Protect against slice index error when checking for exec:/

- Ensure that a short string produces a different error.
- Add test for "no such host"

service/service.go

@@ -45,8 +45,10 @@ func dialWithRetries(network string, address string, timeout time.Duration) (con
 					// Not for bad ports, etc.
 					case *net.AddrError, net.InvalidAddrError:
 						return
-					// Connection Refused (*os.SyscallError) also counts as Temporary,
-					// but that's precisely the error we want to retry.
+					// Some errors are not considered Temporary
+					// but are precisely the sort of errors we want to retry:
+					// - connection refused (*os.SyscallError)
+					// - no such host (*.netDNSError)
 					default:
 					}
 				}
@@ -57,7 +59,7 @@ func dialWithRetries(network string, address string, timeout time.Duration) (con
 }
 
 func (s *Service) handleConnection(src *net.TCPConn, dst string, done chan bool) {
-	if dst[0:6] == "exec:/" {
+	if len(dst) > 5 && dst[0:6] == "exec:/" {
 		var stdout, stderr bytes.Buffer
 		path := dst[5:len(dst)]
 		cmd := exec.Command(path)

test/errors.bats

@@ -12,3 +12,10 @@ load helpers
   # Should be instant, rather than timing out.
   ylog | grep -qF -- "dial tcp: address foobar: missing port in address"
 }
+
+@test "bad host" {
+  ynetd -timeout 0s -proxy ":$LISTEN_PORT .:1"
+  knock
+  sleep 1
+  ylog | grep -qF -- "dial tcp: lookup .: no such host"
+}