Unable to commission devices with OTBR via iOS

[jtbandes]

Describe the bug

Apologies if this is the wrong place to file this issue, but I'm not sure what debugging steps to take and would appreciate any advice.

I'm running OTBR as an add-on to Home Assistant, with a Sonoff Zigbee Dongle-E (flashed with multiprotocol firmware). The Home Assistant iOS app supports commissioning Matter devices, but when I try to do this, I get a "Thread Border Router Required" message from iOS.

I would appreciate any recommendations for how to debug this further. I'm not sure what more information I should provide, or if there are any network configuration things I should be checking. Thank you!

Information to reproduce

1. Git commit id: e6df00d (I think... got this information from here)
2. IEEE 802.15.4 hardware platform: https://sonoff.tech/product/gateway-and-sensors/sonoff-zigbee-3-0-usb-dongle-plus-e/ & https://nanoleaf.me/en-US/products/essentials/bulbs/
3. Build steps: See https://github.com/home-assistant/addons/tree/master/silabs-multiprotocol
4. Network topology: dongle is plugged into a computer running proxmox with Home Assistant OS in a VM. This computer is connected via Ethernet to a wifi access point, which is connected and powered by PoE from a router. The iOS device is connected to the access point via wifi.

Expected behavior

iOS device should be able to communicate with OTBR

Console/log output

Logs from startup of "Silicon Labs Multiprotocol" Home Assistant add-on which runs OTBR

s6-rc: info: service banner: starting

-----------------------------------------------------------
 Add-on: Silicon Labs Multiprotocol
 Zigbee and OpenThread multiprotocol add-on
-----------------------------------------------------------
 Add-on version: 2.3.2
 You are running the latest version of this add-on.
 System: Home Assistant OS 11.1  (amd64 / qemux86-64)
 Home Assistant Core: 2023.11.0
 Home Assistant Supervisor: 2023.10.1
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
s6-rc: info: service banner successfully started
s6-rc: info: service universal-silabs-flasher: starting
[10:25:50] INFO: Flashing firmware is disabled
s6-rc: info: service universal-silabs-flasher successfully started
s6-rc: info: service cpcd-config: starting
[10:25:51] INFO: Generating cpcd configuration.
s6-rc: info: service cpcd-config successfully started
s6-rc: info: service cpcd: starting
[10:25:51] INFO: Starting cpcd...
WARNING in function 'main' in file /usr/src/cpc-daemon/main.c at line #186 : Running CPCd as 'root' is not recommended. Proceed at your own risk.
s6-rc: info: service cpcd successfully started
s6-rc: info: service zigbeed: starting
s6-rc: info: service otbr-agent: starting
s6-rc: info: service zigbeed successfully started
[10:25:51] INFO: Starting zigbeed...
[10:25:51] INFO: Setup OTBR firewall...
[10:25:51] INFO: Starting otbr-agent...
otbr-agent[302]: [NOTE]-AGENT---: Running 0.3.0
otbr-agent[302]: [NOTE]-AGENT---: Thread version: 1.3.0
otbr-agent[302]: [NOTE]-AGENT---: Thread interface: wpan0
otbr-agent[302]: [NOTE]-AGENT---: Radio URL: spinel+cpc://cpcd_0?iid=2&iid-list=0
otbr-agent[302]: [NOTE]-ILS-----: Infra link selected: enp0s18
otbr-agent[302]: 49d.20:52:40.967 [C] Platform------: mCpcBusSpeed = 115200
[10:25:51:359620] Info : [CPCd v4.3.1.0] [Library API v3] [RCP Protocol v4]
[10:25:51:359651] Info : Git commit: 133b29678b3d0bc7578e098d2f46b4d5bcd2ebb4 / branch: 
[10:25:51:359652] Info : Sources hash: ff8300587e7e4ab1def7a89a272c0baef32f9eb3bff9b0ba06b94e655d652367
[10:25:51:359654] WARNING : In function 'main' in file /usr/src/cpc-daemon/main.c at line #186 : Running CPCd as 'root' is not recommended. Proceed at your own risk.
[10:25:51:359941] Info : Reading cli arguments
[10:25:51:359947] Info : /usr/local/bin/cpcd 
[10:25:51:360813] Info : Reading configuration
[10:25:51:360815] Info :   file_path = /usr/local/etc/cpcd.conf
[10:25:51:360816] Info :   instance_name = cpcd_0
[10:25:51:360816] Info :   socket_folder = /dev/shm
[10:25:51:360817] Info :   operation_mode = MODE_NORMAL
[10:25:51:360818] Info :   use_encryption = false
[10:25:51:360819] Info :   binding_key_file = /etc/binding-key.key
[10:25:51:360819] Info :   stdout_tracing = false
[10:25:51:360820] Info :   file_tracing = false
[10:25:51:360820] Info :   lttng_tracing = false
[10:25:51:360821] Info :   enable_frame_trace = false
[10:25:51:360822] Info :   traces_folder = /dev/shm/cpcd-traces
[10:25:51:360822] Info :   bus = UART
[10:25:51:360823] Info :   uart_baudrate = 460800
[10:25:51:360823] Info :   uart_hardflow = false
[10:25:51:360824] Info :   uart_file = /dev/ttyACM0
[10:25:51:360825] Info :   fu_recovery_pins_enabled = false
[10:25:51:360825] Info :   fu_connect_to_bootloader = false
[10:25:51:360826] Info :   fu_enter_bootloader = false
[10:25:51:360826] Info :   restart_cpcd = false
[10:25:51:360827] Info :   application_version_validation = false
[10:25:51:360827] Info :   print_secondary_versions_and_exit = false
[10:25:51:360828] Info :   use_noop_keep_alive = false
[10:25:51:360829] Info :   reset_sequence = true
[10:25:51:360829] Info :   stats_interval = 0
[10:25:51:360830] Info :   rlimit_nofile = 2000
[10:25:51:360831] Info : ENCRYPTION IS DISABLED 
[10:25:51:360831] Info : Starting daemon in normal mode
[10:25:51:372773] Info : Connecting to Secondary...
[10:25:51:446687] Info : RX capability is 256 bytes
[10:25:51:446698] Info : Connected to Secondary
[10:25:51:448524] Info : Secondary Protocol v4
[10:25:51:452533] Info : Secondary CPC v4.3.1
[10:25:51:454526] Info : Secondary bus bitrate is 460800
[10:25:51:458535] Info : Secondary APP vUNDEFINED
[10:25:51:458583] Info : Daemon startup was successful. Waiting for client connections
[10:25:51:868808] Info : New client connection using library v4.3.1.0
[10:25:51:871230] Info : Opened connection socket for ep#12
[10:25:51:871286] Info : Endpoint socket #12: Client connected. 1 connections
[10:25:52:736574] Info : New client connection using library v4.3.1.0
[10:25:52:739475] Info : Endpoint socket #12: Client connected. 2 connections
otbr-agent[302]: 00:00:00.065 [N] RoutingManager: BR ULA prefix: fd2f:d65:f5f8::/48 (loaded)
otbr-agent[302]: 00:00:00.065 [N] RoutingManager: Local on-link prefix: fd83:d756:fe74:be6::/64
otbr-agent[302]: 00:00:00.083 [N] Mle-----------: Role disabled -> detached
otbr-agent[302]: 00:00:00.091 [N] Platform------: [netif] Changing interface state to up.
s6-rc: info: service otbr-agent successfully started
s6-rc: info: service otbr-agent-rest-discovery: starting
[10:25:54] INFO: Successfully sent discovery information to Home Assistant.
s6-rc: info: service otbr-agent-rest-discovery successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
Listening on port 9999 for connection...
Accepting connection.
otbr-agent[302]: 00:00:26.615 [N] Mle-----------: RLOC16 3c00 -> fffe
otbr-agent[302]: 00:00:26.617 [W] Platform------: [netif] Failed to process request#5: Unknown error -95
otbr-agent[302]: 00:00:26.710 [N] Mle-----------: Attach attempt 1, AnyPartition reattaching with Active Dataset

Additional context

The Nanoleaf app (which is connected to my Matter/Thread bulb via Bluetooth) claims it can see my border router, however pressing the "Upgrade" button to try and commission the device results in a "No network found" message:

A _meshcop._udp. service is visible from iOS in the Network Analyzer app:

Trying to commission the device via the Home Assistant app results in a "Thread Border Router Required" error:

[jwhui]

When using the iOS Matter APIs, the Thread Credentials must be stored/shared via the iOS ThreadNetwork APIs.

[jtbandes]

That makes sense, I guess my question is who sets the credentials in the first place? Is that the job of the user (and some app to inform the network about the new credentials on their behalf)?

Edit: I just found this page, will give it a try later. https://openthread.io/guides/border-router/external-commissioning/prepare

[jtbandes]

I realized that I was able to view the thread network's active dataset TLV (which includes the credentials, if I am understanding correctly) in the Home Assistant web UI. I then extracted the border agent ID using ot-ctl ba id.

I tried calling the ThreadNetwork APIs on iOS and macOS to add the credentials to the keychain. Sadly, on macOS the APIs seem to silently do nothing, and on iOS they fail with an error: https://developer.apple.com/forums/thread/718467?answerId=770723022#770723022

I would be curious to learn whether any existing app has gotten this working successfully with the ThreadNetwork APIs. I'm starting to believe it may not be possible yet...or maybe I have simply made some kind of configuration error.

[jwhui]

I believe there are a handful of apps that make use of iOS ThreadNetwork APIs, including Nanoleaf and Google Home.

I would suggest reaching out to Apple Developer Support if you are still having issues.

[Bitwolfies]

It's not just on iOS, having 1:1 the same issues on android.

[jwhui]

@Bitwolfies , I would suggest creating a new discussion that details your specific setup.

[xjshiMax]

i have the same question, has it solved?

[jwhui]

Check out: https://www.home-assistant.io/integrations/matter/