[vhost:NAME] names longer than 43 characters are silently truncated

Summary

A [vhost:NAME] section name longer than 43 characters is silently shortened while the configuration is parsed. The virtual host is registered under the shortened name, so it never matches the hostname a client sends in SNI, and every connection for that host falls back to the default vhost instead.

No warning or error is printed. The only hint is the startup line note: adding virtual host: ... showing the shortened name, and that line is suppressed on SIGHUP reload and in worker processes.

Steps to reproduce

Add a virtual host whose name is longer than 43 characters:

[vhost:vpn-gateway.engineering.department.example.com]
auth = "plain[/etc/ocserv/vhost.passwd]"
server-cert = /etc/ocserv/vhost-cert.pem
server-key = /etc/ocserv/vhost-key.pem
ipv4-network = 192.168.101.0
ipv4-netmask = 255.255.255.0

Starting ocserv prints:

note: adding virtual host: vpn-gateway.engineering.department.example.

The name is cut at 43 characters. A client connecting with the full hostname in SNI is served by the default vhost.

Expected behaviour

Either the name is stored and matched in full, or ocserv refuses to start with a configuration error. Silently operating under a different virtual host name than the one configured is the problem - the administrator has no indication that the configuration did not take effect.

Domain names may be up to 253 characters, so 43 is well below a usable limit.

Cause

src/inih/ini.c copies each section header into char section[MAX_SECTION] via the truncating ini_strncpy0(), with MAX_SECTION defined as 50. The vhost: prefix consumes 6 bytes, leaving 43 characters for the name plus the NUL terminator. ini_parse() reports no error for a truncated section name.

ocserv already raises INI_MAX_LINE to 2048 in src/inih/meson.build, but MAX_SECTION is a plain #define inside ini.c with no #ifndef guard, so it cannot be overridden by a build flag.

The two symptoms follow from that: find_vhost() (src/vhost.h) returns the default vhost when no name matches, and cfg_ini_handler() (src/config.c) selects an existing vhost when the name matches one already added.

Impact

This is a configuration-handling defect, not a security issue. The input is administrator-controlled configuration rather than anything an attacker supplies, and the truncation itself is memory-safe — the buffer bounds are respected and the result is NUL-terminated. The consequence is that a virtual host's configuration silently does not take effect.

Version

master (96a4baf9)

Fix

I have a fix prepared - make the section buffer size overridable and raise it, reject a name that cannot be stored in full, plus a unit test covering both symptoms and a REQ-CONFIG-INIT-003 entry in doc/requirements/. I will open a merge request linked to this issue.

Edited by Katie H