Adds get_last_str_sep, a variant of get_str_sep that checks for the last
occurence of a separator. Updates slirp_hostfwd to parse unix domain
socket paths with dashes.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/347
Signed-off-by: Christopher Palmer-Richez <crichez@pm.me>
---
QEMU added support for `-netdev user,hostfwd=unix:/tmp/vm-:22` last year.
The implementation detects the first dash, and interprets the right side
of it as the guest address (or lack thereof). If the host socket path
contains a dash, the invocation fails with "Bad guest address."

This tiny patch adds a variant of the `get_str_sep` method previously
used by `slirp_hostfwd`, but that detects the last occurence of a
separator instead: `get_last_str_sep`. The only difference is the use of
`strrchr` instead of `strchr`. `slirp_hostfwd` now uses it. It ignores
dashes up to the last occurence, which allows unix domain socket paths
with dashes.
---
 net/slirp.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/net/slirp.c b/net/slirp.c
index 04925f3318..968be9cc99 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -69,6 +69,26 @@ static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
     return 0;
 }
 
+static int get_last_str_sep(char *buf, int buf_size, const char **pp, int sep)
+{
+    const char *p, *p1;
+    int len;
+    p = *pp;
+    p1 = strrchr(p, sep);
+    if (!p1)
+        return -1;
+    len = p1 - p;
+    p1++;
+    if (buf_size > 0) {
+        if (len > buf_size - 1)
+            len = buf_size - 1;
+        memcpy(buf, p, len);
+        buf[len] = '\0';
+    }
+    *pp = p1;
+    return 0;
+}
+
 /* slirp network adapter */
 
 #define SLIRP_CFG_HOSTFWD 1
@@ -848,7 +868,7 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
 
 #if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
     if (is_unix) {
-        if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
+        if (get_last_str_sep(buf, sizeof(buf), &p, '-') < 0) {
             fail_reason = "Missing - separator";
             goto fail_syntax;
         }

---
base-commit: ece408818d27f745ef1b05fb3cc99a1e7a5bf580
change-id: 20260213-fix-hostfwd-unix-dash-b3fe7b49a362

Best regards,
-- 
Christopher Palmer-Richez <crichez@pm.me>

On 2/14/26 00:57, Christopher Palmer-Richez wrote:
> Adds get_last_str_sep, a variant of get_str_sep that checks for the last
> occurence of a separator. Updates slirp_hostfwd to parse unix domain
> socket paths with dashes.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/347
> Signed-off-by: Christopher Palmer-Richez <crichez@pm.me>
> ---
> QEMU added support for `-netdev user,hostfwd=unix:/tmp/vm-:22` last year.
> The implementation detects the first dash, and interprets the right side
> of it as the guest address (or lack thereof). If the host socket path
> contains a dash, the invocation fails with "Bad guest address."
> 
> This tiny patch adds a variant of the `get_str_sep` method previously
> used by `slirp_hostfwd`, but that detects the last occurence of a
> separator instead: `get_last_str_sep`. The only difference is the use of
> `strrchr` instead of `strchr`. `slirp_hostfwd` now uses it. It ignores
> dashes up to the last occurence, which allows unix domain socket paths
> with dashes.

I think neither of the current or the proposed variants is the right
solution.  It doesn't matter how we count the dashes, one way or another
we'll miss the user intention, for example, does the host side allowed
to contain a host name instead of just an IP address?  Besides,
hostfwd=unix:/tmp/foo-bar-:22 is just ugly, it's difficult to read.

It feels like some other solution should be used here, and the
original way wasn't right (it is in used now already, though).

Or maybe I'm wrong.. dunno.  It somehow feels all wrong :)

Thanks,

/mjt