Pushing the Limits with Getaddrinfo

The piece demonstrates that glibc can interpret visually obscure Unicode strings as ordinary IPv4 addresses when a program enables AI_IDN. IDNA processing applies UTS #46 compatibility mappings before numeric parsing, converting characters such as circled, superscript, mathematical, and segmented digits - and Unicode full stops - into ASCII. It also deletes certain invisible characters. The resulting text is then accepted by inet_aton, whose legacy syntax permits decimal, hexadecimal, and octal components, mixed bases, and abbreviated addresses. Thus, many radically different-looking strings can all resolve to the same IP; the examples are tested against a live server at 69.30.206.130 using Ubuntu, glibc, ping, and curl.

The security risk arises when a filter judges an address by its original spelling while the networking library transforms and connects to a different one. Unicode lookalikes can disguise loopback or other restricted IPs, while older numeric forms can evade simple pattern matching. Behavior varies by program: ping enables IDN processing, curl and wget also convert IDNs, and OpenBSD netcat does not; curl additionally handles URL percent-encoding and may preserve the converted numeric form in the HTTP Host header. The central defense is to resolve the input first, validate the resulting IP address, and connect to that exact address - not to rely on string matching. The final section extends the demonstration to deceptive URLs, where encoded hostnames and user-info syntax can make a dangerous destination look like a trusted domain.