Commit Graph

9720 Commits

Author SHA1 Message Date
Jonathan Hui d145aafeea [nexus] migrate CoAP observe test to Nexus (#13005)
This commit migrates the functionality covered by test_coap_observe.py
to the Nexus test framework.

- Enabled OPENTHREAD_CONFIG_COAP_OBSERVE_API_ENABLE in Nexus config.
- Created test_coap_observe.cpp to test CoAP observations and
  notifications in a simulated network.
- Handled edge cases in the test to avoid segfaults during cancel
  response processing.
- Removed the old Python test test_coap_observe.py.
2026-04-29 15:18:36 -07:00
Jonathan Hui 5db0dd3dcb [nexus] fix flaky test 1_2_MATN_TC_10 by increasing wait time (#13007)
This commit addresses an occasional failure in test 1_2_MATN_TC_10
where the Router's ping reply was not found in Step 8.

- Increased the time advanced in Step 8 from 10 seconds
  (kStabilizationTime) to 20 seconds (2 * kStabilizationTime).
- This allows more time for address resolution (NS/NA) and packet
  transmission in the simulated environment.
- Verified that the test passes consistently with 100 consecutive
  successful runs after applying this fix.
2026-04-29 13:36:11 -07:00
Jonathan Hui 84f682486e [nexus] migrate CoAP block transfer test to Nexus (#13003)
This commit migrates the functionality covered by test_coap_block.py
to the Nexus test framework.

- Enabled OPENTHREAD_CONFIG_COAP_BLOCKWISE_TRANSFER_ENABLE in Nexus
  config.
- Created test_coap_block.cpp to test CoAP GET and PUT block
  transfers in a simulated network.
- Removed the old Python test test_coap_block.py.
2026-04-29 13:30:42 -07:00
Abtin Keshavarzian 2cf0bdae62 [vendor-info] add vendor OUI support (#12991)
This commit introduces support for configuring and retrieving a vendor
OUI-24 (Organizationally Unique Identifier). It defines the new
`OPENTHREAD_CONFIG_NET_DIAG_VENDOR_OUI` configuration option and adds
the `otThreadGetVendorOui()` and `otThreadSetVendorOui()` APIs.

When specified, the vendor OUI is included in the `BorderAgent`
mDNS/DNS-SD TXT data under the `vo` key.

The `VendorInfo` class is updated to manage the OUI value. This
commit also adds the `vendor oui` CLI command to get or set this
property. Finally, it updates the tests to validate the presence and
correctness of the new `vo` key in the TXT data.
2026-04-29 15:09:43 -05:00
Abtin Keshavarzian d37e9df698 [mle] remove OPENTHREAD_CONFIG_MLE_IP_ADDRS_TO_REGISTER (#12997)
This commit removes the `OPENTHREAD_CONFIG_MLE_IP_ADDRS_TO_REGISTER`
configuration option and the logic in `Mle` that limited the number of
IPv6 addresses registered by an MTD with its parent.

By removing this limit, MTDs will now attempt to register all their
valid unicast and multicast addresses. The parent router still
enforces its own limit on the number of addresses it accepts and
stores per child via `OPENTHREAD_CONFIG_MLE_IP_ADDRS_PER_CHILD`.

An error check is added to `openthread-core-config-check.h` to inform
users of the removal of this configuration macro.
2026-04-29 08:49:41 -07:00
Abtin Keshavarzian badb895045 [mlr] move address count constants to mlr_types.hpp (#12995)
This commit moves the constants for the minimum and maximum number of
IPv6 addresses allowed in a Multicast Listener Registration (MLR)
request from the `Ip6AddressesTlv` class to `mlr_types.hpp`.

The new constants are named `kMlrMinIp6Addresses` and
`kMlrMaxIp6Addresses`. This change decouples the protocol-specific
limits from the TLV definition, which is more appropriate as these
limits are specific to the MLR process rather than the TLV itself.

The `Ip6AddressesTlv` class is simplified to a `typedef` of `TlvInfo`.
Call sites in `MlrManager`, `BackboneRouter::Manager`, and `NcpBase`
are updated accordingly.
2026-04-28 18:38:18 -07:00
Abtin Keshavarzian 7a8634649f [mle] consolidate RouteTlv definitions (#12994)
This commit combines the two separate definitions of the `RouteTlv`
class, which were previously conditionally compiled based on the
`OPENTHREAD_CONFIG_MLE_LONG_ROUTES_ENABLE` configuration, into a
single unified class definition.

The `#if`/`#else` preprocessor directives are now localized within the
specific getter and setter methods (e.g., `GetRouteDataEntryCount()`,
`GetRouteCost()`, `SetRouteData()`) to handle the different routing
data formats. This removes significant code duplication for shared
methods such as `Init()`, `IsValid()`, `GetRouterIdSequence()`, and
`IsSingleton()`.
2026-04-28 18:37:23 -07:00
Jonathan Hui ef3122b496 [nexus] migrate test_ping_lla_src.py to nexus (#12990)
This commit migrates the test_ping_lla_src.py script from thread-cert
to the Nexus test framework.

The new test_ping_lla_src.cpp implements the same test logic:
- Forms a network with a Leader and two Routers.
- Verifies that pings using a Link-Local Address (LLA) as the source
  succeed when sent to a neighbor's Mesh-Local EID (ML-EID).
- Verifies that pings using an LLA source fail when sent to a
  non-neighbor's ML-EID, as LLAs are only valid for single-hop
  communication.
- Verifies that external routes are not used for LLA-sourced packets.

To support this migration, the Nexus Core class was enhanced with:
- Overloads for SendAndVerifyEchoRequest that allow specifying a
  source address.
- New SendAndVerifyNoEchoResponse methods to verify that no echo
  response is received (useful for negative test scenarios).

Changes:
- Added tests/nexus/test_ping_lla_src.cpp
- Updated tests/nexus/CMakeLists.txt to include the new test.
- Enhanced tests/nexus/platform/nexus_core.hpp/cpp with new helpers.
- Removed tests/scripts/thread-cert/test_ping_lla_src.py.
2026-04-28 14:36:19 -07:00
Jonathan Hui 752581826b [github-actions] free disk space in Nexus workflow jobs (#12996)
Add the jlumbroso/free-disk-space action to all jobs in the Nexus
workflow. This ensures that the runner has sufficient disk space to
complete the build and test tasks, preventing failures due to exhausted
disk resources on GitHub-hosted runners.
2026-04-28 14:36:03 -07:00
Jonathan Hui 3f0cf36419 [nexus] configure parent search backoff interval (#12993)
Added OPENTHREAD_CONFIG_PARENT_SEARCH_BACKOFF_INTERVAL with a value of
10 minutes (10 * 60 seconds) to the Nexus core configuration. This
helps in controlling the backoff behavior during parent search in the
simulator, making it more interactive.
2026-04-28 12:47:21 -07:00
Jonathan Hui d8d1fe2134 [nexus] migrate test_pbbr_aloc.py to nexus (#12989)
This commit migrates the 'test_pbbr_aloc.py' script from the
thread-cert framework to the Nexus simulation framework.

The new 'test_pbbr_aloc.cpp' replicates the original test:
- Forms a network with PBBR, Leader, and Router nodes.
- Enables Backbone Router (BBR) on the PBBR node and waits for it
  to become the Primary BBR.
- Verifies connectivity to the Leader ALOC (0xfc00) and the PBBR
  ALOC (0xfc38) from the Router node using ICMPv6 Echo Requests.
- Confirms that the stack correctly uses Network Data for ALOC
  resolution.

Nexus tests provide faster and more scalable network simulations
within a single process, improving CI efficiency and reliability.

Original Python script 'tests/scripts/thread-cert/test_pbbr_aloc.py'
is removed as its functionality is now fully covered by Nexus.
2026-04-28 12:44:15 -07:00
Jonathan Hui 698c290a36 [nexus] migrate DNSSD special characters test to Nexus (#12972)
This commit migrates the test for DNSSD names with special characters
from the thread-cert functional tests to the Nexus simulation
framework.

The new Nexus test 'test_dnssd_name_with_special_chars.cpp' replicates
the logic from 'test_dnssd_name_with_special_chars.py' and covers:
- SRP service registration with an instance name containing special
  and Unicode characters ("O\T 网关").
- DNS-SD browse to discover the service instance.
- DNS-SD resolution of the service instance name, including
  verification of case-insensitive resolution.
2026-04-28 09:00:05 -07:00
MaikVermeulen c814ec7809 [posix] improve settings file resilience against corruption and power loss (#12872)
* [posix] truncate settings file to last valid offset on parse error

When Init() encounters a corrupt entry, it currently truncates the
entire file to 0 bytes, destroying all settings. Since the parse loop
already knows the exact offset where corruption starts, truncate to
that offset instead, preserving all entries that were successfully
parsed.

This prevents loss of the active operational dataset (and other
settings) when only trailing bytes are corrupt — a common failure
mode when power is lost during a write.

If corruption starts at offset 0 (no valid entries), behavior is
identical to the original code.

* [posix] fsync parent directory after settings file rename

SwapPersist() calls fsync() on the data file descriptor but does not
sync the parent directory after rename(). On journaling filesystems
(ext4, overlayfs), the rename metadata may not reach stable storage
before a power loss. This can leave the old swap file in place,
which triggers a parse error on the next Init().

Add a best-effort fsync() on the parent directory after the rename.
This is non-fatal since the file data is already persisted; only the
directory entry could lag behind.
2026-04-28 09:38:20 -05:00
Jonathan Hui 5bd05a573b [nexus] dynamically sync radio range circles with simulator parameters (#12987)
This commit exposes radio model parameters (path loss constant,
exponent, and sensitivity) and the minimum link request margin from
the Nexus simulator backend to the frontend.

Changes in backend:
- Expose constants in `RadioModel` and `Radio`.
- Add `GetRadioParameters` RPC to `simulation.proto` and implement it
  in gRPC and WASM bindings.
- Expose `OPENTHREAD_CONFIG_MLE_LINK_REQUEST_MARGIN_MIN` and
  `OPENTHREAD_CONFIG_MLE_PARTITION_MERGE_MARGIN_MIN` via the new RPC.

Changes in config:
- Set `OPENTHREAD_CONFIG_MLE_LINK_REQUEST_MARGIN_MIN` and
  `OPENTHREAD_CONFIG_MLE_PARTITION_MERGE_MARGIN_MIN` to 5 dB in
  `openthread-core-nexus-config.h`.

This allows the frontend to calculate and render circles dynamically.
2026-04-27 22:27:36 -07:00
Abtin Keshavarzian 2d14e3ddab [array] add DoesArrayContain() helper function (#12985)
This commit introduces the `DoesArrayContain()` template function to
check if a given item is present in a fixed-size C array. The template
arguments are deduced by the compiler, allowing callers to simply use
`DoesArrayContain(aArray, aItem)`.

It also updates `Manager::CoapDtlsSession::ReadSteeringDataTlv()` and
`Ip6::HandleDatagram()` to use this new helper function instead of
using manual `for` loops to iterate over `kEnrollerValidSteeringDataLengths`
and `kForwardIcmpTypes` arrays respectively.
2026-04-27 21:24:25 -07:00
Abtin Keshavarzian 81d4fd23c9 [mle] use bit-utils in RouteTlv for route data manipulation (#12939)
This commit updates the `RouteTlv` implementation to use `ReadBits` and
`WriteBits` from `bit-utils` for reading and writing route data entries
(Link Quality In/Out and Route Cost). This simplifies the bitwise
operations and improves readability.
2026-04-27 21:23:52 -07:00
dependabot[bot] 928e37b504 Bump lxml from 5.3.0 to 6.1.0 in /tests/scripts/thread-cert (#12958)
Bumps [lxml](https://github.com/lxml/lxml) from 5.3.0 to 6.1.0.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-5.3.0...lxml-6.1.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 21:22:42 -07:00
Jonathan Hui e2e5cba98c [nexus] migrate test_dnssd.py to nexus (#12975)
This commit migrates the DNS-SD test from the thread-cert Python
framework to the Nexus C++ framework.

The new Nexus test 'test_dnssd.cpp' replicates the original test
scenario and functionality:
- Formation of a Thread network with multiple SRP clients and a
  server.
- Service registration with subtypes via SRP.
- DNS browsing for full service types and specific subtypes.
- DNS address (AAAA) and service (SRV/TXT/AAAA) resolution.
- Specific DNS record queries for SRV and KEY record types.
- Verification of DNS behavior for non-existent records.

The original Python script 'tests/scripts/thread-cert/test_dnssd.py'
is removed as its functionality is now fully covered by Nexus.

Nexus tests provide faster and more scalable network simulations
within a single process, improving CI efficiency and reliability.
2026-04-27 18:57:22 -07:00
Jonathan Hui fc4ebb1aaa [nexus] migrate test_service.py to nexus (#12974)
This commit migrates the test_service.py script from thread-cert to the
Nexus test framework.

The new test_service.cpp implements the same test logic:
- Forms a network with a Leader and two Routers.
- Adds and removes services on different nodes.
- Verifies that Service Anycast Locators (ALOCs) are correctly
  added to and removed from the nodes' unicast addresses.
- Confirms reachability of the ALOCs using ICMPv6 Echo Requests
  from all nodes in the network.
- Ensures ALOCs become unreachable after the service is removed
  from the network data.

Changes:
- Added tests/nexus/test_service.cpp
- Updated tests/nexus/CMakeLists.txt to include the new test.
- Removed tests/scripts/thread-cert/test_service.py.
2026-04-27 18:57:07 -07:00
Abtin Keshavarzian 1413778a09 [mle] restrict SetPreferredRouterId() API to REF_DEVICE (#12973)
This commit restricts the API to set a preferred router ID under
`OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE`. This feature is intended
for testing and therefore be excluded from standard builds to ensure
compliance with the Thread Specification.
2026-04-27 17:04:20 -07:00
Jonathan Hui 71d43b5cca [nexus] clear last parent ID on router/leader role change (#12986)
In `Nexus::Core::HandleStateChanged`, the `lastParentId` was not
cleared when a device transitioned to the Router or Leader role. This
could cause stale parent associations to persist, leading to incorrect
link state reporting in the visualizer during subsequent role
transitions (e.g., when a former Leader merges into a partition and
becomes a Child/REED).

This fix clears `lastParentId` (sets it to `0xffff`) when the device
becomes a Router or Leader, ensuring a fresh state for parent
tracking.
2026-04-27 17:21:17 -05:00
Jonathan Hui 0f66392f9c [nexus] migrate on-mesh prefix test to nexus (#12963)
This commit migrates 'test_on_mesh_prefix.py' from the thread-cert
functional tests to the Nexus simulation framework.

The new Nexus test 'test_on_mesh_prefix.cpp' covers:
- Propagation of stable and non-stable on-mesh prefixes.
- Different Network Data request behavior for MEDs and SEDs.
- MEDs receiving both stable and non-stable prefixes.
- SEDs receiving only stable prefixes.
- IPv6 address configuration (SLAAC) for all prefixes.
- Reachability verification via ICMPv6 Echo Request/Response.

Migrating to Nexus provides faster execution and improves the
reliability of the functional test suite.
2026-04-27 16:34:37 -05:00
Jonathan Hui bbb8e7ad15 [nexus] migrate router multicast link request test to nexus (#12966)
This commit migrates the router multicast link request test from the
thread-cert functional tests to the Nexus simulation framework.

The new Nexus test 'test_router_multicast_link_request.cpp' covers:
- Verification of a REED node becoming a router.
- Multicast Link Request transmission to neighboring routers.
- Quick link establishment with multiple neighbors after role upgrade.

The original Python test 'test_router_multicast_link_request.py' is
removed as its functionality is now fully covered by the Nexus test.
2026-04-27 13:02:40 -07:00
Jonathan Hui 8f5a9ff4b8 [nexus] migrate srp server anycast test to nexus (#12951)
This commit migrates the SRP server anycast mode test from the
thread-cert Python script to the Nexus test framework.

The new Nexus test `test_srp_server_anycast_mode.cpp` covers:
- SRP Server configuration in both Anycast and Unicast modes.
- Proper publication of SRP Server information in Network Data.
- SRP Client auto-start and server selection logic.
- Service registration and verification in both address modes.
- DNS browsing for registered SRP services.

Nexus tests allow for faster and more scalable network simulations
within a single process, improving CI efficiency.

Removed:
- tests/scripts/thread-cert/test_srp_server_anycast_mode.py
2026-04-27 13:02:17 -07:00
Jonathan Hui 419decf91e [nexus] migrate test_reset to Nexus (#12971)
Migrate legacy Python test `test_reset.py` to Nexus C++ test
`test_reset.cpp`.

The test verifies that OpenThread correctly recovers network state,
specifically frame counters and datasets, after sequential resets of
nodes in a multi-hop topology (Leader <-> Router <-> ED).

The test sequence:
- Establish multi-hop topology: Leader <-> Router <-> ED.
- Send 1010 pings from ED to Leader to advance the frame counter
  beyond the default storage threshold (1000).
- Reset Leader, Router, and ED sequentially.
- Verify end-to-end connectivity after resets, confirming that frame
  counters were correctly recovered from non-volatile storage.

Legacy `tests/scripts/thread-cert/test_reset.py` is removed as its
functionality is now fully covered by the Nexus test.
2026-04-27 13:00:34 -05:00
Jonathan Hui e74aebb2bd [nexus] migrate router and leader reboot tests to Nexus (#12970)
This commit migrates the following tests from thread-cert to Nexus:
- test_router_reboot_multiple_link_request.py
- test_leader_reboot_multiple_link_request.py

New Nexus tests cover:
- Router rebooting and sending multiple Link Requests when isolated.
- Leader rebooting and sending multiple Link Requests when isolated.

The original Python cert tests are removed as they are now fully
covered by the Nexus framework.
2026-04-27 13:00:17 -05:00
dependabot[bot] b72272fcb1 github-actions: bump actions/upload-artifact from 7.0.0 to 7.0.1 (#12984)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 07:17:57 -07:00
Jonathan Hui d1da39b8b9 [nexus] fix occasional failure in anycast test (#12982) 2026-04-25 18:50:07 -07:00
Abtin Keshavarzian f4f13b6d5b [nexus] add test for OT_MLE_LONG_ROUTES feature (#12956)
This commit adds a new Nexus test to verify the functionality of the
MLE long routes experimental feature, which allows path costs to
exceed the standard limit of 15.

The new test `TestLongRoutes` in `test_long_routes.cpp` forms a
topology consisting of a leader and a chain of 25 routers. It then
validates that the path cost from the last router in the chain to the
leader is correctly reported as 25 using `GetPathCostToLeader()`.

Supporting changes include:
- Updating `build.sh` to support a `long_routes` build target that
  enables `OT_MLE_LONG_ROUTES`.
- Adding the `long_routes` test to `CMakeLists.txt` with the
  appropriate labels.
- Introducing a new GitHub workflow job `nexus-long-routes-tests` in
  `nexus.yml` to automate the execution of this test.
2026-04-25 10:22:06 -07:00
Jonathan Hui 5340cfabc3 [nexus] migrate test_router_reattach.py to nexus (#12967)
This commit migrates the router reattach test from the thread-cert
Python framework to the Nexus C++ framework.

The new Nexus test 'test_router_reattach.cpp' replicates the
original test scenario:
- A full 32-node router network is formed.
- Router upgrade/downgrade thresholds are set to 32.
- A router is reset and verified to re-attach and reclaim its
  router role.
- The test ensures the router does not downgrade after the router
  selection jitter interval.

The original Python script 'tests/scripts/thread-cert/
test_router_reattach.py' is removed as its functionality is now
fully covered by Nexus.

Nexus tests provide faster and more scalable network simulations
within a single process, improving CI efficiency.
2026-04-23 02:47:41 -05:00
Jonathan Hui 33e47882d8 [nexus] migrate anycast test to nexus (#12964)
This commit migrates the anycast routing test from the thread-cert
functional tests to the Nexus simulation framework.

The new Nexus test 'test_anycast.cpp' replicates the linear topology
(R1-R2-R3-R4-R5) and verifies:
- Anycast routing for DHCPv6 Agent (ds/cs) ALOCs.
- Dynamic routing updates when multiple anycast servers are present.
- Traffic routing to the nearest anycast destination.

The original Python test 'test_anycast.py' is removed as its
functionality is now fully covered by the Nexus test.
2026-04-23 02:36:39 -05:00
Jonathan Hui 297fb501a0 [nexus] migrate anycast locator test to Nexus (#12962)
This commit migrates the anycast locator test from the thread-cert
functional tests to the Nexus simulation framework.

The new Nexus test 'test_anycast_locator.cpp' covers:
- Anycast Locator (ALOC) resolution for the Leader from all nodes.
- Custom service ALOC resolution when only one node provides it.
- Closest-node ALOC resolution when multiple nodes provide the same
  service in a line topology (LEADER-R1-R2-R3-R4).
- Verification that nodes resolve to the nearest service instance.

The original Python test 'test_anycast_locator.py' is removed as its
functionality is now fully covered by the Nexus test.
2026-04-23 01:02:33 -05:00
Abtin Keshavarzian db7fd231f0 [thread-tlv] simplify Ip6AddressesTlv implementation (#12965)
This commit simplifies the `Ip6AddressesTlv` by removing the dedicated
class definition and instead defining it as a `TlvInfo` for the
`ThreadTlv::kIp6Addresses` type.

The usage of `Ip6AddressesTlv` is updated in `BbrManager`,
`MlrManager`, and related tests to use `Tlv::StartTlv()` and
`Tlv::EndTlv()` when appending the TLV to messages.
2026-04-23 01:02:05 -05:00
Abtin Keshavarzian b7df29080d [mle] use entry count instead of byte length in RouteTlv (#12957)
This commit renames `GetRouteDataLength()` and `SetRouteDataLength()`
to `GetRouteDataEntryCount()` and `SetRouteDataEntryCount()` in the
`RouteTlv` class.

When `OPENTHREAD_CONFIG_MLE_LONG_ROUTES_ENABLE` is enabled, the
route data entries use a packed format (12 bits or 1.5 bytes per
entry). Consequently, the byte length of the route data field in
the TLV is no longer equal to the number of route entries.

This change ensures that `GetRouteDataEntryCount()` correctly
calculates the number of entries from the TLV length and
`SetRouteDataEntryCount()` sets the TLV length correctly based on
the entry count.
2026-04-23 01:01:44 -05:00
Jonathan Hui 8fbe09e2b5 [nexus] migrate test_srp_ttl.py to nexus (#12960)
This commit migrates the SRP TTL test from the thread-cert Python
framework to the Nexus C++ framework.

The new Nexus test `test_srp_ttl.cpp` covers all four TTL clamping
cases originally implemented in `test_srp_ttl.py`:
1. CLIENT_TTL < TTL_MIN < LEASE_MAX => Clamped to TTL_MIN.
2. TTL_MIN < CLIENT_TTL < TTL_MAX < LEASE_MAX => Used CLIENT_TTL.
3. TTL_MAX < LEASE_MAX < CLIENT_TTL => Clamped to TTL_MAX.
4. LEASE_MAX < TTL_MAX < CLIENT_TTL => Clamped to LEASE_MAX.

Nexus tests provide faster and more scalable network simulations
within a single process, improving CI efficiency.

The original Python script `tests/scripts/thread-cert/test_srp_ttl.py`
is removed as its functionality is now fully covered by Nexus.
2026-04-22 04:18:34 -05:00
Jonathan Hui 706e93f017 [nexus] fix flaky nexus test router_downgrade_on_sec_policy_change (#12959)
The test was failing occasionally due to the unpredictable timing of
tick-aligned timers and dataset propagation in simulations.

Specifically:
1) The router's jittered timeout (minimum 1 second) could expire
   in as little as 1ms if an MLE TimeTick occurred immediately
   after the security policy update.
2) Dataset propagation via MLE Advertisements could take up to
   32 seconds, making immediate checks on the router's role
   unreliable.

This commit fixes the flakiness by:
- Replacing flaky router role checks with `IsRouterRoleAllowed()`
  assertions. This verifies that the security policy has been
  successfully propagated and applied, regardless of whether the
  actual role transition has completed.
- Increasing the propagation wait time to 5 seconds. This provides
  a safe margin for simulated radio propagation while remaining
  well within the leader's 10-second downgrade delay.
- Ensuring both the leader and router are verified for policy
  application in both phases of the test.
- Maintaining the final checks to ensure both nodes eventually
  become detached after the full downgrade delay (150 seconds).

The fix was verified with 1000 consecutive successful iterations.
2026-04-22 02:56:07 -05:00
Jonathan Hui 0a97d566de [nexus] migrate srp server reboot port test to nexus (#12952)
This commit migrates the SRP server reboot port test from the
thread-cert functional tests to the Nexus simulation framework.

The new Nexus test 'test_srp_server_reboot_port.cpp' covers:
- SRP server address mode configuration (Unicast).
- SRP client auto-start discovery of the server.
- SRP server reboot (disable/enable) without node reboot.
- Verification that the server selects a new port after each reboot.
- Robustness of service re-registration over 25 reboot iterations.

The original Python test 'test_srp_server_reboot_port.py' is removed
as its functionality is now fully covered by the Nexus test.
2026-04-22 02:27:17 -05:00
Jonathan Hui 0cf450af44 [nexus] migrate SRP diff lease test to Nexus (#12950)
This commit migrates the SRP register services with different
lease test from the thread-cert Python framework to the Nexus
test framework.

The new Nexus test (test_srp_register_services_diff_lease.cpp)
reproduces the functionality of the original Python test:
- Registration of multiple services with different lease/key-lease
  intervals.
- Verification of per-service lease values on the SRP server.
- Ensuring key-lease is always at least as long as the lease.
- Validating lease renewal and expiry behaviors.
- Testing dynamic changes to default client lease and TTL.

Migrating to Nexus allows for faster and more scalable network
simulations within a single process.
2026-04-21 09:31:49 -05:00
Jonathan Hui 33e163424e [nexus] migrate srp_client_save_server_info to nexus (#12947)
This commit migrates the srp_client_save_server_info test from the
thread-cert Python-based test framework to the Nexus C++ simulation
framework.

The new Nexus test (test_srp_client_save_server_info.cpp) verifies:
- SRP client selects an SRP server when auto-start is enabled.
- SRP client sticks to the current server even if other SRP servers
  become available.
- SRP client saves and reuses the selected server info across SRP
  client stops and restarts.
- SRP client selects a new server if the current one becomes
  unavailable.
- SRP client sticks to the new server even if the old one returns.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-21 08:59:07 -05:00
Jonathan Hui a51677de94 [nexus] migrate srp scale test to nexus (#12949)
This commit migrates the test_srp_register_500_services.py test from
the thread-cert test suite to the Nexus platform.

The new C++ test (tests/nexus/test_srp_scale.cpp) implements the same
functionality: it verifies that 25 SRP clients (13 routers and 12
FEDs) can successfully register a total of 500 services (20 services
per client) with a single SRP server (the leader).

The commit includes:
- Removal of the original Python test file.
- Addition of the new Nexus C++ test file.
- Integration of the new test into CMakeLists.txt and
  run_nexus_tests.sh.
2026-04-21 07:42:46 -05:00
Jonathan Hui acef2288ca [nexus] migrate test_srp_client_remove_host to Nexus (#12946)
This commit migrates the SRP client host removal test from the
thread-cert Python-based framework to the Nexus framework.

The new C++ implementation in tests/nexus/test_srp_client_remove_host.cpp
covers the same scenarios as the original Python script:
- Successful registration of SRP host and services.
- Verification that ClearHostAndServices() does not immediately remove
  server-side state.
- Verification that RemoveHostAndServices(removeKey=False,
  sendUnregToServer=True) marks the host and services as deleted on the
  SRP server.
- Verification that RemoveHostAndServices(removeKey=True,
  sendUnregToServer=True) fully removes the host and service entries
  from the SRP server.

The original Python script test_srp_client_remove_host.py is removed
as its functionality is now fully covered by the Nexus test.
2026-04-21 06:33:39 -05:00
Jonathan Hui 828ffefb21 [nexus] migrate SRP many services MTU test to Nexus (#12948)
This commit migrates the test_srp_many_services_mtu_check.py from
tests/scripts/thread-cert to the Nexus test framework.

The new test, tests/nexus/test_srp_many_services_mtu_check.cpp,
verifies that the SRP client correctly handles and splits SRP Update
messages when registering a large number of services that exceed
the IPv6 MTU size (1280 bytes).

Changes:
- Added tests/nexus/test_srp_many_services_mtu_check.cpp.
- Updated tests/nexus/CMakeLists.txt to include the new test.
- Removed tests/scripts/thread-cert/test_srp_many_services_mtu_check.py.
2026-04-21 05:20:38 -05:00
Jonathan Hui 2f7ccf5d3e [nexus] stabilize reed_address_solicit_rejected test (#12955)
This commit stabilizes the Nexus reed_address_solicit_rejected test by
increasing the wait time for network data synchronization from 5 seconds
to 15 seconds.

The test was occasionally failing because the 5-second wait was
sometimes insufficient for the REED's service registration to reach the
leader and for the updated network data to be broadcast back to the
REED. Increasing the delay to 15 seconds provides more robust buffer for
these network events.

Verified by running the test 50 times in a loop without failures.
2026-04-21 05:04:00 -05:00
Jonathan Hui a5908e5858 [nexus] migrate mle_msg_key_seq_jump test to nexus (#12933)
This commit migrates the `test_mle_msg_key_seq_jump.py` cert test to the
Nexus simulation framework.

The new Nexus test `test_mle_msg_key_seq_jump.cpp` verifies that nodes
can correctly handle jumps in the MLE key sequence and stay attached to
the network. It covers scenarios like child triggering key sequence
updates via Child Update Request and routers propagating key sequence
updates.

The original Python test script is removed as its functionality is now
fully covered by the new Nexus test.
2026-04-21 04:43:19 -05:00
Jonathan Hui 005297b301 [nexus] migrate srp client lease change test to nexus (#12945)
This commit migrates the 'test_srp_client_change_lease.py' cert test
to the Nexus simulation framework.

The new Nexus test ('test_srp_client_change_lease.cpp') verifies:
- SRP registration with default lease and TTL.
- Updating the lease interval and ensuring it is reflected in SRP
  Update messages.
- Updating the TTL and ensuring it is reflected in SRP Update
  messages.
- Setting the TTL to 0 and ensuring the lease interval is used as
  the TTL in SRP Update messages.

The original Python test script is removed as its functionality is
now fully covered by the new Nexus test.
2026-04-21 04:34:43 -05:00
Jonathan Hui 4b4caf3485 [nexus] stabilize srp_auto_start test (#12954)
This commit stabilizes the Nexus SRP auto-start test by increasing
the synchronization wait time from 20 seconds to 30 seconds.

The test was occasionally failing in the Nexus environment because
the 20-second wait was sometimes insufficient for the SRP server
registration to fully propagate through the network data and for
the SRP client to process the update and complete its server
selection. Increasing the wait time to 30 seconds provides a more
robust buffer for these network synchronization events.

Verified by running the test 100 times in a loop without failures.
2026-04-21 02:39:10 -05:00
Jonathan Hui 39b982c8d6 [nexus] migrate ipv6 fragmentation test (#12932)
This commit migrates the `test_ipv6_fragmentation.py` cert test to the
Nexus simulation framework.

To support this migration, the Nexus core configuration was updated to
enable IPv6 fragmentation (`OPENTHREAD_CONFIG_IP6_FRAGMENTATION_ENABLE`).

The new Nexus test `test_ipv6_fragmentation.cpp` covers the validation
of IPv6 fragmentation and reassembly. It sends large ICMPv6 Echo
Requests exceeding the 1280-byte MTU between a Leader and a Router:
- 1952 bytes payload from Leader to Router
- 1831 bytes payload from Router to Leader

The original Python test script is removed as its functionality is now
fully covered by the new Nexus test.
2026-04-20 23:26:02 -05:00
Abtin Keshavarzian cd8e6776e8 [mle] encapsulate router ID sequence and mask in RouterIdMask (#12922)
This commit updates the `RouterIdSet` class, renaming it to
`RouterIdMask` and expanding it to encapsulate both the router ID
sequence number and the bitmask. This allows simplifying the
definition of `ThreadRouterMaskTlv` and `RouteTlv`.
2026-04-20 23:25:30 -05:00
dependabot[bot] b03df41b62 github-actions: bump github/codeql-action from 4.31.10 to 4.35.2 (#12943)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.10 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/cdefb33c0f6224e58673d9004f47f7cb3e328b89...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 16:50:27 -05:00
Abtin Keshavarzian 1d6aa9c6d7 [mle] simplify TimeParameterTlv (#12923)
This commit simplifies the `TimeParameterTlv` implementation by
defining a `TimeParameterTlvValue` and using the `SimpleTlvInfo`
template to define `TimeParameterTlv`.
2026-04-20 16:50:01 -05:00