Fix invalid DNS SAN entries

[mrohera]

Changes here fix a situation where a edge device's host name that begins with number(s) [0-9] gets sanitized. For example host name "2019edgehost" is consumed as "edgehost". This has caused problems was observed when using VMs that begin with numbers since it appears to be permitted configuration contrary to RFC 1035.

The changes involve passing the configured host name as is into the SAN entry without any modifications. The module id DNS entry continues to be sanitized.

[myagley]

Do we need to sanitize this? Should we be returning an error instead? It seems like if we strip out characters we are effectively making the certificate unusable. A client can then never connect to the server because the cert SAN and hostname in the request will always be different. This seems like we are effectively silently failing.

[avranju]

@myagley Are you asking if we should do this sort of sanitization for module ID SAN entries as well? In the Kubernetes case this turned out to be necessary for Edge Hub since the module ID is $edgeHub which isn't a valid DNS name. So this gets transformed into edgehub -- i.e., the $ gets removed and the H is made lowercase. Since its Edge Agent that sets up the GatewayHostName it applies the same rules at that time for modules.

I suppose we could special-case Edge Hub and error out in the general case if the module ID isn't a valid DNS name.

For the subject name case, this PR removes sanitization (still makes it lower case though) and basically allows any arbitrary string. This fixes a regression.

[mrohera]

@myagley suggested using the sanitization rules per: http://man7.org/linux/man-pages/man7/hostname.7.html. @avranju does this work for the aforementioned scenario?

[mrohera]

Also I don't think this is a regression as the current changes merely bypass sanitization only for the hostname. Module IDs continue to be sanitized.

[avranju]

@mrohera Sorry, I meant that what's in master is a regression. This PR fixes the regression.

[avranju]

@myagley suggested using the sanitization rules per: http://man7.org/linux/man-pages/man7/hostname.7.html. @avranju does this work for the aforementioned scenario?

With the Kubernetes integration, module identifiers are used as the service name and here's the check that Kubernetes makes for service names:

A DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is [a-z]([-a-z0-9]*[a-z0-9])?

Maybe we can leave the module ID SAN entry as-is and use the rules suggested above only for the common name?