Allow underscores in domain/hostname label regex

[elhoim]

Finding 35 (Low) — bin/cli.py:159

Problem

The label regex excludes underscores, so common DMARC/DKIM hostnames are never recognised - looks_like_domain('_dmarc.example.com') is False, so no domain/hostname guess is offered.

Fix

Finding #35 (underscore-labels, low severity): looks_like_domain() in bin/cli.py used a label regex ^[A-Za-z0-9-]{1,63}$ that excluded underscores, so common DMARC/DKIM hostnames like _dmarc.example.com were never recognised as domains and no domain/hostname guess was offered for them. Fix: added _ to the label character class (^[A-Za-z0-9_-]{1,63}$), a one-line, one-character-class change. Verified other rejection behaviour (e.g. labels starting/ending with -) is unaffected.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "
import importlib.util
spec = importlib.util.spec_from_file_location('cli','bin/cli.py')
cli = importlib.util.module_from_spec(spec); spec.loader.exec_module(cli)
print(cli.looks_like_domain('_dmarc.example.com'))
"
# Output: False

After

python3 -c "
import importlib.util
spec = importlib.util.spec_from_file_location('cli','bin/cli.py')
cli = importlib.util.module_from_spec(spec); spec.loader.exec_module(cli)
print(cli.looks_like_domain('_dmarc.example.com'))
print(cli.looks_like_domain('-bad.example.com'))  # still False, unaffected
"
# Output: True
#         False

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh