This patch adds the ability to map a host unix socket to a guest tcp socket when
using the slirp backend. This feature was added in libslirp version 4.7.0.

Signed-off-by: Viktor Kurilko <murlockkinght@gmail.com>
---
 net/slirp.c | 65 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 52 insertions(+), 13 deletions(-)

diff --git a/net/slirp.c b/net/slirp.c
index 9657e86a84..fc03e58402 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -795,12 +795,16 @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 
 static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
 {
-    struct sockaddr_in host_addr = {
-        .sin_family = AF_INET,
-        .sin_addr = {
-            .s_addr = INADDR_ANY,
-        },
-    };
+    union {
+        struct sockaddr_in in;
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+        struct sockaddr_un un;
+#endif
+    } host_addr = {0};
+    host_addr.in.sin_family = AF_INET;
+    host_addr.in.sin_addr.s_addr = INADDR_ANY;
+    socklen_t host_addr_size = sizeof(host_addr.in);
+
     struct sockaddr_in guest_addr = {
         .sin_family = AF_INET,
         .sin_addr = {
@@ -833,7 +837,7 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
         fail_reason = "Missing : separator";
         goto fail_syntax;
     }
-    if (buf[0] != '\0' && !inet_aton(buf, &host_addr.sin_addr)) {
+    if (buf[0] != '\0' && !inet_aton(buf, &host_addr.in.sin_addr)) {
         fail_reason = "Bad host address";
         goto fail_syntax;
     }
@@ -842,12 +846,47 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
         fail_reason = "Bad host port separator";
         goto fail_syntax;
     }
-    err = qemu_strtoi(buf, &end, 0, &host_port);
-    if (err || host_port < 0 || host_port > 65535) {
-        fail_reason = "Bad host port";
-        goto fail_syntax;
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+    if (buf[0] == '/') {
+        if (is_udp) {
+            fail_reason = "Mapping unix to udp is not supported";
+            goto fail_syntax;
+        }
+        if (strlen(buf) > sizeof(host_addr.un.sun_path)) {
+            fail_reason = "Unix socket path is too long";
+            goto fail_syntax;
+        }
+        if (access(buf, F_OK) == 0) {
+            struct stat st;
+            if (stat(buf, &st) < 0) {
+                error_setg_errno(errp, errno, "Failed to stat '%s'", buf);
+                goto fail_syntax;
+            }
+
+            if (!S_ISSOCK(st.st_mode)) {
+                fail_reason = "file exists and it's not unix socket";
+                goto fail_syntax;
+            }
+
+            if (unlink(buf) < 0) {
+                error_setg_errno(errp, errno, "Failed to unlink '%s'", buf);
+                goto fail_syntax;
+            }
+        }
+
+        host_addr.un.sun_family = AF_UNIX;
+        memcpy(host_addr.un.sun_path, buf, sizeof(host_addr.un.sun_path));
+        host_addr_size = sizeof(host_addr.un);
+    } else
+#endif
+    {
+        err = qemu_strtoi(buf, &end, 0, &host_port);
+        if (err || host_port < 0 || host_port > 65535) {
+            fail_reason = "Bad host port";
+            goto fail_syntax;
+        }
+        host_addr.in.sin_port = htons(host_port);
     }
-    host_addr.sin_port = htons(host_port);
 
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
         fail_reason = "Missing guest address";
@@ -867,7 +906,7 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
 
 #if SLIRP_CHECK_VERSION(4, 5, 0)
     err = slirp_add_hostxfwd(s->slirp,
-            (struct sockaddr *) &host_addr, sizeof(host_addr),
+            (struct sockaddr *) &host_addr, host_addr_size,
             (struct sockaddr *) &guest_addr, sizeof(guest_addr),
             is_udp ? SLIRP_HOSTFWD_UDP : 0);
 #else
-- 
2.50.1

On 8/2/25 13:41, Viktor Kurilko wrote:
> +#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
> +    if (buf[0] == '/') {
> +        if (is_udp) {
> +            fail_reason = "Mapping unix to udp is not supported";
> +            goto fail_syntax;
> +        }
> +        if (strlen(buf) > sizeof(host_addr.un.sun_path)) {
> +            fail_reason = "Unix socket path is too long";
> +            goto fail_syntax;
> +        }
> +        if (access(buf, F_OK) == 0) {
> +            struct stat st;
> +            if (stat(buf, &st) < 0) {
> +                error_setg_errno(errp, errno, "Failed to stat '%s'", buf);
> +                goto fail_syntax;
> +            }
> +
> +            if (!S_ISSOCK(st.st_mode)) {
> +                fail_reason = "file exists and it's not unix socket";
> +                goto fail_syntax;
> +            }
> +
> +            if (unlink(buf) < 0) {
> +                error_setg_errno(errp, errno, "Failed to unlink '%s'", buf);
> +                goto fail_syntax;
> +            }
> +        }
> +
> +        host_addr.un.sun_family = AF_UNIX;
> +        memcpy(host_addr.un.sun_path, buf, sizeof(host_addr.un.sun_path));

The memcpy length is incorrect -- buf may have strlen 2.

No need for both access and stat.  If the file does not exist, stat will fail just as well 
as access.

Why are you unlinking the socket?


r~