Manual Pages  — GETNAMEINFO

If a link-layer address or UNIX-domain address is passed to getnameinfo(), its ASCII representation will be stored in host. The string pointed to by serv will be set to the empty string if non-NULL; flags will always be ignored. For a link-layer address, this can be used as a replacement of the legacy link_ntoa(3) function.

The sockaddr structure sa should point to either a sockaddr_in, sockaddr_in6, sockaddr_dl, or sockaddr_un structure (for IPv4, IPv6, link-layer, or UNIX-domain respectively ) that is salen bytes long. If salen is shorter than the length corresponding to the specified address family or longer than sizeof(struct sockaddr_storage), it returns EAI_FAMILY. Note that sa->sa_len should be consistent with salen though the value of sa->sa_len is not directly used in this function.

The host and service names associated with sa are stored in host and serv which have length parameters hostlen and servlen. The maximum value for hostlen is NI_MAXHOST and the maximum value for servlen is NI_MAXSERV, as defined by < netdb.h>. If a length parameter is zero, no string will be stored. Otherwise, enough space must be provided to store the host name or service string plus a byte for the NUL terminator.

The flags argument is formed by OR'ing the following values:

NI_NOFQDN	A fully qualified domain name is not required for local hosts. The local part of the fully qualified domain name is returned instead.
NI_NUMERICHOST	Return the address in numeric form, as if calling inet_ntop(3), instead of a host name.
NI_NAMEREQD	A name is required. If the host name cannot be found in DNS and this flag is set, a non-zero error code is returned. If the host name is not found and the flag is not set, the address is returned in numeric form.
NI_NUMERICSERV	The service name is returned as a digit string representing the port number.
NI_NUMERICSCOPE	The scope identifier is returned as a digit string.
NI_DGRAM	Specifies that the service being looked up is a datagram service, and causes getservbyport(3) to be called with a second argument of "udp" instead of its default of "tcp". This is required for the few ports (512-514) that have different services for UDP and TCP.

This implementation allows numeric IPv6 address notation with scope identifier, as documented in chapter 11 of RFC 4007. IPv6 link-local address will appear as a string like "fe80::1%ne0". Refer to getaddrinfo(3) for more information.

R. Gilligan, S. Thomson, J. Bound, J. McCann, W. Stevens, RFC 3493, Basic Socket Interface Extensions for IPv6, February 2003.

S. Deering, B. Haberman, T. Jinmei, E. Nordmark, B. Zill, RFC 4007, IPv6 Scoped Address Architecture, March 2005.

Craig Metz, Proceedings of the freenix track: 2000 USENIX annual technical conference, Protocol Independence Using the Sockets API, June 2000.

1.0.0.127.in-addr.arpa. IN PTR  10.1.1.1

and trick the caller of getnameinfo() into believing that sa is 10.1.1.1 when it is actually 127.0.0.1.

To prevent such attacks, the use of NI_NAMEREQD is recommended when the result of getnameinfo() is used for access control purposes:

struct sockaddr *sa;
socklen_t salen;
char addr[NI_MAXHOST];
struct addrinfo hints, *res;
int error;

error = getnameinfo(sa, salen, addr, sizeof(addr),
    NULL, 0, NI_NAMEREQD);
if (error == 0) {
        memset(&hints, 0, sizeof(hints));
        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
        hints.ai_flags = AI_NUMERICHOST;
        if (getaddrinfo(addr, "0", &hints, &res) == 0) {
                /* malicious PTR record */
                freeaddrinfo(res);
                printf("bogus PTR record\n");
                return -1;
        }
        /* addr is FQDN as a result of PTR lookup */
} else {
        /* addr is numeric string */
        error = getnameinfo(sa, salen, addr, sizeof(addr),
            NULL, 0, NI_NUMERICHOST);
}