Summary

• When using AllowList networking policy, the guest resolves DNS via its own resolvers (e.g. 8.8.8.8) which may return different IPs than the host's resolver for the same hostname (due to anycast/CDN/geo-DNS rotation). The subsequent net_connect to the guest-resolved IP was denied because it wasn't in the host-resolved allow set.
• Fix: intercept DNS responses in net_recvfrom (port 53), parse A/AAAA answer records, and dynamically add resolved IPs to the AllowList when the queried hostname matches an allowed entry.
• Also adds mtime_ns and atime_ns to the fs_stat response so guest-side VFS can expose real file timestamps (previously always returned 0).

Details

Networking:

• AllowList gains a learned_ips: Arc<Mutex<HashSet<IpAddr>>> field
• is_allowed() checks learned_ips in addition to the static set and re-resolution
• learn_ips_from_dns_response() is a minimal DNS response parser that extracts A (type 1) and AAAA (type 28) records
• Only learns IPs for hostnames already in the AllowList (no privilege escalation)

Filesystem timestamps:

• fs_stat now returns mtime_ns and atime_ns (nanoseconds since epoch)
• Guest-side lib/hostfs changes (in .unikraft/, gitignored) parse these fields and propagate to vattr — requires initrd rebuild to take effect

Test plan

• Rebuild host, test AllowList with api.github.com (previously failed due to DNS rotation)
• Verify example.com still works (regression check)
• Rebuild initrd with guest-side hostfs changes, verify os.stat() returns real timestamps
• Existing unit tests pass (cargo test)