fix(dns): simplify response parsing and update examples

- Simplified `dns_response_t` to store `ip_addr_t` directly instead of a nested struct.
- Renamed `esp_dns_extract_ip_addresses_from_response` to `esp_dns_get_ips_from_response` and optimized the answer scanning limits.
- Migrated `esp_dns_basic` and `esp_dns_concurrent_test` examples from `protocol_examples_common` to `net_connect`.
- Increased the `addr_info_task` stack size in `esp_dns_basic` to 8192 bytes to prevent stack overflows during DoT/DoH mbedTLS operations.
- Enabled `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` in example `sdkconfig.defaults` to fix validation errors with cross-signed certificate chains (e.g., Google, Cloudflare).
- Updated READMEs with troubleshooting steps for cross-signed certificate errors.

Author: abhik-roy85

.github/workflows/esp_dns__build.yml

@@ -13,7 +13,7 @@ jobs:
     name: Build
     strategy:
       matrix:
-        idf_ver: ["latest", "release-v5.1", "release-v5.2", "release-v5.3", "release-v5.4"]
+        idf_ver: ["latest", "release-v5.4", "release-v5.5", "release-v6.0"]
         idf_target: ["esp32"]
         test: [ { app: esp_dns_basic, path: "components/esp_dns/examples"}]
         include:
@@ -33,8 +33,9 @@ jobs:
         shell: bash
         working-directory: ${{matrix.test.path}}
         run: |
-          if [[ "${{ matrix.idf_ver }}" == "release-v5.3" || "${{ matrix.idf_ver }}" == "release-v5.4" ]]; then
-            export EXPECTED_WARNING="unknown kconfig symbol 'LWIP_USE_ESP_GETADDRINFO'"
+          if [[ "${{ matrix.idf_ver }}" == "release-v5.4" || "${{ matrix.idf_ver }}" == "release-v5.5" ]]; then
+            export EXPECTED_WARNING="unknown kconfig symbol 'LWIP_USE_ESP_GETADDRINFO'
+          unknown kconfig symbol 'MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY'"
           fi
           . ${IDF_PATH}/export.sh
           python -m pip install idf-build-apps

components/esp_dns/README.md

@@ -213,6 +213,7 @@ Once you add this component to your project, it will replace the default LWIP DN
 - **Certificate Errors**:
   - Verify that the correct certificate is provided for secure protocols
   - For public DNS servers, use the certificate bundle approach
+  - If you see `No matching trusted root certificate found` when using the certificate bundle (e.g. with `dns.google` or Cloudflare), the server likely uses a cross-signed chain. You must enable `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y` in your `sdkconfig` (under Component config → mbedTLS → Certificate Bundle → Support cross-signed certificate verification).
 
 - **Timeout Errors**:
   - Increase the timeout value for slow network connections

components/esp_dns/esp_dns_doh.c

@@ -295,7 +295,7 @@ err_t dns_resolve_doh(const esp_dns_handle_t handle, const char *name, ip_addr_t
         }
 
         /* Extract IP addresses from DNS response */
-        err = esp_dns_extract_ip_addresses_from_response(&response_buffer.dns_response, addr);
+        err = esp_dns_get_ips_from_response(&response_buffer.dns_response, addr);
     } else {
         ESP_LOGE(TAG, "HTTP POST request failed: %s", esp_err_to_name(ret));
         err = ERR_VAL;

components/esp_dns/esp_dns_dot.c

@@ -185,7 +185,7 @@ err_t dns_resolve_dot(const esp_dns_handle_t handle, const char *name, ip_addr_t
                                &response_buffer.dns_response);
 
         /* Extract IP addresses from DNS response */
-        err = esp_dns_extract_ip_addresses_from_response(&response_buffer.dns_response, addr);
+        err = esp_dns_get_ips_from_response(&response_buffer.dns_response, addr);
         if (err != ERR_OK) {
             ESP_LOGE(TAG, "Failed to extract IP address from DNS response");
             goto cleanup;

components/esp_dns/esp_dns_tcp.c

@@ -168,7 +168,7 @@ err_t dns_resolve_tcp(const esp_dns_handle_t handle, const char *name, ip_addr_t
                                &response_buffer.dns_response);
 
         /* Extract IP addresses from DNS response */
-        err = esp_dns_extract_ip_addresses_from_response(&response_buffer.dns_response, addr);
+        err = esp_dns_get_ips_from_response(&response_buffer.dns_response, addr);
         if (err != ERR_OK) {
             ESP_LOGE(TAG, "Failed to extract IP address from DNS response");
             goto cleanup;

components/esp_dns/esp_dns_utils.c

@@ -137,8 +137,9 @@ void esp_dns_parse_response(uint8_t *buffer, size_t response_size, dns_response_
         return;
     }
 
-    /* Ensure only MAX_ANSWERS are processed */
-    dns_response->num_answers = (answer_count < MAX_ANSWERS ? answer_count : MAX_ANSWERS);
+    /* Ensure we scan up to ESP_DNS_MAX_ANSWER_SCAN answers */
+    dns_response->num_answers = 0;
+    int scan_count = (answer_count < ESP_DNS_MAX_ANSWER_SCAN ? answer_count : ESP_DNS_MAX_ANSWER_SCAN);
 
     /* Skip the header and question section */
     uint8_t *ptr = buffer + sizeof(dns_header_t);
@@ -154,7 +155,10 @@ void esp_dns_parse_response(uint8_t *buffer, size_t response_size, dns_response_
     ptr += sizeof(dns_question_t);
 
     /* Parse each answer record */
-    for (int i = 0; i < dns_response->num_answers; i++) {
+    for (int i = 0; i < scan_count; i++) {
+        if (dns_response->num_answers >= MAX_ANSWERS) {
+            break; /* We have collected enough IP addresses */
+        }
 
         /* Answer fields */
         ptr = skip_dns_name(ptr, response_size - (ptr - buffer));
@@ -174,24 +178,20 @@ void esp_dns_parse_response(uint8_t *buffer, size_t response_size, dns_response_
 
         /* Validate RR class and ttl */
         if ((class != DNS_RRCLASS_IN) || (ttl > DNS_MAX_TTL)) {
-            dns_response->answers[i].status = ERR_VAL;
             goto next_answer;
         }
 
-        /* Initialize status for this answer */
-        dns_response->answers[i].status = ERR_OK;
-
         /* Check the type of answer */
         if (type == DNS_RRTYPE_A && data_len == 4) {
             /* IPv4 Address (A record) */
-            memcpy(&dns_response->answers[i].ip, ptr, sizeof(struct in_addr));
-            IP_SET_TYPE(&dns_response->answers[i].ip, IPADDR_TYPE_V4);
+            memcpy(&dns_response->answers[dns_response->num_answers], ptr, sizeof(struct in_addr));
+            IP_SET_TYPE(&dns_response->answers[dns_response->num_answers], IPADDR_TYPE_V4);
+            dns_response->num_answers++;
         } else if (type == DNS_RRTYPE_AAAA && data_len == 16) {
             /* IPv6 Address (AAAA record) */
-            memcpy(&dns_response->answers[i].ip, ptr, sizeof(struct in6_addr));
-            IP_SET_TYPE(&dns_response->answers[i].ip, IPADDR_TYPE_V6);
-        } else {
-            dns_response->answers[i].status = ERR_VAL;
+            memcpy(&dns_response->answers[dns_response->num_answers], ptr, sizeof(struct in6_addr));
+            IP_SET_TYPE(&dns_response->answers[dns_response->num_answers], IPADDR_TYPE_V6);
+            dns_response->num_answers++;
         }
 
 next_answer:
@@ -201,42 +201,33 @@ void esp_dns_parse_response(uint8_t *buffer, size_t response_size, dns_response_
 }
 
 /**
- * @brief Converts a dns_response_t to an array of IP addresses.
+ * @brief Copies parsed IP addresses from a DNS response to an array.
  *
- * This function iterates over the DNS response and extracts valid
- * IPv4 and IPv6 addresses, storing them in the provided array.
+ * This function retrieves the valid IPv4 and IPv6 addresses that were
+ * previously parsed and stored in the DNS response structure, copying
+ * them into the provided array.
  *
- * @param response The DNS response to process
- * @param ipaddr Array to store the extracted IP addresses
+ * @param response The parsed DNS response
+ * @param ipaddr Array to store the copied IP addresses
  *
- * @return err_t Status of DNS response parsing
+ * @return err_t ERR_OK on success, or an error code from the response
  */
-err_t esp_dns_extract_ip_addresses_from_response(const dns_response_t *response, ip_addr_t ipaddr[])
+err_t esp_dns_get_ips_from_response(const dns_response_t *response, ip_addr_t ipaddr[])
 {
-    int count = 0;
     memset(ipaddr, 0, DNS_MAX_HOST_IP * sizeof(ip_addr_t));
 
     if (response->status_code != ERR_OK) {
         return response->status_code;
     }
 
-    /* Iterate over the DNS answers */
-    for (int i = 0; i < response->num_answers && count < DNS_MAX_HOST_IP; i++) {
-        const dns_answer_storage_t *answer = &response->answers[i];
-
-        /* Check if the answer is valid */
-        if (answer->status != ERR_OK) {
-            continue;
-        }
-
-        ipaddr[count] = answer->ip;
-        count++;
+    if (response->num_answers == 0) {
+        return ERR_VAL;
     }
 
-    if (count == 0) {
-        return ERR_VAL;
+    /* Copy the valid IP addresses */
+    for (int i = 0; i < response->num_answers; i++) {
+        ipaddr[i] = response->answers[i];
     }
 
-    /* Store the number of valid IP addresses */
     return ERR_OK;
 }

components/esp_dns/esp_dns_utils.h

@@ -70,15 +70,12 @@ typedef struct {
 /** Maximum number of answers that can be stored */
 #define MAX_ANSWERS (CONFIG_LWIP_DNS_MAX_HOST_IP)
 
-#define ESP_DNS_BUFFER_SIZE 512
+/** Maximum number of resource records to scan in a response */
+#ifndef ESP_DNS_MAX_ANSWER_SCAN
+#define ESP_DNS_MAX_ANSWER_SCAN 16
+#endif
 
-/**
- * @brief Structure to store a single DNS answer
- */
-typedef struct {
-    err_t status;      /* Status of the answer */
-    ip_addr_t ip;      /* IP address from the answer */
-} dns_answer_storage_t;
+#define ESP_DNS_BUFFER_SIZE 512
 
 /**
  * @brief Structure to store a complete DNS response
@@ -87,7 +84,7 @@ typedef struct {
     err_t status_code;           /* Overall status of the DNS response */
     uint16_t id;                 /* Transaction ID */
     int num_answers;             /* Number of valid answers */
-    dns_answer_storage_t answers[MAX_ANSWERS];  /* Array of answers */
+    ip_addr_t answers[MAX_ANSWERS];  /* Array of IP addresses */
 } dns_response_t;
 
 /**
@@ -122,17 +119,18 @@ size_t esp_dns_create_query(uint8_t *buffer, size_t buffer_size, const char *hos
 void esp_dns_parse_response(uint8_t *buffer, size_t response_size, dns_response_t *dns_response);
 
 /**
- * @brief Converts a dns_response_t to an array of IP addresses.
+ * @brief Copies parsed IP addresses from a DNS response to an array.
  *
- * This function iterates over the DNS response and extracts valid
- * IPv4 and IPv6 addresses, storing them in the provided array.
+ * This function retrieves the valid IPv4 and IPv6 addresses that were
+ * previously parsed and stored in the DNS response structure, copying
+ * them into the provided array.
  *
- * @param response The DNS response to process.
- * @param ipaddr An array to store the extracted IP addresses.
+ * @param response The parsed DNS response
+ * @param ipaddr Array to store the copied IP addresses
  *
- * @return err Status of dns response parsing
+ * @return err_t ERR_OK on success, or an error code from the response
  */
-err_t esp_dns_extract_ip_addresses_from_response(const dns_response_t *response, ip_addr_t ipaddr[]);
+err_t esp_dns_get_ips_from_response(const dns_response_t *response, ip_addr_t ipaddr[]);
 
 #ifdef __cplusplus
 }

components/esp_dns/examples/esp_dns_basic/README.md

@@ -67,6 +67,7 @@ See the Getting Started Guide for full steps to configure and use ESP-IDF to bui
 
 * **Certificate Issues**:
   For DoT and DoH protocols, ensure that the certificates are valid for the DNS server you're using. The example includes Google DNS certificates, but these may need to be updated if they expire.
+  If you are using the Certificate Bundle and see a `No matching trusted root certificate found` error, it is likely due to cross-signed chains (e.g., from Google). Make sure that `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY=y` is enabled in your configuration. This can be enabled via `idf.py menuconfig` -> `Component config` -> `mbedTLS` -> `Certificate Bundle` -> `Support cross-signed certificate verification`.
 
 ## Example Output
 

components/esp_dns/examples/esp_dns_basic/main/esp_dns_example.c

@@ -18,7 +18,7 @@
 #include "esp_event.h"
 #include "esp_timer.h"
 #include "lwip/opt.h"
-#include "protocol_examples_common.h"
+#include "net_connect.h"
 #include "esp_dns.h"
 #if defined(CONFIG_MBEDTLS_CERTIFICATE_BUNDLE)
 #include "esp_crt_bundle.h"
@@ -31,6 +31,10 @@
 
 #define TAG "example_esp_dns"
 
+/* ESP-IDF xTaskCreate() stack size is in bytes. DoT/DoH paths pull in mbedTLS inside
+ * getaddrinfo(); 4 KiB is too small and triggers a stack overflow on typical builds. */
+#define DNS_ADDRINFO_TASK_STACK 8192
+
 extern const char server_root_cert_pem_start[] asm("_binary_cert_google_root_pem_start");
 extern const char server_root_cert_pem_end[]   asm("_binary_cert_google_root_pem_end");
 
@@ -137,7 +141,7 @@ static void run_dns_query_task(void)
 {
     TaskHandle_t task_handle = NULL;
     TaskHandle_t parent_handle = xTaskGetCurrentTaskHandle();
-    xTaskCreate(addr_info_task, "AddressInfo", 4 * 1024, parent_handle, 5, &task_handle);
+    xTaskCreate(addr_info_task, "AddressInfo", DNS_ADDRINFO_TASK_STACK, parent_handle, 5, &task_handle);
 
     /* Wait for task to complete */
     if (task_handle != NULL) {
@@ -298,7 +302,7 @@ void app_main(void)
      * Read "Establishing Wi-Fi or Ethernet Connection" section in
      * examples/protocols/README.md for more information about this function.
      */
-    ESP_ERROR_CHECK(example_connect());
+    ESP_ERROR_CHECK(net_connect());
 
     /* Test Without ESP_DNS module */
     ESP_LOGI(TAG, "Executing DNS without initializing ESP_DNS module");

components/esp_dns/examples/esp_dns_basic/main/idf_component.yml

@@ -1,8 +1,7 @@
 dependencies:
   idf:
-    version: ">=5.1"
-  protocol_examples_common:
-    path: ${IDF_PATH}/examples/common_components/protocol_examples_common
+    version: ">=5.4.3"
+  espressif/net_connect: "^0.1.1"
   esp_dns:
     version: "*"
     override_path: '../../../'