Re: [PATCH v6 03/13] fwd: Unify guest accessibility checks with unified address array

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 4581 bytes --]

On Sat, Mar 21, 2026 at 08:43:23PM -0400, Jon Maloy wrote:
> We replace the fwd_guest_accessible4() and fwd_guest_accessible6()
> functions with a unified fwd_guest_accessible() function that handles
> both address families. With the unified address array, we can check
> all configured addresses in a single pass using for_each_addr() with
> family filter AF_UNSPEC.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> 
> ---
> v6: -Some fixes based on feedback from David Gibson
> ---
>  fwd.c | 69 ++++++++++++++---------------------------------------------
>  1 file changed, 16 insertions(+), 53 deletions(-)
> 
> diff --git a/fwd.c b/fwd.c
> index 9101d6d..695b5a5 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -991,19 +991,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini)
>  }
>  
>  /**
> - * fwd_guest_accessible4() - Is IPv4 address guest-accessible
> + * fwd_guest_accessible() - Is address guest-accessible
>   * @c:		Execution context
> - * @addr:	Host visible IPv4 address
> + * @addr:	Host visible address (IPv4 or IPv6)
>   *
>   * Return: true if @addr on the host is accessible to the guest without
>   *         translation, false otherwise
>   */
> -static bool fwd_guest_accessible4(const struct ctx *c,
> -				  const struct in_addr *addr)
> +static bool fwd_guest_accessible(const struct ctx *c,
> +				 const union inany_addr *addr)
>  {
> -	const struct guest_addr *a = fwd_get_addr(c, AF_INET, 0, 0);
> +	const struct guest_addr *a;
>  
> -	if (IN4_IS_ADDR_LOOPBACK(addr))
> +	if (inany_is_loopback(addr))
>  		return false;
>  
>  	/* In socket interfaces 0.0.0.0 generally means "any" or unspecified,
> @@ -1011,36 +1011,18 @@ static bool fwd_guest_accessible4(const struct ctx *c,
>  	 * that has a different meaning for host and guest, we can't let it
>  	 * through untranslated.
>  	 */
> -	if (IN4_IS_ADDR_UNSPECIFIED(addr))
> +	if (inany_is_unspecified(addr))
>  		return false;
>  
> -	/* For IPv4, addr_seen is initialised to addr, so is always a valid
> -	 * address
> -	 */
> -	if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) ||
> -	    IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen))
> -		return false;
> -
> -	return true;
> -}
> -
> -/**
> - * fwd_guest_accessible6() - Is IPv6 address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv6 address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible6(const struct ctx *c,
> -				  const struct in6_addr *addr)
> -{
> -	const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0);
> -
> -	if (IN6_IS_ADDR_LOOPBACK(addr))
> -		return false;
> +	/* Check against all configured guest addresses */
> +	for_each_addr(a, c, AF_UNSPEC)
> +		if (inany_equals(addr, &a->addr))
> +			return false;
>  
> -	if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6))
> +	/* Also check addr_seen: it tracks the address the guest is actually
> +	 * using, which may differ from configured addresses.
> +	 */
> +	if (inany_equals4(addr, &c->ip4.addr_seen))
>  		return false;
>  
>  	/* For IPv6, addr_seen starts unspecified, because we don't know what LL
> @@ -1048,31 +1030,12 @@ static bool fwd_guest_accessible6(const struct ctx *c,
>  	 * if it has been set to a real address.
>  	 */
>  	if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&
> -	    IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen))
> +	    inany_equals6(addr, &c->ip6.addr_seen))
>  		return false;
>  
>  	return true;
>  }
>  
> -/**
> - * fwd_guest_accessible() - Is IPv[46] address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv[46] address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible(const struct ctx *c,
> -				 const union inany_addr *addr)
> -{
> -	const struct in_addr *a4 = inany_v4(addr);
> -
> -	if (a4)
> -		return fwd_guest_accessible4(c, a4);
> -
> -	return fwd_guest_accessible6(c, &addr->a6);
> -}
> -
>  /**
>   * nat_outbound() - Apply address translation for outbound (TAP to HOST)
>   * @c:		Execution context
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]