fix(qemu): pass SLIRP DNS address via kernel cmdline when QEMU_NET_CIDR is set (#2570)

* fix(qemu): pass SLIRP DNS address via kernel cmdline when QEMU_NET_CIDR is set

## What

When QEMU_NET_CIDR overrides the SLIRP internal network, derive the
correct DNS server address (network base + 3, per SLIRP convention) and
pass it to the guest via the `dns=` kernel command line parameter.

## Why

Guest init scripts typically write `/etc/resolv.conf` using the `dns=`
kernel param with a fallback to `10.0.2.3` (SLIRP's default). When
QEMU_NET_CIDR moves the SLIRP network to a different subnet (e.g.,
`192.168.76.0/24`), the default DNS address `10.0.2.3` no longer exists
on that network and all DNS resolution inside the QEMU VM fails. This
breaks git clones, submodule fetches, and any other network operation
that requires name resolution.

## Notes

- When QEMU_NET_CIDR is not set or empty, no `dns=` is added to the
  kernel cmdline. Zero behavior change for existing builds.
- The `dns=` parameter follows QEMU/Linux kernel cmdline conventions
  and is already consumed by common guest init scripts.

Signed-off-by: jmeridth <jmeridth@gmail.com>

* fix(qemu): address review feedback on SLIRP DNS handling

- Set dns= explicitly on QEMU netdev args so melange is authoritative
  about the DNS address rather than relying on SLIRP's internal default
  derivation, which uses a different algorithm for prefixes wider than /23
- Remove redundant ip/ipv4 nil-check in slirpDNSAddr, use
  binary.BigEndian for cleaner uint32 pack/unpack
- Remove dead ipnet.Contains check (base+3 is always in-network for
  the /8-/28 range enforced by parseAndValidateNetCIDR)
- Tighten parseAndValidateNetCIDR minimum prefix from /30 to /28 since
  SLIRP needs room for gateway (.2), DNS (.3), and DHCP range (.15+)
- Add /22, /23, and /28 boundary test cases for slirpDNSAddr

Signed-off-by: jmeridth <jmeridth@gmail.com>

---------

Signed-off-by: jmeridth <jmeridth@gmail.com>

Author: jmeridth

pkg/container/qemu_runner.go

@@ -25,6 +25,7 @@ import (
 	"crypto/sha256"
 	_ "embed"
 	"encoding/base64"
+	"encoding/binary"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -806,13 +807,19 @@ func createMicroVM(ctx context.Context, cfg *Config) error {
 	// The value must be a valid IPv4 CIDR. SLIRP automatically assigns the
 	// gateway, DNS, and DHCP range based on the supplied network.
 	// Example: QEMU_NET_CIDR="192.168.76.0/24"
+	var slirpDNS string
 	if netCIDR, ok := os.LookupEnv("QEMU_NET_CIDR"); ok && netCIDR != "" {
 		cidr, err := parseAndValidateNetCIDR(netCIDR)
 		if err != nil {
 			return fmt.Errorf("invalid QEMU_NET_CIDR value %q: %w", netCIDR, err)
 		}
-		log.Infof("qemu: QEMU_NET_CIDR set to %s, overriding SLIRP default network", cidr)
-		netdevArgs += ",net=" + cidr
+		dnsIP, err := slirpDNSAddr(cidr)
+		if err != nil {
+			return fmt.Errorf("deriving SLIRP DNS address from QEMU_NET_CIDR %q: %w", cidr, err)
+		}
+		slirpDNS = dnsIP
+		log.Infof("qemu: QEMU_NET_CIDR set to %s, overriding SLIRP default network (dns=%s)", cidr, slirpDNS)
+		netdevArgs += ",net=" + cidr + ",dns=" + slirpDNS
 	}
 	// QEMU_DNS_SEARCH allows configuring DNS search domains inside the guest VM.
 	// This is useful for builds that need to resolve short hostnames via search
@@ -852,6 +859,13 @@ func createMicroVM(ctx context.Context, cfg *Config) error {
 		cmdlineVar + " sshkey=" + sshkey +
 		" melange_qemu_runner=1"
 
+	// When QEMU_NET_CIDR overrides the SLIRP network, the default DNS
+	// address (10.0.2.3) no longer exists. Pass the correct address via
+	// kernel cmdline so microvm-init writes it to /etc/resolv.conf.
+	if slirpDNS != "" {
+		kernelArgs += " dns=" + slirpDNS
+	}
+
 	// Check for TESTING environment variable and pass it to microvm-init
 	// TESTING must be a number (0 for disabled, non-zero for enabled)
 	if testingValue, ok := os.LookupEnv("TESTING"); ok {
@@ -2582,13 +2596,37 @@ func parseAndValidateNetCIDR(input string) (string, error) {
 	if bits != 32 {
 		return "", fmt.Errorf("CIDR must be IPv4 (got %d-bit mask)", bits)
 	}
-	if ones < 8 || ones > 30 {
-		return "", fmt.Errorf("CIDR prefix length must be between 8 and 30 (got /%d)", ones)
+	if ones < 8 || ones > 28 {
+		return "", fmt.Errorf("CIDR prefix length must be between 8 and 28 (got /%d)", ones)
 	}
 
 	return ipnet.String(), nil
 }
 
+// slirpDNSAddr returns the DNS server address to use for the SLIRP network.
+// The address is network base + 3, placed at offset .3 within the subnet.
+// The caller must also pass this address via the QEMU netdev dns= option so
+// SLIRP serves it, and via the kernel cmdline dns= parameter so the guest
+// init writes it to /etc/resolv.conf. For example, 192.168.76.0/24 yields
+// 192.168.76.3. The input must be a valid IPv4 CIDR (as returned by
+// parseAndValidateNetCIDR).
+func slirpDNSAddr(cidr string) (string, error) {
+	_, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return "", fmt.Errorf("parse CIDR: %w", err)
+	}
+	base := ipnet.IP.To4()
+	if base == nil {
+		return "", fmt.Errorf("not IPv4")
+	}
+
+	n := binary.BigEndian.Uint32(base) + 3
+	dns := make(net.IP, 4)
+	binary.BigEndian.PutUint32(dns, n)
+
+	return dns.String(), nil
+}
+
 // buildDNSSearchNetdevArgs constructs the QEMU netdev dnssearch options string.
 // Returns empty string if no domains provided.
 // Each domain produces a separate ",dnssearch=<domain>" option.

pkg/container/qemu_runner_test.go

@@ -545,10 +545,25 @@ func TestParseAndValidateNetCIDR(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name:    "prefix too long",
+			name:    "prefix too long /29",
+			input:   "192.168.76.0/29",
+			wantErr: true,
+		},
+		{
+			name:    "prefix too long /30",
+			input:   "192.168.76.0/30",
+			wantErr: true,
+		},
+		{
+			name:    "prefix too long /31",
 			input:   "192.168.76.0/31",
 			wantErr: true,
 		},
+		{
+			name:     "valid /28 boundary",
+			input:    "192.168.76.0/28",
+			expected: "192.168.76.0/28",
+		},
 		{
 			name:    "injection via comma",
 			input:   "192.168.76.0/24,dnssearch=evil.com",
@@ -576,6 +591,85 @@ func TestParseAndValidateNetCIDR(t *testing.T) {
 	}
 }
 
+func TestSlirpDNSAddr(t *testing.T) {
+	tests := []struct {
+		name     string
+		cidr     string
+		expected string
+		wantErr  bool
+	}{
+		{
+			name:     "standard /24",
+			cidr:     "192.168.76.0/24",
+			expected: "192.168.76.3",
+		},
+		{
+			name:     "default SLIRP network",
+			cidr:     "10.0.2.0/24",
+			expected: "10.0.2.3",
+		},
+		{
+			name:     "/16 network",
+			cidr:     "172.16.0.0/16",
+			expected: "172.16.0.3",
+		},
+		{
+			name:     "/8 network",
+			cidr:     "10.0.0.0/8",
+			expected: "10.0.0.3",
+		},
+		{
+			name:     "non-zero third octet",
+			cidr:     "192.168.1.0/24",
+			expected: "192.168.1.3",
+		},
+		{
+			name:     "/22 boundary",
+			cidr:     "192.168.0.0/22",
+			expected: "192.168.0.3",
+		},
+		{
+			name:     "/23 boundary",
+			cidr:     "192.168.0.0/23",
+			expected: "192.168.0.3",
+		},
+		{
+			name:     "/28 smallest valid",
+			cidr:     "192.168.76.0/28",
+			expected: "192.168.76.3",
+		},
+		{
+			name:    "invalid CIDR",
+			cidr:    "not-a-cidr",
+			wantErr: true,
+		},
+		{
+			name:    "empty input",
+			cidr:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := slirpDNSAddr(tt.cidr)
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("slirpDNSAddr(%q) expected error, got %q", tt.cidr, result)
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("slirpDNSAddr(%q) unexpected error: %v", tt.cidr, err)
+				return
+			}
+			if result != tt.expected {
+				t.Errorf("slirpDNSAddr(%q) = %q, expected %q", tt.cidr, result, tt.expected)
+			}
+		})
+	}
+}
+
 func TestGetPackageCacheSuffix(t *testing.T) {
 	tests := []struct {
 		name     string