openthread-br: update to the 2026.09.0 release

third_party/openthread-br/Makefile

@@ -34,9 +34,9 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL:=https://github.com/openthread/ot-br-posix.git
 PKG_SOURCE_PROTO:=git-with-metadata
 
-PKG_SOURCE_DATE:=2026-05-22
-PKG_SOURCE_VERSION:=9e56492ef19b6d43cc8be4a69ac7ae6376194f69
-PKG_MIRROR_HASH:=2ba2e9aeeeb8c5ee7411f18d3303340bf35817f6c1f12fa35bebeae5974ac45a
+PKG_SOURCE_DATE:=2026-09-01
+PKG_SOURCE_VERSION:=fd872ab9d4afdfaf034b3b1154fed08b8b6d1e43
+PKG_MIRROR_HASH:=c323d8c5f8f156bada623cd6cdd8280c8dfd2fd2601ceda2f298b448eef58075
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -57,7 +57,7 @@ define Package/openthread-br/Default
   CATEGORY:=Network
   TITLE:=OpenThread Border Router
   URL:=https://github.com/openthread/ot-br-posix
-  DEPENDS:=+libstdcpp +OPENTHREADBR_SHARED_MBEDTLS:libmbedtls +libjson-c +libubus +libubox +kmod-usb-acm +kmod-tun +jsonfilter
+  DEPENDS:=+libstdcpp +OPENTHREADBR_SHARED_MBEDTLS:libmbedtls +libjson-c +libubus +libubox +libmnl +libnftnl +kmod-nft-core +kmod-nft-nat +kmod-usb-acm +kmod-tun +jsonfilter
 endef
 
 define Package/openthread-br/Default/description
@@ -69,18 +69,17 @@ endef
 
 define Package/openthread-br
   $(call Package/openthread-br/Default)
-  VARIANT:=default
-  DEPENDS+= +PACKAGE_openthread-br:libdnssd
+  DEPENDS+= +libdnssd
 endef
 
 define Package/openthread-br/description
 $(call Package/openthread-br/Default/description)
 
-This default variant of the package uses mDNSResponder for mDNS / DNS-SD.
+The package uses mDNSResponder for mDNS / DNS-SD.
 endef
 
 define Package/openthread-br/config
-if PACKAGE_openthread-br || PACKAGE_openthread-br-avahi
+if PACKAGE_openthread-br
 config OPENTHREADBR_SHARED_MBEDTLS
 	bool "Use shared mbedTLS library for OpenThread"
 	default n
@@ -92,32 +91,15 @@ config OPENTHREADBR_SHARED_MBEDTLS
 endif
 endef
 
-define Package/openthread-br-avahi
-  $(call Package/openthread-br/Default)
-  VARIANT:=avahi
-  PROVIDES:=openthread-br
-  CONFLICTS:=openthread-br
-  DEPENDS+= +PACKAGE_openthread-br-avahi:libavahi-client
-endef
-
-define Package/openthread-br-avahi/description
-$(call Package/openthread-br/Default/description)
-
-This variant of the package uses Avahi for mDNS / DNS-SD.
-endef
-
-
-define Package/openthread-br-luci
-  $(call Package/openthread-br/Default)
-  TITLE+= (LuCI module)
-  DEPENDS:=+luci-lua-runtime @PACKAGE_openthread-br||PACKAGE_openthread-br-avahi
-endef
-
-define Package/openthread-br-luci/description
-LuCI user interface for the OpenThread Border Router.
-endef
-
-# Disable firewall integration due to https://github.com/openthread/ot-br-posix/issues/1675
+# The OT posix platform firewall (OT_FIREWALL) produces ipset/ip6tables
+# rules, which nftables-based OpenWrt does not run, so it stays off - the
+# original reason firewall integration was disabled here
+# (https://github.com/openthread/ot-br-posix/issues/1675). OTBR_NFTABLES
+# is that issue delivered: otbr-agent installs the Thread ingress filter
+# and the NAT44 masquerade in-process, through nftables in an isolated
+# table. It needs nf_tables kernel support at runtime (kmod-nft-core,
+# kmod-nft-nat): with the backend compiled in, a failed firewall install
+# aborts the agent rather than silently forwarding unfiltered traffic.
 CMAKE_OPTIONS+= \
 	-DOTBR_GIT_VERSION=$(call GitWithMetadata/resolve,OTBR_GIT_VERSION)$(if $(PKG_RELEASE),-r$(PKG_RELEASE)) \
 	-DOT_PACKAGE_VERSION=$(call GitWithMetadata/resolve,OT_GIT_VERSION) \
@@ -128,8 +110,8 @@ CMAKE_OPTIONS+= \
 	-DOTBR_VENDOR_NAME=$(VERSION_MANUFACTURER) \
 	-DOTBR_BORDER_AGENT=ON \
 	-DOTBR_BORDER_ROUTING=ON \
-	-DOTBR_SRP_ADVERTISING_PROXY=ON \
 	-DOTBR_NAT64=OFF \
+	-DOTBR_NFTABLES=ON \
 	-DOTBR_SETTINGS_FILE_USE_INTERFACE_NAME=ON \
 	-DOT_POSIX_SETTINGS_PATH=\"/etc/openthread\" \
 	-DOT_FIREWALL=OFF \
@@ -145,15 +127,12 @@ ifneq ($(CONFIG_OPENTHREADBR_SHARED_MBEDTLS),)
 CMAKE_OPTIONS+= -DOTBR_EXTERNAL_MBEDTLS="mbedtls;mbedcrypto;mbedx509"
 endif
 
-ifeq ($(BUILD_VARIANT),avahi)
-CMAKE_OPTIONS+= -DOTBR_MDNS=avahi
-else
 CMAKE_OPTIONS+= -DOTBR_MDNS=mDNSResponder
-endif
 
 define Package/openthread-br/install
-	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/usb
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/usb $(1)/usr/share/otbr
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/otbr-agent $(1)/usr/sbin
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/otbr/nftables-backend $(1)/usr/share/otbr
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ot-ctl $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/otbr-rcp $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/otbr-agent.init $(1)/etc/init.d/otbr-agent
@@ -167,20 +146,4 @@ define Package/openthread-br/conffiles
 /etc/openthread/
 endef
 
-Package/openthread-br-avahi/install=$(Package/openthread-br/install)
-Package/openthread-br-avahi/conffiles=$(Package/openthread-br/conffiles)
-
-define Package/openthread-br-luci/install
-	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/controller/admin
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/openwrt/controller/thread.lua $(1)/usr/lib/lua/luci/controller/admin
-
-	$(INSTALL_DIR) $(1)/usr/lib/lua/luci/view
-	$(CP) $(PKG_BUILD_DIR)/src/openwrt/view/admin_thread $(1)/usr/lib/lua/luci/view
-
-	$(INSTALL_DIR) $(1)/www/luci-static/resources
-	$(CP) $(PKG_BUILD_DIR)/src/openwrt/handle_error.js $(1)/www/luci-static/resources
-endef
-
 $(eval $(call BuildPackage,openthread-br))
-$(eval $(call BuildPackage,openthread-br-avahi))
-$(eval $(call BuildPackage,openthread-br-luci))

third_party/openthread-br/patches/020-external-mbedtls.patch

@@ -1,4 +1,4 @@
-From 875543a791f91c2ada64977ce5fc75502c8daf1e Mon Sep 17 00:00:00 2001
+From 4c068e0ba07007d62bd8aad515d1f47370b7193b Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Fri, 10 Oct 2025 22:29:18 +1300
 Subject: [PATCH] Add OTBR_EXTERNAL_MBEDTLS build setting
@@ -14,11 +14,11 @@ This works the same as (and propagates to OT_EXTERNAL_MBEDTLS).
  6 files changed, 14 insertions(+), 6 deletions(-)
 
 diff --git a/etc/cmake/options.cmake b/etc/cmake/options.cmake
-index 1339b3b2..8183bb19 100644
+index c82916e9..c18e56fb 100644
 --- a/etc/cmake/options.cmake
 +++ b/etc/cmake/options.cmake
-@@ -40,6 +40,13 @@ elseif (OTBR_MDNS STREQUAL "openthread")
-     target_compile_definitions(otbr-config INTERFACE OTBR_ENABLE_MDNS_OPENTHREAD=1)
+@@ -39,6 +39,13 @@ elseif (OTBR_MDNS STREQUAL "avahi")
+     message(FATAL_ERROR "OTBR_MDNS=avahi is no longer supported. Use OTBR_MDNS=openthread or OTBR_MDNS=mDNSResponder.")
  endif()
 
 +set(OTBR_EXTERNAL_MBEDTLS "" CACHE STRING "Specify external mbedtls library")
@@ -56,10 +56,10 @@ index 217341ba..270e28a1 100644
  )
  install(
 diff --git a/tests/gtest/CMakeLists.txt b/tests/gtest/CMakeLists.txt
-index 2974cf52..79e559d3 100644
+index c03af338..ba38ec94 100644
 --- a/tests/gtest/CMakeLists.txt
 +++ b/tests/gtest/CMakeLists.txt
-@@ -47,7 +47,7 @@ add_executable(otbr-gtest-unit
+@@ -48,7 +48,7 @@ add_executable(otbr-gtest-unit
      test_task_runner.cpp
  )
  target_link_libraries(otbr-gtest-unit
@@ -68,7 +68,7 @@ index 2974cf52..79e559d3 100644
      otbr-common
      otbr-host
      otbr-utils
-@@ -132,7 +132,7 @@ target_include_directories(otbr-gtest-host-api
+@@ -182,7 +182,7 @@ target_include_directories(otbr-gtest-host-api
          ${OPENTHREAD_PROJECT_DIRECTORY}/tests/gtest
  )
  target_link_libraries(otbr-gtest-host-api
@@ -78,17 +78,17 @@ index 2974cf52..79e559d3 100644
      otbr-utils
      otbr-posix
 diff --git a/third_party/openthread/CMakeLists.txt b/third_party/openthread/CMakeLists.txt
-index eddf5ce1..3b7dbf1e 100644
+index 156c9c59..3a14c382 100644
 --- a/third_party/openthread/CMakeLists.txt
 +++ b/third_party/openthread/CMakeLists.txt
-@@ -51,6 +51,7 @@ set(OT_DNS_CLIENT_OVER_TCP OFF CACHE STRING "disable DNS query over TCP")
+@@ -50,6 +50,7 @@ set(OT_DNS_CLIENT_OVER_TCP OFF CACHE STRING "disable DNS query over TCP")
  set(OT_DNS_UPSTREAM_QUERY ${OTBR_DNS_UPSTREAM_QUERY} CACHE STRING "enable sending DNS queries to upstream" FORCE)
  set(OT_ECDSA ON CACHE STRING "enable ECDSA" FORCE)
  set(OT_EXTERNAL_HEAP ON CACHE STRING "enable external heap" FORCE)
 +set(OT_EXTERNAL_MBEDTLS ${OTBR_EXTERNAL_MBEDTLS} CACHE STRING "Specify external mbedtls library" FORCE)
- set(OT_FIREWALL ON CACHE STRING "enable firewall feature")
- set(OT_HISTORY_TRACKER ON CACHE STRING "enable history tracker" FORCE)
- set(OT_JOINER ON CACHE STRING "enable joiner" FORCE)
+ if (OTBR_NFTABLES)
+     # otbr-agent owns the OTBR ingress firewall in-process (nftables), including
+     # producing the ingress prefix sets from Thread network data, so the OT posix
 diff --git a/tools/CMakeLists.txt b/tools/CMakeLists.txt
 index 5e8451af..7df5c690 100644
 --- a/tools/CMakeLists.txt
@@ -111,6 +111,3 @@ index 5e8451af..7df5c690 100644
  )
 
  if ($ENV{REFERENCE_DEVICE})
--- 
-2.50.1 (Apple Git-155)
-

third_party/openthread-br/patches/100-ubus-uloop-main-thread.patch

@@ -1,4 +1,4 @@
-From 1f56fbac66f0d545a43c5f6f46c5eba78e57ddc5 Mon Sep 17 00:00:00 2001
+From 9239cabf0d8e9f38eca0c54c6158ab5a26a732eb Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Thu, 2 Oct 2025 08:10:30 +1300
 Subject: [PATCH] Ubus: Move ubus / uloop integration onto the main thread
@@ -9,17 +9,17 @@ overall and aligns with how the DBus integration is implemented.
 
 Also remove unused blobmsg_json dependency.
 ---
- src/agent/application.cpp       |  11 +-
+ src/agent/application.cpp       |   5 +
  src/openwrt/ubus/CMakeLists.txt |   2 -
  src/openwrt/ubus/otubus.cpp     | 226 ++++++++++++++------------------
  src/openwrt/ubus/otubus.hpp     |  72 +++++-----
- 4 files changed, 145 insertions(+), 166 deletions(-)
+ 4 files changed, 145 insertions(+), 160 deletions(-)
 
 diff --git a/src/agent/application.cpp b/src/agent/application.cpp
-index fe2aa55b..751622c0 100644
+index 9f510b37..5ed69bec 100644
 --- a/src/agent/application.cpp
 +++ b/src/agent/application.cpp
-@@ -100,6 +100,11 @@ void Application::Init(const std::string &aRestListenAddress, int aRestListenPor
+@@ -117,6 +117,11 @@ void Application::Init(const std::string &aRestListenAddress, int aRestListenPor
  {
      CoprocessorType type;
 
@@ -31,19 +31,6 @@ index fe2aa55b..751622c0 100644
      mHost.Init();
 
      type = mHost.GetCoprocessorType();
-@@ -173,12 +178,6 @@ otbrError Application::Run(void)
-     }
- #endif
-
--    // allow quitting elegantly
--    signal(SIGTERM, HandleSignal);
--
--    // avoid exiting on SIGPIPE
--    signal(SIGPIPE, SIG_IGN);
--
-     while (!sShouldTerminate)
-     {
-         otbr::MainloopContext mainloop;
 diff --git a/src/openwrt/ubus/CMakeLists.txt b/src/openwrt/ubus/CMakeLists.txt
 index 9d0a086e..8e868f2b 100644
 --- a/src/openwrt/ubus/CMakeLists.txt
@@ -56,7 +43,7 @@ index 9d0a086e..8e868f2b 100644
 -    json-c
  )
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 45b9ed4e..5d2724a8 100644
+index 8c633d14..5c2a698a 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -34,23 +34,18 @@
@@ -346,15 +333,15 @@ index 45b9ed4e..5d2724a8 100644
      if (!strcmp(aAction, "networkname"))
      {
          struct blob_attr *tb[SET_NETWORK_MAX];
-@@ -1613,7 +1563,6 @@ int UbusServer::UbusSetInformation(struct ubus_context      *aContext,
+@@ -1614,7 +1564,6 @@ int UbusServer::UbusSetInformation(struct ubus_context      *aContext,
      }
 
  exit:
 -    mHostMutex->unlock();
      AppendResult(error, aContext, aRequest);
      return 0;
  }
-@@ -1692,9 +1641,6 @@ void UbusServer::UbusConnectionLost(struct ubus_context *aContext)
+@@ -1693,9 +1642,6 @@ void UbusServer::UbusConnectionLost(struct ubus_context *aContext)
 
  int UbusServer::DisplayUbusInit(const char *aPath)
  {
@@ -364,7 +351,7 @@ index 45b9ed4e..5d2724a8 100644
      mSockPath = aPath;
 
      mContext = ubus_connect(aPath);
-@@ -1738,13 +1684,6 @@ void UbusServer::InstallUbusObject(void)
+@@ -1739,13 +1685,6 @@ void UbusServer::InstallUbusObject(void)
          otbrLogErr("Ubus connect failed");
          return;
      }
@@ -378,7 +365,7 @@ index 45b9ed4e..5d2724a8 100644
  }
 
  otError UbusServer::ParseLong(char *aString, long &aLong)
-@@ -1805,52 +1744,85 @@ exit:
+@@ -1806,52 +1745,85 @@ exit:
      return rval;
  }
 
@@ -630,6 +617,3 @@ index f87e9c1c..77e4237c 100644
  };
  } // namespace ubus
  } // namespace otbr
--- 
-2.50.1 (Apple Git-155)
-

third_party/openthread-br/patches/101-ubus-connection-handling.patch

@@ -1,4 +1,4 @@
-From c735382f18325a47a8fcae280893b4527a510982 Mon Sep 17 00:00:00 2001
+From 02a21012607733c442fe57b7fc2636daf5557b9d Mon Sep 17 00:00:00 2001
 From: Karsten Sperling <ksperling@apple.com>
 Date: Thu, 2 Oct 2025 13:09:47 +1300
 Subject: [PATCH] Ubus: Move connection logic into UBusAgent and reduce
@@ -10,7 +10,7 @@ Subject: [PATCH] Ubus: Move connection logic into UBusAgent and reduce
  2 files changed, 84 insertions(+), 144 deletions(-)
 
 diff --git a/src/openwrt/ubus/otubus.cpp b/src/openwrt/ubus/otubus.cpp
-index 5d2724a8..a18af82a 100644
+index 5c2a698a..be85f1e5 100644
 --- a/src/openwrt/ubus/otubus.cpp
 +++ b/src/openwrt/ubus/otubus.cpp
 @@ -53,9 +53,8 @@ const static int PANID_LENGTH      = 10;
@@ -57,7 +57,7 @@ index 5d2724a8..a18af82a 100644
      blob_buf_init(&mScanBuf, 0);
      mScanArray = blobmsg_open_array(&mScanBuf, "scan_list");
 
-@@ -1596,93 +1595,11 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
+@@ -1597,93 +1596,11 @@ void UbusServer::GetState(otInstance *aInstance, char *aState)
      }
  }
 
@@ -153,7 +153,7 @@ index 5d2724a8..a18af82a 100644
      }
  }
 
-@@ -1818,12 +1735,58 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
+@@ -1819,12 +1736,58 @@ void UloopProcessor::Process(const MainloopContext &aMainloop)
 
  // === UBusAgent ===
 
@@ -364,6 +364,3 @@ index 77e4237c..6396dfa9 100644
      otbr::Host::RcpHost &mHost;
  };
  } // namespace ubus
--- 
-2.50.1 (Apple Git-155)
-