fix(dns): update esp_dns examples, tests, and CI

Migrate esp_dns_basic to net_connect, make the getaddrinfo worker stack
configurable, and enable cross-signed certificate verification in
sdkconfig.defaults. Move the concurrent stress app to
tests/test_apps/esp_dns_concurrent and add it to esp_dns CI builds.

Author: abhik-roy85

.github/workflows/esp_dns__build.yml

@@ -13,9 +13,15 @@ jobs:
     name: Build
     strategy:
       matrix:
-        idf_ver: ["latest", "release-v5.1", "release-v5.2", "release-v5.3", "release-v5.4"]
+        idf_ver: ["latest", "release-v5.4", "release-v5.5", "release-v6.0"]
         idf_target: ["esp32"]
-        test: [ { app: esp_dns_basic, path: "components/esp_dns/examples"}]
+        test:
+          - app: esp_dns_basic
+            path: components/esp_dns/examples
+            ci_relpath: ../../../ci/build_apps.py
+          - app: esp_dns_concurrent
+            path: components/esp_dns/tests/test_apps
+            ci_relpath: ../../../../ci/build_apps.py
         include:
           - idf_ver: "latest"
             warning: "the choice symbol ETHERNET_PHY_LAN867X\nis deprecated: Please use smi_gpio instead"
@@ -31,11 +37,12 @@ jobs:
         env:
           EXPECTED_WARNING: ${{ matrix.warning }}
         shell: bash
-        working-directory: ${{matrix.test.path}}
+        working-directory: ${{ matrix.test.path }}
         run: |
-          if [[ "${{ matrix.idf_ver }}" == "release-v5.3" || "${{ matrix.idf_ver }}" == "release-v5.4" ]]; then
-            export EXPECTED_WARNING="unknown kconfig symbol 'LWIP_USE_ESP_GETADDRINFO'"
+          if [[ "${{ matrix.idf_ver }}" == "release-v5.4" || "${{ matrix.idf_ver }}" == "release-v5.5" ]]; then
+            export EXPECTED_WARNING="unknown kconfig symbol 'LWIP_USE_ESP_GETADDRINFO'
+          unknown kconfig symbol 'MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY'"
           fi
           . ${IDF_PATH}/export.sh
           python -m pip install idf-build-apps
-          python ../../../ci/build_apps.py ./${{ matrix.test.app }} --target ${{ matrix.idf_target }} -vv --preserve-all --pytest-app
+          python ${{ matrix.test.ci_relpath }} ./${{ matrix.test.app }} --target ${{ matrix.idf_target }} -vv --preserve-all --pytest-app

components/esp_dns/examples/esp_dns_basic/README.md

@@ -63,10 +63,11 @@ See the Getting Started Guide for full steps to configure and use ESP-IDF to bui
   Ensure that the network connection details are accurate. For example, verify the Wi-Fi SSID and password or check that the Ethernet connection is secure and not faulty.
 
 * **Memory Issues**:
-  If you encounter memory-related errors, check the system information output which displays free heap and stack high water mark. You may need to increase task stack sizes for more complex DNS operations.
+  If you encounter memory-related errors, check the system information output which displays free heap and stack high water mark. You may need to increase task stack sizes for more complex DNS operations. The `getaddrinfo()` worker stack is configurable via menuconfig (**Example Configuration → getaddrinfo worker task stack size**); default is 8192 bytes.
 
 * **Certificate Issues**:
   For DoT and DoH protocols, ensure that the certificates are valid for the DNS server you're using. The example includes Google DNS certificates, but these may need to be updated if they expire.
+  Cross-signed chain verification is enabled by default in this example's `sdkconfig.defaults` (`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y`). If you still see `No matching trusted root certificate found` with the certificate bundle, confirm that option is present in your active `sdkconfig`. To opt out, remove it from `sdkconfig.defaults` or disable it in menuconfig (**Component config → mbedTLS → Certificate Bundle → Support cross-signed certificate verification**).
 
 ## Example Output
 

components/esp_dns/examples/esp_dns_basic/main/Kconfig.projbuild

@@ -0,0 +1,11 @@
+menu "Example Configuration"
+
+    config EXAMPLE_DNS_ADDRINFO_TASK_STACK
+        int "getaddrinfo worker task stack size (bytes)"
+        range 4096 32768
+        default 8192
+        help
+            Stack size for the FreeRTOS task that runs getaddrinfo() in this example.
+            DoT/DoH resolution pulls in mbedTLS; 4 KiB is too small on typical builds.
+
+endmenu

components/esp_dns/examples/esp_dns_basic/main/esp_dns_example.c

@@ -17,8 +17,9 @@
 #include "nvs_flash.h"
 #include "esp_event.h"
 #include "esp_timer.h"
+#include "sdkconfig.h"
 #include "lwip/opt.h"
-#include "protocol_examples_common.h"
+#include "net_connect.h"
 #include "esp_dns.h"
 #if defined(CONFIG_MBEDTLS_CERTIFICATE_BUNDLE)
 #include "esp_crt_bundle.h"
@@ -31,9 +32,6 @@
 
 #define TAG "example_esp_dns"
 
-/* DoH runs TLS + esp_http_client on the caller task; 4 KB overflows on IDF 6.x */
-#define ADDR_INFO_TASK_STACK_SIZE   (8 * 1024)
-
 extern const char server_root_cert_pem_start[] asm("_binary_cert_google_root_pem_start");
 extern const char server_root_cert_pem_end[]   asm("_binary_cert_google_root_pem_end");
 
@@ -140,7 +138,7 @@ static void run_dns_query_task(void)
 {
     TaskHandle_t task_handle = NULL;
     TaskHandle_t parent_handle = xTaskGetCurrentTaskHandle();
-    xTaskCreate(addr_info_task, "AddressInfo", ADDR_INFO_TASK_STACK_SIZE, parent_handle, 5, &task_handle);
+    xTaskCreate(addr_info_task, "AddressInfo", CONFIG_EXAMPLE_DNS_ADDRINFO_TASK_STACK, parent_handle, 5, &task_handle);
 
     /* Wait for task to complete */
     if (task_handle != NULL) {
@@ -315,7 +313,7 @@ void app_main(void)
      * Read "Establishing Wi-Fi or Ethernet Connection" section in
      * examples/protocols/README.md for more information about this function.
      */
-    ESP_ERROR_CHECK(example_connect());
+    ESP_ERROR_CHECK(net_connect());
 
     /* Test Without ESP_DNS module */
     ESP_LOGI(TAG, "Executing DNS without initializing ESP_DNS module");

components/esp_dns/examples/esp_dns_basic/main/idf_component.yml

@@ -1,8 +1,7 @@
 dependencies:
   idf:
-    version: ">=5.1"
-  protocol_examples_common:
-    path: ${IDF_PATH}/examples/common_components/protocol_examples_common
+    version: ">=5.4.3"
+  espressif/net_connect: "^0.1.1"
   esp_dns:
     version: "*"
     override_path: '../../../'

components/esp_dns/examples/esp_dns_basic/sdkconfig.defaults

@@ -5,3 +5,9 @@ CONFIG_PARTITION_TABLE_SINGLE_APP_LARGE=y
 CONFIG_LWIP_DNS_MAX_HOST_IP=4
 CONFIG_LWIP_USE_ESP_GETADDRINFO=y
 CONFIG_LWIP_HOOK_NETCONN_EXT_RESOLVE_CUSTOM=y
+# Google Public DNS (and many other sites) present cross-signed chains; without this,
+# esp_crt_bundle may log "No matching trusted root certificate found" while PEM pinning works.
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y
+CONFIG_EXAMPLE_DNS_ADDRINFO_TASK_STACK=8192

components/esp_dns/examples/esp_dns_concurrent_test/main/idf_component.yml

@@ -3,18 +3,15 @@
 | Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
 | ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | -------- | -------- | -------- |
 
-This example stress-tests **`getaddrinfo()`** while the **esp_dns** component owns the lwIP **external resolve** hook. It is meant to surface concurrency bugs documented in [ISSUES_AND_PROGRESS.md](../../ISSUES_AND_PROGRESS.md):
-
-- **Issue 1** — shared singleton resolver state (`response_buffer`, transaction id) under concurrent lookups.
-- **Issue 4** — DNS-over-HTTPS builds the response in the same shared handle across overlapping HTTP requests.
+This test app stress-tests **`getaddrinfo()`** while the **esp_dns** component owns the lwIP **external resolve** hook. It exercises concurrent DoT/DoH lookups to catch regressions in per-query resolver state.
 
 ## What it does
 
-1. Connects Wi-Fi or Ethernet via `protocol_examples_common` (`example_connect()`).
+1. Connects Wi-Fi or Ethernet via the **net_connect** component (`net_connect()`).
 2. Initializes **Cloudflare** DNS-over-TLS (`1dot1dot1dot1.cloudflare-dns.com:853`) with the **certificate bundle**.
 3. Starts several FreeRTOS tasks that call `getaddrinfo()` on real hostnames at the same time; then prints success/failure counts.
 4. Repeats the same pattern for **DNS-over-HTTPS** (`1dot1dot1dot1.cloudflare-dns.com:443`, path `dns-query`).
-5. Logs explicit lines when failures occur, e.g. **Issue 1 reproduced** (DoT) / **Issue 4 reproduced** (DoH).
+5. Logs summary lines when lookup failures occur in a batch.
 
 Tunable defines in `main/esp_dns_concurrent_test.c`:
 
@@ -30,20 +27,19 @@ Tunable defines in `main/esp_dns_concurrent_test.c`:
 ## Build and flash
 
 ```bash
-cd /path/to/esp-protocols/components/esp_dns/examples/esp_dns_concurrent_test
+cd /path/to/esp-protocols/components/esp_dns/tests/test_apps/esp_dns_concurrent
 idf.py set-target esp32c6
 idf.py -p PORT flash monitor
 ```
 
 ## Expected output
 
-- Many successful hostname lines, or intermittent **`getaddrinfo()`** failures (status codes depend on lwIP / LWIP-compatible errno mapping).
+- Many successful hostname lines under concurrent DoT/DoH.
 - On failure batches, component logs may include **`ESP_DNS_DOT`** / **`ESP_DNS_DOH`** errors (e.g. failed to extract IP).
-- Summary ends with **`Issue 1 reproduced`** and/or **`Issue 4 reproduced`** when at least one lookup failed in that mode.
 
-If you see **no failures**, increase **`NUM_WORKERS`** and **`ITERATIONS_PER_TASK`** and run again.
+If you see unexpected failures after the concurrency fix, increase **`NUM_WORKERS`** and **`ITERATIONS_PER_TASK`** and run again.
 
 ## Troubleshooting
 
-- **Network**: check `example_connect` credentials in `menuconfig` (same as other protocol examples).
-- **Certificate**: ensure certificate bundle options in `sdkconfig.defaults` match your IDF version (`menuconfig` → mbedTLS → certificate bundle).
+- **Network**: configure Wi-Fi/Ethernet credentials in **net_connect** options in `menuconfig`.
+- **Certificate**: ensure certificate bundle options in `sdkconfig.defaults` match your IDF version (`menuconfig` → mbedTLS → certificate bundle). Cross-signed chain verification is enabled by default in this test app's `sdkconfig.defaults`. Disable it in menuconfig only if you do not need cross-signed chain support.