Merge pull request #44 from orbisai0security/fix-v001-path-traversal-wrq

fix: add path validation in tqftpserv.c

Makefile

@@ -1,25 +0,0 @@
-TQFTPSERV := tqftpserv
-
-CFLAGS += -Wall -g -O2
-LDFLAGS += -lqrtr
-prefix ?= /usr/local
-
-bindir := $(prefix)/bin
-servicedir := $(prefix)/lib/systemd/system
-
-SRCS := tqftpserv.c translate.c
-
-OBJS := $(SRCS:.c=.o)
-
-$(TQFTPSERV): $(OBJS)
-	$(CC) -o $@ $^ $(LDFLAGS)
-
-tqftpserv.service: tqftpserv.service.in
-	@sed 's+TQFTPSERV_PATH+$(bindir)+g' $< > $@
-
-install: $(TQFTPSERV) tqftpserv.service
-	@install -D -m 755 $(TQFTPSERV) $(DESTDIR)$(bindir)/$(TQFTPSERV)
-	@install -D -m 644 tqftpserv.service $(DESTDIR)$(servicedir)/tqftpserv.service
-
-clean:
-	rm -f $(TQFTPSERV) $(OBJS) tqftpserv.service

README.md

@@ -0,0 +1,53 @@
+# tqftpserv
+
+The tqftpserv software is an implementation of a TFTP (Trivial File Transfer Protocol) server which runs on top of the AF_QIPCRTR (a.k.a QRTR) socket type.
+
+The main purpose of tqftpserv is to serve files from the Linux file system to other processors on the Qualcomm SoCs as requested.
+
+The protocol implemented here is (loosely) based on RFC 1350 including some extensions to the protocol.
+
+In basic terms, the protocol supports RRQ (Read Request) and WRQ (Write Request) messages which read and write files respectively. A request can have some extra options, like `blksize` ior `wsize`. The meaning of those is documented in the `parse_options` function.
+
+For reference, the proprietary implementation of this that is used on practically all Qualcomm-based Android devices is called "tftp_server".
+
+## File paths
+
+There's two different virtual paths prefixes that are supported:
+* `/readonly/firmware/image/` for read-only files such as firmware files
+* `/readwrite/` for read-write (temporary) files
+
+Requests to those paths are "translated" (see `translate.c`) to paths in the Linux filesystem. In a regular setup readonly requests go to `/lib/firmware/` and readwrite requests go to `/tmp/tqftpserv/`.
+
+Translating those readonly request paths tries to take into account custom Linux firmware paths, custom "firmware-name" paths for remoteprocs, .zstd compressed firmware and more. In case of doubt, please consult the source code.
+
+For example on a QCM6490 Fairphone 5 smartphone the path for `/readonly/firmware/image/modem_pr/so/901_0_0.mbn` will be translated to `/lib/firmware/qcom/qcm6490/fairphone5/modem_pr/so/901_0_0.mbn`, based on the devicetree property `firmware-name = "qcom/qcm6490/fairphone5/modem.mbn";` in the modem/mpss DT node.
+
+The actual paths that are used and requested are dependent on the TFTP clients, which is usually the firmware that is running on the Hexagon-based modem processor on the SoC.
+
+## Example requests
+
+The following are some example requests which are grabbed from the tqftpserv log during modem bootup.
+
+* Write content to a file called "server_check.txt":
+```
+[TQFTP] WRQ: /readwrite/server_check.txt (octet)
+```
+
+* Read a file called "ota_firewall/ruleset" which does not exist:
+```
+[TQFTP] RRQ: /readwrite/ota_firewall/ruleset (mode=octet rsize=0 seek=0)
+tqftpserv: failed to open ota_firewall/ruleset: No such file or directory
+[TQFTP] unable to open /readwrite/ota_firewall/ruleset (2), reject
+```
+
+* Stat a file with the path "modem_pr/so/901_0_0.mbn", and then read it:
+```
+[TQFTP] RRQ: /readonly/firmware/image/modem_pr/so/901_0_0.mbn (mode=octet rsize=0 seek=0)
+[TQFTP] Remote returned END OF TRANSFER: 9 - End of Transfer
+[TQFTP] RRQ: /readonly/firmware/image/modem_pr/so/901_0_0.mbn (mode=octet rsize=52 seek=0)
+```
+
+In binary such a request can look like the following:
+```
+\0\1/readonly/firmware/image/modem_pr/so/901_0_0.mbn\0octet\0blksize\0007680\0timeoutms\0001000\0tsize\0000\0wsize\00010\0
+```

meson.build

@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: BSD-3-Clause
+
+project('tqftpserv',
+        'c',
+        version: '1.1.1',
+        default_options: [
+            'warning_level=1',
+            'buildtype=release',
+        ])
+
+prefix = get_option('prefix')
+
+zstd_dep = dependency('libzstd')
+add_project_arguments('-DHAVE_ZSTD', language : 'c')
+
+# Not required to build the executable,
+# only to automatically retrieve the install dir for unit files
+systemd = dependency('systemd', required : false)
+if get_option('systemd-unit-prefix') != ''
+  systemd_system_unit_dir = get_option('systemd-unit-prefix')
+elif systemd.found()
+  systemd_system_unit_dir = systemd.get_variable(
+    pkgconfig : 'systemdsystemunitdir',
+    pkgconfig_define: ['prefix', prefix])
+endif
+
+qrtr_dep = dependency('qrtr')
+
+tqftpserv_srcs = ['translate.c',
+                  'tqftpserv.c',
+                  'zstd-decompress.c']
+executable('tqftpserv',
+           tqftpserv_srcs,
+           dependencies : [qrtr_dep, zstd_dep],
+           install : true)
+
+if systemd_system_unit_dir != ''
+        systemd_unit_conf = configuration_data()
+        systemd_unit_conf.set('prefix', prefix)
+        configure_file(
+                input : 'tqftpserv.service.in',
+                output : 'tqftpserv.service',
+                configuration : systemd_unit_conf,
+                install_dir : systemd_system_unit_dir)
+endif

meson_options.txt

@@ -0,0 +1,4 @@
+option('systemd-unit-prefix',
+  type: 'string',
+  description: 'Directory for systemd system unit files'
+)

tqftpserv.service.in

@@ -1,12 +1,10 @@
 [Unit]
 Description=QRTR TFTP service
-Requires=qrtr-ns.service
-After=qrtr-ns.service
 
 [Service]
-ExecStart=TQFTPSERV_PATH/tqftpserv
+ExecStart=@prefix@/bin/tqftpserv
 Restart=always
+StateDirectory=tqftpserv
 
 [Install]
 WantedBy=multi-user.target
-

translate.c

@@ -16,18 +16,26 @@
 #include <unistd.h>
 
 #include "translate.h"
+#include "zstd-decompress.h"
 
 #define READONLY_PATH	"/readonly/firmware/image/"
 #define READWRITE_PATH	"/readwrite/"
+#define UPDATES_DIR	"updates/"
+#define READONLY_FW_BASE	"/readonly/firmware/"
+#define READONLY_MODEM_PATH	READONLY_FW_BASE "modem_pr"
+#define READONLY_VENDOR_PATH		"/readonly/vendor/firmware/"
+#define READONLY_VENDOR_MNT_PATH	"/readonly/vendor/firmware_mnt/image/"
 
 #ifndef ANDROID
 #define FIRMWARE_BASE	"/lib/firmware/"
-#define TQFTPSERV_TMP	"/tmp/tqftpserv"
+#define TQFTPSERV_RW_DIR	"/var/lib/tqftpserv"
 #else
 #define FIRMWARE_BASE	"/vendor/firmware/"
-#define TQFTPSERV_TMP	"/data/vendor/tmp/tqftpserv"
+#define TQFTPSERV_RW_DIR	"/data/vendor/tmp/tqftpserv"
 #endif
 
+static int open_maybe_compressed(const char *path);
+
 static void read_fw_path_from_sysfs(char *outbuffer, size_t bufsize)
 {
 	size_t pathsize;
@@ -118,7 +126,7 @@ static int translate_readonly(const char *file)
 			strcat(path, "/");
 			strcat(path, file);
 
-			fd = open(path, O_RDONLY);
+			fd = open_maybe_compressed(path);
 			if (fd >= 0)
 				break;
 			if (errno != ENOENT)
@@ -126,16 +134,25 @@ static int translate_readonly(const char *file)
 		}
 
 		/* now try with base path */
-		if (strlen(FIRMWARE_BASE) + strlen(firmware_value) + 1 +
+		if (strlen(FIRMWARE_BASE) + strlen(UPDATES_DIR) + strlen(firmware_value) + 1 +
 		    strlen(file) + 1 > sizeof(path))
 			continue;
 
 		strcpy(path, FIRMWARE_BASE);
+		strcat(path, UPDATES_DIR);
 		strcat(path, firmware_path);
 		strcat(path, "/");
 		strcat(path, file);
 
-		fd = open(path, O_RDONLY);
+		fd = open_maybe_compressed(path);
+		if (fd < 0) {
+			strcpy(path, FIRMWARE_BASE);
+			strcat(path, firmware_path);
+			strcat(path, "/");
+			strcat(path, file);
+
+			fd = open_maybe_compressed(path);
+		}
 		if (fd >= 0)
 			break;
 
@@ -150,7 +167,7 @@ static int translate_readonly(const char *file)
 }
 
 /**
- * translate_readwrite() - open "file" from a temporary directory
+ * translate_readwrite() - open "file" from the persistent readwrite directory
  * @file:	relative path of the requested file, with /readwrite/ stripped
  * @flags:	flags to be passed to open(2)
  *
@@ -162,15 +179,22 @@ static int translate_readwrite(const char *file, int flags)
 	int ret;
 	int fd;
 
-	ret = mkdir(TQFTPSERV_TMP, 0700);
-	if (ret < 0 && errno != EEXIST) {
-		warn("failed to create temporary tqftpserv directory");
+	/* Reject directory traversal attempts */
+	if (strstr(file, "..")) {
+		warn("path traversal attempt rejected: %s", file);
+		errno = EACCES;
 		return -1;
 	}
 
-	base = open(TQFTPSERV_TMP, O_RDONLY | O_DIRECTORY);
+	ret = mkdir(TQFTPSERV_RW_DIR, 0700);
+	if (ret < 0 && errno != EEXIST) {
+		warn("failed to create tqftpserv readwrite directory");
+		return -1;
+	}
+
+	base = open(TQFTPSERV_RW_DIR, O_RDONLY | O_DIRECTORY);
 	if (base < 0) {
-		warn("failed top open temporary tqftpserv directory");
+		warn("failed to open tqftpserv readwrite directory");
 		return -1;
 	}
 
@@ -185,19 +209,57 @@ static int translate_readwrite(const char *file, int flags)
 /**
  * translate_open() - open file after translating path
  *
-
- * Strips /readonly/firmware/image and search among remoteproc firmware.
- * Replaces /readwrite with a temporary directory.
-
+ * Strips /readonly/firmware/image/ and searches among remoteproc firmware.
+ * Strips /readonly/firmware/modem_pr and searches among remoteproc firmware
+ * using the modem_pr relative path (e.g., maps to READONLY_FW_BASE/<fw_dir>/modem_pr/...).
+ * Strips /readonly/vendor/firmware/ and /readonly/vendor/firmware_mnt/image/
+ * and searches among remoteproc firmware.
+ * Replaces /readwrite/ with a persistent directory.
  */
 int translate_open(const char *path, int flags)
 {
 	if (!strncmp(path, READONLY_PATH, strlen(READONLY_PATH)))
 		return translate_readonly(path + strlen(READONLY_PATH));
+	else if (!strncmp(path, READONLY_MODEM_PATH, strlen(READONLY_MODEM_PATH)))
+		return translate_readonly(path + strlen(READONLY_FW_BASE));
 	else if (!strncmp(path, READWRITE_PATH, strlen(READWRITE_PATH)))
 		return translate_readwrite(path + strlen(READWRITE_PATH), flags);
+	else if (!strncmp(path, READONLY_VENDOR_MNT_PATH, strlen(READONLY_VENDOR_MNT_PATH)))
+		return translate_readonly(path + strlen(READONLY_VENDOR_MNT_PATH));
+	else if (!strncmp(path, READONLY_VENDOR_PATH, strlen(READONLY_VENDOR_PATH)))
+		return translate_readonly(path + strlen(READONLY_VENDOR_PATH));
 
 	fprintf(stderr, "invalid path %s, rejecting\n", path);
 	errno = ENOENT;
 	return -1;
 }
+
+/* linux-firmware uses .zst as file extension */
+#define ZSTD_EXTENSION ".zst"
+
+/**
+ * open_maybe_compressed() - open a file and maybe decompress it if necessary
+ * @filename:	path to a file that may be compressed (should not include compression format extension)
+ *
+ * Return: opened fd on success, -1 on error
+ */
+static int open_maybe_compressed(const char *path)
+{
+	char *path_with_zstd_extension = NULL;
+	int fd = -1;
+	int ret;
+
+	if (access(path, F_OK) == 0)
+		return open(path, O_RDONLY);
+
+	ret = asprintf(&path_with_zstd_extension, "%s%s", path, ZSTD_EXTENSION);
+	if (ret < 0)
+		return ret;
+
+	if (access(path_with_zstd_extension, F_OK) == 0)
+		fd = zstd_decompress_file(path_with_zstd_extension);
+
+	free(path_with_zstd_extension);
+
+	return fd;
+}

zstd-decompress.c

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Stefan Hansson
+ * Copyright (c) 2024, Emil Velikov
+ */
+
+/* For memfd_create */
+#define _GNU_SOURCE
+
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <zstd.h>
+
+#include "zstd-decompress.h"
+
+/**
+ * zstd_decompress_file() - decompress a zstd-compressed file
+ * @filename:	path to a file to decompress
+ *
+ * Return: opened fd on success, -1 on error
+ */
+int zstd_decompress_file(const char *filename)
+{
+	/* Figure out the size of the file. */
+	struct stat file_stat;
+	if (stat(filename, &file_stat) == -1) {
+		fprintf(stderr, "stat %s failed (%s)\n", filename, strerror(errno));
+		return -1;
+	}
+
+	const size_t file_size = file_stat.st_size;
+
+	const int input_file_fd = open(filename, O_RDONLY);
+	if (input_file_fd == -1) {
+		perror("open failed");
+		return -1;
+	}
+
+	void* const compressed_buffer = mmap(NULL, file_size, PROT_READ, MAP_POPULATE | MAP_PRIVATE, input_file_fd, 0);
+	if (compressed_buffer == MAP_FAILED) {
+		perror("mmap failed");
+		close(input_file_fd);
+		return -1;
+	}
+	close(input_file_fd);
+
+	const unsigned long long decompressed_size = ZSTD_getFrameContentSize(compressed_buffer, file_size);
+	if (decompressed_size == ZSTD_CONTENTSIZE_UNKNOWN) {
+		fprintf(stderr, "Content size could not be determined for %s\n", filename);
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+	if (decompressed_size == ZSTD_CONTENTSIZE_ERROR) {
+		fprintf(stderr, "Error getting content size for %s\n", filename);
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+
+	void* const decompressed_buffer = malloc((size_t)decompressed_size);
+	if (decompressed_buffer == NULL) {
+		perror("malloc failed");
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+
+	const size_t return_size = ZSTD_decompress(decompressed_buffer, decompressed_size, compressed_buffer, file_size);
+	if (ZSTD_isError(return_size)) {
+		fprintf(stderr, "ZSTD_decompress failed: %s\n", ZSTD_getErrorName(return_size));
+		free(decompressed_buffer);
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+
+	const int output_file_fd = memfd_create(filename, 0);
+	if (output_file_fd == -1) {
+		perror("memfd_create failed");
+		free(decompressed_buffer);
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+
+	if (write(output_file_fd, decompressed_buffer, decompressed_size) != decompressed_size) {
+		perror("write failed");
+		close(output_file_fd);
+		free(decompressed_buffer);
+		munmap(compressed_buffer, file_size);
+		return -1;
+	}
+
+	return output_file_fd;
+}

zstd-decompress.h

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) 2024, Stefan Hansson
+ */
+
+#ifndef __ZSTD_DECOMPRESS_H__
+#define __ZSTD_DECOMPRESS_H__
+
+#include <stdbool.h>
+
+#ifdef HAVE_ZSTD
+int zstd_decompress_file(const char *filename);
+#else
+static int zstd_decompress_file(const char *filename)
+{
+	fprintf(stderr, "Built without ZSTD support\n");
+	return -1;
+}
+#endif
+
+#endif