Showing results for 
Search instead for 
Do you mean 
Reply
Core Memory
Posts: 8
Registered: ‎12-09-2015
Location: Germany
Message 1 of 13 (3,209 Views)

GPLed software used in Lenovo ThinkPad Stack Professional Kit

[ Edited ]

I already sent this request to @lenovo on Twitter and your accswsupport@lenovo.com support address which turned out to be unavailable. So here is my request via this forum:

I recently bought the Lenovo ThinkPad Stack Professional Kit. This kit contains a wireless router component (4XH0H34187). This router is based on software, namely the Linux Kernel, Busybox and Samba et al., which are licensed under the terms of the GNU General Public License (GNU GPL) 2 or any later version authored by the Free Software Foundation (FSF).
This open source license mandates that the source codes and tools to create the executable final product (firmware of the router or parts thereof) have to be made available. Please refer to http://www.gnu.org/licenses/gpl.html for further details.

I was not able to locate any material or information on Lenovo's website, let alone a reference to the GPL in the documentation accompanying the product.

I kindly request a copy of the source codes along with the required tool chain (compiler, linker, packager et al.) that were used to build the current firmware of the mobile wireless router.

Please forward this request to the proper department in your organization (legal or compliance).

Thank you for your efforts.

Guru
Posts: 1,558
Registered: ‎02-27-2012
Location: US
Message 2 of 13 (3,031 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

Hi

 

I don't have that dock, so I can not check myself and this why I'm asking. Does it specifically says it uses GNU GPL code when you are running it? It is on the "About this software" or "version information" or any paper that cames with the router?

 

Usually Lenovo does not have issues to post the source code of GNU GPL software on the support site, but you are right, on this device there is no source code available on the support site.

 

Maybe Lenovo needs to be reminded of this, if the device actually uses GNU GPL software. Can you try to get more information of what components under GNU GPL is the device using?

 

Regards






Martín Itúrbide
OS2World.com NewsMaster
"Don't Panic"
Wil Wheaton
Remember: Your Friend Wil Declares....
Please click "Kudos" for Ego Boost !!

Core Memory
Posts: 8
Registered: ‎12-09-2015
Location: Germany
Message 3 of 13 (3,002 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

[ Edited ]

Hi Martin,

I am actually liking this router quite a bit and would love to have OpenVPN working on it.

However, as described in this thread ( https://forums.lenovo.com/t5/forums/v3_1/forumtopicpage/board-id/op01_en/thread-id/7659/page/1 ) the router has a security issue that allows one to very easily get root access to the device. The latest firmware (v1.1.3.4 / EC 0.0.12.0) has telnet access (tcp port 23) enabled by default on the internal interfaces (Wifi). You can use any telnet client (e.g. PuTTY) to access the device via the "stack.lenovo" address. The default root password is "root" - and it can't be changed via the Stack Assistant software or the Web interface - something Lenovo should look into urgently.

So, without any reverse engineering or hacking I am able to gain full access to the device and that makes it easy to check what binaries run on it:

 

Connected to stack.lenovo.                                                                                                                                                                                                             
Escape character is '^]'.                                                                                                                                                                                                              
                                                                                                                                                                                                                                       
lenovo-stack login: root                                                                                                                                                                                                               
Password:
RLX Linux version 2.0
         _           _  _
        | |         | ||_|                 
   _  _ | | _  _    | | _ ____  _   _  _  _
  | |/ || |\ \/ /   | || |  _ \| | | |\ \/ /
  | |_/ | |/    \   | || | | | | |_| |/    \
  |_|   |_|\_/\_/   |_||_|_| |_|\____|\_/\_/

For further information check:
http://processor.realtek.com/

# cat /proc/version
Linux version 2.6.30.9 (pk@pk-HP-NodeBook) (gcc version 4.4.5-1.5.5p4 (GCC) ) #1 Thu Mar 24 14:37:26 CST 2016

# cat /proc/cmdline
console=ttyS0,115200 root=/dev/mtdblock1 cgroup_enable=memory

It is using a pretty old version of the Linux kernel. Also, the Realtek URL mentioned in the login message is dead.

# cat /proc/cpuinfo
system type             : RTL8881a
processor               : 0
cpu model               : 56322
BogoMIPS                : 519.37
hardware watchpoint     : no
tlb_entries             : 64
mips16 implemented      : yes

The system uses a Realtek SoC RTL8881a which contains an exotic MIPS derivative (Lexra RLX5281 I assume) that is missing some instructions of the MIPS ISA (patent issue, see http://probell.com/Lexra/ ), thus requiring a specialized MIPS gcc toolchain. Also from what I understand the Linux kernel source code is heavily customized to run on this SoC and it is not mainlined, i.e. the modifications are not included in the official Linux kernel sources.

On embedded devices Busybox is commonly used to replace several essential tools with one binary to save precious ROM space.

# /bin/busybox
BusyBox v1.13.4 (2016-03-24 14:22:04 CST) multi-call binary
Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        addgroup, adduser, ash, awk, blkid, bunzip2, bzcat, cat, chmod, chown,
        cp, cut, date, dd, depmod, df, diff, dmesg, echo, egrep, expr, false,
        fgrep, find, free, fuser, grep, halt, head, hostname, ifconfig, init,
        insmod, ip, kill, killall, klogd, ln, login, ls, lsmod, md5sum, mdev,
        mkdir, modprobe, more, mount, mv, passwd, ping, poweroff, ps, reboot,
        renice, rm, rmmod, route, sed, sh, sleep, sort, su, sulogin, syslogd,
        tail, telnetd, top, touch, tr, true, umount, vi, wc, wget, whoami


Samba binaries are also present in /bin/smbd and /bin/smbpasswd, but they lack any version string. However, using the following command on a local copy of the router's binaries on my ThinkPad 8 I was able to identify symbols in the binary making it look like a rather old version of Samba:

darkstar@ThinkPad8 ~/Desktop/Router $ strings bin/smbd | grep samba
samba_version_string
/var/samba/smbpasswd
/var/samba
/var/samba/samba
sambaMinPwdLength
sambaPwdHistoryLength
sambaLogonToChgPwd
sambaMaxPwdAge
sambaMinPwdAge
sambaLockoutDuration
sambaLockoutObservationWindow
sambaLockoutThreshold
sambaForceLogoff
sambaRefuseMachinePwdChange
/var/samba/smb.conf
/var/samba/smb.conf

-> https://www.samba.org

Other notable GPL software included in the firmware:
/bin/aria2c - Download tool unknown version -> https://aria2.github.io/
/bin/minidlna - MiniDLNA server version 1.0.25 -> https://sourceforge.net/projects/minidlna/
/bin/iptables - Tool to configure Linux firewall tables - http://www.netfilter.org

/bin/iwconfig et al. - Wireless Tools for Linux - https://hewlettpackard.github.io/wireless-tools/Tools.html

 

There is probably more in the firmware.

 

Regards,

Andre

Highlighted
Core Memory
Posts: 8
Registered: ‎12-09-2015
Location: Germany
Message 4 of 13 (2,817 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

I am pretty sure not making the source code available for the GPLed parts of this router (see my previous post) is just an oversight on Lenovo's part.

Could any official representative or moderator please comment if Lenovo is actively working on a solution to this license issue?

Thank you in advance.

SCSI Port
Posts: 47
Registered: ‎08-15-2016
Location: US
Message 5 of 13 (2,765 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

I own the ThinkPad Stack Professional Kit as well - wasn't there some mod who was actually the head in charge of developing some aspect of it and he promised an update on the issu??

 

but he was never heard from again... I am also very interested to see what unfolds from this - KUDOS to my fellow users for taking the initiative on this. 

Core Memory
Posts: 8
Registered: ‎12-09-2015
Location: Germany
Message 6 of 13 (2,668 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

[ Edited ]

For the record: Today I raised the issue of this license violation again to Lenovo, this time to compliance@lenovo.com. I will now wait another week for a response before escalating this issue. It is in Lenovo's best interest to act swiftly upon solving this issue and complying with the GPL.

Guru
Posts: 1,558
Registered: ‎02-27-2012
Location: US
Message 7 of 13 (2,630 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

Hi evilJazz

 

Thanks for your efforts, I'm very pro open source software and I think that every line of open source code needs to be released to the public and preserved.

 

If there is interest on hacking the device (good hacking I mean, nothing that goes out of the legal way), like making a custom image, or trying to make an alternative management app, I think that a good place to try to consolidate efforts is the ThinkWiki.org wiki. I like to organize Lenovo Software on that wiki with some screenshots for example.

 

Maybe some pages can be created there to list information that is getting discovered by the community about this device. It is obvious that changing the firmware and/or modifying of the device is outside Lenovo's warranty, but in my opinion it is good for people that want to try that under they own risk.

 

Regards






Martín Itúrbide
OS2World.com NewsMaster
"Don't Panic"
Wil Wheaton
Remember: Your Friend Wil Declares....
Please click "Kudos" for Ego Boost !!

Guru
Posts: 1,558
Registered: ‎02-27-2012
Location: US
Message 8 of 13 (2,626 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

Hi evilJazz.

 

I found an email that seems to be of the support team of the Stack on this document:

https://download.lenovo.com/ibmdl/pub/pc/pccbbs/options/tpstack_wireless_router_1tb_hd_kit_4xh0h3418...

 

Please give it a try if you can get the source code there.

 

Regards






Martín Itúrbide
OS2World.com NewsMaster
"Don't Panic"
Wil Wheaton
Remember: Your Friend Wil Declares....
Please click "Kudos" for Ego Boost !!

Core Memory
Posts: 8
Registered: ‎12-09-2015
Location: Germany
Message 9 of 13 (2,570 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

Hi Martin,

thanks for the link to the document! I didn't see this one before. I sent an email to the email address mentioned in there, namely accswdev@lenovo.com. It didn't bounce like it did with accswsupport@lenovo.com, so here is hoping somebody at Lenovo read and reacts to it.

As for your suggestion to use ThinkWiki.org wiki, good idea! Will do so once anything emerges from this.

Thanks and best regards,
Andre
Guru
Posts: 1,558
Registered: ‎02-27-2012
Location: US
Message 10 of 13 (2,498 Views)

Re: GPLed software used in Lenovo ThinkPad Stack Professional Kit

Hi

 

I created this page on the wiki that can be like the starting point to have other articles related to the device:

http://www.thinkwiki.org/wiki/ThinkPad_Stack

 

Maybe you can create some other articles on the wiki about your hacking with the device in the future and link it on that page.

 

Regards.






Martín Itúrbide
OS2World.com NewsMaster
"Don't Panic"
Wil Wheaton
Remember: Your Friend Wil Declares....
Please click "Kudos" for Ego Boost !!

Top kudoed Authors