[scarabeusiv]

match_hostname() forward-resolves hosts allow/hosts deny hostname tokens with gethostbyname(), which only returns IPv4 addresses, and string-compares them against the peer's numeric address. For an IPv6 peer the comparison can never succeed, so a hostname token is dead in both lists: in hosts allow, a client whose address is the name's AAAA record is denied anyway (#563); in hosts deny, the same client is admitted — the deny rule silently fails open for IPv6, the failure class CVE-2026-70452 closed for unresolvable tokens.

Resolve the token with getaddrinfo() (PF_UNSPEC) instead and compare each result via inet_ntop, mirroring match_address() in the same file. IPv4 behaviour is unchanged; the only semantics change is that AAAA results now take part in the match. Failure to resolve keeps the existing behaviour (deny tokens fail closed, allow tokens fail as a non-match).

Verified with a loopback daemon (hosts allow/hosts deny = localhost, clients over 127.0.0.1 and ::1): before, IPv6 was denied by the allow rule and admitted past the deny rule; after, both rules apply to both families. daemon-access, daemon-access-ip and daemon-deny-dns-failopen pass.

Spotted by rpmcrab's binary-or-shlib-calls-gethostbyname check (the Rust successor to rpmlint) while auditing the openSUSE rsync package.

Fixes #563.

[scarabeusiv]

Thanks — all three points addressed in 84c9292:

1. The IPv6 matching now sits under #ifdef INET6.
2. The peer address is parsed once with getaddrinfo(AI_NUMERICHOST) and compared in binary form by address family (memcmp over the family-matched sockaddr), mirroring match_address() — no inet_ntop string comparison remains in the hostname path.
3. New regression: testsuite/daemon-access-hostname_test.py covers IPv4 and IPv6 hostname allow/deny, forward lookup = no (deny wins), and unresolvable tokens (deny fails closed, allow doesn't match). All cases run with reverse lookup = no so only the forward path can match.

Verified: warning-free builds with and without INET6 (--disable-ipv6); the new test plus daemon-access-ip, daemon-access-idn, daemon and daemon-config pass; the new test fails on pre-PR master (at the IPv6 allow case), pinning the defect. One caveat: on loopback the string and binary forms render identically, so the test can't distinguish point 2's comparison form — that change follows the requested idiom rather than a test-visible behaviour difference.