From 1941dc246ffc4f02b6d8e9de2a400a7c68e7cff8 Mon Sep 17 00:00:00 2001 From: Stefan Agner Date: Fri, 28 Aug 2026 14:28:15 +0200 Subject: [PATCH] openthread_border_router: Fix upstream DNS resolution for Thread devices (#4794) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * openthread_border_router: Fix upstream DNS resolution for Thread devices Since add-on 2.12.0 (OTBR bump to b041fa52, which pulled in OpenThread d88b63d19 / openthread/openthread#10864) the upstream DNS resolver binds its UDP sockets to the infrastructure interface via SO_BINDTODEVICE. The add-on runs with host networking, and the nameserver in /etc/resolv.conf is the Supervisor DNS (172.30.32.3), which is only reachable through the hassio bridge. With the socket bound, the kernel routes the query out the physical interface via the default route instead, where it goes unanswered: upstream DNS queries from Thread devices, and with them NAT64/DNS64 name resolution (device cloud connectivity, MQTT broker hostnames, ...), time out. Disable the binding via OPENTHREAD_POSIX_CONFIG_UPSTREAM_DNS_BIND_TO_INFRA_NETIF in the project config header so upstream queries follow the host routing table again, as they did before 2.12.0. A behavioral fix has been proposed upstream (openthread/openthread#13545); this define can be dropped once it is merged and picked up. Notes from debugging, for future reference: - Networks whose router advertises RDNSS in router advertisements are NOT affected on recent add-on versions: since OpenThread #11342 (March 2025) the resolver also queries RDNSS-discovered servers, which are on-link on the infrastructure interface and work despite the binding. This masked the regression and made it appear environment-dependent. IPv4-only networks (no RDNSS) are always affected. - `ot-ctl dns resolve4` on the border router itself is not a valid test for this path: in our testing such queries never reached the BR's own DNS-SD server, independent of this bug. Test from an actual Thread device (or a TREL-connected OpenThread CLI node). Fixes #3947 * Update openthread_border_router/CHANGELOG.md Co-authored-by: Jan Čermák --------- Co-authored-by: Jan Čermák --- openthread_border_router/CHANGELOG.md | 4 ++++ openthread_border_router/config.yaml | 2 +- .../openthread-core-ha-config-posix.h | 14 ++++++++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/openthread_border_router/CHANGELOG.md b/openthread_border_router/CHANGELOG.md index a01692f48..4c5090a1c 100644 --- a/openthread_border_router/CHANGELOG.md +++ b/openthread_border_router/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## 3.1.2 + +- Fix upstream DNS/DNS64 resolution for Thread devices by not binding the upstream DNS resolver socket to the infra interface (fixes #3947, regression since 2.12.0) + ## 3.1.1 - Bump beta to OTBR POSIX version d83ddc62 to test ePSKc / Thread 1.4 Credentials Sharing support ahead of the upstream `release-v2026.09.0` tag diff --git a/openthread_border_router/config.yaml b/openthread_border_router/config.yaml index cf5038cdf..3bf4813e9 100644 --- a/openthread_border_router/config.yaml +++ b/openthread_border_router/config.yaml @@ -1,5 +1,5 @@ --- -version: 3.1.1 +version: 3.1.2 breaking_versions: [3.0.0] slug: openthread_border_router name: OpenThread Border Router diff --git a/openthread_border_router/openthread-core-ha-config-posix.h b/openthread_border_router/openthread-core-ha-config-posix.h index 699e31aea..2fd96b1f8 100644 --- a/openthread_border_router/openthread-core-ha-config-posix.h +++ b/openthread_border_router/openthread-core-ha-config-posix.h @@ -83,4 +83,18 @@ */ #define OPENTHREAD_CONFIG_MULTICAST_DNS_AUTO_ENABLE_ON_INFRA_IF 0 +/** + * @def OPENTHREAD_POSIX_CONFIG_UPSTREAM_DNS_BIND_TO_INFRA_NETIF + * + * The app runs with host networking; the upstream DNS server from + * /etc/resolv.conf (Supervisor CoreDNS, 172.30.32.3) is only reachable + * through the hassio bridge, not through the infra interface. Binding the + * upstream DNS resolver socket to the infra interface (OpenThread default + * since commit d88b63d19, first shipped in app 2.12.0) misroutes those + * queries out the physical interface, breaking upstream DNS/DNS64 for + * Thread devices. Disable the bind so queries follow the host routing + * table (see home-assistant/addons#3947). + */ +#define OPENTHREAD_POSIX_CONFIG_UPSTREAM_DNS_BIND_TO_INFRA_NETIF 0 + #endif /* OPENTHREAD_CORE_HA_CONFIG_POSIX_H_ */