Stricter hostname verification

[tarcieri]

This change implements hostname verification more in-line with RFC 6125.

Additionally it eliminates the use of regexes when verifying hostnames, opting for simple string comparisons instead.

[tarcieri]

The test_post_connection_check(OpenSSL::TestSSL) test is failing because the tests try to match "*.localdomain" and this hostname verifier has been explicitly written to disallow wildcards on TLDs.

Disallowing wildcards on TLDs is recommended by ICANN:

https://www.icann.org/groups/ssac/documents/sac-015-en

[csstaub]

I would add a comment here to indicate the reasoning for this.

[tarcieri]

Done

[zzak]

I'd prefer we nodoc these functions (for now) to avoid promoting them as public api

[tarcieri]

@zzak my last commit makes the existing test suite pass (sans the unrelated memory leak error)

[tarcieri]

I'd call this finished for a first pass

[zzak]

Can you squash your commits please?

[tarcieri]

Squashed

[stouset]

This isn't strict enough.

>> san_component    = "abc*bcd"
>> domain_component = "abcd"
>> parts            = san_component.split("*", -1)
>> domain_component.start_with?(parts[0]) && domain_component.end_with?(parts[1])
=> true

[stouset]

Sans the issue above, LGTM. More tests, though?

[tarcieri]

Will reopen with the in-repo branch

[tarcieri]

Reopened as #12