net: "connectex: invalid argument" when dialing an Artifactory server over IPv6

[tsubus]

Working from home on a company-owned laptop (no admin rights) with Windows 10. From the office everything is OK, from home office the situation is different. The GOPROXY URL is IPv6 and then it gets redirected by the server. I can connect just fine to artifactory (the GOPROXY we use) both from shell and from browser, but "go get" fails with "connectex: invalid argument". The error is very vague and hard to debug.

Here you can see the output from curl, proving everything is ok server side:

curl -vk https://artifactory.domain.com Output

curl -vk https://artifactory.domain.com
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed

0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying ffff:eeee:dddd:cccc::aaa:333:443...


TCP_NODELAY set


Connected to artifactory.domain.com (ffff:eeee:dddd:cccc::aaa:333) port 443 (#0)


ALPN, offering h2


ALPN, offering http/1.1


successfully set certificate verify locations:


CAfile: C:/PortableGit/mingw64/ssl/certs/ca-bundle.crt


CApath: none
} [5 bytes data]

TLSv1.3 (OUT), TLS handshake, Client hello (1):

} [512 bytes data]

TLSv1.3 (IN), TLS handshake, Server hello (2):

{ [108 bytes data]

TLSv1.2 (IN), TLS handshake, Certificate (11):

{ [1719 bytes data]

TLSv1.2 (IN), TLS handshake, Server key exchange (12):

{ [333 bytes data]

TLSv1.2 (IN), TLS handshake, Server finished (14):

{ [4 bytes data]

TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

} [70 bytes data]

TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):

} [1 bytes data]

TLSv1.2 (OUT), TLS handshake, Finished (20):

} [16 bytes data]

TLSv1.2 (IN), TLS handshake, Finished (20):

{ [16 bytes data]


SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384


ALPN, server accepted to use http/1.1


Server certificate:


subject: CN=artifactory.domain.com


start date: Sep 25 02:47:51 2020 GMT


expire date: Sep 24 02:47:51 2024 GMT


issuer: DC=loc; DC=A2; CN=LGTSubCA23


SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.


} [5 bytes data]

GET / HTTP/1.1


Host: artifactory.domain.com


User-Agent: curl/7.68.0


Accept: /



{ [5 bytes data]

Mark bundle as not supporting multiuse

< HTTP/1.1 302 Moved Temporarily
< Server: nginx/1.16.1
< Date: Thu, 05 Nov 2020 09:45:45 GMT
< Content-Type: text/html
< Content-Length: 145
< Location: https://artifactory.domain.com/ui/
< Connection: keep-alive
<
{ [145 bytes data]
100   145  100   145    0     0    523      0 --:--:-- --:--:-- --:--:--   525
<title>302 Found</title>

302 Found
nginx/1.16.1



Connection #0 to host artifactory.domain.com left intact

What version of Go are you using (go version)?

$ go version

go version go1.15.3 windows/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=on
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\username\AppData\Local\go-build
set GOENV=C:\Users\username\AppData\Roaming\go\env
set GOEXE=.exe
set GOFLAGS= -mod=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\username\go\pkg\mod
set GONOPROXY=bitbucket.domain.com
set GONOSUMDB=bitbucket.domain.com/*
set GOOS=windows
set GOPATH=C:\Users\username\go
set GOPRIVATE=bitbucket.domain.com
set GOPROXY=https://username:password@artifactory.domain.com/artifactory/api/go/go-all
set GOROOT=C:\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\Users\username\go\src\bitbucket.domain.com\go\digicertapi\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\username\AppData\Local\Temp\1\go-build705699710=/tmp/go-build -gno-record-gcc-switches

What did you do?

go get -u

(or any go get command)

What did you expect to see?

go modules downloaded

What did you see instead?

go: github.com/google/go-cmp@v0.5.2: Get "https://username:***@artifactory.domain.com/artifactory/api/go/go-all/github.com/google/go-cmp/@v/v0.5.2.mod": dial tcp [ipv6 address]:443: connectex: invalid argument

[bcmills]

That error likely comes from here:

go/src/net/fd_windows.go

Line 112 in d55e0c1

err = os.NewSyscallError("connectex", err)

[bcmills]

CC @bradfitz @ianlancetaylor @alexbrainman @zx2c4

[bcmills]

This looks to me like a bug in the net package on Windows: at the very least, net should be returning a more useful error than simply connectex: invalid argument.

(There may also be a bug in cmd/go, but if so it is obscured by the net bug.)

[alexbrainman]

net should be returning a more useful error than simply connectex: invalid argument.

That means ConnectEx Windows API

https://docs.microsoft.com/en-us/windows/win32/api/Mswsock/nc-mswsock-lpfn_connectex

returned WSAEINVAL. We can add error numbers, for example, WSAEINVAL is 10022

https://docs.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2

But I find it is not difficult to search Windows errors by their text.

And we cannot replace error text with a number, because text is usually helpful. This error text is not helpful.

Alex

[bcmills]

@alexbrainman, I say net should be returning a more useful error because it is at the wrong layer of abstraction. It reports that an invalid argument was passed to connectex, but that does not tell us what (if anything) was wrong with the arguments passed to Dial itself.

(We can't tell from that error whether the invalid argument is due to an internal error within net, or due to some problem with the arguments passed to Dial by the caller.)

[alexbrainman]

I say net should be returning a more useful error because it is at the wrong layer of abstraction. It reports that an invalid argument was passed to connectex, but that does not tell us what (if anything) was wrong with the arguments passed to Dial itself.

@bcmills I agree that error message is not helpful. But WSAEINVAL is the only information we get from ConnectEx - Windows does not tell us anything else about what is wrong with ConnectEx arguments. If you read documentation

https://docs.microsoft.com/en-us/windows/win32/api/mswsock/nc-mswsock-lpfn_connectex

it adds

WSAEINVAL | The parameter s is an unbound or a listening socket.

Maybe it helps.

But you need to read this information in Microsoft documentation. Windows API does not provide any information but WSAEINVAL.

Alex