This commit adds support for TLS in the TCP CLI tool, along with a
test of TLS functionality.
The main purpose of this is to provide an example of how to use
mbedTLS with TCPlp to run TLS. I felt it is important to have an
example because I expect that many applications that use TCP,
particularly those in which a Thread device exchanges data with a
device outside the Thread mesh, will need to run TLS over TCP for
security reasons.
A secondary benefit is to add TCP functionality to the TCP CLI
tool. Additionally, by having the example code be part of a "real"
application (the CLI tool), there is less risk of the code going stale
as OpenThread evolves.
I added an "expects" test for the TLS functionality in the CLI tool. I
also ran the code on two Nordic NRF52840-DK boards to make sure it
works.
The performance impact of TLS appears to be small. When using TCP
without TLS, I am able to achieve ~80 kb/s goodput between two
NRF52840-DK boards. With TLS in the same setup, I am able to achieve
~70-75 kb/s goodput.
This commit add `discover reqcallback {enable/disable}` CLI command
which registers callback to output whenever device gets a "MLE
Discovery Request". This command allows the callback to be explicitly
set when needed and avoid having it be enabled by default (since the
extra output from this callback can be treated as unexpected result by
tests that parse the CLI output).
If an infrastructure-provided NAT64 prefix is present, we should
bypass the NAT64 translator to let the border router forward the
packet to the infra NAT64 service.
The actual output power of the Thread device may be determined by both
the Thread radio chip and the FEM. Consider the output power error of
the Thread radio chip and the gain error of the FEM, the actual output
power is inconsistent with the expected output power. To guarantee
that the actual output power is accurate and meet the regulatory
requirements, the output power should be calibrated in the factory if
the output power is not accurate.
This commit contains the following changes:
- Adds a power calibration implementation
- Adds a config file to configure the target power for different
countries
- Adds a tool for the factory to persist the power calibration data
This commit updates behavior when device mode gets changed
so to re-attach on switching between MTD/FTD modes and also on
switching from rx-on to sleepy (rx-off) mode (when attached as a
child).
This commit also updates `test-027-child-mode-change.py` to match
the new behavior.
This commit increases the wait time in `test_single_border_router`
after re-enabling `ether` link. It also changes the order of pings
in the test (first ping from host to Thread router and the opposite
direction).
This commit add a new feature in `Srp::Client` to allow user to
specify the lease and/or key lease intervals explicitly per service.
The lease intervals in a service can be left unspecified(set to zero)
in which case the default lease intervals will be used.
In an SRP Update message, the lease info is included in additional
section in an Update Lease Option record. Therefore the lease values
are applicable to the entire message and all its records. If we have
services with different lease intervals, they need to be registered
in separate messages. This commit updates `Srp::Client` to implement
such a mechanism. When preparing an SRP message, we first determine
the lease and key lease intervals and ensure the services using
matching intervals are included in the message.
This commit also updates and simplifies the "single service mode"
functionality to use the newly added mechanism for tracking which
services are included in the message.
This commit adds `test_srp_register_services_diff_lease` which covers
the behavior of the newly added mechanisms.
This commit updates CLI `SrpServer`, `CoapSecure`, `UdpExample`, and
`TcpExample` to use the template `Process<Cmd("cmd")>` model. This
helps make them similar to other CLI modules.
This commit fixes the "single service mode" behavior to handle
if there are many simultaneous service removes. It also updates the
test to cover this situation.
This commit updates CLI `linkmetrics query` command to allow it
to be used in blocking mode (wait for response to query). This
is then used in different tests to validate the `LinkMetrics`
module behavior. In particular, `v1_2_test_single_probe` and
`v1_2_LowPower_7_2_01_ForwardTrackingSeries` are updated to
validate that the received query report message is correctly
parsed.
This commit imports `Crypto` module only when it's used.
This helps thread-cert tests that do not use message factory to run
without having to install `Crypto` module.
According to the Spec, egress packets from LLA should not be
forwarded. Linux kernel doesn't automatically block such forwarding
so that we need to check this before adding the MFC entry.
According to Thread Spec, PBBR should not forward a multicast packet
from Thread interface to Backbone interface when the source address is
Mesh-Local.
This commit fetches the NAT64 prefix on infrastructure interface and
advertise it to Network Data at medium preference.
- Use `getaddrinfo_a()` function to asynchronously lookup the ipv6
address of the special domain `ipv4only.arpa`. The infrastructure
NAT64 prefix is extracted from the domain answer.
- `mInfraIfNat64PrefixStaleTimer` is scheduled to monitor the presence
and change of infrastructure NAT64 prefix.
- `EvaluateNat64Prefix` evaluates whether to advertise the
infrastructure prefix or the local ULA prefix or neither. When there
is a new infrastructure prefix, it will withdraw the legacy one and
add the new one. When the infrastructure prefix no longer exists, it
will withdraw the legacy one and add the local ULA prefix. When the
infrastructure prefix presents again, it will add the infrastructure
prefix and withdraw the local ULA prefix.
New tests are added to test the scenarios when infrastructure NAT64
prefix exists. `DNS64` on OTBR is turned on to enable `bind9` with
NAT64 prefix on infrastructure interface for these tests. `bind9` is
explicitly turned off when testing local ULA prefix. Since bind9 is
conflict with other components like dnssd, all nat64 tests are moved
under /nat64 directory and configured separately.
The case that two or more BRs have same infrastructure NAT64 prefix is
not covered by this commit and will be followed up later.
This commit updates how unspecified CSL channel is conveyed in MLE
messages. Special value of zero in CSL Channel TLV is used to
indicate that the CSL channel is unspecified. The exclusion of the
TLV keeps the CSL channel as before (no change to the previously
set CSL channel).
This commit updates `test_mle_msg_key_seq_jump` to increase the wait
time after key index change for MLE advertisement transmissions. The
MLE advertisement uses trickle timer with max interval of 32 seconds.
Based on this the max interval between two consecutive advertisement
transmissions can be 1.5 times the trickle timer max interval or 48
seconds. The test uses 52 sec as wait time which includes a 4 sec
additional guard time to account for any action and/or message
exchanges after rx of an advertisement. This change should help
address the occasional failures of this test.
Thread BR may advertise IPv6 GUA rather than LLA. For example, Avahi
stops publishing LLA when any GUA is found on the network interface.
This commit enhances mdns_query to find border agents with
non-link-local addresses.
This commit changes the NAT64 CI tests to be ran as an independent
job. A new /nat64 folder is added and it would make it easier to
configure new NAT64 tests in the future.
This commit updates the MLE attach process so that in the first attach
cycle device tries a total of six MLE Parent Requests, the first two
to routers only followed by four to routers and REEDs. For example,
the six Parent Request message will be used before device can decide
to act the leader. An MTD in the next attach attempt (if cannot find a
parent in first attempt cycle), will go to the model of two Parent
Requests (first to routers, then to routers/REEDs).
This change impacts the time it takes for a device to start as leader
(due to increased number of Parent Request and wait time). This commit
updates different test scripts to address the change in the wait
time. It adds a new `config.LEADER_STARTUP_DELAY` constants which is
used for wait time for leader to start.
This commit implements new mechanism in `Mle` related to key sequence
update when an MLE message is received with a larger key sequence
compared to the one being used by `KeyManager`. The MLE messages are
categorized into classes of Authoritative, or Peer depending on the
MLE command type and included TLVs. The class determines different
actions: Authoritative indicates sender is confident that its key seq
is in sync, so receiver will adopt the larger key seq. Peer class is
used when both sender and receiver think they are in sync. In this
case, if the MLE message is from a known neighbor, receiver will
adopt the larger key seq if the difference is one, otherwise it will
try to re-establish link with the neighbor using Authoritative
message exchanges (e.g. sending Link Request or Child Update
Request).
This commit updates `NetworkData::Publisher` so that a call to
`PublishOnMeshPrefix()` or `PublishExternalRoute()` replaces a
previous request for the same prefix. In particular, if the new call
only changes the flags (e.g., preference level) and the prefix is
already added in the Network Data, the change to flags is immediately
reflected in the Network Data. This ensures that existing entries in
the Network Data are not abruptly removed. Note that a change in the
preference level can potentially later cause the entry to be removed
from the Network Data after determining there are other nodes that
are publishing the same prefix with the same or higher preference.
This commit also updates `test_netdata_publisher.py` to test the newly
added behavior.
This commit adds a new mechanism to allow border routers to request
router role upgrade.
A border router which provides IP connectivity (either adding an
external route prefix or an on-mesh prefix with default route flag)
and is acting as a REED is eligible to request a router role upgrade
by sending an "Address Solicit" request to leader with status reason
`BorderRouterRequest`. This reason is used when the number of active
routers in the Thread mesh is above the threshold, and only if the
number of existing eligible BRs (determined from the network data)
that are acting as router is less than two. This mechanism allows up
to two eligible border routers to request router role upgrade when
the number of routers is already above the threshold.
This commit also adds a new test-case `test_br_upgrade_router_role`
which validates the behavior of the new mechanism.
This commit adds a new mechanism in `Srp::Client`: When preparing an
update message, client will check whether the prepared message fits
in an IPv6 MTU (1280 bytes). If it does not, the SRP client would
temporarily enable "single service mode" which ensures only a single
service (along with its sub-types) to be appended in the SRP update
message. After the message is sent SRP client would switch back to
normal behavior and disables the single service mode.
This change addresses situation where user may register many services
(with multiple sub-types and long TXT data) which then may not fit
in a single UDP message payload.
This commit also adds `test_srp_many_services_mtu_check` test which
verifies the newly added behavior.
Time delay between MLE Advertisements after reset can be up to 3.5
seconds. For example:
- 0.0s: Reset Interval, reset interval to 1 seconds, random interval
at 0.5 second
- 0.5s: Transmit MLE Advertisement
- 1.0s: Set interval to 2 seconds, random interval at 2 seconds
- 3.0s: Receive MLE Advertisement, reset interval to 1 second, random
interval at 1.0 second
- 4.0s: Transmit MLE Advertisement
This commit adds a "auto host address mode" in SRP client. When
enabled, host IPv6 addresses are automatically set by SRP client
using all the unicast addresses on Thread netif excluding the
link-local and mesh-local addresses. If there is no valid address,
then Mesh Local EID address is added. The SRP client will
automatically re-register when/if addresses on Thread netif are
updated (e.g., new addresses are added or existing addresses are
removed).
This commit updates CLI to add support for new SRP client APIs related
to the new feature. It also adds `test_srp_auto_host_address` test to
cover the behavior of this feature.
This commit adds an API `otThreadDetachGracefully` to notify other
nodes in the network (if any) and then stop Thread protocol
operation. It sends an Address Release if it's a router, or sets its
child timeout to 0 if it's a child.
Sam Kumar