Re: [PATCH v7 03/13] fwd: Unify guest accessibility checks with unified address array

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 4958 bytes --]

On Sun, Apr 12, 2026 at 08:53:09PM -0400, Jon Maloy wrote:
> We replace the fwd_guest_accessible4() and fwd_guest_accessible6()
> functions with a unified fwd_guest_accessible() function that handles
> both address families. With the unified address array, we can check
> all configured addresses in a single pass using for_each_addr() with
> family filter AF_UNSPEC.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

Small pre-existing nit noted below, but it probably goes away later in
the series anyway.

> 
> ---
> v6: -Some fixes based on feedback from David Gibson
> v7: -Added curly brackets to for_each_addr() in fwd_guest_accessible(),
>      as suggested by Stefano Brivio.
> ---
>  fwd.c | 69 +++++++++++++----------------------------------------------
>  1 file changed, 15 insertions(+), 54 deletions(-)
> 
> diff --git a/fwd.c b/fwd.c
> index 14ce0a7..e676c18 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -988,19 +988,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini)
>  }
>  
>  /**
> - * fwd_guest_accessible4() - Is IPv4 address guest-accessible
> + * fwd_guest_accessible() - Is address guest-accessible
>   * @c:		Execution context
> - * @addr:	Host visible IPv4 address
> + * @addr:	Host visible address (IPv4 or IPv6)
>   *
>   * Return: true if @addr on the host is accessible to the guest without
>   *         translation, false otherwise
>   */
> -static bool fwd_guest_accessible4(const struct ctx *c,
> -				  const struct in_addr *addr)
> +static bool fwd_guest_accessible(const struct ctx *c,
> +				 const union inany_addr *addr)
>  {
>  	const struct guest_addr *a;
>  
> -	if (IN4_IS_ADDR_LOOPBACK(addr))
> +	if (inany_is_loopback(addr))
>  		return false;
>  
>  	/* In socket interfaces 0.0.0.0 generally means "any" or unspecified,
> @@ -1008,38 +1008,18 @@ static bool fwd_guest_accessible4(const struct ctx *c,
>  	 * that has a different meaning for host and guest, we can't let it
>  	 * through untranslated.
>  	 */
> -	if (IN4_IS_ADDR_UNSPECIFIED(addr))
> +	if (inany_is_unspecified(addr))
>  		return false;
>  
> -	/* For IPv4, addr_seen is initialised to addr, so is always a valid
> -	 * address
> +	/* Check against all configured guest addresses */
> +	for_each_addr(a, c->addrs, c->addr_count, AF_UNSPEC) {
> +		if (inany_equals(addr, &a->addr))
> +			return false;
> +	}
> +	/* Also check addr_seen: it tracks the address the guest is actually
> +	 * using, which may differ from configured addresses.
>  	 */
> -	a = fwd_get_addr(c, AF_INET, 0, 0);
> -	if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) ||
> -	    IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen))
> -		return false;
> -
> -	return true;
> -}
> -
> -/**
> - * fwd_guest_accessible6() - Is IPv6 address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv6 address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible6(const struct ctx *c,
> -				  const struct in6_addr *addr)
> -{
> -	const struct guest_addr *a;
> -
> -	if (IN6_IS_ADDR_LOOPBACK(addr))
> -		return false;
> -
> -	a = fwd_get_addr(c, AF_INET6, 0, 0);
> -	if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6))
> +	if (inany_equals4(addr, &c->ip4.addr_seen))
>  		return false;
>  
>  	/* For IPv6, addr_seen starts unspecified, because we don't know what LL
> @@ -1047,31 +1027,12 @@ static bool fwd_guest_accessible6(const struct ctx *c,
>  	 * if it has been set to a real address.
>  	 */
>  	if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&

Pre-existing nit: this test is unnecessary, we already checked that
this address is not unspecified, so if addr_seen *is* unspecified,
they can't be equal.

> -	    IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen))
> +	    inany_equals6(addr, &c->ip6.addr_seen))
>  		return false;
>  
>  	return true;
>  }
>  
> -/**
> - * fwd_guest_accessible() - Is IPv[46] address guest-accessible
> - * @c:		Execution context
> - * @addr:	Host visible IPv[46] address
> - *
> - * Return: true if @addr on the host is accessible to the guest without
> - *         translation, false otherwise
> - */
> -static bool fwd_guest_accessible(const struct ctx *c,
> -				 const union inany_addr *addr)
> -{
> -	const struct in_addr *a4 = inany_v4(addr);
> -
> -	if (a4)
> -		return fwd_guest_accessible4(c, a4);
> -
> -	return fwd_guest_accessible6(c, &addr->a6);
> -}
> -
>  /**
>   * nat_outbound() - Apply address translation for outbound (TAP to HOST)
>   * @c:		Execution context
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]