Commit Graph

9495 Commits

Author SHA1 Message Date
Abtin Keshavarzian fb216d335c [cmake] update CMake configurations for Apple platforms (#12729)
This commit updates various CMake configuration files to simplify
the check for Apple platforms. It replaces the `CMAKE_CXX_COMPILER_ID`
check for `AppleClang` with the built-in `APPLE` variable across
multiple targets (such as `ftd`, `mtd`, `cli`, and others). This
ensures that Apple-specific linker and compiler flags (like `-Wl,-map`
and `-Wimplicit-int-conversion`) are correctly applied when building
on macOS, regardless of the specific compiler used.

Additionally, this commit updates `CMakeLists.txt` to explicitly set
the `CMAKE_AR` and `CMAKE_RANLIB` paths to the default system
locations (`/usr/bin/ar` and `/usr/bin/ranlib`) when the `APPLE`
variable is set.
2026-03-20 13:19:29 -05:00
Jonathan Hui da7a103401 [nexus] add BBR-TC-02 test case for BBR role switch and dataset removal (#12718)
This commit implements the BBR-TC-02 test case in the Nexus simulation
framework to verify that if two BBR Datasets are present in a network,
the Backbone Router (BBR) that is not elected as Primary will delete
its own BBR Dataset from the Network Data.

Key implementation details include:
- Implementation of BBR-TC-02 in C++ simulating a topology with two
  Border Routers (BR_1 as DUT/initial Primary, BR_2) and a Thread
  Router as Leader.
- Verification of BR_1's role switch from Primary to Secondary when it
  detects a BBR Dataset with a higher sequence number (BR_2's dataset).
- Verification that BR_1 sends a Server Data notification to the Leader
  to remove its BBR Dataset upon switching to the Secondary role.
- Verification that BR_1 (as Secondary BBR) correctly rejects MLR.req
  messages with ST_MLR_BBR_NOT_PRIMARY.
- Verification that BR_1 automatically resumes the Primary BBR role
  and becomes Leader when Router_1 and BR_2 are removed from the
  network.
- Addition of a Python verification script to validate:
  - Correct sequence of SVR_DATA.ntf CoAP requests for BBR Dataset
    registration and removal.
  - Correct handling of MLR.req with ST_MLR_BBR_NOT_PRIMARY error.
  - Correct filtering of Thread Network Data TLVs in CoAP payloads.
- Inclusion of the full test specification as inline comments in both
  the C++ and Python files.
- Use of direct core method calls in C++ and adherence to strict
  formatting rules in both files.
- Registration of the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-18 21:38:56 -05:00
Michael Hopfengaertner a7a7fff00a [cli] remove duplicate and conflicting cli config (#12721)
The cli config `OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE` was
duplicated in `cli_config.h`.
Their default values were even conflicting.

Changes:
* Remove second define of `OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE`
  (default value 0) in `cli_config.h` since it would have never
  been reached.
2026-03-18 21:38:37 -05:00
Yang Song aa2437a313 [cli] prevent ot-ctl termination during debug command (#12600)
Under interactive mode, the `ot-ctl` client treats lines starting with
"Error" as fatal command failures. It exits immediately and stop
receiving CLI output. As the `debug` command runs a sequence of
sub-commands; if one fails , the entire debug session would stop.

This change modifies the error prefix to "ERROR" for internal debug
commands, allowing ot-ctl to continue processing subsequent output.
Also, it adds an explicit `OutputLine("Done")` at the end of the debug
command processing to ensure the CLI client correctly detects the end
of the command.
2026-03-18 19:51:40 -05:00
Jonathan Hui 23caf33af5 [nexus] implement BBR-TC-01 and add infra ICMPv6 echo reply support (#12717)
This commit implements the BBR-TC-01 test case in the Nexus simulation
framework to verify that a Backbone Router (BBR) device automatically
sends its BBR dataset to the Leader if none exists in the network.

To support the Host receiving echo replies on its infrastructure
interface, the Nexus InfraIf class is extended to support custom
ICMPv6 Echo Reply handlers.

Key changes:
- Implement BBR-TC-01 C++ test case and Python verification script.
- Add EchoReplyHandler callback and registration to Nexus InfraIf.
- Update InfraIf::Receive to handle and dispatch ICMPv6 Echo Replies.
- Register 1_2_BBR_TC_1 in CMake and the test runner script.
2026-03-18 19:47:30 -05:00
Abtin Keshavarzian 0db2bade37 [network-diag] simplify MacCountersTlv and its usage (#12711)
This commit simplifies `MacCountersTlv` by replacing its individual
getter and setter methods with bulk operations:
- Adds an `Init()` method that takes a `Mac::Counters` to directly
  populate the TLV fields from the MAC layer counters.
- Adds a `Read()` method to parse the TLV and populate a given
  `NetworkDiagnostic::MacCounters` structure.
- Updates `NetworkDiagnostic::Server` and `Client` to use these new
  methods, allowing the removal of their local helper methods
  `AppendMacCounters()` and `ParseMacCounters()`.
- Introduces `Counters` as an alias for `otMacCounters` within the
  `Mac` namespace.
2026-03-18 19:44:37 -05:00
Jonathan Hui 9e87d67405 [nexus] add MATN-TC-26 test case for mcast reg error handling (#12714)
This commit adds a new nexus test for MATN-TC-26: Multicast
registrations error handling by Thread Device.

The test verifies that a Thread Device correctly handles multicast
registration errors, such as when a Backbone Router (BBR) runs out of
resources or responds with a general failure.

Changes:
- Implemented test_1_2_MATN_TC_26.cpp to execute the test steps.
- Implemented verify_1_2_MATN_TC_26.py to verify pcap output.
- Updated CMakeLists.txt and run_nexus_tests.sh to include the
  new test.
- Modified bbr_manager.cpp to correctly include failed addresses in
  the MLR response when using configured error status for reference
  devices.

The test ensures the DUT retries registration within the
Reregistration Delay after receiving an error and does not retry
if registration was successful until necessary.
2026-03-18 17:54:08 -05:00
Jonathan Hui 8f980e8ba0 [nexus] add MATN-TC-23 test case for automatic MLR re-registration (#12713)
This commit adds a new Nexus test case MATN-TC-23 to verify that a
Thread Device (DUT) automatically re-registers its multicast addresses
before the Multicast Listener Registration (MLR) timeout expires.

The test simulates a topology with two Border Routers (BR_1 and BR_2)
and a Thread Device (TD as DUT). BR_1 acts as the Primary Backbone
Router (BBR) and distributes a BBR Dataset with a configured MLR
timeout. The TD registers a multicast address and then automatically
sends a subsequent MLR.req to renew the registration before the
timeout period ends.

Implementation details:
- Added test_1_2_MATN_TC_23.cpp to execute the simulation using direct
  method calls and 'note' log level.
- Added verify_1_2_MATN_TC_23.py to validate the MLR.req/rsp exchange
  in the pcap output.
- Included the full test specification as inline comments in both
  files, following strict indentation and formatting rules.
- Registered the new test in CMakeLists.txt and run_nexus_tests.sh.
2026-03-18 10:02:30 -05:00
Jonathan Hui 3f908aa5c3 [nexus] add MATN-TC-22 test case for low MLR timeout (#12710)
This commit adds a new Nexus test case MATN-TC-22 to verify that a
Primary Backbone Border Router (BBR) that is configured with a low
value of Multicast Listener Registration (MLR) timeout
(< MLR_TIMEOUT_MIN) is interpreted as using an MLR timeout of
MLR_TIMEOUT_MIN by Thread Devices (DUT).

The test performs the following steps:
- Configures the Primary BBR (BR_1) with an MLR timeout of
  MLR_TIMEOUT_MIN / 4.
- Verifies that the DUT registers a multicast address (MA1) at BR_1.
- Confirms that the DUT automatically re-registers for MA1 within
  MLR_TIMEOUT_MIN seconds of the initial registration.
- Ensures that no more than 2 re-registrations occur within this time
  period.

Included changes:
- New test implementation: test_1_2_MATN_TC_22.cpp.
- New verification script: verify_1_2_MATN_TC_22.py.
- Registration of the test in CMakeLists.txt and run_nexus_tests.sh.

The test implementation uses direct method calls in C++ and provides
step-by-step logging in both C++ and Python to match the test
specification.
2026-03-18 03:09:51 -05:00
Jonathan Hui 640fbc895a [nexus] add MATN-TC-21 test case for incorrect multicast registrations (#12709)
This commit implements the MATN-TC-21 test case in the Nexus
simulation framework to verify that a Primary BBR correctly handles
incorrect or invalid multicast registrations from a Thread device.

Key implementation details include:
- Implementation of MATN-TC-21 in C++ simulating a topology with two
  Border Routers (BR_1 as Primary/DUT, BR_2 as Secondary), a Thread
  Router, and a Host.
- Verification of BR_1's handling of various invalid MLR registrations:
  - Invalid unicast addresses (MAe1, MAe3) or unspecified address (MAe2).
  - Link-local (MA6) and mesh-local (MA5) multicast addresses.
  - Partial registration success when valid (MA1) and invalid (MA6)
    addresses are mixed.
  - Malformed IPv6 Addresses TLV with incorrect length (MAe4).
- Verification that only the Primary BBR (BR_1) accepts registrations,
  while the Secondary BBR (BR_2) returns ST_MLR_BBR_NOT_PRIMARY.
- Addition of a Python verification script to validate:
  - Correct error status codes in MLR responses (ST_MLR_INVALID,
    ST_MLR_BBR_NOT_PRIMARY).
  - Multicast forwarding from backbone to Thread for valid registrations.
  - Handling of malformed TLVs by checking raw CoAP payloads.
- Inclusion of the full test specification as inline comments in
  both the C++ and Python files.
- Registration of the new test case in tests/nexus/CMakeLists.txt
  and tests/nexus/run_nexus_tests.sh.
2026-03-18 01:21:06 -05:00
Jonathan Hui 15c728ed21 [nexus] add MATN-TC-20 test case for automatic re-registration (#12708)
This commit implements the MATN-TC-20 test case in the Nexus
simulation framework to verify that a Parent Router handling a
multicast registration on behalf of an MTD re-registers the
multicast address on behalf of its child before the MLR timeout
expires.

Key implementation details include:
- Implementation of the MATN-TC-20 test scenario in C++ simulating
  a topology with a Router (DUT), a MED, and two Border Routers
  (BR_1 as initial Primary BBR, BR_2 as Secondary BBR).
- Addition of a Python verification script to validate MLE Child
  Update Request/Response exchanges and subsequent MLR.req CoAP
  requests from the DUT to the Primary BBR.
- Verification that the DUT automatically re-registers the multicast
  address when the MLR timeout is updated in the BBR Dataset.
- Inclusion of the full test specification as inline comments in
  both the C++ and Python files, following strict formatting rules.
- Registration of the new test case in tests/nexus/CMakeLists.txt
  and tests/nexus/run_nexus_tests.sh.
2026-03-17 19:44:45 -05:00
Abtin Keshavarzian a0c332b2a2 [ip6] add otIp6Init() to configure external address pools (#12603)
This commit introduces the `OPENTHREAD_CONFIG_IP6_INIT_EXT_ADDR_POOL_ENABLE`
configuration and the `otIp6Init()` API. When enabled, this feature
allows the OpenThread stack to use externally provided memory buffers for
its external unicast and multicast address pools.

By decoupling the pool sizes from build-time configurations
(`OPENTHREAD_CONFIG_IP6_MAX_EXT_UCAST_ADDRS` and
`OPENTHREAD_CONFIG_IP6_MAX_EXT_MCAST_ADDRS`), the OpenThread stack can be
compiled as a generic library without hardcoding the address pool sizes.
It delegates the memory allocation and configuration to the application
layer at run-time.

When the feature is enabled, `otIp6Init()` must be invoked to initialize
the `Netif` address pools before calling `otIp6SetEnabled()`.
2026-03-17 19:24:47 -05:00
Abtin Keshavarzian b28b4a6a5d [network-diag] simplify ChannelPagesTlv and diag data parsing (#12706)
This commit simplifies appending `ChannelPagesTlv` using the standard
`Tlv::Append<>()` with the the array of supported channel pages as
the TLV value.

In addition, a `ReadDiagData()` helper method is introduced in the
`NetworkDiagnostic::Client` to unify and simplify how `otNetworkDiagData`
arrays (e.g. `mNetworkData`, `mChannelPages`) are parsed and populated
from read TLVs.
2026-03-17 18:51:04 -05:00
Abtin Keshavarzian 44f5cddc2e [message] introduce MessageAllocator to unify allocation (#12702)
This commit introduces the `MessageAllocator` template class using the
CRTP pattern to provide a unified implementation of the `NewMessage()`
methods. It standardizes the reserved header sizes for different
message types within `ReservedHeaderSize`. This removes boilerplate
code and redundant `NewMessage()` method implementations across the
`Ip6`, `Icmp`, `Udp`, `Udp::Socket`, and `CoapBase` classes.
2026-03-17 18:50:39 -05:00
Jonathan Hui 422a649919 [nexus] add MATN-TC-19 test case for multicast registration by MTD (#12707)
This commit implements the Thread 1.2 test MATN-TC-19: Multicast
registration by MTD in the Nexus simulation framework. The test
verifies that an MTD can correctly register multicast addresses
through a parent Thread Router and receive multicast traffic from
the backbone.

Key implementation details:
- Created test_1_2_MATN_TC_19.cpp to simulate the network topology
  (BR_1, BR_2, Router, MTD, and Host) and execute the test steps
  using direct method calls.
- Implemented verify_1_2_MATN_TC_19.py for PCAP-based verification
  of MLE Child Update exchanges, MLR registrations, and multicast
  ICMPv6 Echo Request/Reply forwarding.
- Configured the test to use Note log level and included 1-line
  log output for each step to match existing Nexus tests.
- Integrated the new test into the Nexus build system via
  CMakeLists.txt and added it to the default test execution list
  in run_nexus_tests.sh.
2026-03-17 18:05:10 -05:00
Jonathan Hui 7353a38871 [nexus] add MATN-TC-16 test case for large multicast subscriptions (#12705)
This commit adds a new Nexus test case MATN-TC-16 to verify that the
Primary Backbone Border Router (BBR) can handle a large number of
multicast group subscriptions.

The test performs 75 multicast registrations in 5 batches of 15
addresses each. It verifies the following behavior:
- The BBR correctly processes Multicast Listener Registration (MLR)
  requests and returns a success status.
- Multicast packets sent to registered addresses on the backbone are
  successfully forwarded to the Thread network.
- Multicast packets sent to unregistered addresses are not forwarded.

To accommodate the requirements of this test, Nexus configuration
limits are increased:
- OPENTHREAD_CONFIG_IP6_MAX_EXT_MCAST_ADDRS is increased from 4 to 80.
- The mTestVars array in Nexus Core is increased from 16 to 128
  entries to support storing all multicast addresses for verification.

Included changes:
- New test files: test_1_2_MATN_TC_16.cpp and verify_1_2_MATN_TC_16.py.
- Registration of the test in CMakeLists.txt and run_nexus_tests.sh.
- Configuration updates in openthread-core-nexus-config.h and
  nexus_core.hpp.
2026-03-17 09:31:29 -05:00
Jonathan Hui 12aa812cf0 [nexus] add MATN-TC-15 test case for Primary BBR change (#12703)
This commit implements the MATN-TC-15 test case in the Nexus simulation
framework to verify that a Thread End Device detects a change of Primary
Backbone Router (BBR) and triggers a re-registration of its multicast
groups.

Key implementation details include:
- Implementation of MATN-TC-15 in C++ simulating a topology with two
  Border Routers (BR_1 and BR_2), a Thread Router, and a Thread End
  Device (TD as DUT).
- Simulation of Primary BBR failover by stopping BR_1 and waiting for
  BR_2 to become the new Primary BBR.
- Addition of a Python verification script to validate:
  - Detection of Primary BBR change by the DUT.
  - Multicast Listener Registration (MLR.req) sent by the DUT to BR_2.
  - Correct forwarding of MLR.req and MLR.rsp by the intermediate
    Thread Router.
  - Successful registration response (MLR.rsp) from BR_2 to the DUT.
- Inclusion of the full test specification as inline comments in both
  the C++ and Python files.
- Registration of the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-17 05:09:59 -05:00
Jonathan Hui 244900a49a [nexus] add MATN-TC-12 test case for hop limit processing (#12701)
This commit implements the MATN-TC-12 test case in the Nexus
simulation framework to verify that a Primary BBR correctly
decrements the IPv6 Hop Limit when forwarding multicast packets
between the backbone link and the Thread network.

Key implementation details include:
- Implementation of MATN-TC-12 in C++ simulating a topology with a
  Border Router (BR_1 as DUT), a Thread Router, and a Host.
- Enhancement of the Nexus platform to support hop limit processing:
  - Updated InfraIf::Receive to decrement Hop Limit when forwarding
    from the backbone to the Thread network.
  - Updated Node::HandleReceive to decrement Hop Limit when forwarding
    from the Thread network to the backbone.
  - Added support for simulating packets with Hop Limit 0 by setting
    mAllowZeroHopLimit in Node::SendEchoRequest.
- Addition of a Python verification script to validate:
  - Multicast forwarding from backbone to Thread with decrement.
  - Multicast forwarding from Thread to backbone with decrement.
  - Dropping of packets with Hop Limit 1 (or 0) during forwarding.
  - Use of unique ICMPv6 identifiers to reliably distinguish between
    pings in different test steps.
- Inclusion of the full test specification as inline comments in
  both the C++ and Python files.
- Registration of the new test case in tests/nexus/CMakeLists.txt
  and tests/nexus/run_nexus_tests.sh.
2026-03-17 03:02:44 -05:00
Jonathan Hui 27d57f9925 [nexus] add MATN-TC-10 test case for BBR dataset distribution (#12697)
This commit implements the MATN-TC-10 test case in the Nexus
simulation framework to verify that a Secondary BBR correctly
takes over forwarding of outbound multicast transmissions when
the Primary BBR fails, specifically focusing on BBR Dataset
distribution and MLDv2/BMLR registration behavior.

Key implementation details include:
- Implementation of the MATN-TC-10 test scenario in C++ simulating
  a topology with two Border Routers (BR_1 as initial Primary,
  BR_2 as Secondary/DUT), a Router, and a Host.
- Verification that BR_2 takes over as the Primary BBR and Leader
  after BR_1 is stopped.
- Validation of BBR Dataset (PBBR) presence in Network Data.
- Addition of a Python verification script to validate:
  - Multicast ping reachability.
  - Correct BBR Dataset distribution.
  - Outbound multicast registration (BMLR/MLDv2) on the backbone.
- Use of explicit multicast re-subscription in Step 14 to ensure
  observable registration traffic within the simulation window.
- Robust packet filters for BMLR (port 61631) and MLDv2 to handle
  platform-specific dissection variances.
- Inclusion of the full test specification as inline comments in
  both the C++ and Python files.
- Registration of the new test case in tests/nexus/CMakeLists.txt
  and tests/nexus/run_nexus_tests.sh.
2026-03-17 00:06:33 -05:00
Jonathan Hui c82664c48f [nexus] add MATN-TC-09 test case for Primary BBR failure (#12696)
This commit implements the MATN-TC-09 test case in the Nexus
simulation framework to verify that a Secondary BBR correctly
takes over forwarding of outbound multicast transmissions when
the Primary BBR fails.

Key implementation details include:
- Implementation of the MATN-TC-09 test scenario in C++ simulating
  a topology with two Border Routers (BR_1 as initial Primary,
  BR_2 as Secondary/DUT) and a Thread Router.
- Verification that BR_2 takes over as the Primary BBR and Leader
  after BR_1 is stopped.
- Addition of a Python verification script to validate that only
  the Primary BBR forwards outbound multicast packets to the
  backbone link.
- Use of distinct ICMPv6 identifiers to reliably distinguish
  between multicast pings sent before and after the Primary BBR
  failure.
- Inclusion of the full test specification as inline comments in
  both the C++ and Python files.
- Registration of the new test case in tests/nexus/CMakeLists.txt
  and tests/nexus/run_nexus_tests.sh.
2026-03-16 22:27:55 -05:00
Jonathan Hui 0f44bd990e [nexus] add MATN-TC-07 test case for BBR multicast forwarding (#12694)
This commit implements the MATN-TC-07 test case in the Nexus
simulation framework to verify default multicast forwarding
behavior on Border Routers.

Key implementation details include:
- Implementation of the MATN-TC-07 test scenario in C++ to
  trigger various multicast ping requests across different
  IPv6 scopes (realm-local, admin-local, site-local, global,
  and link-local).
- Enhancement of the Python verification script to strictly
  validate that only the Primary BBR forwards multicast
  packets to the backbone link using Ethernet source address
  filtering.
- Support for Ethernet link type in Nexus PCAP generation by
  prepending Ethernet headers to infrastructure IPv6 packets.
- Exposure of infrastructure MAC addresses (ethaddrs) in the
  test information JSON to enable identification of the
  forwarding node on the backbone link.
- Support for verifying source addresses of MPL-encapsulated
  multicast packets by checking both outer and inner headers.
- Addition of FindGlobalAddress() helper in the Nexus node
  platform.
2026-03-16 20:35:22 -05:00
Jonathan Hui 725b101150 [nexus] add MATN-TC-05 test case for multicast re-registration (#12693)
Implement Thread 1.2 test MATN-TC-05: Re-registration to same Multicast
Group. This test verifies that a Primary Backbone Router (BBR)
correctly manages multicast address re-registration and handles UDP
multicast traffic between the backbone and Thread network.

Key additions:
- Added SendUdp to Nexus InfraIf to support simulated UDP multicast
  traffic from backbone hosts.
- Implemented test_1_2_MATN_TC_5.cpp to simulate the network topology
  (DUT, BR_2, Router, and Host) and the test steps.
- Implemented verify_1_2_MATN_TC_5.py for pcap-based verification of
  multicast forwarding and BBR timeout behavior.
- Integrated the new test into the Nexus build system and the default
  test execution script.
2026-03-16 18:57:51 -05:00
Abtin Keshavarzian 0c2148e803 [sntp] simplify message allocation in Client::Query() (#12691)
This commit simplifies how the SNTP request message is allocated and
constructed in `Client::Query()`. It removes the `NewMessage()`
helper method, replacing its use with a direct message allocation from
the socket followed by `Append()` to add the header. It also updates
the error cleanup path to use the `FreeMessage()` macro.
2026-03-16 17:34:13 -05:00
Abtin Keshavarzian 27c6098c2b [locator] fix doc for GetProvider::Get() implementation location (#12690) 2026-03-16 17:33:34 -05:00
Abtin Keshavarzian 0231669620 [ip6] move transport and extension headers to ip6_headers.hpp (#12689)
This commit moves the definitions of `MplOption`, `UdpHeader`,
`TcpHeader`, and `Icmp6Header` from their module-specific headers into
`net/ip6_headers.hpp`. The original class definitions in `Ip6::Udp`,
`Ip6::Tcp`, and `Ip6::Icmp` are replaced with `typedef` aliases to
maintain internal compatibility.

This consolidation centralizes IPv6 protocol header definitions,
ensuring that all header sizes are available when allocating or
cloning messages. This allows for calculating the proper reserved
header length in `NewMessage()`.
2026-03-16 17:33:19 -05:00
Abtin Keshavarzian 3d4812d151 [tests] handle return error value in TCAT unit test (#12685)
This commit updates `tests/unit/test_tcat.cpp` to properly handle the
`Error` return value from `NetworkName::Set()`, resolving compiler
warnings about unhandled return types.

In `TestInitInstanceTcat()`, `IgnoreError()` is used when setting
default test values since `NetworkName::Set()` returns `kErrorNone`
or `kErrorAlready` when the same name is set again.
2026-03-16 17:31:56 -05:00
dependabot[bot] 99e12db7ea github-actions: bump docker/build-push-action from 6.18.0 to 7.0.0 (#12698)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 7.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/263435318d21b8e681c14492fe198d362a7d2c83...d08e5c354a6adb9ed34480a06d141179aa583294)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 17:31:25 -05:00
Jonathan Hui 27c7a546d2 [nexus] add MATN-TC-04 test case for multicast listener timeout (#12692)
Add MATN-TC-04 test case to verify that a Primary BBR removes a
multicast listener entry when it expires by timeout.

- Add test_1_2_MATN_TC_4.cpp implementing the simulation of two
  Border Routers (BR_1 as Primary BBR, BR_2), a Router, and a Host.
- Verify that a registered multicast address expires after the
  configured MLR timeout and that the BBR stops forwarding traffic
  to the group.
- Verify that a new registration to the same group is accepted
  after the previous one has expired.
- Use direct method calls for BBR configuration and management.
- Add verify_1_2_MATN_TC_4.py for automated packet verification.
- Fix a loopback issue in nexus_core.cpp where infra-if packets
  were being delivered back to the sender.
- Register the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-16 16:27:50 -05:00
Jonathan Hui 0d4a43ab8d [nexus] add MATN-TC-03 test case for multicast registration (#12688)
Add MATN-TC-03 test case to verify that a Primary Backbone Router
(BBR) correctly handles Multicast Listener Registration (MLR)
requests and ignores a Timeout TLV when it is not sent by a
Commissioner.

- Add test_1_2_MATN_TC_3.cpp implementing the simulation of two
  Border Routers (BR_1 as Primary BBR, BR_2), a Router, and an
  external Host on the backbone.
- Verify that a Router can successfully register a multicast address.
- Verify that a Router attempting to deregister a multicast address
  by sending an MLR.req with a Timeout TLV of 0 (without a
  Commissioner Session ID) is handled correctly by the PBBR.
- Verify that the PBBR responds with Success and continues to
  forward multicast traffic to the registered address, effectively
  ignoring the invalid Timeout TLV.
- Add verify_1_2_MATN_TC_3.py for automated packet verification of
  the test scenario.
- Register the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-15 23:24:34 -05:00
Jonathan Hui a904b66b70 [nexus] add MATN-TC-02 test case for multicast registration (#12686)
Add MATN-TC-02 test case to verify Multicast Listener Registration
(MLR) and multicast traffic forwarding between a Thread network and
an infrastructure link (backbone).

- Add test_1_2_MATN_TC_2.cpp implementing the simulation of two
  Border Routers (BR_1 as Primary BBR, BR_2), a Thread Device (TD),
  and an external host on the backbone.
- Verify TD registration of multicast addresses at BR_1 via MLR.req.
- Verify BR_1 responses and backbone notifications (BMLR.ntf).
- Verify successful forwarding of multicast ICMPv6 Echo Requests
  from the backbone to the Thread network by the Primary BBR.
- Verify that non-Primary BBRs and BBRs without active registrations
  do not forward multicast traffic.
- Add verify_1_2_MATN_TC_2.py for automated packet verification of
  the test scenario.
- Register the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-15 21:42:39 -05:00
Jonathan Hui 4b57531dea [nexus] add MATN-TC-01 test case for multicast blocking (#12687)
Add MATN-TC-01 test case to verify that a Primary BBR by default
blocks IPv6 multicast traffic from the backbone to the Thread
network when no devices have registered for the multicast groups.

- Add test_1_2_MATN_TC_1.cpp implementing the simulation of a
  Border Router (BR_1 as Primary BBR), a Thread Router, and an
  external host on the backbone.
- Send ICMPv6 Echo Requests from the backbone host to various
  multicast addresses (admin-local, site-local, global, and
  link-local).
- Add verify_1_2_MATN_TC_1.py for automated packet verification
  to ensure the DUT (BR_1) does not forward these multicast
  packets to its Thread Network.
- Register the new test case in tests/nexus/CMakeLists.txt and
  tests/nexus/run_nexus_tests.sh.
2026-03-15 19:49:42 -05:00
Jonathan Hui 5df29f74e1 [nexus] implement infra interface for backbone simulation (#12683)
Implement the InfraIf class and associated platform logic to simulate
a shared infrastructure link (backbone) between Border Routers and
external hosts within the Nexus simulation environment.

Infra interface simulation:
- Implement shared Ethernet-like link for IPv6 traffic delivery.
- Add automated SLAAC address configuration based on ICMPv6 RAs.
- Support sending/receiving ICMPv6 Neighbor Discovery (RS, RA, NS, NA).
- Implement manual ICMPv6 checksum calculation for raw packets.
- Add infrastructure-level loop prevention and destination filtering.
- Provide helper methods to find nodes by infrastructure addresses.

Platform integration:
- Implement otPlatInfraIf APIs and integrate with otInstance.
- Use native Message and MessageQueue for pending traffic management.
- Add support for custom test variables in SaveTestInfo() JSON output.
- Update Node::Reset() to properly clear pending infra interface tasks.

Core enhancements:
- Add MulticastListenersTable::Has() to check for address presence.
- Add PrefixInfoOption::GetPrefixLength() and SetPrefixLength().
- Enable MLR and Backbone Router multicast routing in Nexus config.
2026-03-15 02:39:57 -05:00
Abtin Keshavarzian 0b7427884e [coap] add SendAckResponseIfUnicastRequest() (#12673)
This commit introduces `CoapBase::SendAckResponseIfUnicastRequest()`,
which sends an ACK response with a CoAP Code mapped from an `Error`
value, provided the original request was confirmable and not sent to
a multicast address. It also adds `Message::MapErrorToCoapCode()` to
handle the translation of common `Error` types into their appropriate
CoAP Code equivalents (e.g., `kErrorBusy` to `kCodeServiceUnavailable`,
or `kErrorParse` to `kCodeBadRequest`).

The TMF handlers in `AnnounceBeginServer`, `EnergyScanServer`, and
`PanIdQueryServer` are updated to use this new method. Additionally,
all three servers now explicitly reject new requests with `kErrorBusy`
if they are already running an active scan or announce operation. The
state tracking in `PanIdQueryServer` (`mIsRunning`) is also added
to correctly check its running state when starting a query.
2026-03-14 07:33:32 -05:00
Abtin Keshavarzian 3d975f7f9d [coap] encapsulate Request state and hide its Metadata (#12675)
This commit updates the `CoapBase::Request` class to encapsulate its
internal state. The `mMessage` pointer and `mMetadata` struct are
now private, and their properties are accessed and modified through
explicit getter and setter methods (e.g., `GetMessage()`,
`IsConfirmable()`, `MarkAsAcknowledged()`).

By doing so, the code that manages pending requests no longer directly
manipulates the internal metadata fields, improving code structure and
maintainability.
2026-03-12 22:50:43 -05:00
Jonathan Hui 6ba23210af [pktverify] add support for raw IPv6 and CoAP TLV parsing (#12678)
Extend the pktverify framework to handle Raw IPv6 packets and parse CoAP
TLVs:

- Add support for verifying Raw IPv6 packets (DLT_RAW) captured on the
  infrastructure link.
- Implement parsing for CoAP TLVs used in Multicast Listener
  Registration (MLR) and Backbone MLR (BMLR) messages.
- Clean up magic numbers and improve summary output for better
  traceability in test reports.
2026-03-12 22:36:57 -05:00
Jonathan Hui 5e6d1af48f [nexus] enhance pcap to support pcapng and multiple interfaces (#12677)
Enhance the Nexus Pcap class to support the pcapng format and logging from
multiple interfaces:

- Transition from pcap to pcapng format to support multiple interface
  descriptions in a single capture file.
- Add support for logging both IEEE 802.15.4 (Thread) and Raw IPv6
  (Backbone) traffic.
- Implement Interface Description Blocks (IDB) and Enhanced Packet
  Blocks (EPB) for pcapng compliance.
2026-03-12 22:36:46 -05:00
Abtin Keshavarzian cf733a331e [infra-if] add missing otInstance parameter to otPlatInfraIf APIs (#12662)
This commit updates the following `otPlatInfraIf` platform APIs to
include an `otInstance *` as their first parameter:

- `otPlatInfraIfHasAddress()`
- `otPlatInfraIfSendIcmp6Nd()`
- `otPlatInfraIfDiscoverNat64Prefix()`

Other APIs under `otPlatInfraIf` already follow this pattern. Passing
the `otInstance` pointer is the required standard for all platform
and public APIs; however, it was missed during the initial design of
these specific APIs.

While missing this parameter is often not a blocker on platforms using
a single OpenThread instance, it has become a blocker for simulations,
especially when multiple Border Routers are emulated in the same
simulation setup.

This change introduces a compatibility break for existing platform
implementations, however, it is necessary to support new use cases
(simulation of BRs). It also helps ensure consistent API design
across the stack.
2026-03-12 10:10:08 -05:00
Abtin Keshavarzian a03011cf73 [tmf] simplify URI paths array using X-Macro (#12674)
This commit simplfies `thread/uri_paths.cpp` by introducing the
`UriEntryMapList` X-Macro. This macro centralizes the mapping
between the URI path string, its `kUri*` enum value and its string
name representation used in `UriToString()`.

By using this macro, we avoid redundant lists and manual template
specializations. The `kEntries[]` array, the compile-time assertions
validating the sorting of the array, and the `UriToString<>()`
template specializations are now all automatically generated from
this single list, improving maintainability and reducing the chance
of mismatches.
2026-03-11 19:37:11 -05:00
Abtin Keshavarzian 7696e38945 [mle] use increasing timeout for child role restoration (#11895)
This change updates the `PrevRoleRestorer` logic to use an increasing
timeout when a non-sleepy device sends `Child Update Request`
messages to restore its previous child role.

The timeout starts at 4 seconds and doubles with each subsequent
retransmission. This strategy is designed to handle scenarios where
the parent may also be restarting, such as after a network-wide power
outage, by allowing more time for the parent to recover. Over four
attempts, the device waits a total of 29 seconds (4 + 8 + 16 + 1)
before abandoning the restoration process.

Sleepy devices continue to use a short and fixed 1-second timeout
between retransmissions.

Additionally, if the restoring child receives a Child Update Request
from its former parent, it switches back to the shorter 1-second
timeout to expedite the restoration process and allow at least
two more Child Update attempts.
2026-03-11 16:21:44 -05:00
Jonathan Hui 69d4282a3f [nexus] update packet capture to pcapng format (#12660)
This commit updates the Nexus test framework to use the pcapng format
for packet capture instead of the legacy pcap format.

The pcapng format provides several advantages over legacy pcap,
most importantly the ability to support multiple interface captures
within a single file. This change prepares the Nexus framework for
more comprehensive border router testing, where capturing traffic
from both the Thread (802.15.4) and infrastructure (Ethernet)
interfaces simultaneously is required.

Changes:
- Implemented Section Header Block (SHB) and Interface Description
  Block (IDB) in Pcap::Open.
- Updated Pcap::WriteFrame to use Enhanced Packet Block (EPB).
- Added proper 32-bit alignment padding for EPB records as required
  by the pcapng specification.
- Updated the test runner script to use the .pcapng extension.
2026-03-11 16:01:32 -05:00
Abtin Keshavarzian b6beeef5b1 [energy-scan] use Tlv::StartTlv() and Tlv::EndTlv() (#12665)
This commit updates `EnergyScanServer` to use `Tlv::StartTlv()` and
`Tlv::EndTlv()` when constructing the Energy List TLV for the report
message. By leveraging a `Tlv::Bookmark` (`mEnergyListTlvBookmark`),
the server no longer needs to manually track the number of scan
results (`mNumScanResults`) and calculate the exact offset to update
the TLV length.

Furthermore, `Tlv::EndTlv()` automatically manages the conversion to
an Extended TLV if the payload size exceeds the maximum length of a
standard TLV (255 bytes).
2026-03-11 15:41:00 -05:00
Abtin Keshavarzian 34856e4d67 [commissioner] simplify energy list parsing in report handler (#12666)
This commit updates `Commissioner::HandleTmf<kUriEnergyReport>()` to
read the energy list data directly into a local array instead of
using a dedicated TLV class.

The report handler now uses `Tlv::FindTlvValueOffsetRange()` to locate
the TLV value, which works correctly whether the TLV is encoded as a
standard or extended TLV. With this change, the `EnergyListTlv` class
definition is replaced with a simple typedef to `TlvInfo`.
2026-03-11 15:36:30 -05:00
Abtin Keshavarzian ea94a2edf6 [network-diag] introduce TlvTypeListIterator (#12672)
This commit introduces a new `TlvTypeListIterator` helper class in
the network diagnostic `Server` to simplify the parsing of Type List
TLVs. This iterator handles deduplication of requested TLV types
using a `BitSet` and centralizes the offset management and iteration
logic.

The iterator is now used in `AppendRequestedTlvs()`,
`AppendRequestedTlvsForTcat()`, `PrepareAndSendAnswers()`, and
`HandleTmf<kUriDiagnosticReset>()`, replacing redundant manual
iteration and deduplication code.

Additionally, the `TypeListTlv` definition is simplified to a
`typedef` of `TlvInfo`, as the dedicated class structure is no
longer needed.
2026-03-11 14:19:41 -05:00
Jonathan Hui e3d03f4f14 [tcplp] fix boundary check in cbuf_reass_write (#12671)
This commit fixes a logic error in the TCP receive buffer reassembly
logic. The issue occurred when an out-of-order segment was exactly
the size of the circular buffer and the write index was non-zero.

The original logic incorrectly used modulo-wrapped indices to check
if a write should be contiguous or split:
start_index + numbytes % size. When numbytes == size, end_index ==
start_index, which evaluates to true, leading to an incorrect memory
write if start_index > 0.

This commit updates the check to use the absolute write boundary:
if (start_index + numbytes <= chdr->size). This ensures that any
write spanning the buffer boundary is correctly split.

A regression test test_cbuf_reass_boundary is added to test_all.c
to verify the fix and prevent future regressions. The test Makefile
is also updated to use $(CC) for better portability.
2026-03-11 14:04:02 -05:00
Jonathan Hui edd387d04e [coap] enhance CoAP option parsing validation and robustness (#12670)
This commit improves the robustness of CoAP option parsing by adding
rigorous validation checks to prevent potential overflows and null
pointer dereferences.

Summary of changes:
1. In 'ReadExtendedOptionField()', added an overflow check when
   calculating extended lengths for 2-byte extensions. It now returns
   'kErrorParse' if the value would exceed the 16-bit range.
2. In 'ReadBlockOptionValues()', added a check to ensure the block
   option exists before accessing it. This prevents a crash when
   'GetOption()' returns null.
3. In 'ReadBlockOptionValues()', added length validation to ensure the
   option value does not exceed the local buffer size (5 bytes) before
   copying.
4. Added a new unit test 'test_coap_overflow' to verify these validation
   checks and ensure they correctly handle malformed or missing options.
2026-03-11 14:03:42 -05:00
Jonathan Hui 3390085720 [lowpan] limit recursion depth in 6LoWPAN decompression (#12669)
This commit introduces a maximum recursion depth limit for 6LoWPAN
decompression to prevent potential stack exhaustion from maliciously
crafted frames with deep IPv6-in-IPv6 encapsulation.

- Added a private constant kMaxRecursionDepth in the Lowpan
  class to define the maximum allowed recursion depth.
- Updated Lowpan::Decompress() to track and validate the current
  recursion depth, returning kErrorParse if the limit is exceeded.
- Added a new unit test TestLowpanDecompressRecursion in
  tests/unit/test_lowpan.cpp to verify the recursion limit and
  ensure it correctly handles both excessive and legitimate
  encapsulation levels.
2026-03-11 14:03:29 -05:00
Abtin Keshavarzian 3e3690a068 [ip6] simplify multicast forwarding logic in DetermineAction() (#12653)
This commit simplifies and updates `Ip6::DetermineAction()` regarding
how the `aForwardThread` flag is determined for multicast messages
with a scope larger than realm-local.

Such messages are sent using IP-in-IP encapsulation destined to the
`RealmLocalAllMplForwarders` address. Both the encapsulated
(outer) and embedded (inner) messages are processed. When processing
the embedded IPv6 message, regardless of its origin, we only need to
forward it to the Thread mesh if the device has a sleepy child
subscribed to the multicast address. `MeshForwarder::SendMessage()`
on an FTD will then check for these subscriptions and schedule
indirect transmissions to those children.

The behavior for FTDs remains functionally the same as before, though
the code has been refactored to be clearer and easier to follow.

The primary change applies to MTDs: if the multicast destination scope
is larger than realm-local, the message is no longer forwarded to
Thread, as an MTD cannot have any children to support.
2026-03-11 13:10:45 -05:00
Abtin Keshavarzian b988a07525 [commissioner] clean up member variable and type formatting (#12667)
This commit reorganizes the member variables in the `Commissioner`
class, ordering them to optimize memory packing. Additionally, it
shortens the local typedef names for callback function pointers, such
as renaming `otCommissionerEnergyReportCallback` to the more concise
`EnergyReportCallback`, improving overall readability. Finally, it
aligns parameter formatting in method signatures like
`SendEnergyScanQuery()` and `SendPanIdQuery()`.
2026-03-11 13:09:34 -05:00
Abtin Keshavarzian dad25dc5b5 [energy-scan] protect server state on allocation failure (#12664)
This commit updates `EnergyScanServer::HandleTmf<kUriEnergyScan>()`
to use a local `OwnedPtr<Coap::Message>` when allocating and preparing
the initial energy report message. Previously, the method directly
modified `mReportMessage`, potentially leaving the object in an
inconsistent state or leaking memory if subsequent `Append()` operations
failed and exited early.

By building the message in a local `newMessage` first and only taking
ownership using `PassOwnership()` after all operations succeed, we
ensure the server's internal state remains consistent.
2026-03-11 13:08:49 -05:00
Abtin Keshavarzian 039819699a [coap] flatten Receive() and ProcessReceivedResponse() (#12663)
This commit updates the `CoapBase::Receive()` and
`CoapBase::ProcessReceivedResponse()` methods to utilize early returns
via `ExitNow()` and `VerifyOrExit()`. By doing so, it flattens the
nested conditional logic and improves the overall readability of the
code.

As a result of this change in `CoapBase::Receive()`, an invalid
message that fails CoAP header parsing will exit early, correctly
skipping the `Utils::Otns::EmitCoapReceive()` signal.
2026-03-10 22:12:36 -05:00