otbr 2026.07.0: pending dataset, full NIM cluster data, netifd thread protocol - #53
otbr 2026.07.0: pending dataset, full NIM cluster data, netifd thread protocol#53LorbusChris wants to merge 9 commits into
Conversation
Moves the pin 74 commits forward, from 9e56492e to the v2026.07.0 tag. Drop OTBR_SRP_ADVERTISING_PROXY. This release turns the OT core Advertising Proxy on by default whenever OTBR_MDNS is set, and the two are mutually exclusive, so forcing the POSIX proxy on now fails configure with "Only one Advertising Proxy can be enabled." Dropping the flag adopts the OT core proxy, which is upstream's default build. The mDNS provider is unchanged; both the mDNSResponder and avahi variants keep their own responder. OTBR_PRODUCT_NAME is not needed even though this release makes vendor and model mandatory, because otbr-agent.init already passes --model-name from board.json at runtime. 020-external-mbedtls no longer applies with strict context. A three way apply resolves every hunk without conflict, so it is refreshed against the tag with no change in what it does. The other build patches and the whole ubus series apply unchanged, as nothing upstream touched src/openwrt/ubus in that range. PKG_MIRROR_HASH is regenerated for the new tarball. Signed-off-by: Christian Glombek <c.glombek@cosa.systems> Assisted-By: Claude Opus 5
The ubus surface can form a Thread network but cannot change one that is already running. Replacing the credentials or the channel of a live network has to go through the pending dataset, so every node switches together when the delay timer expires rather than being orphaned. The existing ubus series (100-106, 110) stays untouched: the original patch files apply cleanly to 2026.07.0 as they are. New patches continue the series in three clean blocks, generated with git format-patch from the upstream PR branches: - 120-125: host/ncp groundwork (openthread/ot-br-posix#3489) — refresh the cached active dataset on unsolicited changes, implement the pending dataset under NCP mode, do not report the result of Leave twice, value-initialise the dataset in ScheduleMigration, erase the dataset in Leave based on the device role, report a dataset erase to state-change subscribers. - 130-135: the ubus methods — provision through the host abstraction, set_pending forwarding to ThreadHost::ScheduleMigration() (MGMT_PENDING_SET), a pending_dataset_changed notification, a deprovision method (detach + erase; gentler than factory-reset leave, needed for Matter's RevertActiveDataset()), respond to provision once the join is under way, and threadstart/threadstop through the host abstraction. - 140: advertise mDNS under the system host name (openthread/ot-br-posix#3488). Signed-off-by: Christian Glombek <c.glombek@cosa.systems> Assisted-By: Claude Opus 5
|
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances the matter-netman service on OpenWrt to fully support the Network Infrastructure Manager (NIM) cluster set using real system data. Key updates include publishing a 'matter' ubus object for onboarding and commissioning control, integrating real-time diagnostics for Wi-Fi, Thread, and Ethernet clusters, and migrating the OpenThread border router agent to a netifd protocol handler. Feedback on these changes identifies a build issue in the Makefile due to an invalid $(INSTALL_CONF) macro, potential information leaks and globbing bugs in the init script's reload logic, and a deprecated -a shell operator in the RCP script.
b0c79de to
50a0964
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request refactors the OpenThread Border Router (OTBR) agent configuration on OpenWrt by moving it to a netifd protocol handler (thread-proto.sh) and implements real data providers for the NIM clusters (Wi-Fi, Thread, and Ethernet diagnostics). It also publishes a new 'matter' ubus object to expose commissioning status and control. The review feedback is highly constructive, pointing out that in multi-interface setups, ot-ctl needs to be directed to the correct socket path. It suggests introducing an otctl helper function in thread-proto.sh to ensure commands are routed correctly based on the active device.
50a0964 to
dd5bab4
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request integrates the full Network Infrastructure Manager (NIM) cluster set for OpenWrt, including Wi-Fi Network Management, Thread Network Diagnostics, Thread Network Directory, and Ethernet Network Diagnostics. It also updates the openthread-br package to support pending datasets, asynchronous provisioning/deprovisioning, and publishing a matter ubus object. The feedback recommends avoiding the suppression of stderr from the RCP discovery tool in thread-proto.sh to facilitate debugging.
dd5bab4 to
116342a
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates the matter-netman service and openthread-br package to improve Thread network management and integration with OpenWrt. Key changes include migrating to a new netifd protocol for Thread, implementing asynchronous ubus calls for provisioning, and adding a matter ubus object for commissioning. I have reviewed the code and identified two issues: a potential race condition in the protocol handler that could permanently block the interface at boot, and an unsafe string comparison in the OsReleaseField helper that could lead to undefined behavior.
116342a to
a8c3077
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request integrates the Matter Network Infrastructure Manager (NIM) service with OpenWrt, enabling full support for Thread Border Router Management, Wi-Fi Network Management, and diagnostics clusters. It replaces the legacy procd service for otbr-agent with a native netifd protocol handler (thread) and introduces a series of patches to OpenThread Border Router (OTBR) and the Matter daemon to support asynchronous provisioning, pending datasets, and local commissioning control via a published Ubus object. The review feedback highlights two shell scripting issues: a syntax error in thread-proto.sh due to unsupported default value syntax in json_get_vars, and a potential false positive in the hotplug script when matching unconfigured backbone networks.
The delegate advertised no PANChange support and answered SetPendingDataset and RevertActiveDataset with NOT_IMPLEMENTED, so a controller could form a Thread network through it but never change one already running, and a fail-safe expiry left the border router holding a dataset the controller had abandoned. With the ubus methods added to openthread-br, the delegate can now report PANChange, invoke set_pending to schedule a migration and deprovision to revert, and serve the pending dataset that status and pending_dataset_changed report. 030 also implements RevertActiveDataset in the fake delegate, so fail-safe rollback can be exercised without hardware. Signed-off-by: Christian Glombek <c.glombek@cosa.systems> Assisted-By: Claude Opus 5
a8c3077 to
79885b9
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces comprehensive improvements to the Matter Network Infrastructure Manager (NIM) and OpenThread Border Router (OTBR) integration on OpenWrt. Key changes include migrating the OTBR service to a native netifd protocol handler (thread), implementing full NIM cluster support (Wi-Fi Network Management, Thread Network Diagnostics, Thread Network Directory, and Ethernet Network Diagnostics) backed by real system data via ubus, publishing a matter ubus object for local commissioning control, and resolving several commissioning-flow issues such as asynchronous provisioning and fail-safe revert guarding. Additionally, the openthread-br package is updated, and several patches are introduced to enhance dataset handling, mDNS hostname advertising, and robustness. As there are no review comments, no further feedback is provided.
Patch 035 replaces the demo stubs behind the NIM device type with live router state: the Wi-Fi Network Management cluster shares the LAN access point credentials read from netifd (guest networks excluded; wifi_share, wifi_network and wifi_iface in /etc/config/matter adjust or disable the sharing), Thread Network Diagnostics is fed from otbr-agent over ubus, the Thread Network Directory is seeded with the border router own network, and Ethernet Network Diagnostics reports the uplink counters. The service gains a procd reload trigger on wireless/network config changes that pokes the daemon over ubus, and the ubusd ACL grants the matter user read access to exactly network.wireless status. Applying a new ubusd ACL needs a ubusd restart, which breaks clients holding the old connection (rpcd, lighttpd, foris) - a reboot after install is the clean path. Assisted-By: Claude Fable 5
The bundled mbedtls miscompiles its NEON tail case with GCC >= 14.1; carry the guard in slot 060, below the ubus series. Assisted-By: Claude Fable 5
This release rejects it outright: configure fails with "OTBR_MDNS=avahi is no longer supported", so the variant has stopped being buildable and only mDNSResponder remains. With no backend choice left there is nothing for the variants to vary, and openthread-br becomes a single package selecting mDNSResponder explicitly. Assisted-By: Claude Fable 5
Enable the border router feature set the other packagings build with: OT_BORDER_ROUTER for the management surface the ubus methods sit on, the channel manager and monitor so a channel can be changed and judged at runtime, and the SRP server's auto-enable. The REST API is switched off explicitly rather than by relying on the upstream default, since nothing here consumes it and it would listen on the infrastructure interface. Assisted-By: Claude Fable 5
The border router was driven by its own procd service and uci config, which kept the Thread interface invisible to netifd: nothing modelled its dependency on the backbone network, and the LuCI network pages had no interface to show. The other packagings of this daemon integrate as a netifd protocol named thread; adopt the same shape here without giving up what the procd integration could do that the shared protocol script cannot: locating the RCP dongle by its USB properties, updating its firmware, and surviving a replug. The protocol handler resolves the dongle through the otbr-rcp wrapper before launching the agent, in a single discovery pass that also carries out any firmware install or update. Running the update in the setup phase matters: a flash can take minutes, and under the launched command it would race the bounded wait for the agent's ubus object, with netifd tearing the flash down mid-write on a timeout. A missing dongle fails setup with the restart block every failure needs, since netifd retries a failed interface immediately and without backoff. Recovery is the USB hotplug handler's job: ifup lifts the block, and matching on the recorded RCP_NOT_FOUND error keeps the handler away from interfaces an administrator took down on purpose. The uci-defaults declare a network.thread interface, carrying over the settings of the retired procd service so an upgrade keeps the border router on the network it was configured for, retire the service's leftovers, and reload netifd so the interface comes up without a reboot when installed on a live system. Assisted-By: Claude Fable 5
otbr-rcp only accepted devices whose USB product string contains the word OpenThread, even when the operator named the exact bus position. Many RCP dongles carry other product strings — Home Assistant's ZBT-2 reports "ZBT-2" — and could not be selected at all. An explicit bus position is the operator saying this device is the RCP, so it now only needs the usable cdc_acm interface. Unattended selection with "any" keeps the conservative product match. Assisted-By: Claude Fable 5
79885b9 to
07049b4
Compare
|
Hi @LorbusChris, thanks for this PR, it looks like a very substantial piece of work! I will have a detailed look next week. In regards to upstreaming my OTBR patches, yes, I’m going through our company internal contribution review process at the moment, so I should be able to upstream them in a few weeks time. |
3 participants
Updates the border-router stack to enable Matter management of the Thread network, including migration to a different dataset via the pending-dataset mechanism. In daily use on OpenWrt-based hardware:
git format-patchfrom the upstream PR branches.matterubus object, pending-dataset support in the ubus delegate, and real data on all NIM clusters (upstream as [network-manager-app] pending dataset support over ubus connectedhomeip#73309).threadprotocol, with an RCP selector that can override the USB product-string match.(On Turris OS we additionally run the nftables firewall backend from openthread/ot-br-posix#3325; it is not carried in this PR.)
@ksperling-apple — the ubus series upstream: the 100–106/110 patches are your commits, and I'd like to see them land in ot-br-posix proper so the packagings can stop carrying them. Since the CLA has to come from the author, would you open that upstream PR yourself? I have a rebased copy of your commits (onto current ot-br-posix main, they apply cleanly) that you're welcome to take. My follow-on work is already in flight — openthread/ot-br-posix#3487, openthread/ot-br-posix#3488, openthread/ot-br-posix#3489 — and the ubus methods series that builds on yours (130–135 here) would follow, stacked on your PR.
The controller side works as well: Home Assistant imports the Thread dataset and Wi-Fi credentials from the network manager, surfaces the diagnostics, and can hand a border router a new network as a pending migration — those changes are heading upstream to home-assistant/core as a series of PRs.