Skip to content

Conversation

@PetitBaguette
Copy link

Summary

matchHostName in RoutingUtils and XdsNameResolver currently rejects hostnames and patterns
with a trailing dot (.) via checkArgument. A trailing dot denotes a
Fully Qualified Domain Name (FQDN) as defined in
RFC 1034 Section 3.1, and is a valid,
well-defined representation of an absolute domain name. Rejecting it is inconsistent with the RFC.

This change removes the trailing-dot rejection and adds normalization to strip the trailing dot
before matching, making example.com. and example.com match equivalently.

Background

Per RFC 1034 Section 3.1:

"If the name ends with a dot, it is an absolute name ... For example, poneria.ISI.EDU."

A trailing dot simply indicates that the name is rooted at the DNS root and is semantically
equivalent to the same name without the trailing dot. Treating it as invalid prevents legitimate
FQDNs from being used as hostnames or virtual host domain patterns in xDS routing configuration.

Motivation

This was discovered when using gRPC Proxyless Service Mesh on a Kubernetes cluster with Istio.
The issue surfaced after upgrading Istio from 1.26.8 to 1.28.3. The Istio change
istio/istio#56008 began sending FQDN-style domain
names (with trailing dots) in xDS route configuration, which caused grpc-java to throw an
IllegalArgumentException in matchHostName:

java.lang.IllegalArgumentException: Invalid pattern/domain name
    at com.google.common.base.Preconditions.checkArgument(Preconditions.java:143)

The root cause is that grpc-java's matchHostName was not RFC-compliant in rejecting trailing dots — the Istio upgrade merely made it visible. The fix here is to bring grpc-java into compliance with RFC 1034, independent of any specific Istio version.

Changes

  • xds/src/main/java/io/grpc/xds/RoutingUtils.java: Removed trailing-dot rejection and added
    FQDN normalization in matchHostName.
  • xds/src/main/java/io/grpc/xds/XdsNameResolver.java: Same as above.
  • xds/src/test/java/io/grpc/xds/XdsNameResolverTest.java: Added matchHostName_trailingDot
    test covering exact match, prefix wildcard, and suffix wildcard with trailing dot combinations.

References

@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Feb 4, 2026

CLA Missing ID CLA Not Signed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant