* not allowed in general names

[reaperhulk]

If you attempt to parse a DNS name from a certificate SAN that contains a wildcard (e.g. *.cryptography.io) you get an IDNA InvalidCodePoint when it should successfully parse.

[reaperhulk]

I'm not entirely sure how to resolve this short of just excluding a name from the IDNA decode if there's a * in it. Ideas?

[alex]

Presumaebly in *.cryptgography.io the cryptography.io portion should still be IDNA decoded?

[reaperhulk]

Yeah, I think so.

[alex]

This isn't actually fixed, we just added a vector.

[JoshData]

Hey, I'm wondering why you IDNA-decode at all here. The cert's subject CN won't be IDNA decoded, so it's a little inconsistent. When doing rudimentary validity checking on whether a cert matches a domain, the caller will be given an IDNA (ASCII but returned as a Python 3 str) common name and IDNA-decoded SAN values. If the caller has IDNA, it'll have to do the same "*." wildcard fix to make the string comparable with the DNSName value, and if the caller has Unicode it'll have to do the "*." fix in reverse to get IDNA to compare with the CN. (Reference: mail-in-a-box/mailinabox#467)