fix: learn IPs from DNS responses to handle anycast rotation in AllowList

[danbugs]

Summary

• When using AllowList networking policy, the guest resolves DNS via its own resolvers (e.g. 8.8.8.8) which may return different IPs than the host's resolver for the same hostname (due to anycast/CDN/geo-DNS rotation). The subsequent net_connect to the guest-resolved IP was denied because it wasn't in the host-resolved allow set.
• Fix: intercept DNS responses in net_recvfrom (port 53), parse A/AAAA answer records, and dynamically add resolved IPs to the AllowList when the queried hostname matches an allowed entry.
• Also adds mtime_ns and atime_ns to the fs_stat response so guest-side VFS can expose real file timestamps (previously always returned 0).

Details

Networking:

• AllowList gains a learned_ips: Arc<Mutex<HashSet<IpAddr>>> field
• is_allowed() checks learned_ips in addition to the static set and re-resolution
• learn_ips_from_dns_response() is a minimal DNS response parser that extracts A (type 1) and AAAA (type 28) records
• Only learns IPs for hostnames already in the AllowList (no privilege escalation)

Filesystem timestamps:

• fs_stat now returns mtime_ns and atime_ns (nanoseconds since epoch)
• Guest-side lib/hostfs changes (in .unikraft/, gitignored) parse these fields and propagate to vattr — requires initrd rebuild to take effect

Test plan

• Rebuild host, test AllowList with api.github.com (previously failed due to DNS rotation)
• Verify example.com still works (regression check)
• Rebuild initrd with guest-side hostfs changes, verify os.stat() returns real timestamps
• Existing unit tests pass (cargo test)

[github-actions]

Linux Benchmarks

Details

Benchmark suite	Current: 4c374d9	Previous: c6128d7	Ratio
hello_world (median)	20 ms	20 ms	1
pandas (median)	110 ms	110 ms	1
density (per VM)	7 MB	7 MB	1
snapshot (disk)	385 MiB	385 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Windows Benchmarks

Details

Benchmark suite	Current: 4c374d9	Previous: c6128d7	Ratio
hello_world (median)	249 ms	235 ms	1.06
pandas (median)	789 ms	814 ms	0.97
density (per VM)	6 MB	6 MB	1
snapshot (disk)	392 MiB	392 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.