openthread-br: update to 2026.09.0

[LorbusChris]

Update openthread-br from the 2025-06-12 snapshot to the v2026.09.0 release, carrying the packaging improvements from #30091 and #30096 on top. Supersedes both.

• update to 2026.09.0: release-tag versioning. The in-tree LuCI app was removed upstream in this release ([openwrt] remove the in-tree LuCI app (proposed for openwrt/luci) openthread/ot-br-posix#3326), so the luci-app-openthread package goes with it; a maintained replacement is proposed as a proper LuCI app in luci-app-openthread: add new application luci#8871. OTBR_VENDOR_NAME/OTBR_PRODUCT_NAME are now required and are set to the values the removed built-in defaults had, so existing users' border routers keep their MeshCoP instance name. Patches 101 (external cJSON) and 102 (LuCI icons) are upstream; the gcc14/mbedtls fix is still needed at this release's submodule pins. Also adds a functional smoke test.
• make the REST API listen address configurable (carried from openthread-br: update to 2026.08.0, internal mDNS, configurable REST listen address #30091): the REST API defaults to loopback since 2026.07.0; remote clients such as Home Assistant on another host need it bindable elsewhere. Unset keeps the loopback-only default.
• use OpenThread's internal mDNS (carried from openthread-br: update to 2026.08.0, internal mDNS, configurable REST listen address #30091): drops the mdnsd and mDNSResponder dependencies.
• use the in-process nftables firewall backend (new upstream in this release, [firewall] opt-in in-process nftables backend via libnftnl/libmnl openthread/ot-br-posix#3325): the default firewall backend shells out to ipset, iptables and ip6tables, none of which are installed on an fw4-based OpenWrt, so the Thread ingress filter and the NAT44 masquerade silently did nothing. The in-process backend installs them through nftables in an isolated table, and the package ships the marker file the build writes for the upstream helper scripts.

Compile-tested in the CI SDK image (x86_64 snapshot), with PKG_MIRROR_HASH generated by the SDK's own source pack. Written with AI assistance (Assisted-By trailers); I've reviewed and understand all of it and will answer questions myself.

[openwrt-ai]

Reviewed 4 new commits against upstream ot-br-posix at v2026.09.0 (tag fd872ab9d4afdfaf034b3b1154fed08b8b6d1e43). The version bump itself checks out: the tag exists, PKG_RELEASE is correctly reset to 1, patch 101 is genuinely upstream now (third_party/CMakeLists.txt does the pkg_check_modules(CJSON libcjson) dance, so +cJSON still buys you the system library), OTBR_DUA_ROUTING no longer exists upstream, --rest-listen-address / --rest-listen-port match realmain.cpp, the Vendor name must be set. string is verbatim, the 0.3.0 fallback claim is correct (project(openthread-br VERSION 0.3.0)), and <vendor> <product> is indeed how border_agent.cpp:194 composes the MeshCoP base name.

The one finding I'd treat as merge-blocking is the missing nftables kernel-module dependencies (inline on the +libnftnl line) — with OTBR_NFTABLES=ON a failed firewall install is SuccessOrDie, so on an image without fw4 this turns a working daemon into one that aborts at startup. The rest are documentation/commit-message accuracy and one question about the shipped marker file.

Commit checks

• 8af420e "openthread-br: update to 2026.09.0" — the message accounts for every other build-option change (vendor/product name, OTBR_VERSION, the dropped patches, the LuCI app) but never mentions that the commit also drops -DOTBR_DNSSD_DISCOVERY_PROXY=ON, -DOTBR_DUA_ROUTING=ON and -DOTBR_SRP_ADVERTISING_PROXY=ON. All three removals look correct — OTBR_DUA_ROUTING is gone upstream, and with OTBR_MDNS set the OT-core proxies now default on, so keeping either of the other two would hit message(FATAL_ERROR "Only one Advertising Proxy can be enabled.") / "Only one Discovery Proxy can be enabled." in etc/cmake/options.cmake — but three feature-visible options disappearing silently is exactly the kind of hunk a reader will stop on. A sentence saying they are now the OT-core equivalents would close it.
• 644e613 "openthread-br: use the in-process nftables firewall backend" — the message's premise ("The package builds with the default firewall enabled, and that backend shells out to ipset, iptables and ip6tables at runtime") does not match the Makefile, which sets and keeps -DOT_FIREWALL=OFF. Details and references inline on the -DOTBR_NFTABLES=ON line.

f5dbd03 and 50d6602 match their diffs.

CI on 644e613 is green on all three FormalityCheck runs, with the build/test workflows not yet reported — nothing to attribute to this diff.

---

Generated by Claude Code

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Updates the OpenWrt openthread-br package to the upstream v2026.09.0 release while carrying forward packaging/behavior adjustments (REST bind configurability, OpenThread internal mDNS, nftables firewall backend) and adding a basic functional smoke test.

Changes:

• Bump openthread-br to v2026.09.0 and adjust CMake options/dependencies (nftables backend, internal mDNS, vendor/product/version settings).
• Make REST listen address/port configurable via netifd protocol options and document the security implications.
• Drop now-upstream patches (external cJSON, LuCI icons), remove the in-tree LuCI app packaging, and add a functional smoke test script.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
net/openthread-br/test.sh	Adds a functional smoke test to exercise otbr-agent/ot-ctl option parsing and runtime closure.
net/openthread-br/patches/102-openwrt-fix-LuCI-icons.patch	Removes a patch that is now upstream.
net/openthread-br/patches/101-rest-Permit-to-externally-provide-cJSON-library.patch	Removes a patch that is now upstream.
net/openthread-br/files/openthread-proto.sh	Adds netifd options for REST bind address/port and removes mdnsd service checks.
net/openthread-br/README.md	Updates documentation for 2026.09.0 changes, nftables backend, internal mDNS, REST binding, and LuCI packaging split.
net/openthread-br/Makefile	Updates versioning, dependencies, CMake options, installs nftables backend marker, and drops in-tree LuCI app packaging.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[openwrt-ai]

Re-reviewed the range 644e613..0c2e300. The force-push rewrote all four commits, but only two carry content changes since my last pass: the Makefile gained the two kmod dependencies, and the README "Firewall support" section was rewritten. Commits 2 and 3 are byte-identical rebases; commit 1 changed only its message.

All four findings from my previous review are addressed:

• kmod dependencies — +kmod-nft-core and +kmod-nft-nat are now in DEPENDS, tab-indented and alphabetically placed next to +kmod-tun, matching upstream's example Makefile swap. kmod-nft-nat already pulls kmod-nft-core via netfilter.mk:1371, so listing both is redundant but harmless and mirrors upstream. This was the merge-blocking one; it's resolved.
• Firewall mechanism — the commit message and README no longer claim the package shelled out to ipset/iptables. The new text ("no Thread ingress filter existed at all") matches the Makefile, which has carried -DOT_FIREWALL=OFF for as far back as the file's history goes here.
• Marker file — reworded to a debugging aid that nothing on the target reads today. Accurate.
• Stale README section — folded into "Packaging decisions" rather than left contradicting an appended tail section; the duplicate tail section is gone.

One new documentation-accuracy nit inline on the rewritten paragraph: the clause explaining why OT_FIREWALL stays off is contradicted by the same CMake guard I cited last round, and by upstream's example package pairing the two options. Non-blocking, and the rest of that paragraph already carries the rationale.

CI on 0c2e300: all three FormalityCheck runs green; the build/test workflows have not reported yet. Nothing to attribute to this diff.

Commit messages all match their diffs now — commit 1 picked up the paragraph on the three dropped CMake options, and commit 4's message was rewritten alongside its content.

---

Generated by Claude Code