[Android] Fall back to 'localhost' when *.localhost resolves to only non-loopback addresses

Dns falls back to resolving plain 'localhost' when the OS resolver fails or returns zero addresses for a '*.localhost' subdomain (RFC 6761 Section 6.3). However, on Android the bionic getaddrinfo returns non-loopback addresses (link-local fe80::* and globally-routable IPv6) for '*.localhost', bypassing the fallback and causing Dns.GetHostAddresses("foo.localhost.") to return non-loopback addresses. This was caused by the fallback condition only triggering on empty or failed OS responses; it is now extended to also trigger when the OS returns only non-loopback addresses, in both the sync and async paths.

Fixes #127965.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: kotlarmilos

src/libraries/System.Net.NameResolution/src/System/Net/Dns.cs

@@ -463,6 +463,30 @@ private static bool IsLocalhostSubdomain(string hostName)
             return length > Localhost.Length && IsReservedName(hostName, Localhost);
         }
 
+        /// <summary>
+        /// Returns true when the address array is non-empty and contains no loopback addresses.
+        /// Used by the RFC 6761 Section 6.3 fallback path: some platform resolvers (e.g. Android's
+        /// bionic getaddrinfo) return non-loopback addresses for "*.localhost" subdomains. In that
+        /// case we discard the OS result and fall back to resolving plain "localhost".
+        /// </summary>
+        private static bool HasNoLoopbackAddress(IPAddress[] addresses)
+        {
+            if (addresses.Length == 0)
+            {
+                return false;
+            }
+
+            foreach (IPAddress address in addresses)
+            {
+                if (IPAddress.IsLoopback(address))
+                {
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
         /// <summary>
         /// Tries to handle RFC 6761 "invalid" domain names.
         /// Returns true if the host name is an invalid domain (exception will be set).
@@ -522,10 +546,13 @@ private static object GetHostEntryOrAddressesCore(string hostName, bool justAddr
                         throw CreateException(errorCode, nativeErrorCode);
                     }
                 }
-                else if (addresses.Length == 0 && IsLocalhostSubdomain(hostName))
+                else if (IsLocalhostSubdomain(hostName) &&
+                         (addresses.Length == 0 || HasNoLoopbackAddress(addresses)))
                 {
-                    // RFC 6761 Section 6.3: If localhost subdomain returns empty addresses, fall back to plain "localhost".
-                    if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned empty, falling back to 'localhost'");
+                    // RFC 6761 Section 6.3: If localhost subdomain returns empty addresses, or only
+                    // non-loopback addresses (e.g. Android bionic returns globally-routable IPv6 for
+                    // "*.localhost"), fall back to plain "localhost".
+                    if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned no loopback addresses, falling back to 'localhost'");
                     NameResolutionTelemetry.Log.AfterResolution(hostName, activity, answer: justAddresses ? addresses : (object)new IPHostEntry { AddressList = addresses, HostName = newHostName!, Aliases = aliases }, exception: null);
                     fallbackToLocalhost = true;
                 }
@@ -788,20 +815,24 @@ static async Task<T> CompleteAsync(Task task, string hostName, bool justAddresse
                 {
                     result = await ((Task<T>)task).ConfigureAwait(false);
 
-                    // RFC 6761 Section 6.3: If localhost subdomain returns empty addresses, fall back to plain "localhost".
-                    if (isLocalhostSubdomain && result is IPAddress[] addresses && addresses.Length == 0)
+                    // RFC 6761 Section 6.3: If localhost subdomain returns no loopback addresses
+                    // (empty, or only non-loopback like Android bionic's globally-routable IPv6),
+                    // fall back to plain "localhost".
+                    if (isLocalhostSubdomain && result is IPAddress[] addresses &&
+                        (addresses.Length == 0 || HasNoLoopbackAddress(addresses)))
                     {
-                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned empty, falling back to 'localhost'");
+                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned no loopback addresses, falling back to 'localhost'");
                         NameResolutionTelemetry.Log.AfterResolution(hostName, activity, answer: result, exception: null);
                         fallbackOccurred = true;
 
                         // result is IPAddress[] so justAddresses is guaranteed true here.
                         return await ((Task<T>)(Task)Dns.GetHostAddressesAsync(Localhost, addressFamily, cancellationToken)).ConfigureAwait(false);
                     }
 
-                    if (isLocalhostSubdomain && result is IPHostEntry entry && entry.AddressList.Length == 0)
+                    if (isLocalhostSubdomain && result is IPHostEntry entry &&
+                        (entry.AddressList.Length == 0 || HasNoLoopbackAddress(entry.AddressList)))
                     {
-                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned empty, falling back to 'localhost'");
+                        if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Localhost subdomain returned no loopback addresses, falling back to 'localhost'");
                         NameResolutionTelemetry.Log.AfterResolution(hostName, activity, answer: result, exception: null);
                         fallbackOccurred = true;