Introduces dnsmasq DNS forwarder/cache

[vTusharr]

dnsmasq: DNS forwarder/cache app

Adds dnsmasq 2.91 as a catalog app — a DNS forwarder and cache , with DNSSEC validation on by default. DHCP/TFTP are intentionally disabled (they need PF_PACKET raw sockets, layer 2 things .

requirements

• Unikraft ≥ 0.21.0 — uses netlink interface discovery (posix-netlink + the lwIP NETLINK_ROUTE driver) for iface_enumerate.

!-> requires unikraft/lib-dnsmasq#2 & unikraft/lib-nettle#2

[vTusharr]

also .yml and test script will require changing git repo from mine to unikaft's one for nettle and lib dnsmasq

[Copilot]

Pull request overview

Adds dnsmasq as a new Unikraft catalog-core application, including build/run scripts, a rootfs configuration enabling DNS forwarding + caching with DNSSEC validation by default, and a dedicated GitHub Actions workflow to build/test it.

Changes:

• Introduces a new dnsmasq/ app directory with Unikraft config, rootfs, build/run scripts, and a DNS test harness (including DNSSEC checks).
• Updates the repo-level setup.sh to clone the additional dnsmasq dependency libraries (lib-nettle, lib-dnsmasq) from feature branches.
• Adds a standalone CI workflow to build and test dnsmasq on x86_64 (and build-only on arm64).

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
setup.sh	Adds cloning of dnsmasq dependency forks into repos/.
dnsmasq/test.sh	Implements runtime DNS (UDP/TCP) + forwarding + DNSSEC validation checks.
dnsmasq/setup.sh	Creates workdir/ and symlinks required Unikraft/libs into it.
dnsmasq/rootfs/etc/dnsmasq.conf	Provides dnsmasq configuration (forwarding, caching, DNSSEC, local record).
dnsmasq/README.md	Documents setup, running under QEMU slirp, testing, and DNSSEC notes.
dnsmasq/Makefile.uk	Placeholder Makefile.uk (build logic delegated to library).
dnsmasq/Makefile	Standard Unikraft app Makefile wiring UK_ROOT/UK_LIBS/UK_BUILD.
dnsmasq/Config.uk	Kconfig selections for running dnsmasq with initrd rootfs + networking params.
dnsmasq/.scripts/test/wrapper.sh	Starts the instance and runs the app-level DNS tests.
dnsmasq/.scripts/test/common.sh	Shared helpers: cleanup, start instance, wait-for-readiness, success exit.
dnsmasq/.scripts/test/all.sh	Orchestrates build + run/test (x86_64) and build-only (arm64).
dnsmasq/.scripts/test/.gitignore	Ignores test log output directory.
dnsmasq/.scripts/run/qemu.x86_64	Runs dnsmasq under QEMU x86_64 with initrd and hostfwd for DNS.
dnsmasq/.scripts/run/qemu.arm64	Runs dnsmasq under QEMU arm64 with initrd and hostfwd for DNS.
dnsmasq/.scripts/defconfig/qemu.x86_64	App defconfig for x86_64 build.
dnsmasq/.scripts/defconfig/qemu.arm64	App defconfig for arm64 build.
dnsmasq/.scripts/build/qemu.x86_64	Build script for x86_64 target.
dnsmasq/.scripts/build/qemu.arm64	Build script for arm64 target.
dnsmasq/.gitignore	Ignores build outputs, workdir, generated trust anchor file, logs/config artifacts.
.github/workflows/app-dnsmasq.yml	CI workflow to install deps, clone repos, and build/test dnsmasq.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vTusharr]

In my tests & on my local act runner it does fine .

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.

Suppressed comments (5)

setup.sh:22

• This script clones into repos/… paths but never creates the parent directories (repos/, repos/libs, repos/apps). On a clean checkout (where repos/ doesn’t exist), the first clone to repos/unikraft will fail. Create the directories near the top of the script before any clone commands.

# dnsmasq deps. Pinned to feature-branch forks until upstreamed

test -d repos/libs/nettle || git clone -b musl-hogweed-dnssec https://github.com/vTusharr/lib-nettle repos/libs/nettle
test -d repos/libs/dnsmasq || git clone -b dnsmasq-port https://github.com/vTusharr/lib-dnsmasq repos/libs/dnsmasq

.github/workflows/app-dnsmasq.yml:43

• These clone commands target repos/... but the workflow never creates repos/ (or repos/libs). Since git does not create missing parent directories, this step fails on a clean runner unless the repo already contains repos/. Add a mkdir -p before the first clone.

      - name: Clone dnsmasq dependencies into repos/
        run: |
          # lib-nettle/lib-dnsmasq: feature-branch forks until upstreamed.
          test -d repos/unikraft   || git clone --depth 1 https://github.com/unikraft/unikraft repos/unikraft
          test -d repos/libs/lwip  || git clone --depth 1 https://github.com/unikraft/lib-lwip repos/libs/lwip

dnsmasq/.scripts/trust-anchors.py:34

• IANA’s root-anchors.xml uses RFC3339 timestamps with a trailing 'Z' (UTC) in validUntil/validFrom. datetime.fromisoformat() does not accept the 'Z' suffix, so this will raise ValueError and break trust-anchor generation on hosts without /usr/share/dns/root.ds. Normalize the timestamp before parsing.

            # revoked keys must not be anchors.
            retired = key.get("validUntil")
            if retired and datetime.fromisoformat(retired) <= now:
                continue

dnsmasq/test.sh:23

• The forwarding checks treat any answer starting with a digit as success. dig +short may return IPv6 AAAA records first (which can start with a-f), causing false failures even when resolution works. Query A records explicitly (or broaden the match) so the test is stable.

echo "Forwarding: google.com resolves via upstream"
q google.com | grep -qE '^[0-9]'

echo "Forwarding: unikraft.org resolves via upstream"
q unikraft.org | grep -qE '^[0-9]'

dnsmasq/.scripts/test/common.sh:13

• clean_up() currently runs sudo pkill -9 qemu-system, which can kill unrelated QEMU instances on the host/runner. Restrict the kill to the dnsmasq QEMU process (e.g., by matching the kernel path used by the run scripts).

    # qemu runs under sudo (bridge networking), so clean up as root.
    sudo pkill -9 qemu-system
    sudo iptables -t nat -D POSTROUTING -s 172.44.0.0/24 ! -o virbr0 -j MASQUERADE