Re: [PATCH] tftpd: strip leading slashes from the requested file name

This doesn’t seem right. It turns every absolute path name into a relative
one.

Guillermo Rodriguez Garcia
[email protected]

El El lun, 17 ago 2026 a las 2:02, Ali Ahmet Memis via busybox <
[email protected]> escribió:

> tftpd confines clients to the served directory by chroot'ing into the
> DIR argument, added in 4e3beb2e1 to fix bug 4874. The requested name
> itself is never checked for a leading slash, so the confinement depends
> entirely on that chroot being in place.
>
> DIR is optional. Without it there is no chroot and no chdir either, so
> an absolute request is resolved from the real root. Serving files
> relative to the current directory otherwise works fine in this mode,
> which makes the escape easy to miss:
>
>   $ cd /srv/tftp && tftpd          # inetd/udpsvd service
>   $ tftp -g -r /etc/shadow HOST    # served
>
> Uploads use the same name, and uploads are enabled unless -r is given.
> A client can therefore overwrite any existing file the daemon can write
> to, and with -c create new ones. tftpd usually runs as root, so this
> reaches files such as a root-owned script or a crontab.
>
> chroot also needs root, so a tftpd running as an unprivileged user
> cannot use DIR at all: xchroot() fails and the daemon exits. That
> setup has no way to confine clients.
>
> Strip leading slashes instead of rejecting them. PXE clients routinely
> ask for names like /pxelinux.0, and translating those into the served
> directory is the behaviour bug 4874 asked for. With DIR the result is
> unchanged, since xchroot() already chdir()s to the chroot root. Without
> DIR both downloads and uploads are now resolved below the current
> directory, and the existing dot check keeps rejecting ".." components.
>
>    text    data     bss     dec     hex filename
>    3998       0       0    3998     f9e networking/tftp.o before
>    4019       0       0    4019     fb3 networking/tftp.o after
>                            +21
>
> Signed-off-by: Ali Ahmet Memis <[email protected]>
> ---
> Both the read and the write were reproduced against a tftpd started
> without DIR. Unrelated to this patch, udpsvd reads past the end of a
> 20-byte allocation while serving tftpd (caught by ASan). I am looking
> into that separately
>
>  networking/tftp.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/networking/tftp.c b/networking/tftp.c
> index b698a9288..fefb4b06b 100644
> --- a/networking/tftp.c
> +++ b/networking/tftp.c
> @@ -944,6 +944,9 @@ int tftpd_main(int argc UNUSED_PARAM, char **argv)
>         G.block_buf_tail[0] = '\0';
>
>         local_file = G.block_buf + 2;
> +       /* Strip leading slashes from client-supplied paths */
> +       while (local_file[0] == '/')
> +               local_file++;
>         if (local_file[0] == '.' || strstr(local_file, "/.")) {
>                 error_msg = "dot in file name";
>                 goto err;
> --
> 2.55.0
>
> _______________________________________________
> busybox mailing list
> [email protected]
> https://lists.busybox.net/mailman/listinfo/busybox
>

_______________________________________________
busybox mailing list
[email protected]
https://lists.busybox.net/mailman/listinfo/busybox