Merge pull request #1129 from rhenium/ky/ssl-verify-hostname-bad-wildcard

ssl: fix NoMethodError on SAN dNSName with an empty label

Author: rhenium

lib/openssl/ssl.rb

@@ -335,7 +335,7 @@ def verify_wildcard(domain_component, san_component) # :nodoc:
       parts = san_component.split("*", -1)
 
       return false if parts.size > 2
-      return san_component == domain_component if parts.size == 1
+      return san_component == domain_component if parts.size <= 1
 
       # RFC 6125, section 6.4.3, subitem 3.
       # The client SHOULD NOT attempt to match a presented identifier

test/openssl/test_ssl.rb

@@ -898,6 +898,7 @@ def test_verify_certificate_identity
   def test_verify_hostname
     assert_equal(true,  OpenSSL::SSL.verify_hostname("www.example.com", "*.example.com"))
     assert_equal(false, OpenSSL::SSL.verify_hostname("www.subdomain.example.com", "*.example.com"))
+    assert_equal(false, OpenSSL::SSL.verify_hostname("www.example.com", ".example.com"))
   end
 
   def test_verify_wildcard