converted from XML data.
+ *
+ * This is a dumb data holder class, a struct with helpers.
+ */
+class UPnPDirObject {
+public:
+	enum ObjType {item, container};
+	// There are actually several kinds of containers:
+	// object.container.storageFolder, object.container.person,
+	// object.container.playlistContainer etc., but they all seem to
+	// behave the same as far as we're concerned. Otoh, musicTrack
+	// items are special to us, and so should playlists, but I've not
+	// seen one of the latter yet (servers seem to use containers for
+	// playlists).
+	enum ItemClass {audioItem_musicTrack, audioItem_playlist};
+
+	std::string m_id; // ObjectId
+	std::string m_pid; // Parent ObjectId
+	std::string m_title; // dc:title. Directory name for a container.
+	ObjType m_type; // item or container
+	ItemClass m_iclass;
+	// Properties as gathered from the XML document (url, artist, etc.)
+	// The map keys are the XML tag or attribute names.
+	std::map<std::string, std::string> m_props;
+
+	/** Get named property
+	 * @param property name (e.g. upnp:artist, upnp:album,
+	 *     upnp:originalTrackNumber, upnp:genre). Use m_title instead
+	 *     for dc:title.
+	 * @param[out] value
+	 * @return true if found.
+	 */
+	bool getprop(const std::string &name, std::string &value) const
+	{
+		auto it = m_props.find(name);
+		if (it == m_props.end())
+			return false;
+		value = it->second;
+		return true;
+	}
+
+	void clear()
+	{
+		m_id.clear();
+		m_pid.clear();
+		m_title.clear();
+		m_type = (ObjType)-1;
+		m_iclass = (ItemClass)-1;
+		m_props.clear();
+	}
+};
+
+#endif /* _UPNPDIRCONTENT_H_X_INCLUDED_ */
diff --git a/src/db/upnp/Util.cxx b/src/db/upnp/Util.cxx
new file mode 100644
index 000000000..52d2bc63f
--- /dev/null
+++ b/src/db/upnp/Util.cxx
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "Util.hxx"
+
+#include <string>
+#include <map>
+#include <vector>
+#include <set>
+
+#include <upnp/ixml.h>
+
+/** Get rid of white space at both ends */
+void
+trimstring(std::string &s, const char *ws)
+{
+	auto pos = s.find_first_not_of(ws);
+	if (pos == std::string::npos) {
+		s.clear();
+		return;
+	}
+	s.replace(0, pos, std::string());
+
+	pos = s.find_last_not_of(ws);
+	if (pos != std::string::npos && pos != s.length()-1)
+		s.replace(pos + 1, std::string::npos, std::string());
+}
+
+std::string
+caturl(const std::string &s1, const std::string &s2)
+{
+	std::string out(s1);
+	if (out[out.size()-1] == '/') {
+		if (s2[0] == '/')
+			out.erase(out.size()-1);
+	} else {
+		if (s2[0] != '/')
+			out.push_back('/');
+	}
+	out += s2;
+	return out;
+}
+
+static void
+path_catslash(std::string &s)
+{
+	if (s.empty() || s[s.length() - 1] != '/')
+		s += '/';
+}
+
+std::string
+path_getfather(const std::string &s)
+{
+	std::string father = s;
+
+	// ??
+	if (father.empty())
+		return "./";
+
+	if (father[father.length() - 1] == '/') {
+		// Input ends with /. Strip it, handle special case for root
+		if (father.length() == 1)
+			return father;
+		father.erase(father.length()-1);
+	}
+
+	auto slp = father.rfind('/');
+	if (slp == std::string::npos)
+		return "./";
+
+	father.erase(slp);
+	path_catslash(father);
+	return father;
+}
+
+template <class T>
+bool
+csvToStrings(const std::string &s, T &tokens)
+{
+	std::string current;
+	tokens.clear();
+	enum states {TOKEN, ESCAPE};
+	states state = TOKEN;
+	for (unsigned int i = 0; i < s.length(); i++) {
+		switch (s[i]) {
+		case ',':
+			switch(state) {
+			case TOKEN:
+				tokens.insert(tokens.end(), current);
+				current.clear();
+				continue;
+			case ESCAPE:
+				current += ',';
+				state = TOKEN;
+				continue;
+			}
+			break;
+		case '\\':
+			switch(state) {
+			case TOKEN:
+				state=ESCAPE;
+				continue;
+			case ESCAPE:
+				current += '\\';
+				state = TOKEN;
+				continue;
+			}
+			break;
+
+		default:
+			switch(state) {
+			case ESCAPE:
+				state = TOKEN;
+				break;
+			case TOKEN:
+				break;
+			}
+			current += s[i];
+		}
+	}
+	switch(state) {
+	case TOKEN:
+		tokens.insert(tokens.end(), current);
+		break;
+	case ESCAPE:
+		return false;
+	}
+	return true;
+}
+
+//template bool csvToStrings<list<string> >(const string &, list<string> &);
+template bool csvToStrings<std::vector<std::string> >(const std::string &, std::vector<std::string> &);
+template bool csvToStrings<std::set<std::string> >(const std::string &, std::set<std::string> &);
diff --git a/src/db/upnp/Util.hxx b/src/db/upnp/Util.hxx
new file mode 100644
index 000000000..2fdc3890f
--- /dev/null
+++ b/src/db/upnp/Util.hxx
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef MPD_UPNP_UTIL_HXX
+#define MPD_UPNP_UTIL_HXX
+
+#include <string>
+
+std::string
+caturl(const std::string& s1, const std::string& s2);
+
+void
+trimstring(std::string &s, const char *ws = " \t\n");
+
+std::string
+path_getfather(const std::string &s);
+
+template <class T>
+bool csvToStrings(const std::string& s, T &tokens);
+
+#define UPNPP_DEBUG
+
+#if defined(UPNPP_DEBUG) && defined(DEBUG)
+#include <upnp/upnpdebug.h>
+#define PLOGINF(...) UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__, __VA_ARGS__)
+#else
+#define PLOGINF(...)
+#endif
+
+#endif /* _UPNPP_H_X_INCLUDED_ */
diff --git a/src/db/upnp/WorkQueue.hxx b/src/db/upnp/WorkQueue.hxx
new file mode 100644
index 000000000..851f81837
--- /dev/null
+++ b/src/db/upnp/WorkQueue.hxx
@@ -0,0 +1,327 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _WORKQUEUE_H_INCLUDED_
+#define _WORKQUEUE_H_INCLUDED_
+
+#include "thread/Mutex.hxx"
+#include "thread/Cond.hxx"
+
+#include <pthread.h>
+#include <time.h>
+
+#include <string>
+#include <queue>
+#include <unordered_map>
+
+//#include "debuglog.h"
+#define LOGINFO(X)
+#define LOGERR(X)
+
+/**
+ * A WorkQueue manages the synchronisation around a queue of work items,
+ * where a number of client threads queue tasks and a number of worker
+ * threads take and execute them. The goal is to introduce some level
+ * of parallelism between the successive steps of a previously single
+ * threaded pipeline. For example data extraction / data preparation / index
+ * update, but this could have other uses.
+ *
+ * There is no individual task status return. In case of fatal error,
+ * the client or worker sets an end condition on the queue. A second
+ * queue could conceivably be used for returning individual task
+ * status.
+ */
+template <class T>
+class WorkQueue {
+	/**
+	 * Store per-worker-thread data. Just an initialized timespec,
+	 * and used at the moment.
+	 */
+	class WQTData {
+	public:
+		WQTData() {wstart.tv_sec = 0; wstart.tv_nsec = 0;}
+		struct timespec wstart;
+	};
+
+	// Configuration
+	std::string m_name;
+	size_t m_high;
+	size_t m_low;
+
+	// Status
+	// Worker threads having called exit
+	unsigned int m_workers_exited;
+	bool m_ok;
+
+	// Per-thread data. The data is not used currently, this could be
+	// a set<pthread_t>
+	std::unordered_map<pthread_t, WQTData> m_worker_threads;
+
+	// Synchronization
+	std::queue<T> m_queue;
+	Cond m_ccond;
+	Cond m_wcond;
+	Mutex m_mutex;
+	// Client/Worker threads currently waiting for a job
+	unsigned int m_clients_waiting;
+	unsigned int m_workers_waiting;
+
+	// Statistics
+	unsigned int m_tottasks;
+	unsigned int m_nowake;
+	unsigned int m_workersleeps;
+	unsigned int m_clientsleeps;
+
+public:
+	/** Create a WorkQueue
+	 * @param name for message printing
+	 * @param hi number of tasks on queue before clients blocks. Default 0
+	 *    meaning no limit. hi == -1 means that the queue is disabled.
+	 * @param lo minimum count of tasks before worker starts. Default 1.
+	 */
+	WorkQueue(const char *name, size_t hi = 0, size_t lo = 1)
+		:m_name(name), m_high(hi), m_low(lo),
+		 m_workers_exited(0),
+		 m_ok(true),
+		 m_clients_waiting(0), m_workers_waiting(0),
+		 m_tottasks(0), m_nowake(0), m_workersleeps(0), m_clientsleeps(0)
+	{
+	}
+
+	~WorkQueue() {
+		setTerminateAndWait();
+	}
+
+	/** Start the worker threads.
+	 *
+	 * @param nworkers number of threads copies to start.
+	 * @param start_routine thread function. It should loop
+	 *      taking (QueueWorker::take()) and executing tasks.
+	 * @param arg initial parameter to thread function.
+	 * @return true if ok.
+	 */
+	bool start(int nworkers, void *(*workproc)(void *), void *arg)
+	{
+		const ScopeLock protect(m_mutex);
+
+		for  (int i = 0; i < nworkers; i++) {
+			int err;
+			pthread_t thr;
+			if ((err = pthread_create(&thr, 0, workproc, arg))) {
+				LOGERR(("WorkQueue:%s: pthread_create failed, err %d\n",
+					m_name.c_str(), err));
+				return false;
+			}
+			m_worker_threads.insert(std::make_pair(thr, WQTData()));
+		}
+		return true;
+	}
+
+	/** Add item to work queue, called from client.
+	 *
+	 * Sleeps if there are already too many.
+	 */
+	bool put(T t)
+	{
+		const ScopeLock protect(m_mutex);
+
+		if (!ok()) {
+			LOGERR(("WorkQueue::put:%s: !ok or mutex_lock failed\n",
+				m_name.c_str()));
+			return false;
+		}
+
+		while (ok() && m_high > 0 && m_queue.size() >= m_high) {
+			m_clientsleeps++;
+			// Keep the order: we test ok() AFTER the sleep...
+			m_clients_waiting++;
+			m_ccond.wait(m_mutex);
+			if (!ok()) {
+				m_clients_waiting--;
+				return false;
+			}
+			m_clients_waiting--;
+		}
+
+		m_queue.push(t);
+		if (m_workers_waiting > 0) {
+			// Just wake one worker, there is only one new task.
+			m_wcond.signal();
+		} else {
+			m_nowake++;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Wait until the queue is inactive. Called from client.
+	 *
+	 * Waits until the task queue is empty and the workers are all
+	 * back sleeping. Used by the client to wait for all current work
+	 * to be completed, when it needs to perform work that couldn't be
+	 * done in parallel with the worker's tasks, or before shutting
+	 * down. Work can be resumed after calling this. Note that the
+	 * only thread which can call it safely is the client just above
+	 * (which can control the task flow), else there could be
+	 * tasks in the intermediate queues.
+	 * To rephrase: there is no warranty on return that the queue is actually
+	 * idle EXCEPT if the caller knows that no jobs are still being created.
+	 * It would be possible to transform this into a safe call if some kind
+	 * of suspend condition was set on the queue by waitIdle(), to be reset by
+	 * some kind of "resume" call. Not currently the case.
+	 */
+	bool waitIdle()
+	{
+		const ScopeLock protect(m_mutex);
+
+		if (!ok()) {
+			LOGERR(("WorkQueue::waitIdle:%s: not ok or can't lock\n",
+				m_name.c_str()));
+			return false;
+		}
+
+		// We're done when the queue is empty AND all workers are back
+		// waiting for a task.
+		while (ok() && (m_queue.size() > 0 ||
+				m_workers_waiting != m_worker_threads.size())) {
+			m_clients_waiting++;
+			m_ccond.wait(m_mutex);
+			m_clients_waiting--;
+		}
+
+		return ok();
+	}
+
+
+	/** Tell the workers to exit, and wait for them.
+	 *
+	 * Does not bother about tasks possibly remaining on the queue, so
+	 * should be called after waitIdle() for an orderly shutdown.
+	 */
+	void setTerminateAndWait()
+	{
+		const ScopeLock protect(m_mutex);
+
+		if (m_worker_threads.empty())
+			// Already called ?
+			return;
+
+		// Wait for all worker threads to have called workerExit()
+		m_ok = false;
+		while (m_workers_exited < m_worker_threads.size()) {
+			m_wcond.broadcast();
+			m_clients_waiting++;
+			m_ccond.wait(m_mutex);
+			m_clients_waiting--;
+		}
+
+		// Perform the thread joins and compute overall status
+		// Workers return (void*)1 if ok
+		while (!m_worker_threads.empty()) {
+			void *status;
+			auto it = m_worker_threads.begin();
+			pthread_join(it->first, &status);
+			m_worker_threads.erase(it);
+		}
+
+		// Reset to start state.
+		m_workers_exited = m_clients_waiting = m_workers_waiting =
+			m_tottasks = m_nowake = m_workersleeps = m_clientsleeps = 0;
+		m_ok = true;
+	}
+
+	/** Take task from queue. Called from worker.
+	 *
+	 * Sleeps if there are not enough. Signal if we go to sleep on empty
+	 * queue: client may be waiting for our going idle.
+	 */
+	bool take(T* tp, size_t *szp = 0)
+	{
+		const ScopeLock protect(m_mutex);
+
+		if (!ok()) {
+			return false;
+		}
+
+		while (ok() && m_queue.size() < m_low) {
+			m_workersleeps++;
+			m_workers_waiting++;
+			if (m_queue.empty())
+				m_ccond.broadcast();
+			m_wcond.wait(m_mutex);
+			if (!ok()) {
+				// !ok is a normal condition when shutting down
+				if (ok()) {
+					LOGERR(("WorkQueue::take:%s: cond_wait failed or !ok\n",
+						m_name.c_str()));
+				}
+				m_workers_waiting--;
+				return false;
+			}
+			m_workers_waiting--;
+		}
+
+		m_tottasks++;
+		*tp = m_queue.front();
+		if (szp)
+			*szp = m_queue.size();
+		m_queue.pop();
+		if (m_clients_waiting > 0) {
+			// No reason to wake up more than one client thread
+			m_ccond.signal();
+		} else {
+			m_nowake++;
+		}
+		return true;
+	}
+
+	/** Advertise exit and abort queue. Called from worker
+	 *
+	 * This would happen after an unrecoverable error, or when
+	 * the queue is terminated by the client. Workers never exit normally,
+	 * except when the queue is shut down (at which point m_ok is set to
+	 * false by the shutdown code anyway). The thread must return/exit
+	 * immediately after calling this.
+	 */
+	void workerExit()
+	{
+		const ScopeLock protect(m_mutex);
+
+		m_workers_exited++;
+		m_ok = false;
+		m_ccond.broadcast();
+	}
+
+	size_t qsize()
+	{
+		const ScopeLock protect(m_mutex);
+
+		size_t sz = m_queue.size();
+		return sz;
+	}
+
+private:
+	bool ok()
+	{
+		return m_ok && m_workers_exited == 0 && !m_worker_threads.empty();
+	}
+};
+
+#endif /* _WORKQUEUE_H_INCLUDED_ */
diff --git a/src/db/upnp/ixmlwrap.cxx b/src/db/upnp/ixmlwrap.cxx
new file mode 100644
index 000000000..247c36d5d
--- /dev/null
+++ b/src/db/upnp/ixmlwrap.cxx
@@ -0,0 +1,44 @@
+/* Copyright (C) 2013 J.F.Dockes
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the
+ *   Free Software Foundation, Inc.,
+ *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "ixmlwrap.hxx"
+
+namespace ixmlwrap {
+
+std::string
+getFirstElementValue(IXML_Document *doc, const char *name)
+{
+	std::string ret;
+	IXML_NodeList *nodes =
+		ixmlDocument_getElementsByTagName(doc, name);
+
+	if (nodes) {
+		IXML_Node *first = ixmlNodeList_item(nodes, 0);
+		if (first) {
+			IXML_Node *dnode = ixmlNode_getFirstChild(first);
+			if (dnode) {
+				ret = ixmlNode_getNodeValue(dnode);
+			}
+		}
+	}
+
+	if(nodes)
+		ixmlNodeList_free(nodes);
+	return ret;
+}
+
+}
diff --git a/src/db/upnp/ixmlwrap.hxx b/src/db/upnp/ixmlwrap.hxx
new file mode 100644
index 000000000..8677d691a
--- /dev/null
+++ b/src/db/upnp/ixmlwrap.hxx
@@ -0,0 +1,35 @@
+/* Copyright (C) 2013 J.F.Dockes
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the
+ *   Free Software Foundation, Inc.,
+ *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+#ifndef _IXMLWRAP_H_INCLUDED_
+#define _IXMLWRAP_H_INCLUDED_
+
+#include <upnp/ixml.h>
+
+#include <string>
+
+namespace ixmlwrap {
+	/**
+	 * Retrieve the text content for the first element of given
+	 * name.  Returns an empty string if the element does not
+	 * contain a text node
+	 */
+	std::string getFirstElementValue(IXML_Document *doc,
+					 const char *name);
+
+};
+
+#endif /* _IXMLWRAP_H_INCLUDED_ */
diff --git a/src/db/upnp/upnpplib.cxx b/src/db/upnp/upnpplib.cxx
new file mode 100644
index 000000000..27dd9557a
--- /dev/null
+++ b/src/db/upnp/upnpplib.cxx
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+#include "upnpplib.hxx"
+#include "Domain.hxx"
+#include "Util.hxx"
+#include "Log.hxx"
+
+#include <string>
+#include <sstream>
+#include <map>
+#include <vector>
+#include <set>
+
+#include <upnp/ixml.h>
+#include <upnp/upnpdebug.h>
+
+static LibUPnP *theLib;
+
+LibUPnP *
+LibUPnP::getLibUPnP(Error &error)
+{
+	if (theLib == nullptr)
+		theLib = new LibUPnP;
+
+	if (!theLib->ok()) {
+		error.Set(theLib->GetInitError());
+		return nullptr;
+	}
+
+	return theLib;
+}
+
+LibUPnP::LibUPnP()
+{
+	auto code = UpnpInit(0, 0);
+	if (code != UPNP_E_SUCCESS) {
+		init_error.Format(upnp_domain, code,
+				  "UpnpInit() failed: %s",
+				  UpnpGetErrorMessage(code));
+		return;
+	}
+
+	setMaxContentLength(2000*1024);
+#ifdef DEBUG
+	UpnpCloseLog();
+#endif
+
+	code = UpnpRegisterClient(o_callback, (void *)this, &m_clh);
+	if (code != UPNP_E_SUCCESS) {
+		init_error.Format(upnp_domain, code,
+				  "UpnpRegisterClient() failed: %s",
+				  UpnpGetErrorMessage(code));
+		return;
+	}
+
+	// Servers sometimes make error (e.g.: minidlna returns bad utf-8)
+	ixmlRelaxParser(1);
+}
+
+void LibUPnP::setMaxContentLength(int bytes)
+{
+	UpnpSetMaxContentLength(bytes);
+}
+
+bool LibUPnP::setLogFileName(const std::string& fn)
+{
+	const ScopeLock protect(m_mutex);
+
+	if (fn.empty()) {
+		UpnpCloseLog();
+	} else {
+		UpnpSetLogLevel(UPNP_INFO);
+		UpnpSetLogFileNames(fn.c_str(), fn.c_str());
+		int code = UpnpInitLog();
+		if (code != UPNP_E_SUCCESS) {
+			FormatError(upnp_domain, "UpnpInitLog() failed: %s",
+				    UpnpGetErrorMessage(code));
+			return false;
+		}
+	}
+
+	return true;
+}
+
+void
+LibUPnP::registerHandler(Upnp_EventType et, Upnp_FunPtr handler, void *cookie)
+{
+	const ScopeLock protect(m_mutex);
+
+	if (handler == nullptr)
+		m_handlers.erase(et);
+	else
+		m_handlers.emplace(et, Handler(handler, cookie));
+}
+
+std::string
+LibUPnP::errAsString(const std::string& who, int code)
+{
+	std::ostringstream os;
+	os << who << " :" << code << ": " << UpnpGetErrorMessage(code);
+	return os.str();
+}
+
+int
+LibUPnP::o_callback(Upnp_EventType et, void* evp, void* cookie)
+{
+	LibUPnP *ulib = (LibUPnP *)cookie;
+	if (ulib == nullptr) {
+		// Because the asyncsearch calls uses a null cookie.
+		ulib = theLib;
+	}
+
+	auto it = ulib->m_handlers.find(et);
+	if (it != ulib->m_handlers.end()) {
+		(it->second.handler)(et, evp, it->second.cookie);
+	}
+	return UPNP_E_SUCCESS;
+}
+
+LibUPnP::~LibUPnP()
+{
+	int error = UpnpFinish();
+	if (error != UPNP_E_SUCCESS)
+		FormatError(upnp_domain, "UpnpFinish() failed: %s",
+			    UpnpGetErrorMessage(error));
+}
diff --git a/src/db/upnp/upnpplib.hxx b/src/db/upnp/upnpplib.hxx
new file mode 100644
index 000000000..fa3454072
--- /dev/null
+++ b/src/db/upnp/upnpplib.hxx
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2003-2014 The Music Player Daemon Project
+ * http://www.musicpd.org
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _LIBUPNP_H_X_INCLUDED_
+#define _LIBUPNP_H_X_INCLUDED_
+
+#include "thread/Mutex.hxx"
+#include "util/Error.hxx"
+
+#include <string>
+#include <map>
+
+#include <upnp/upnp.h>
+#include <upnp/upnptools.h>
+
+/** Our link to libupnp. Initialize and keep the handle around */
+class LibUPnP {
+	// A Handler object records the data from registerHandler.
+	class Handler {
+	public:
+		Handler(Upnp_FunPtr h, void *c)
+			: handler(h), cookie(c) {}
+		Upnp_FunPtr handler;
+		void *cookie;
+	};
+
+	Error init_error;
+	UpnpClient_Handle m_clh;
+	Mutex m_mutex;
+	std::map<Upnp_EventType, Handler> m_handlers;
+
+	LibUPnP();
+
+	LibUPnP(const LibUPnP &) = delete;
+	LibUPnP &operator=(const LibUPnP &) = delete;
+
+	static int o_callback(Upnp_EventType, void *, void *);
+
+public:
+	~LibUPnP();
+
+	/** Retrieve the singleton LibUPnP object */
+	static LibUPnP *getLibUPnP(Error &error);
+
+	/** Set log file name and activate logging.
+	 *
+	 * @param fn file name to use. Use empty string to turn logging off
+	 */
+	bool setLogFileName(const std::string& fn);
+
+	/** Set max library buffer size for reading content from servers.
+	 * The default is 200k and should be ok */
+	void setMaxContentLength(int bytes);
+
+	/** Check state after initialization */
+	bool ok() const
+	{
+		return !init_error.IsDefined();
+	}
+
+	/** Retrieve init error if state not ok */
+	const Error &GetInitError() const {
+		return init_error;
+	}
+
+	void registerHandler(Upnp_EventType et, Upnp_FunPtr handler, void *cookie);
+
+	UpnpClient_Handle getclh()
+	{
+		return m_clh;
+	}
+
+	/** Translate integer error code (UPNP_E_XXX) to string */
+	static std::string errAsString(const std::string& who, int code);
+};
+
+#endif /* _LIBUPNP.H_X_INCLUDED_ */
diff --git a/test/DumpDatabase.cxx b/test/DumpDatabase.cxx
index 6e9259238..52f7fbd02 100644
--- a/test/DumpDatabase.cxx
+++ b/test/DumpDatabase.cxx
@@ -39,6 +39,15 @@ using std::endl;
 
 #include <stdlib.h>
 
+#ifdef HAVE_LIBUPNP
+#include "InputStream.hxx"
+size_t
+InputStream::LockRead(void *, size_t, Error &)
+{
+	return 0;
+}
+#endif
+
 static bool
 DumpDirectory(const Directory &directory, Error &)
 {