This seems kind of inefficient -- O(n). Instead, you can look up the IP in the trie itself, making sure that it's an exact match, and then after double check that node->peer==peer.

That's what we do on Linux and in Go:

https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/allowedips.c?h=devel#n283
https://git.zx2c4.com/wireguard-go/tree/device/allowedips.go#n259

Would it be better to have this macro be constructed by oring together the various supported flags for future proofing?

I think you actually have to check if (aip->a_peer != peer) { unlock...(); return ENOENT; }, because the user could conceivably try to delete an aip that belongs to a different peer. See line 291 here: https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/allowedips.c#n283

It finds the node with an exact match (not nearest match!), and then checks that the node's peer is the peer we want.

Similar code in the go, which is maybe clearer: https://git.zx2c4.com/wireguard-go/tree/device/allowedips.go#n258

	if prefix.Addr().Is6() {
		ip := prefix.Addr().As16()
		node, exact = table.IPv6.nodePlacement(ip[:], uint8(prefix.Bits()))
	} else if prefix.Addr().Is4() {
		ip := prefix.Addr().As4()
		node, exact = table.IPv4.nodePlacement(ip[:], uint8(prefix.Bits()))
	}

First looks up the node and whether or not it's an exact match. Then:

	if !exact || node == nil || peer != node.peer {
		return
	}
	node.remove()

It checks to see if it's exact, if it's actually a node, and if it's a node for the peer in question.

Whoops, yeah, meant to return to that. Will fix