From: Adriana Kobylak <anoo@linux.ibm.com>
To: Gunnar Mills <gmills@linux.vnet.ibm.com>
Cc: rgrs <rgrs@protonmail.com>, openbmc@lists.ozlabs.org, anoo@us.ibm.com
Subject: Re: BMC update via TFTP
Date: Tue, 03 Dec 2019 13:55:13 -0600 [thread overview]
Message-ID: <9e0303e5beb34b9bb50b050cd56e35d8@linux.vnet.ibm.com> (raw)
In-Reply-To: <f778ce0c-f395-7528-ed05-cec194707a14@linux.vnet.ibm.com>
On 2019-12-03 11:08, Gunnar Mills wrote:
> On 12/3/2019 10:12 AM, Gunnar Mills wrote:
>
>>> In BMC WebUI under "Download image file from TFTP server" section,
>>>
>>> we have text fields "TFTP Server IP address" and "File name".
>>> "File name" doesn't take folders in path. Is this a bug or
>>> expected behavior?
>>>
>>> TFTP downloads work only if file is kept in root of tftp share.
>> This is expected.
>>
> https://github.com/openbmc/phosphor-bmc-code-mgmt/blob/b0ce996ac60cf80487d71c3cdb7165d065079377/download_manager.cpp#L33
>> [1]
>
> As long as we continue to sanitize the local filename, I don't see why
> we need to limit the source file name.
> Patrick, Adriana, Any objection? Remember why we wrote it this way? I
> assume for simplicity..?
It was done for security to prevent users from specifying a file outside
the tftp directory, such as /mydir/../root/system-file.
But seems the current file name handling breaks the ability to get files
from a subdir like Raj pointed out, we should be able to fix that out,
tftp supports having a file in subdirs such as
/tftpboot/subdirectory/file, and passing /subdirectory/file to it as the
path.
>
> Thanks,
> Gunnar
>
>
> Links:
> ------
> [1]
> https://github.com/openbmc/phosphor-bmc-code-mgmt/blob/b0ce996ac60cf80487d71c3cdb7165d065079377/download_manager.cpp#L33
next prev parent reply other threads:[~2019-12-03 19:54 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-03 12:02 BMC update via TFTP rgrs
2019-12-03 16:12 ` Gunnar Mills
2019-12-03 17:08 ` Gunnar Mills
2019-12-03 19:55 ` Adriana Kobylak [this message]
2019-12-04 15:47 ` Joseph Reynolds
2019-12-04 21:36 ` Vernon Mauery
2019-12-05 11:05 ` Alexander Tereschenko
2019-12-05 22:37 ` Vernon Mauery
2019-12-06 14:03 ` Alexander Tereschenko
2019-12-06 22:52 ` Joseph Reynolds
2019-12-09 16:06 ` Alexander Tereschenko
2019-12-10 1:25 ` Joseph Reynolds
2019-12-10 18:58 ` [EXTERNAL] " Neeraj Ladkani
2019-12-10 21:10 ` Joseph Reynolds
2019-12-11 4:56 ` Bonnie Lo/WYHQ/Wiwynn
2019-12-11 5:59 ` Lei YU
2019-12-11 21:51 ` Milton Miller II
2019-12-11 11:02 ` Alexander Tereschenko
2019-12-11 20:17 ` Joseph Reynolds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9e0303e5beb34b9bb50b050cd56e35d8@linux.vnet.ibm.com \
--to=anoo@linux.ibm.com \
--cc=anoo@us.ibm.com \
--cc=gmills@linux.vnet.ibm.com \
--cc=openbmc@lists.ozlabs.org \
--cc=rgrs@protonmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.