On Sun, Feb 22, 2026 at 12:44:35PM -0500, Jon Maloy wrote:
> We replace the  fwd_guest_accessible4() and fwd_guest_accessible6()
> functions with a unified fwd_guest_accessible() function that handles
> both address families. With the unified address array, we can check
> all configured addresses in a single pass using for_each_addr() with
> family filter INADDR_UNSPEC (== 0).
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>
> ---
>  fwd.c | 70 +++++++++++++++--------------------------------------------
>  1 file changed, 18 insertions(+), 52 deletions(-)
> 
> diff --git a/fwd.c b/fwd.c
> index cf13ddd..edf6a6b 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -880,19 +880,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini)
>  }
>  
>  /**
> - * fwd_guest_accessible4() - Is IPv4 address guest-accessible
> + * fwd_guest_accessible() - Is address guest-accessible
>   * @c:		Execution context
> - * @addr:	Host visible IPv4 address
> + * @addr:	Host visible address (IPv4 or IPv6)
>   *
>   * Return: true if @addr on the host is accessible to the guest without
>   *         translation, false otherwise
>   */
> -static bool fwd_guest_accessible4(const struct ctx *c,
> -				    const struct in_addr *addr)
> +static bool fwd_guest_accessible(const struct ctx *c,
> +				 const union inany_addr *addr)
>  {
> -	struct inany_addr_entry *e = first_v4(c);
> +	const struct inany_addr_entry *e;
>  
> -	if (IN4_IS_ADDR_LOOPBACK(addr))
> +	if (inany_is_loopback(addr))
>  		return false;
>  
>  	/* In socket interfaces 0.0.0.0 generally means "any" or unspecified,
> @@ -900,66 +900,32 @@ static bool fwd_guest_accessible4(const struct ctx *c,
>  	 * that has a different meaning for host and guest, we can't let it
>  	 * through untranslated.
>  	 */
> -	if (IN4_IS_ADDR_UNSPECIFIED(addr))
> -		return false;
> -
> -	/* For IPv4, addr_seen is initialised to addr, so is always a valid
> -	 * address
> -	 */
> -	if ((e && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&e->addr))) ||
> -	    IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen))
> +	if (inany_is_unspecified4(addr))

You want inany_is_unspecified(), not inany_is_unspecified4().

>  		return false;
>  
> -	return true;
> -}
> -
> -/**
> - * fwd_guest_accessible6() - Is IPv6 address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv6 address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible6(const struct ctx *c,
> -				  const struct in6_addr *addr)
> -{
> -	if (IN6_IS_ADDR_LOOPBACK(addr))
> -		return false;
> +	/* Check against all configured guest addresses */
> +	for_each_addr(e, c, 0)
> +		if (inany_equals(addr, &e->addr))
> +			return false;
>  
> -	if (first_v6(c) && IN6_ARE_ADDR_EQUAL(addr, &first_v6(c)->addr.a6))
> +	/* Also check addr_seen: it tracks the address the guest is actually
> +	 * using, which may differ from configured addresses.
> +	 */
> +	if (inany_equals4(addr, &c->ip4.addr_seen))
>  		return false;
>  
>  	/* For IPv6, addr_seen starts unspecified, because we don't know what LL
>  	 * address the guest will take until we see it.  Only check against it
>  	 * if it has been set to a real address.
>  	 */
> -	if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&
> -	    IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen))
> +	if (!inany_v4(addr) &&

You don't need this test.  If addr is IPv4, it necessarily won't equal
ip6.addr_seen which is IPv6.

> +	    !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&
> +	    inany_equals6(addr, &c->ip6.addr_seen))
>  		return false;
>  
>  	return true;
>  }
>  
> -/**
> - * fwd_guest_accessible() - Is IPv[46] address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv[46] address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible(const struct ctx *c,
> -				 const union inany_addr *addr)
> -{
> -	const struct in_addr *a4 = inany_v4(addr);
> -
> -	if (a4)
> -		return fwd_guest_accessible4(c, a4);
> -
> -	return fwd_guest_accessible6(c, &addr->a6);
> -}
> -
>  /**
>   * nat_outbound() - Apply address translation for outbound (TAP to HOST)
>   * @c:		Execution context
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson