net: reject Lookup("www.google.com..") on all systems

[vdobler]

On Linux domain look-up is too liberal and accepts domain
names with two trailing dots like "www.google.com..".
Most probably this is an issue on the OS level as
gethostbyname(3) shows this behavior also.

Allowing two trailing dots instead of none or
one (for a FQDN) seems harmless but it messes with the
domain name canonicalization done in net/http/cookiejar
and the determination of the public suffix of a domain.

I'd like to argue that malformed domains should be
rejected on look-up on any OS; at least no request
should be made to such malformed domain names.

This issue is not present on Windows and OSX.
Domains with three trailing dots are properly rejected
on Linux, Windows and OSX.
Other OS are untested.

The following program demonstrates the issue:
On Linux neither net.LookupHost nor http.Get fail.

--------------
package main

import (
    "io"
    "log"
    "net"
    "net/http"
    "os"
)

func main() {
    addrs, err := net.LookupHost("www.google.com..")
    if err != nil {
        log.Fatal(err)
    }
    for _, a := range addrs {
        log.Println(a)
    }
    res, err := http.Get("http://www.google.com../foo")
    if err != nil {
        log.Fatal(err)
    }
    defer res.Body.Close()
    io.Copy(os.Stdout, res.Body)
}

[mikioh]

Comment 1:

Perhaps we should ask rsc (or iant?) why did you guys choose hostname-like
platform-dependent (but plain and  flexible) namespace instead of host subcomponent of
URI namespace. Anyway, the current net package takes both namespaces and never
recognises the difference btw those twos. I personally hope that packages that have to
take account of their property's namespace would handle this issue at each package.

[nigeltao]

Comment 2:

This is possibly a glibc bug. In any case, I filed
https://sourceware.org/bugzilla/show_bug.cgi?id=16469

[rsc]

Comment 3:

I do not understand the question in #1.
I agree that net.LookupHost("www.google.com..") should be made to fail everywhere.

[mikioh]

Comment 4:

I'm not good at this section but what if we have some entries in local database (e.g.
/etc/hosts) like the following:
::1  www.google.com..
127.0.0.1  www.google.com..
getaddrinfo (or similar kernel/system library service) on some implementation works as
not only a DNS resolver but mDNS or some network instance (that is represented in
net-unicode, see http://tools.ietf.org/html/rfc6762#appendix-F) resolver.
# ping6 www.google.com..
PING6(56=40+8+8 bytes) ::1 --> ::1
16 bytes from ::1, icmp_seq=0 hlim=64 time=0.092 ms
# ping www.google.com..
PING www.google.com.. (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.059 ms
I have no concrete opinion about this issue, whether we should normalize network
instance/node namespace in the package net API level.

[rsc]

Comment 5:

Labels changed: added release-go1.3.

Status changed to Accepted.

[rsc]

Comment 6:

Labels changed: added release-none, suggested, removed release-go1.3.

[griesemer]

Comment 7:

Labels changed: added repo-main.

[gopherbot]

CL https://golang.org/cl/37843 mentions this issue.

[odeke-em]

Thank you for filing this bug @vdobler! This issue seems to have been filed when we were on code.google.com so I shall raise some attention to it. Kindly paging @iangudger, you might be interested in this bug, if you are free and bored.

[r5d]

@odeke-em, net.LookupHost("www.google.com..") is currently failing on Linux:

$ uname -a
Linux cygnus 5.10.0-8-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64 GNU/Linux
$ go version
go version go1.17.1 linux/amd64
$ ./7122
2021/09/11 18:04:13 lookup www.google.com..: no such host

Perhaps, this can be closed now?

[ianlancetaylor]

Sounds like it. Thanks.