Check active_pane_id for validity

Suggested by Matthias Gerstner

Dockerfile

@@ -1,19 +1,24 @@
-FROM alpine:3.9 AS build
+FROM alpine:3.13 AS build
 
 RUN apk add --no-cache msgpack-c ncurses-libs libevent libexecinfo openssl zlib
 
-RUN apk add --no-cache git wget cmake make gcc g++ linux-headers zlib-dev openssl-dev \
-		automake autoconf libevent-dev ncurses-dev msgpack-c-dev libexecinfo-dev
+RUN apk add --no-cache \
+	autoconf \
+	automake \
+	cmake \
+	g++ \
+	gcc \
+	git \
+	libevent-dev \
+	libexecinfo-dev \
+	linux-headers \
+	make \
+	msgpack-c-dev \
+	ncurses-dev \
+	openssl-dev \
+	zlib-dev
 
-RUN set -ex; \
-	mkdir -p /src/libssh/build; \
-	cd /src; \
-	wget -O libssh.tar.xz https://www.libssh.org/files/0.9/libssh-0.9.0.tar.xz; \
-	tar -xf libssh.tar.xz -C /src/libssh --strip-components=1; \
-	cd /src/libssh/build; \
-	cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DWITH_SFTP=OFF ..; \
-	make -j "$(nproc)"; \
-	make install
+RUN apk add --no-cache libssh-dev
 
 RUN mkdir -p /src/tmate-ssh-server
 COPY . /src/tmate-ssh-server
@@ -26,9 +31,18 @@ RUN set -ex; \
 	make install
 
 ### Minimal run-time image
-FROM alpine:3.9
+FROM alpine:3.13
 
-RUN apk add --no-cache msgpack-c ncurses-libs libevent libexecinfo openssl zlib gdb bash
+RUN apk add --no-cache \
+	bash \
+	gdb \
+	libevent \
+	libexecinfo \
+	libssh \
+	msgpack-c \
+	ncurses-libs \
+	openssl \
+	zlib
 
 COPY --from=build /usr/lib/libssh.so.* /usr/lib/
 COPY --from=build /usr/bin/tmate-ssh-server /usr/bin/

Dockerfile.dev

@@ -1,20 +1,26 @@
-FROM alpine:3.9
+FROM alpine:3.13
 
 RUN apk add --no-cache msgpack-c ncurses-libs libevent libexecinfo openssl zlib
 
 RUN set -ex; \
 	apk add --no-cache --virtual .build-deps \
-		git wget cmake make gcc g++ linux-headers zlib-dev openssl-dev \
-		automake autoconf libevent-dev ncurses-dev msgpack-c-dev libexecinfo-dev; \
-	\
-	mkdir -p /src/libssh/build; \
-	cd /src; \
-	wget -O libssh.tar.xz https://www.libssh.org/files/0.9/libssh-0.9.0.tar.xz; \
-	tar -xf libssh.tar.xz -C /src/libssh --strip-components=1; \
-	cd /src/libssh/build; \
-	cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DWITH_SFTP=OFF ..; \
-	make -j "$(nproc)"; \
-	make install
+		autoconf \
+		automake \
+		cmake \
+		g++ \
+		gcc \
+		git \
+		libevent-dev \
+		libexecinfo-dev \
+		linux-headers \
+		make \
+		msgpack-c-dev \
+		ncurses-dev \
+		openssl-dev \
+		zlib-dev
+
+RUN set -ex; \
+	apk add --no-cache libssh-dev
 
 WORKDIR /src/tmate-ssh-server
 
@@ -24,7 +30,7 @@ RUN set -ex; \
 	./autogen.sh; \
 	./configure --prefix=/usr CFLAGS="-D_GNU_SOURCE"; \
 	make -j "$(nproc)"; \
-  ln -s /src/tmate-ssh-server/tmate-ssh-server /usr/bin
+	ln -s /src/tmate-ssh-server/tmate-ssh-server /usr/bin
 
 COPY docker-entrypoint.sh /usr/local/bin
 

create_keys.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 gen_key() {
@@ -6,10 +6,10 @@ gen_key() {
   ks="${keytype}_"
   key="keys/ssh_host_${ks}key"
   if [ ! -e "${key}" ] ; then
-    ssh-keygen -t ${keytype} -f "${key}" -N ''
+    ssh-keygen -t "${keytype}" -f "${key}" -N ''
     echo ""
   fi
-  SIG=$(ssh-keygen -l -E SHA256 -f $key.pub | cut -d ' ' -f 2)
+  SIG=$(ssh-keygen -l -E SHA256 -f "$key.pub" | cut -d ' ' -f 2)
 }
 
 mkdir -p keys

docker-entrypoint.sh

@@ -1,14 +1,18 @@
 #!/bin/sh
 set -e
 
-if [ "${USE_PROXY_PROTOCOL}" == "1" ]; then
+if [ "${USE_PROXY_PROTOCOL}" -eq "1" ]; then
   set -- -x "$@"
 fi
 
-if [ "${HAS_WEBSOCKET}" == "1" ]; then
+if [ "${HAS_WEBSOCKET}" -eq "1" ]; then
   set -- -w localhost "$@"
 fi
 
+if [ -n "${WEBSOCKET_HOSTNAME}" ]; then
+  set -- -w "${WEBSOCKET_HOSTNAME}" "$@"
+fi
+
 if [ ! -z "${SSH_HOSTNAME}" ]; then
   set -- -h "${SSH_HOSTNAME}" "$@"
 fi

tmate-daemon-decoder.c

@@ -83,7 +83,8 @@ static void tmate_uname(struct tmate_session *session,
 extern u_int next_window_pane_id;
 
 static void tmate_sync_window_panes(struct window *w,
-				    struct tmate_unpacker *w_uk)
+				    struct tmate_unpacker *w_uk,
+				    int *num_panes)
 {
 	struct tmate_unpacker uk, tmp_uk;
 	struct window_pane *wp, *wp_tmp;
@@ -93,6 +94,9 @@ static void tmate_sync_window_panes(struct window *w,
 		wp->flags |= PANE_KILL;
 
 	unpack_each(&uk, &tmp_uk, w_uk) {
+		if (++(*num_panes) > TMATE_MAX_PANES)
+			tmate_fatal("Too many opened panes (max=%d)", TMATE_MAX_PANES);
+
 		int id = unpack_int(&uk);
 		u_int sx = unpack_int(&uk);
 		u_int sy = unpack_int(&uk);
@@ -129,6 +133,8 @@ static void tmate_sync_window_panes(struct window *w,
 
 	active_pane_id = unpack_int(w_uk);
 	wp = window_pane_find_by_id(active_pane_id);
+	if (!wp || wp->window != w)
+		tmate_fatal("Invalid active_pane_id recevied");
 	window_set_active_pane(w, wp);
 }
 
@@ -139,6 +145,7 @@ static void tmate_sync_windows(struct session *s,
 	struct winlink *wl, *wl_tmp;
 	struct window *w;
 	int active_window_idx;
+	int num_panes = 0;
 	char *cause;
 
 	RB_FOREACH(wl, winlinks, &s->windows)
@@ -163,7 +170,7 @@ static void tmate_sync_windows(struct session *s,
 		w->sx = s->sx;
 		w->sy = s->sy;
 
-		tmate_sync_window_panes(w, &uk);
+		tmate_sync_window_panes(w, &uk, &num_panes);
 	}
 
 	RB_FOREACH_SAFE(wl, winlinks, &s->windows, wl_tmp) {

tmate-main.c

@@ -98,6 +98,24 @@ static void setup_locale(void)
 	tzset();
 }
 
+static int check_owned_directory_mode(const char *path, mode_t expected_mode)
+{
+	struct stat stat;
+	if (lstat(path, &stat))
+		return -1;
+
+	if (!S_ISDIR(stat.st_mode))
+		return -1;
+
+	if (stat.st_uid != getuid())
+		return -1;
+
+	if ((stat.st_mode & 07777) != expected_mode)
+		return -1;
+
+	return 0;
+}
+
 int main(int argc, char **argv, char **envp)
 {
 	int opt;
@@ -151,17 +169,22 @@ int main(int argc, char **argv, char **envp)
 	tmate_catch_sigsegv();
 	tmate_init_rand();
 
-	if ((mkdir(TMATE_WORKDIR, 0701)             < 0 && errno != EEXIST) ||
-	    (mkdir(TMATE_WORKDIR "/sessions", 0703) < 0 && errno != EEXIST) ||
+	if ((mkdir(TMATE_WORKDIR, 0700)             < 0 && errno != EEXIST) ||
+	    (mkdir(TMATE_WORKDIR "/sessions", 0700) < 0 && errno != EEXIST) ||
 	    (mkdir(TMATE_WORKDIR "/jail", 0700)     < 0 && errno != EEXIST))
 		tmate_fatal("Cannot prepare session in " TMATE_WORKDIR);
 
-	/* The websocket server needs to access the /session dir to rename sockets */
-	if ((chmod(TMATE_WORKDIR, 0701)             < 0) ||
-	    (chmod(TMATE_WORKDIR "/sessions", 0703) < 0) ||
+	if ((chmod(TMATE_WORKDIR, 0700)             < 0) ||
+	    (chmod(TMATE_WORKDIR "/sessions", 0700) < 0) ||
 	    (chmod(TMATE_WORKDIR "/jail", 0700)     < 0))
 		tmate_fatal("Cannot prepare session in " TMATE_WORKDIR);
 
+	if (check_owned_directory_mode(TMATE_WORKDIR, 0700) ||
+	    check_owned_directory_mode(TMATE_WORKDIR "/sessions", 0700) ||
+	    check_owned_directory_mode(TMATE_WORKDIR "/jail", 0700))
+		tmate_fatal(TMATE_WORKDIR " and subdirectories has incorrect ownership/mode. "
+			    "Try deleting " TMATE_WORKDIR " and try again");
+
 	tmate_ssh_server_main(tmate_session,
 			      tmate_settings->keys_dir, tmate_settings->bind_addr, tmate_settings->ssh_port);
 	return 0;

tmate-msgpack.c

@@ -285,6 +285,11 @@ void tmate_decoder_init(struct tmate_decoder *decoder, tmate_decoder_reader *rea
 void tmate_decoder_get_buffer(struct tmate_decoder *decoder,
 			      char **buf, size_t *len)
 {
+	if (msgpack_unpacker_message_size(&decoder->unpacker) > TMATE_MAX_MESSAGE_SIZE) {
+		tmate_fatal("Incoming message is too large");
+		return;
+	}
+
 	if (!msgpack_unpacker_reserve_buffer(&decoder->unpacker, UNPACKER_RESERVE_SIZE))
 		tmate_fatal("cannot expand decoder buffer");
 

tmate-ssh-server.c

@@ -423,7 +423,7 @@ static ssh_bind prepare_ssh(const char *keys_dir, const char *bind_addr, int por
 	ssh_import_key(bind, keys_dir, "ssh_host_ed25519_key");
 
 	if (ssh_bind_listen(bind) < 0)
-		tmate_fatal("Error listening to socket: %s\n", ssh_get_error(bind));
+		tmate_fatal("Error listening to socket: %s", ssh_get_error(bind));
 
 	tmate_info("Accepting connections on %s:%d", bind_addr ?: "", port);
 

tmate.h

@@ -108,6 +108,8 @@ extern void tmate_translate_legacy_key(int pane_id, key_code key);
 
 #define TMATE_HLIMIT 2000
 #define TMATE_PANE_ACTIVE 1
+#define TMATE_MAX_MESSAGE_SIZE (17*1024)
+#define TMATE_MAX_PANES 1000
 
 extern char *tmate_left_status, *tmate_right_status;
 extern void tmate_dispatch_daemon_message(struct tmate_session *session,

window.c

@@ -685,7 +685,7 @@ window_destroy_panes(struct window *w)
 	}
 }
 
-/* Retuns the printable flags on a window, empty string if no flags set. */
+/* Returns the printable flags on a window, empty string if no flags set. */
 char *
 window_printable_flags(struct session *s, struct winlink *wl)
 {