Commit Graph

9686 Commits

Author SHA1 Message Date
Jonathan Hui 8fbe09e2b5 [nexus] migrate test_srp_ttl.py to nexus (#12960)
This commit migrates the SRP TTL test from the thread-cert Python
framework to the Nexus C++ framework.

The new Nexus test `test_srp_ttl.cpp` covers all four TTL clamping
cases originally implemented in `test_srp_ttl.py`:
1. CLIENT_TTL < TTL_MIN < LEASE_MAX => Clamped to TTL_MIN.
2. TTL_MIN < CLIENT_TTL < TTL_MAX < LEASE_MAX => Used CLIENT_TTL.
3. TTL_MAX < LEASE_MAX < CLIENT_TTL => Clamped to TTL_MAX.
4. LEASE_MAX < TTL_MAX < CLIENT_TTL => Clamped to LEASE_MAX.

Nexus tests provide faster and more scalable network simulations
within a single process, improving CI efficiency.

The original Python script `tests/scripts/thread-cert/test_srp_ttl.py`
is removed as its functionality is now fully covered by Nexus.
2026-04-22 04:18:34 -05:00
Jonathan Hui 706e93f017 [nexus] fix flaky nexus test router_downgrade_on_sec_policy_change (#12959)
The test was failing occasionally due to the unpredictable timing of
tick-aligned timers and dataset propagation in simulations.

Specifically:
1) The router's jittered timeout (minimum 1 second) could expire
   in as little as 1ms if an MLE TimeTick occurred immediately
   after the security policy update.
2) Dataset propagation via MLE Advertisements could take up to
   32 seconds, making immediate checks on the router's role
   unreliable.

This commit fixes the flakiness by:
- Replacing flaky router role checks with `IsRouterRoleAllowed()`
  assertions. This verifies that the security policy has been
  successfully propagated and applied, regardless of whether the
  actual role transition has completed.
- Increasing the propagation wait time to 5 seconds. This provides
  a safe margin for simulated radio propagation while remaining
  well within the leader's 10-second downgrade delay.
- Ensuring both the leader and router are verified for policy
  application in both phases of the test.
- Maintaining the final checks to ensure both nodes eventually
  become detached after the full downgrade delay (150 seconds).

The fix was verified with 1000 consecutive successful iterations.
2026-04-22 02:56:07 -05:00
Jonathan Hui 0a97d566de [nexus] migrate srp server reboot port test to nexus (#12952)
This commit migrates the SRP server reboot port test from the
thread-cert functional tests to the Nexus simulation framework.

The new Nexus test 'test_srp_server_reboot_port.cpp' covers:
- SRP server address mode configuration (Unicast).
- SRP client auto-start discovery of the server.
- SRP server reboot (disable/enable) without node reboot.
- Verification that the server selects a new port after each reboot.
- Robustness of service re-registration over 25 reboot iterations.

The original Python test 'test_srp_server_reboot_port.py' is removed
as its functionality is now fully covered by the Nexus test.
2026-04-22 02:27:17 -05:00
Jonathan Hui 0cf450af44 [nexus] migrate SRP diff lease test to Nexus (#12950)
This commit migrates the SRP register services with different
lease test from the thread-cert Python framework to the Nexus
test framework.

The new Nexus test (test_srp_register_services_diff_lease.cpp)
reproduces the functionality of the original Python test:
- Registration of multiple services with different lease/key-lease
  intervals.
- Verification of per-service lease values on the SRP server.
- Ensuring key-lease is always at least as long as the lease.
- Validating lease renewal and expiry behaviors.
- Testing dynamic changes to default client lease and TTL.

Migrating to Nexus allows for faster and more scalable network
simulations within a single process.
2026-04-21 09:31:49 -05:00
Jonathan Hui 33e163424e [nexus] migrate srp_client_save_server_info to nexus (#12947)
This commit migrates the srp_client_save_server_info test from the
thread-cert Python-based test framework to the Nexus C++ simulation
framework.

The new Nexus test (test_srp_client_save_server_info.cpp) verifies:
- SRP client selects an SRP server when auto-start is enabled.
- SRP client sticks to the current server even if other SRP servers
  become available.
- SRP client saves and reuses the selected server info across SRP
  client stops and restarts.
- SRP client selects a new server if the current one becomes
  unavailable.
- SRP client sticks to the new server even if the old one returns.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-21 08:59:07 -05:00
Jonathan Hui a51677de94 [nexus] migrate srp scale test to nexus (#12949)
This commit migrates the test_srp_register_500_services.py test from
the thread-cert test suite to the Nexus platform.

The new C++ test (tests/nexus/test_srp_scale.cpp) implements the same
functionality: it verifies that 25 SRP clients (13 routers and 12
FEDs) can successfully register a total of 500 services (20 services
per client) with a single SRP server (the leader).

The commit includes:
- Removal of the original Python test file.
- Addition of the new Nexus C++ test file.
- Integration of the new test into CMakeLists.txt and
  run_nexus_tests.sh.
2026-04-21 07:42:46 -05:00
Jonathan Hui acef2288ca [nexus] migrate test_srp_client_remove_host to Nexus (#12946)
This commit migrates the SRP client host removal test from the
thread-cert Python-based framework to the Nexus framework.

The new C++ implementation in tests/nexus/test_srp_client_remove_host.cpp
covers the same scenarios as the original Python script:
- Successful registration of SRP host and services.
- Verification that ClearHostAndServices() does not immediately remove
  server-side state.
- Verification that RemoveHostAndServices(removeKey=False,
  sendUnregToServer=True) marks the host and services as deleted on the
  SRP server.
- Verification that RemoveHostAndServices(removeKey=True,
  sendUnregToServer=True) fully removes the host and service entries
  from the SRP server.

The original Python script test_srp_client_remove_host.py is removed
as its functionality is now fully covered by the Nexus test.
2026-04-21 06:33:39 -05:00
Jonathan Hui 828ffefb21 [nexus] migrate SRP many services MTU test to Nexus (#12948)
This commit migrates the test_srp_many_services_mtu_check.py from
tests/scripts/thread-cert to the Nexus test framework.

The new test, tests/nexus/test_srp_many_services_mtu_check.cpp,
verifies that the SRP client correctly handles and splits SRP Update
messages when registering a large number of services that exceed
the IPv6 MTU size (1280 bytes).

Changes:
- Added tests/nexus/test_srp_many_services_mtu_check.cpp.
- Updated tests/nexus/CMakeLists.txt to include the new test.
- Removed tests/scripts/thread-cert/test_srp_many_services_mtu_check.py.
2026-04-21 05:20:38 -05:00
Jonathan Hui 2f7ccf5d3e [nexus] stabilize reed_address_solicit_rejected test (#12955)
This commit stabilizes the Nexus reed_address_solicit_rejected test by
increasing the wait time for network data synchronization from 5 seconds
to 15 seconds.

The test was occasionally failing because the 5-second wait was
sometimes insufficient for the REED's service registration to reach the
leader and for the updated network data to be broadcast back to the
REED. Increasing the delay to 15 seconds provides more robust buffer for
these network events.

Verified by running the test 50 times in a loop without failures.
2026-04-21 05:04:00 -05:00
Jonathan Hui a5908e5858 [nexus] migrate mle_msg_key_seq_jump test to nexus (#12933)
This commit migrates the `test_mle_msg_key_seq_jump.py` cert test to the
Nexus simulation framework.

The new Nexus test `test_mle_msg_key_seq_jump.cpp` verifies that nodes
can correctly handle jumps in the MLE key sequence and stay attached to
the network. It covers scenarios like child triggering key sequence
updates via Child Update Request and routers propagating key sequence
updates.

The original Python test script is removed as its functionality is now
fully covered by the new Nexus test.
2026-04-21 04:43:19 -05:00
Jonathan Hui 005297b301 [nexus] migrate srp client lease change test to nexus (#12945)
This commit migrates the 'test_srp_client_change_lease.py' cert test
to the Nexus simulation framework.

The new Nexus test ('test_srp_client_change_lease.cpp') verifies:
- SRP registration with default lease and TTL.
- Updating the lease interval and ensuring it is reflected in SRP
  Update messages.
- Updating the TTL and ensuring it is reflected in SRP Update
  messages.
- Setting the TTL to 0 and ensuring the lease interval is used as
  the TTL in SRP Update messages.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-21 04:34:43 -05:00
Jonathan Hui 4b4caf3485 [nexus] stabilize srp_auto_start test (#12954)
This commit stabilizes the Nexus SRP auto-start test by increasing
the synchronization wait time from 20 seconds to 30 seconds.

The test was occasionally failing in the Nexus environment because
the 20-second wait was sometimes insufficient for the SRP server
registration to fully propagate through the network data and for
the SRP client to process the update and complete its server
selection. Increasing the wait time to 30 seconds provides a more
robust buffer for these network synchronization events.

Verified by running the test 100 times in a loop without failures.
2026-04-21 02:39:10 -05:00
Jonathan Hui 39b982c8d6 [nexus] migrate ipv6 fragmentation test (#12932)
This commit migrates the `test_ipv6_fragmentation.py` cert test to the
Nexus simulation framework.

To support this migration, the Nexus core configuration was updated to
enable IPv6 fragmentation (`OPENTHREAD_CONFIG_IP6_FRAGMENTATION_ENABLE`).

The new Nexus test `test_ipv6_fragmentation.cpp` covers the validation
of IPv6 fragmentation and reassembly. It sends large ICMPv6 Echo
Requests exceeding the 1280-byte MTU between a Leader and a Router:
- 1952 bytes payload from Leader to Router
- 1831 bytes payload from Router to Leader

The original Python test script is removed as its functionality is now
fully covered by the new Nexus test.
2026-04-20 23:26:02 -05:00
Abtin Keshavarzian cd8e6776e8 [mle] encapsulate router ID sequence and mask in RouterIdMask (#12922)
This commit updates the `RouterIdSet` class, renaming it to
`RouterIdMask` and expanding it to encapsulate both the router ID
sequence number and the bitmask. This allows simplifying the
definition of `ThreadRouterMaskTlv` and `RouteTlv`.
2026-04-20 23:25:30 -05:00
dependabot[bot] b03df41b62 github-actions: bump github/codeql-action from 4.31.10 to 4.35.2 (#12943)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.10 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/cdefb33c0f6224e58673d9004f47f7cb3e328b89...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 16:50:27 -05:00
Abtin Keshavarzian 1d6aa9c6d7 [mle] simplify TimeParameterTlv (#12923)
This commit simplifies the `TimeParameterTlv` implementation by
defining a `TimeParameterTlvValue` and using the `SimpleTlvInfo`
template to define `TimeParameterTlv`.
2026-04-20 16:50:01 -05:00
Jonathan Hui e88998abc3 [nexus] migrate test_srp_auto_start_mode to Nexus (#12944)
This commit migrates the SRP auto-start test from the Python-based
thread-cert test suite to the Nexus C++ test framework.

The new Nexus test replicates the logic of the original Python test:
- Forms a network with four router nodes.
- Verifies SRP client auto-start upon server discovery in netdata.
- Tests selection priority between multiple unicast and anycast
  SRP servers.
- Verifies selection based on anycast sequence numbers.
- Tests selection of specific unicast addresses published in
  Service Data.
- Confirms automatic failover and client stop/restart.

The original Python test file is removed as it is now covered by
the Nexus test suite.
2026-04-20 16:47:24 -05:00
Jonathan Hui 41979b593d [nexus] migrate test_netdata_publisher to Nexus (#12931)
This commit migrates the functionality of
tests/scripts/thread-cert/test_netdata_publisher.py to a new Nexus
test tests/nexus/test_netdata_publisher.cpp.

The new Nexus test covers:
- DNS/SRP Anycast entries (equal and different version numbers).
- DNS/SRP Unicast entries (service data and server data).
- Displacement of server data unicast by anycast entries.
- Publisher preference logic for DNS/SRP services.
- On-mesh prefix publisher preference and replacement.
- External route publisher preference and replacement.

Other changes:
- Add netdata_publisher to tests/nexus/CMakeLists.txt.
- Add netdata_publisher to default tests in tests/nexus/run_nexus_tests.sh.
- Remove the old tests/scripts/thread-cert/test_netdata_publisher.py.
2026-04-20 16:47:09 -05:00
Jonathan Hui 516472c1b5 [nexus] migrate key rotation and guard time test to nexus (#12937)
This commit migrates the cert test script to the Nexus simulation
framework.

The new Nexus test  covers:
- Initial key sequence counter and default key switch guard time.
- Dynamic updates of the key rotation time via Operational Dataset
  and verification of the 93% guard time calculation rule.
- Automatic key rotation after the rotation time interval expires.
- Verification that the key switch guard time correctly prevents
  nodes from updating their key sequence counter prematurely when
  receiving MLE messages with a higher sequence.
- Continued communication (ICMP Echo) between nodes even when key
  sequences are temporarily mismatched due to the guard timer.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-20 09:26:18 -05:00
Jonathan Hui 2ed544115b [nexus] fix intermittent failure in dns_client_config_auto_start test (#12940)
This commit fixes an intermittent failure in the Nexus test
'dns_client_config_auto_start'. The test was occasionally failing
because the REED node was not upgrading to the Router role within
the previous 15-second stabilization period.

The Router role transition can take up to 120 seconds due to the
default 'ROUTER_SELECTION_JITTER' parameter. This commit increases
'kStabilizationTime' to 200 seconds to ensure the node has ample
time to become a router before the test proceeds to verify its
DNS configuration.
2026-04-20 08:59:21 -05:00
Suvesh Pratapa 9bff14609d [cli] make otPlatLogOutput weak to allow application override (#12888)
Make `otPlatLogOutput()` `OT_TOOL_WEAK` in `cli_logging.cpp` so that
applications can provide their own strong definition to customize
instance-aware log output behaviour.
2026-04-20 08:34:32 -05:00
Jonathan Hui 4e216d0d88 [nexus] migrate MAC scan test to nexus (#12938)
This commit migrates the 'test_mac_scan.py' cert test to the Nexus
simulation framework.

The new Nexus test 'test_mac_scan.cpp' verifies the IEEE 802.15.4
Active Scan (MAC scan) functionality. It forms a simple network
consisting of a Leader and a Router and performs an active scan
from the Leader to ensure it correctly discovers the Router's
beacon.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-20 02:09:53 -05:00
Jonathan Hui 524240fdb0 [nexus] migrate dns_client_config_auto_start to nexus (#12936)
This commit migrates the dns_client_config_auto_start test from the
thread-cert Python-based test framework to the Nexus C++ simulation
framework.

The new Nexus test (test_dns_client_config_auto_start.cpp) verifies:
- DNS client uses the SRP server address automatically when no
  explicit config is set.
- Explicitly set DNS config takes precedence over auto-discovered
  SRP server address.
- Clearing an explicit DNS config allows the client to fall back to
  the auto-discovered SRP server address.
- DNS client updates its default config when the SRP server changes.

Changes:
- Added tests/nexus/test_dns_client_config_auto_start.cpp
- Updated tests/nexus/CMakeLists.txt to build the new test
- Updated tests/nexus/run_nexus_tests.sh to include it in default
- Removed tests/scripts/thread-cert/test_dns_client_config_auto_start.py
2026-04-20 02:09:35 -05:00
Jonathan Hui a07c892270 [nexus] migrate child supervision test to nexus (#12935)
This commit migrates the functional test for child supervision from
the thread-cert Python-based framework to the Nexus framework.

The original test in 'tests/scripts/thread-cert/test_child_supervision.py'
has been removed and replaced with a C++ implementation in
'tests/nexus/test_child_supervision.cpp'.

The new Nexus test covers:
- Verification of initial child supervision interval on parent and child.
- Dynamically updating the supervision interval and check timeout.
- Behavior when supervision messages are blocked (child detaching).
- Verification of connectivity when child supervision is disabled.
- Handling of zero supervision interval.

'tests/nexus/CMakeLists.txt' is updated to include the new test.
2026-04-20 02:09:19 -05:00
Jonathan Hui 2145cda437 [nexus] migrate REED address solicit rejected test to nexus (#12934)
This commit migrates the 'test_reed_address_solicit_rejected.py' test
from the thread-cert suite to the Nexus test framework.

The new Nexus test 'test_reed_address_solicit_rejected.cpp' covers:
- Verification that a REED node can successfully register a service and
  receive the corresponding Service ALOC (0xfc10).
- Verification that when a REED node's attempt to upgrade to a router
  is rejected by the Leader, it correctly remains a child while
  maintaining its Service ALOC.

The original Python script is removed as its functionality is now
fully covered by the Nexus implementation.
2026-04-20 02:09:01 -05:00
Jonathan Hui a5a5bc622a [nexus] migrate test_br_upgrade_router_role to nexus (#12921)
This commit migrates the functionality of the Python-based certification
test 'test_br_upgrade_router_role.py' to a new Nexus-based C++ test
'test_br_upgrade_router_role.cpp'.

The test verifies that Border Routers (BRs) providing IP connectivity
are eligible to request a router role upgrade even when the active
router count already meets the 'router_upgrade_threshold'.

Key test steps:
- Set router upgrade threshold to 2.
- Ensure three BRs remain in child role when 2 routers already exist.
- Verify BRs upgrade to router role when they provide external routes
  or prefixes, up to the limit of 2 BR routers.
- Verify that a third BR providing external routes remains a child.
- Verify that removing a route from one BR router triggers the child BR
  to upgrade to a router.

The Python test is removed as it is now covered by the Nexus test.
2026-04-20 02:08:28 -05:00
Jonathan Hui d8da3c3ae9 [nexus] set RSSI in simulated ACK frames (#12929)
Set the RSSI field in simulated MAC ACK frames in nexus_core.cpp.

Previously, the simulator did not populate the mRssi field in the
mInfo.mRxInfo structure of simulated ACK frames passed to
otPlatRadioTxDone. This caused OpenThread to ignore the RSSI of ACKs,
preventing the parentRss average from updating on successful data polls
from Sleepy End Devices (SEDs).

Now, the RSSI from the parent to the child is calculated using the radio
model and clamped to int8_t before being assigned to the ACK frame.
2026-04-19 16:43:34 -05:00
Jonathan Hui fba018f36e [nexus] migrate zero_len_external_route to nexus (#12930)
This commit migrates the test for zero-length external routes from a
Python script to the Nexus test framework. The original test was
test_zero_len_external_route.py in tests/scripts/thread-cert.

The new Nexus test test_zero_len_external_route.cpp replicates the
original test scenario:
- Forms a network with a Leader and two Routers.
- Verifies that adding a zero-length external route "::/0" on a Router
  allows routing to a manually added IPv6 address on that Router.
- Verifies that explicit external routes are preferred over on-mesh
  prefixes that have the default route flag set.
- Verifies that removing the external route causes traffic to be
  re-routed (and in this case, fail as intended when the destination
  is moved).
- Verifies that moving the address to another Router with a default
  route flag allows successful routing.

This commit also fixes a bug in Core::SendAndVerifyEchoRequest in
nexus_core.cpp where the ICMP handler was not always unregistered,
especially when failures occurred. This fix ensures that subsequent
handler registrations in the same process do not fail with
kErrorAlready.

Migrating to Nexus provides faster execution and better integration with
the core OpenThread codebase.
2026-04-19 16:40:44 -05:00
Jonathan Hui cea7e325b0 [nexus] migrate ipv6 source selection test to nexus (#12924)
This commit migrates the `test_ipv6_source_selection.py` cert test to
the Nexus simulation framework.

To support this migration, the Nexus framework was extended to allow
verifying the local (source) address on which an ICMP Echo Reply is
received. This is achieved by adding an overload to
`SendAndVerifyEchoRequest` that accepts an expected source address.

The new Nexus test `test_ipv6_source_selection.cpp` covers the
following scenarios:
- RLOC source for RLOC destination
- ML-EID source for ALOC destination
- ML-EID source for ML-EID destination
- Link-local source for Link-local destination
- ML-EID source for Realm-local multicast destination (ff03::1)
- GUA source for GUA destination
- GUA source for external address (via default route)

The original Python test script is removed as its functionality is now
fully covered by the new Nexus test.
2026-04-18 23:37:35 -05:00
Jonathan Hui 5b301fcb72 [nexus] refine CHILD_REMOVED event suppression (#12928)
Refine the event suppression logic in nexus_core.cpp when handling
NeighborTable::kChildRemoved events.

Previously, any valid neighbor found would suppress the event. Now, it
only suppresses the event if the node is found in the Router table.
This ensures that removal events for Sleepy End Devices (SEDs) are not
suppressed, allowing the link to disappear in the visualizer as
expected.
2026-04-18 21:59:02 -05:00
Jonathan Hui 87e9a39eb3 [nexus] fix unused variable warning in otPlatRadioTransmit (#12927)
This commit fixes a compiler warning in nexus_radio.cpp where the
aFrame parameter in otPlatRadioTransmit was considered unused in
non-debug builds. The variable is only used within an OT_ASSERT.

Using OT_UNUSED_VARIABLE is the standard OpenThread pattern to
address unused parameters and ensure clean builds across different
compilers and build configurations.
2026-04-18 21:55:25 -05:00
Jonathan Hui 932e00e12d [nexus] migrate router_downgrade_on_sec_policy_change to nexus (#12926)
This commit migrates the certification test for router downgrade on
security policy change from a Python script to the Nexus test framework.
The original test was test_router_downgrade_on_sec_policy_change.py in
tests/scripts/thread-cert.

The new Nexus test test_router_downgrade_on_sec_policy_change.cpp
replicates the original test scenario:
- Forms a network with a Leader and a Router.
- Verifies that both nodes are in the expected router/leader roles.
- Changes the security policy to disable 'R' bit (routers) and sets the
  version threshold to 7.
- Verifies that the Leader and Router do not immediately downgrade,
  respecting the mandatory 10-second delay.
- Verifies that restoring the original security policy before the
  timeout cancels the pending downgrade.
- Verifies that re-applying the security policy change leads to both
  nodes eventually downgrading to the detached state once the version
  threshold and router disable flags are propagated and the timer
  expires.

Migrating to Nexus provides faster execution using virtual time and a
more integrated environment for debugging core Thread logic.
2026-04-18 21:55:13 -05:00
Jonathan Hui d92a77c1b9 [nexus] fix intermittent failures in 1.4 DNS and PIC tests (#12925)
This commit addresses intermittent failures in Nexus tests 1_4_DNS_TC_1,
1_4_DNS_TC_5, 1_4_PIC_TC_1, 1_4_PIC_TC_3, and 1_4_PIC_TC_4.

The issue was caused by the 'ed1' node occasionally upgrading its role
from an End Device to a Router. When 'ed1' became a router, it would
sometimes use its Routing Locator (RLOC) as the source address for DNS
queries, whereas the verification scripts expected its Mesh Local
Endpoint Identifier (MLEID), leading to packet verification failures.

To resolve this, 'ed1' is now explicitly joined as a Full End Device
(FED) using 'Node::kAsFed' instead of the default Full Thread Device
(FTD) mode. This prevents 'ed1' from becoming a router and ensures it
maintains its End Device role throughout the test, providing stable
addressing for verification.
2026-04-18 21:54:43 -05:00
Jonathan Hui e01eea5c7e [nexus] migrate dataset_updater test to nexus (#12920)
This commit migrates the dataset_updater functional test from the
Python-based thread-cert framework to the Nexus simulation framework.

Nexus provides faster and more scalable network simulations within a
single process using virtual time.

The new test_dataset_updater.cpp covers:
- Network formation and child joining (MED and SED).
- Channel updates initiated by Leader and Router using DatasetUpdater.
- Dataset update overrides between nodes.

The legacy tests/scripts/thread-cert/test_dataset_updater.py is removed
as it is now redundant.
2026-04-18 21:54:17 -05:00
Jonathan Hui f76b876f22 [nexus] add test for informing previous parent on reattach (#12919)
This commit adds a new Nexus test to verify that a Sleepy End Device
(SED) correctly informs its previous parent after reattaching to a new
parent. This replicates the functionality of the now-deleted
test_inform_previous_parent_on_reattach.py script.

The test scenario involves:
- Forming a network with a Leader and a Router.
- Attaching a SED to the Leader.
- Simulating a link failure between the SED and Leader while allowing
  communication between the SED and Router.
- Verifying that the SED reattaches to the Router.
- Confirming that the SED sends an empty IPv6 message (Next Header 59)
  to the Leader's RLOC to inform it of the change.
- Ensuring the SED is successfully removed from the Leader's child
  table.

Migrating this test to Nexus allows for faster execution using virtual
time and single-process simulation.
2026-04-18 10:52:25 -05:00
Jonathan Hui 88f364af1b [tests] remove redundant SRP certification tests (#12910)
The following SRP test scripts in tests/scripts/thread-cert are
redundant as their functionality is now covered by the Nexus test
framework certification suite (test_1_3_SRP_TC_*):

- test_srp_register_single_service.py: Covered by Nexus
  test_1_3_SRP_TC_1.
- test_srp_lease.py: Covered by Nexus test_1_3_SRP_TC_3 (service
  lease) and test_1_3_SRP_TC_4 (key lease).
- test_srp_name_conflicts.py: Covered by Nexus test_1_3_SRP_TC_2.
- test_srp_auto_host_address.py: Covered by Nexus test_1_3_SRP_TC_13.
- test_srp_sub_type.py: Covered by Nexus test_1_3_SRP_TC_15.

Nexus tests are preferred as they run in a single process using
virtual time, making them faster and more reliable than the
multi-process simulation scripts.
2026-04-18 10:52:12 -05:00
Jonathan Hui 27321a2110 [nexus] add WebAssembly support using Emscripten (#12904)
This commit adds support for building the Nexus simulator for
WebAssembly (WASM) using the Emscripten toolchain. This enables the
simulator to run in a web browser environment with a JavaScript-based
control interface and visualization.

Key implementation details:
- Introduced `nexus_wasm.cpp` which defines Emscripten bindings (using
  Embind) for core simulation controls, including stepping time,
  node creation, topology orchestration, and state manipulation.
- Implemented a `WasmObserver` and a global event queue to capture
  simulation events (node state changes, link updates, packet events)
  and expose them to JavaScript via a polling mechanism (`pollEvent`).
- Updated the CMake build system to support the `EMSCRIPTEN` platform,
  configuring specific linker options for ES6 module export,
  modularization, and memory growth.
- Enhanced `build.sh` to allow targeting WASM via `emcmake`.
- Guarded file-system-dependent operations in `nexus_pcap.cpp` and
  adjusted `nexus_core.cpp` to handle WASM-specific constraints where
  standard I/O or multiple observers might not be applicable.
- Added `test_wasm_bindings.mjs`, a Node.js-based smoke test that
  verifies the integrity of the WASM bindings and event pipeline.
- Integrated `nexus-wasm-tests` into the GitHub Actions workflow to
  ensure continuous verification of the WASM build and functionality.
2026-04-17 15:25:28 -05:00
Abtin Keshavarzian c10b4e1da4 [logging] introduce log level override feature (#12903)
This commit introduces a mechanism to temporarily override the log
level. The `Instance` class now provides `OverrideLogLevel()` and
`RestoreLogLevel()` methods. When an override is active, the
effective log level is the maximum of the original user-set level and
the override level. If `SetLogLevel()` is called while an override is
active, it updates the original level and the effective level is
recomputed.

This ensures that log messages are generated only when needed,
without permanently losing the user's original log level
configuration.

The feature is controlled by the new configuration macro
`OPENTHREAD_CONFIG_LOG_LEVEL_OVERRIDE_ENABLE`.

A new Nexus unit test `test_log_override.cpp` is added to validate
the behavior of these new feature.
2026-04-17 13:23:14 -05:00
Jonathan Hui 5fad120d9b [tests] remove redundant MLE and connectivity tests (#12909)
The following test scripts in tests/scripts/thread-cert are now
redundant as their functionality is sufficiently covered by the Nexus
test framework:

- test_detach.py: Covered by Nexus MLE synchronization and parent
  selection tests.
- test_router_upgrade.py: Covered by 5.1.x Nexus router attachment
  tests.

Nexus tests are preferred for these scenarios as they execute in a
single process using virtual time, providing faster and more reliable
verification than the traditional multi-process simulation scripts.
2026-04-17 13:22:46 -05:00
Abtin Keshavarzian 064529cbfc [nexus] add helper to allow link between nodes in nexus (#12906)
Added `Core::AllowLinkBetween()` and `Core::UnallowLinkBetween()`
helper methods to the Nexus test platform. These methods simplify
establishing bidirectional links between nodes in simulation tests by
handling the reciprocal `AllowList()` calls in a single step.

Updated various Nexus test cases to utilize these new helpers,
replacing manual bidirectional `AllowList()` calls. This change
reduces verbosity and ensures consistency in how links are established
in the test topology.
2026-04-17 13:22:27 -05:00
Abtin Keshavarzian 7eb59f71da [network-diag] introduce AnswerBuilder to manage answer messages (#12887)
This commit introduces `AnswerBuilder` class to track and manage
Network Diagnostic answer messages. This class is used when the
response to a query requires multiple CoAP answer messages. It
automatically manages the inclusion of the Query ID and the Answer
TLVs(providing message indexing and "more-to-follow" flags) in each
allocated answer message, while maintaining all answer messages in a
queue. The `NetworkDiagnostic::Server` is updated to use the
`AnswerBuilder`, simplifying the logic for preparing and sending
answers.

The `AnswerBuilder` class is added in a new header file
`network_diagnostic_types.hpp` to allow for its reuse by other
modules in the future.
2026-04-17 13:21:59 -05:00
Jonathan Hui 254043deec [nexus] add gRPC support and live demo (#12898)
This commit introduces gRPC support to the Nexus simulator, enabling
remote control and monitoring of simulations. This infrastructure allows
external tools and visualizers to interact with the simulated network
in real-time.

Key changes:
- Defined `simulation.proto` providing the `NexusService` definition for
  simulation control and event streaming.
- Implemented `GrpcServer` in `nexus_grpc.cpp` which functions as a
  Nexus simulation observer, pushing events to connected clients.
- Added RPCs for dynamic node creation, position updates, node state
  control, and network orchestration (forming and joining).
- Implemented a real-time event stream that includes node state changes,
  link updates, and packet captures (with basic protocol decoding).
- Introduced `nexus_native.cpp` as an entry point for a persistent
  simulation server that can be controlled via gRPC.
- Updated `Core` and `Observer` interfaces to support a list of
  concurrent observers instead of a single instance.
- Enhanced the CMake build system to optionally find and link against
  gRPC and Protobuf, including automatic source generation.
- Updated CI (GitHub Actions) to include build and test steps for the
  new gRPC functionality.
- Added comprehensive unit tests in `test_grpc.cpp` to verify all
  exposed gRPC service methods.
2026-04-16 22:05:19 -05:00
Abtin Keshavarzian e536562296 [mle] simplify CslClockAccuracyTlv (#12905)
This commit updates `CslClockAccuracyTlv` to use the `SimpleTlvInfo`
and a separate `CslClockAccuracyTlvValue` class. This change
simplifies how the TLV is appended to and read from messages
by leveraging the `Tlv::Append<TlvType>` and `Tlv::Find<TlvType>`
helper methods (avoiding the use of `FindTlv()`).
2026-04-16 10:27:08 -05:00
Jonathan Hui e43df01933 [github-actions] remove multiple-instance job from simulation-1.1.yml (#12897)
This commit removes the redundant `multiple-instance` job from the
`simulation-1.1.yml` workflow. This job was used to run Thread 1.1
certification tests with `OT_MULTIPLE_INSTANCE=ON`.

The job is being removed to streamline the CI process and reduce
redundant test coverage, as multiple-instance configurations are
sufficiently covered in other workflow files. The dependency list
for the coverage collection job is also updated to reflect this
removal.
2026-04-15 16:20:45 -05:00
Jonathan Hui e8a52ab654 [nexus] fix false suppression of CHILD_REMOVED events (#12902)
The previous logic for suppressing CHILD_REMOVED events was flawed. It
checked if the neighbor was not in the child table. However, since the
callback is triggered after the child is removed, it was always false,
leading to false suppression for all removed children.

This caused the parent node to never emit "link removed" events to the
UI when children detached, leading to inconsistent link states (dashed
lines) when only one direction was active.

This fix updates the logic to check if a neighbor entry exists in the
neighbor table with an established link (kStateValid). This ensures we
only suppress the event when the child has successfully transitioned to
a router role and established a valid link.
2026-04-15 15:56:01 -05:00
Abtin Keshavarzian 8a032575da [mle] check router role allowed before sending multicast adv (#12876)
This commit updates `Mle::SendMulticastAdvertisement()` to verify
that the router role is allowed by calling `IsRouterRoleAllowed()`
before proceeding to send the multicast MLE advertisement.
2026-04-14 23:38:56 -05:00
Jonathan Hui e2d07be235 [nexus] introduce simulation observer interface and hooks (#12894)
This commit introduces the `SimulationObserver` interface and integrates
it into the Nexus core simulation logic. This allows external systems to
observe node state changes, link updates, and packet events in real-time.

Key changes:
- Defined `SimulationObserver` interface to handle node state changes,
  link updates, packet events, and event clearing.
- Added `SetObserver` and `GetObserver` methods to the `Core` class.
- Implemented `Core::HandleNeighborTableChanged` to notify the observer
  of neighbor additions and removals.
- Implemented `Core::HandleStateChanged` to track node role transitions
  and parent changes, updating links accordingly.
- Integrated packet event notification in `Core::ProcessRadio`,
  including basic destination node ID resolution for unicast frames.
- Added `Core::SetNodeEnabled` to allow enabling or disabling Thread and
  MLE on specific nodes at runtime.
- Updated `Core::Reset` to clear events via the observer.
- Increased `OPENTHREAD_CONFIG_MAX_STATECHANGE_HANDLERS` to accommodate
  the new nexus state change handler.
- Added `mLastParentId` to `Node` class to correctly manage link updates
  during parent switches or detachment.
2026-04-14 23:26:09 -05:00
Jonathan Hui 7829782b06 [ip6] enforce single Hop-by-Hop Options header rule (#12896)
RFC 8200 states that the Hop-by-Hop Options header MUST be the first
extension header and can only occur once in a packet. This commit
updates HandleExtensionHeaders to enforce this rule.

This fix prevents a potential infinite loop or exponential growth of
messages when multiple Hop-by-Hop headers (each containing an MPL
option) are processed. Previously, each MPL option could trigger its
own retransmission, and if these options were evicted from the MPL
SeedSet, they would be re-processed as new messages upon loopback,
leading to exponential growth and eventually a timeout.
2026-04-14 23:25:42 -05:00
Jonathan Hui 0a38d5f97b [nexus] introduce radio model for RSSI calculation (#12892)
This commit adds a new RadioModel class to simulate wireless propagation
characteristics between Nexus nodes. It implements a simple path-loss
model based on node distance to calculate RSSI.

Key changes include:
- Added RadioModel with CalculateRssi and ShouldDropPacket methods.
- Integrated RSSI calculation into the Core radio processing logic.
- Implemented packet dropping for signals below -100 dBm sensitivity.
- Added nexus_radio_model.cpp to the build system.
2026-04-14 16:35:28 -05:00
Abtin Keshavarzian 221a9cbbb0 [mle] track "router role allowed" state in a new variable (#12854)
This commit introduces a new member variable `mRouterRoleAllowed` in
the `Mle` class to cache the evaluation of whether the device is
currently permitted to operate as a router.

Previously, the `IsRouterEligible()` method evaluated several
conditions (e.g., `IsFullThreadDevice()`, `mRouterEligible` config,
and various fields in `SecurityPolicy`) every time it was called.
Since this method is invoked frequently across different `Mle`
operations, re-evaluating these conditions repeatedly was
inefficient.

The new `mRouterRoleAllowed` variable caches the final computed
result. It is updated via the `UpdateRouterRoleAllowed()` method
whenever any underlying input changes, such as:
- `Mle` starting.
- Configuration parameter updates (e.g., `SetRouterEligible()`).
- Security policy changes from the `KeyManager`.

This change centralizes the logic for handling role permission updates
into a single location (`UpdateRouterRoleAllowed()`). By
consolidating the actions taken when the allowed state changes, the
codebase is cleaner and easier to maintain and update.

It also provides a clearer conceptual distinction between the user's
router configuration (`mRouterEligible`) and the effective state
used by the device.
2026-04-14 14:15:22 -05:00