IP6 vs IP4 issues....?

[LCF-AT]

Hi guys,

I have another short question today about using getaddrinfo function and calling diffrents about IP4 & IP6 addresses you can choose.

So I found some diffrents when calling IP4 or IP6 with specific ports (http or https).So normaly I always get an answer by the server I do call anyway if I do call it with port 80 or 443 but I see in some cases it seems not be possible to call a IP6 with port 80 and I do get a "refused" error message (WSAECONNREFUSED (0000274D)) on calling connect function.As I said, it seems only to happen for some sites I have test and other sites are working to connect and send any response back.So now I am no more sure whether calling any IP6 address in first case anymore when I also get a IP4 address of a site I can choose.In best case I want to get a successfully connection anyway whether using IP6 or IP4 version but it seems that its more better using the IP4 version.

Example: 
pagexy.com:443 = success over IP4
pagexy.com:80  = success over IP4 getting 301 moved response

pagexy.com:443 = success over IP6
pagexy.com:80  = failed  over IP6 getting WSAECONNREFUSED

So what do you think guys?Should I just trust in IP4 addresses to call them when I have the choice between IP4 & IP6?In the example above you can see that I get any answer back from server when using IP4 but not in case of IP6 = taken a while before it returns from connect function (few seconds) or more worse when I am using a timeout so then it does hang in the select function for the whole timeout I did set manually before.Lets say I set a timeout of 20 seconds then it does hang into select function for 20 seconds = really bad of course.Anyway, so all in all I just wanted to know your opinion what you do think about that IPx issues etc you know.

greetz

[atom0s]

Your IPv4 info resembles a typical website attempting to enforce SSL where all http:// traffic is forwarded to the proper https:// instead.

Your IPv6 info resembles a server misconfigured for the same thing and not properly handling the forwarding.

[LCF-AT]

Hi,

good ok its an server side issue I can't do anything about it.Could that problem example I did post above also happen the other way round too?

So what would be best?Lets say I am getting some diffrent AF_INET and AF_INET6 structs filled back after calling getaddrinfo function.In normal case I am just reading the first one I found in the ADDRINFO struct anyway if AF_INET or AF_INET6 version and use it to create a socket / connect etc.

So my question now would be whether I should call the first struct (all AF_INET or AF_INET6) and if this does fail should I the loop all structs till any of them does work?

By the way, I have again another question about that getaddrinfo function and the last paramter...

INT WSAAPI getaddrinfo(
  PCSTR           pNodeName,
  PCSTR           pServiceName,
  const ADDRINFOA *pHints,
  PADDRINFOA      *ppResult  <----
);

...the descriptions isnt really good to understand on MSDN.Normaly in real action I do just enter a store location address DWORD into this paramter and after calling that function I get a pointer into back to filled ADDRINFOA struct.It means the function itself does handle it already by itself.On MSDN I can see some example looking so...

    struct addrinfo *result = NULL;
    struct addrinfo *ptr = NULL;
    struct addrinfo hints;
....
    //--------------------------------
    // Setup the hints address info structure
    // which is passed to the getaddrinfo() function
    ZeroMemory( &hints, sizeof(hints) );
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;

    printf("Calling getaddrinfo with following parameters:\n");
    printf("\tnodename = %s\n", argv[1]);
    printf("\tservname (or port) = %s\n\n", argv[2]);
//--------------------------------
// Call getaddrinfo(). If the call succeeds,
// the result variable will hold a linked list
// of addrinfo structures containing response
// information
    dwRetval = getaddrinfo(argv[1], argv[2], &hints, &result); <---------
    if ( dwRetval != 0 ) {
        printf("getaddrinfo failed with error: %d\n", dwRetval);
        WSACleanup();
        return 1;
    }

....so what is in &result now?A pointer address to a ADDRINFOA struct would be same like in &hints paramter.Or is it a pointer to pointer to a free size ADDRINFOA struct?So this last paramter is anyhow confusing and it seems I really don't need to handle this and just putting a free address into only.Maybe you know that and could tell me how to manage this paramter correctly etc.

Thank you

[JMC31337]

This site (in Chinese) explains a bit about that last parameter structure 

“The fourth parameter ppResult is a pointer of type PADDRINFOA, that is, a double pointer of type addrinfo”

https://www.cnblogs.com/Ishore/p/4009205.html

 

[Progman]

Often servers have global settings and per domain or IP settings.  So globally require SSL is on.  But only the IPv4 address is configured for the redirect.  The redirect should have been global possibly or defined also for the IPv6.  Actually usually it's done on domain names which makes more sense.  There are further tricks since SSL can validate IPs and there is some complexity to getting all this to work right in all scenarios such as shared certificates for multiple domains, etc.

[LCF-AT]

Hi again,

good ok and thanks for that info about the double pointer to the struct.For me its still not clear why doing that.As I can read is the 4. parameter used only to get infos into in return and not used to set some request paramters like in param 3.So for me it makes no sense pointing the 4. parameter to another pointer to a ADDRINFOA struct!?I can also call the function getaddrinfo without the 4. paramter (just zero) and I get the same back = pointer to filled ADDRINFOA struct,Do you know what I mean?Thats why I'am asking for whether its needed to handle the 4 paramter or not.

Example: I am using curl to request any page just because curl used getaddrinfo function.

03A7FBF4   0053D789  RETURN to curl.0053D789 from WS2_32.getaddrinfo
03A7FBF8   01C79C68  ASCII "www.bbc.com"
03A7FBFC   03A7FC34  ASCII "80"
03A7FC00   01C99674
03A7FC04   03A7FC08  <-- pointer1

03A7FC08   03A7FC30  <-- pointer2

03A7FC30   01C99670  <-- ADDRINFOA

ADDRINFOA
$ ==>    01C99670  00000000 ai_flags
$+4      01C99674  00000000 ai_family
$+8      01C99678  00000000 ai_socktype
$+C      01C9967C  00000001 ai_protocol    IPPROTO_ICMP = 1 only set paramter into
$+10     01C99680  00000000 ai_addrlen
$+14     01C99684  00000000 ai_canonname
$+18     01C99688  00000000 ai_addr
$+1C     01C9968C  00000000 ai_next
$+20    

Now when the function comes back then the struct curl did set pointers into was not changed or used etc and I am getting a new address back of a filled struct.At the moment it looks like usless extra work I have to do for that paramter 4 which I dont have to do.So did anyone check this already out a little?For me there is no logic (at the moment) using that 4. paramter like description of function says.But of course I wanna use that function correctly but I am still unsure about it. Any more hints about that would be welcome of course.Thanks.

greetz

[JMC31337]

On 6/24/2020 at 2:49 PM, LCF-AT said:

Hi again,

good ok and thanks for that info about the double pointer to the struct.For me its still not clear why doing that.As I can read is the 4. parameter used only to get infos into in return and not used to set some request paramters like in param 3.So for me it makes no sense pointing the 4. parameter to another pointer to a ADDRINFOA struct!?I can also call the function getaddrinfo without the 4. paramter (just zero) and I get the same back = pointer to filled ADDRINFOA struct,Do you know what I mean?Thats why I'am asking for whether its needed to handle the 4 paramter or not.

Example: I am using curl to request any page just because curl used getaddrinfo function.

03A7FBF4   0053D789  RETURN to curl.0053D789 from WS2_32.getaddrinfo
03A7FBF8   01C79C68  ASCII "www.bbc.com"
03A7FBFC   03A7FC34  ASCII "80"
03A7FC00   01C99674
03A7FC04   03A7FC08  <-- pointer1

03A7FC08   03A7FC30  <-- pointer2

03A7FC30   01C99670  <-- ADDRINFOA

ADDRINFOA
$ ==>    01C99670  00000000 ai_flags
$+4      01C99674  00000000 ai_family
$+8      01C99678  00000000 ai_socktype
$+C      01C9967C  00000001 ai_protocol    IPPROTO_ICMP = 1 only set paramter into
$+10     01C99680  00000000 ai_addrlen
$+14     01C99684  00000000 ai_canonname
$+18     01C99688  00000000 ai_addr
$+1C     01C9968C  00000000 ai_next
$+20    

Now when the function comes back then the struct curl did set pointers into was not changed or used etc and I am getting a new address back of a filled struct.At the moment it looks like usless extra work I have to do for that paramter 4 which I dont have to do.So did anyone check this already out a little?For me there is no logic (at the moment) using that 4. paramter like description of function says.But of course I wanna use that function correctly but I am still unsure about it. Any more hints about that would be welcome of course.Thanks.

greetz

the fourth parameter is holding your results that you see in protocol family etc

the third parameter is the type of connection you want to send 

MSDN:

ZeroMemory( &hints, sizeof(hints) ); hints.ai_family = AF_UNSPEC; hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP;
 

clears the memory holding ADDRINFO of sending type... then fills it with the type of connection of TCP socket unspecified family (auto detect IPv4 IPv6) in this case

once that gets sent out we want our servers reply: that’s the info stored in parameter 4 results

You then read the “results” starting at 01C99670

Before you call getaddrinfo breakpoint it on curl and see what the params’ point to

 

[LCF-AT]

Hi,

so lets just talk about again that 4. paramter only.I still dont check that part because we are using already paramter 3 to fill a ADDRINFOA struct with values we want to request so this 3. paramters is glass clear so far.So for what do I need now the 4. parameter?

Maybe it would be make more sense to see a example when this ADDRINFOA struct in paramter 4 gets filled anyhow.In my tests it never get changed.Another try using Curl and checking the results in OllyDBG....

Before the call to getaddrinfo
0316F890   008AD789  RETURN to curl.008AD789 from WS2_32.getaddrinfo
0316F894   02B389A8  ASCII "www.google.com"
0316F898   0316F8D0  ASCII "80"
0316F89C   02B596D4
0316F8A0   0316F8A4

ADDRINFOA struct for paramter 3
$ ==>    02B596D4   00000000 ai_flags    = not set
$+4      02B596D8   00000000 ai_family   = AF_UNSPEC
$+8      02B596DC   00000001 ai_socktype = SOCK_STREAM
$+C      02B596E0   00000000 ai_protocol = IPPROTO_IP
$+10     02B596E4   00000000
$+14     02B596E8   00000000
$+18     02B596EC   00000000
$+1C     02B596F0   00000000

$ ==>    0316F8A4   0316F8CC
$ ==>    0316F8CC   02B596D0

ADDRINFOA struct paramter 4
$ ==>    02B596D0   00000000
$+4      02B596D4   00000000
$+8      02B596D8   00000000
$+C      02B596DC   00000001 ai_protocol = IPPROTO_ICMP ? <-- why this?
$+10     02B596E0   00000000
$+14     02B596E4   00000000
$+18     02B596E8   00000000
$+1C     02B596EC   00000000

...why does Curl set value 1 into ai_protocol?So when I change this value from 1 to 6 = IPPROTO_TCP then the function fails and I get the error WSAESOCKTNOSUPPORT back.Look this...

033CF788   008AD789  RETURN to curl.008AD789 from WS2_32.getaddrinfo
033CF78C   02D19D10  ASCII "www.google.com"
033CF790   033CF7C8  ASCII "80"
033CF794   02D396D4
033CF798   01530000  <-- new test

$ ==>    02D396D4   00000000
$+4      02D396D8   00000000
$+8      02D396DC   00000001
$+C      02D396E0   00000000
$+10     02D396E4   00000000
$+14     02D396E8   00000000
$+18     02D396EC   00000000
$+1C     02D396F0   00000000

Nothing / no pointer
$ ==>    01530000   00000000
$+4      01530004   00000000
$+8      01530008   00000000
$+C      0153000C   00000000
$+10     01530010   00000000
$+14     01530014   00000000
$+18     01530018   00000000
$+1C     0153001C   00000000

Now after function call I got this filled in parameter 4 address

$ ==>    01530000   00E12030 <--- filled by function
$+4      01530004   00000000
$+8      01530008   00000000
$+C      0153000C   00000000
$+10     01530010   00000000
$+14     01530014   00000000
$+18     01530018   00000000
$+1C     0153001C   00000000

$ ==>    00E12030   00000000
$+4      00E12034   00000017  AF_INET6
$+8      00E12038   00000001  SOCK_STREAM
$+C      00E1203C   00000000
$+10     00E12040   0000001C  ai_addrlen
$+14     00E12044   00000000
$+18     00E12048   00E12288  ai_addr
$+1C     00E1204C   00E12378  ai_next
etc

....here I just entered a free address in parm 4 which points to just zero bytes.In return I get a address back from function which points to filled ADDRINFOA struct made by the function itself.In this case I get some IP6 & IP4 structs filled back = same as would I do what Curl does using 4. paramter to set pointer to pointer to ADDRINFOA struct with one filled paramter ai_protocol = IPPROTO_ICMP (dont check why this is set here).Do you know what I mean?Anyhow I get the same back = no diffrent.Maybe you can show / tell me when it makes sense using 4. paramter with which filled infos inside etc.I still dont check this.Specially because I dont get any infos filled into the struct in paramter 4 if I set it or using Curl and checking this in Olly.The function getaddrinfo always just returns a NEW pointer address to the filled with results ADDRINFOA struct and the struct in param 4 keeps unchanged etc.

So I just wanna understand that behavior of param 4 and why I should use it when I get already same back when using not a ADDRINFOA struct + double (sensless) address pointers.You know.I also dont understand the reason why we have to use double pointer addresses in param 4.Why not just a simple single pointer address?Strange.

greetz

[JMC31337]

“ai_protocol = IPPROTO_ICMP ? <-- why this?“

0316F8A4 will hold all the data returned back from your PARAM3 however you showed me the wrong memory buffer 

“ADDRINFOA struct paramter 4 $ ==> 02B596D0 00000000

$+4 02B596D4 00000000

$+8 02B596D8 00000000

$+C 02B596DC 00000001 ai_protocol = IPPROTO_ICMP ? <-- why this?”

The right param4 buffer -> 0316F8A0 0316F8A4

 

which is why in your second example:

“here I just entered a free address in parm 4 which points to just zero bytes”

You manually changed the pointer to point to a memory buffer that will hold all those returned bytes - in your case they were already 00’s 

Why curl did the icmp I dunno ... does it ping a port before the GET I dunno and I haven’t looked at it’s source code sorry 

 

 

 

 

 

Edited July 13, 2020 by JMC31337

[LCF-AT]

Hi again,

thanks for answering so far.I still dont check that 4. parameter.I was checking Curl again and see that the 4. param points at the end to the same address like param 3 has just with -4 = over it but nothing is into.Just like that in visual style....

-------------------
|    Param4       |
-------------------
|    Param3       |
|                 |
|                 |
|                 |
-------------------

....and in addresses....

$ ==>    > 0059D789  RETURN to curl.0059D789 from WS2_32.getaddrinfo
$+4      > 01017BF0  ASCII "google.com"
$+8      > 0356FBD4  RETURN to 0356FBD4
$+C      > 02F19A14
$+10     > 0356FBA8  RETURN to 0356FBA8

Param3
$ ==>    02F19A14  00000000 ai_flags
$+4      02F19A18  00000002 ai_family
$+8      02F19A1C  00000001 ai_socktype
$+C      02F19A20  00000000
$+10     02F19A24  00000000
$+14     02F19A28  00000000
$+18     02F19A2C  00000000
$+1C     02F19A30  00000000
$+20     

Param4
0356FBA8  0356FBD0
to
0356FBD0  02F19A10 = Param3 address -4

$ ==>    02F19A10  00000000  <--- on top over struct!?But nothing into.
------------------------------------------
$+4      02F19A14  00000000  <--- Param3 addr
$+8      02F19A18  00000002
$+C      02F19A1C  00000001
$+10     02F19A20  00000000
$+14     02F19A24  00000000
$+18     02F19A28  00000000
$+1C     02F19A2C  00000000
$+20     

...and the function param4 said.....

ppResult

A pointer to a linked list of one or more addrinfo structures that contains response information about the host.

So is this now called linked?Using those 2 extra pointer addresses in param4 which points at the end to the ADDRINFOA struct -4h on param3?

Hhmm.So I think that the fourth paramter isnt really important (to use as linked style) when just requesting on single filled ADDRINFOA struct.Not sure about that.Maybe anyone could post a example about a filled / pointed linked list to see how it would look and how to create it.

greetz

[JMC31337]

Knew you would say that ... lemme see it brb

[JMC31337]

here's my quick example source code in relevant part since im behind a proxy via iphone at port 443 i use it as an example: 

 hints.ai_family = AF_UNSPEC; 
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;
    getaddrinfo("192.168.127.120","443",&hints,&res);

===========

AT THE CALL:

 

stack params:

 

param3: 

ai_flags=0 - we didnt set any

ai_family = 0 - AF_UNSPEC

ai_socktype = 1 - SOCK_STREAM we set it to this

ai_protocol = 6 - IPPROTO_TCP we also set this

 

 

param4: 

nothing because we havent completed the API call yet

=======================

AFTER THE CALL

EAX = 00000000 (successful call)

 

stack: (its noted i cleaned the esp after call by 10)

 

param3:

hasnt changed

param4 however:

             

so if i read this correctly our reply contains info that the server (my proxy on the iphone) expects

ai_flags = 04 - AI_NUMERICHOST

ai_family = 2 - AF_INET (IPv4)

ai_socktype = 1 - SOCK_STREAM

ai_protocol = 6 - IPPROTO_TCP

ai_addrlen = 10 - The length, in bytes, of the buffer pointed to by the ai_addr member

ai_canonname = 0

ai_addr (sockaddr ) = 0x0071EA80 (mem buffer location)

                 struct sockaddr { ushort sa_family; char sa_data[14]; };    

                                      

ai_next (addrinfo ) = 0x00

A pointer to the next structure in a linked list. This parameter is set to NULL in the last addrinfo structure of a linked list.

We have but one so it was set to NULL

 

 

someone can correct me if im wrong... but thats how it works in a nutshell

 

[LCF-AT]

Hi JMC31337,

thank you for trying to check this out and creating some details.So I see the problem isnt solved yet about param 4.In your example you did the same as I did before (only not putting param 4 over param 3 address) and just entering a free location 4 byte address in param 4.So before it said I have to use a pointer to pointer to ADDRINFO linked struct in param 4 like I can see in CURL.In your example you are not using a pointer to pointer address in param 4.All in all still = ?!?

I did check again the function description about param 4...

ppResult

A pointer to a linked list of one or more addrinfo structures that contains response information about the host.


Upon success, a linked list of addrinfo structures is returned in the ppResult parameter.

...so it could be that we do misunderstand this param maybe, what means that we just need to enter a free location address and in return we get back a linked list of one or more addrinfo structs.So this happens already so far.In this case (if I am right) then I did it already correctly from the beginning but I was getting confused by checking this out in CURL and found that pointer to pointer to addrinfo struct of param 3 address -4.In this case CURL does it wrong = unnecessary pointing of param 4.

Otherwise it dosent match with the MSDN example.....

    struct addrinfo *result = NULL;
    struct addrinfo *ptr = NULL;
    struct addrinfo hints;



    // Setup the hints address info structure
    // which is passed to the getaddrinfo() function
    ZeroMemory( &hints, sizeof(hints) );
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;

    printf("Calling getaddrinfo with following parameters:\n");
    printf("\tnodename = %s\n", argv[1]);
    printf("\tservname (or port) = %s\n\n", argv[2]);
    
//--------------------------------
// Call getaddrinfo(). If the call succeeds,
// the result variable will hold a linked list
// of addrinfo structures containing response
// information
    dwRetval = getaddrinfo(argv[1], argv[2], &hints, &result);
    if ( dwRetval != 0 ) {
        printf("getaddrinfo failed with error: %d\n", dwRetval);
        WSACleanup();
        return 1;
    }

....you know.Uhm!How to make it right?Or is it important to use this 4. param right (or is it possible to use param 4 wrong)?Anyway, so I tried all out so far and playing around with that param 4 but getting just same results back anyway whether I do use param 4 as P2P to addrinfo struct of param3 -4 or whether I am just using a simple free location address of any xy location (random) etc.I dont get any diffrent results back.In that case I would say its just needed to enter a simple free pointer address into param 4 to get there the linked results address back = over out Micky Mouse. But if I am should be wrong then just tell me guys and show me how to make it correctly.

greetz

[LCF-AT]

Hi again,

I have another question about few functions and older systems.

getaddrinfo          Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
getnameinfo          Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
inet_ntop            Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
inet_pton            Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
-------------------
inet_addr            Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
gethostbyname        Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
gethostbyaddr        Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
WSAAddressToString   Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]
inet_ntoa            Minimum supported client 	Windows 8.1, Windows Vista [desktop apps | UWP apps]

I was checking MSDN about minimum OS support and just found all the same!=?Whats this?No XP to find etc.So in normal moddern cases I am just using the first 4 functions to get all infos about a address (IPv4 / IPv6) but I think that they (all or just some) arent not supported by XP.In this case I wanted to check this to build another routine when using code on older OS but now on MSDN I just see all same requirements starting from Win 8.What happend there?The lower 5 functions should be also used on XP if I remember right but wanted to verify this by checking MSDN but now I just found that infos above.Can anyone explain that why all starting same from WIn8 or Vista?

greetz

[Teddy Rogers]

It is not unusual for API's to support different OS versions or even OS builds, predominantly as is the case on Windows 10. There has to be a minimum baseline when the API's are introduced and supported. It is impractical for Microsoft to go back and update every previous OS and build.

For new software I would personally focus my time on developing for OS's that are still in their support life-cycle unless it is for a specific use case.

At least one of the API's you have listed has been deprecated. I would check them all again and follow the guidance notes...

Ted.

[LCF-AT]

Hi Ted,

thanks for your answer.So my goal was it to build a client code which I can also use on XP using older API functions.On the other hand I see that IPv6 arent supported using older functions like inet_addr (only ip4), gethostbyname (also only ip4).So in case of calling a domain name address which only used AF_INET6 type it will fail.

Maybe I should really quit trying to handle / create codes which also would work on XP and just using newer functions which starts their support from Vista OS.

greetz

[JMC31337]

My struct for results is already set as a pointer 

 

struct addrinfo hints, *res;

so my &res is the memory location which will hold a pointer

this pointer comes to us after a successful call 

so *res is pointing to another memory location which has all our linked list results 

 

btw- are you using curl through a proxy ?

Edited July 20, 2020 by JMC31337

[LCF-AT]

Hi,

but its not same as in Curl which used P2Pointer to addrinfostruct of param 3 -4.In your case you just using one single pointer...

0061FCBC | 0061FCCC  <-- Pointer to param 3 -4 address

...anyway, slowly I get enough of that BS param4.

No I don't use a proxy in Curl.Just doing normal simple requests.I am using that version...

curl 7.65.3 (i386-pc-win32) libcurl/7.65.3 OpenSSL/1.1.1c (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.9.0 nghttp2/1.39.2
Release-Date: 2019-07-19
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile MultiSSL NTLM SPNEGO SSL SSPI TLS-SRP brotli libz

greetz

[JMC31337]

Hmmm my x86 version of curl 7.71 won’t pop the getaddrinfo API ... which makes it tough to see what you’re saying about param 4 with curl...

lemme see if I can find you’re particular version ...

Btw - reason I asked about a proxy is getaddrinfo won’t work behind a proxy (https://devblogs.microsoft.com/oldnewthing/20150916-00/?p=91581)

Edited July 21, 2020 by JMC31337

[LCF-AT]

Hi,

so I have test the latest version of Curl no (7.71.1) and it pops getaddrinfo function for me.

curl 7.71.1 (i386-pc-win32) libcurl/7.71.1 OpenSSL/1.1.1g (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.9.0 nghttp2/1.41.0
Release-Date: 2020-07-01
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile MultiSSL NTLM SPNEGO SSL SSPI TLS-SRP UnixSockets brotli libz

Now when I do check getaddrinfo I get something else in this version to see about param4...

$ ==>    032DF6F4    00E0A1BB  RETURN to curl.00E0A1BB from WS2_32.getaddrinfo
$+4      032DF6F8    017BA538  ASCII "www.google.com"
$+8      032DF6FC    032DF740  ASCII "443"
$+C      032DF700    017C41B4
$+10     032DF704    032DF70C

Param3 struct
$ ==>    017C41B4   00000000
$+4      017C41B8   00000000
$+8      017C41BC   00000001
$+C      017C41C0   00000000
$+10     017C41C4   00000000
$+14     017C41C8   00000000
$+18     017C41CC   00000000
$+1C     017C41D0   00000000
$+20     

Param4
032DF70C  01077242  ASCII "%d"
032DF710  032DF738  -  017C41B0 = Param3 -4 address
032DF714  032DF743
032DF718  032DF740  ASCII "443"
032DF71C  017C4190
032DF720  017C4180
032DF724  032DF78C

...the address in Param4 points to a unimportant address with %d format.I think just random.So at address 032DF70C comes the new results address back after calling the function as always.Only thing what is strange is that on Param4 address +4 is stored a pointer address which points go on to param3 address  -4.Same like we had before on other Curl version but this time 4 bytes lower!?Not sure whether this is important or not.Maybe also just random.All in all still unclear.

PS: Ah ok about getaddrinfo + using proxy on system.So I dont use any proxy so far.I will keep this info in my mind for later.At the moment I do re-write my whole client codes just using that newer functions which supports Vista and higher.

 greetz