[tests] address PR review comments for 1.4.3 default route test

This commit addresses unresolved review comments on PR openthread#3443:
- Add 'iproute2' to border-router Dockerfile and use 'docker exec'
  instead of 'nsenter' to delete the default route inside the OTBR
  container. This removes the requirement for root privileges on the
  host VM/runner to run the tests.
- Add 'procps' package to the test client image in test_dind_dns_sd.sh
  to ensure 'pgrep' and 'pkill' commands are available for radvd.
- Include radvd and tcpdump logs from eth2-server in test_teardown.
- Print radvd.log from eth2-server if Step 10 ping unexpectedly
  succeeded to ease debugging of routing issues.

Note: The suggestion to use SIGHUP (pkill -HUP radvd) was evaluated but
rejected because radvd does not immediately send a Router Lifetime 0 RA
upon reload, causing the default route to remain active on the DUT and
failing the verification in Step 10. The original kill/restart approach
is maintained as it guarantees immediate route withdrawal.

Author: jwhui

etc/docker/border-router/Dockerfile

@@ -134,6 +134,7 @@ RUN set -x \
            curl \
            ipset \
            iptables \
+           iproute2 \
            libjsoncpp25 \
            xz-utils \
     && PLATFORM_SPEC="${TARGETARCH}${TARGETVARIANT:+/$TARGETVARIANT}" \

tests/scripts/expect/dind_1_4_pic_tc_1.exp

@@ -202,6 +202,8 @@ send_user "OMR prefix verified in Thread Network Data successfully.\n"
 send_user "Step 4b: Validating RA on adjacent infrastructure link...\n"
 set py_ra_sniffer {import sys
 import ipaddress
+import logging
+logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
 from scapy.all import *
 
 target_prefix = sys.argv[1]
@@ -258,7 +260,7 @@ def check_pkt(pkt):
     return False
 
 # Sniff until check_pkt returns True, or timeout
-sniff(filter="icmp6 and ip6[40] == 134", stop_filter=check_pkt, timeout=20)
+sniff(filter="icmp6 and icmp6[0] == 134", stop_filter=check_pkt, timeout=20)
 
 if not found_otbr_ra:
     print("FAIL: OTBR RA packet not captured")

tests/scripts/expect/dind_1_4_pic_tc_3.exp

@@ -29,6 +29,19 @@
 
 source "tests/scripts/expect/_common.exp"
 
+proc start_radvd {server} {
+    exec docker exec -d $server bash -c "radvd -C /etc/radvd.conf -u root -n -m stderr >/var/log/radvd.log 2>&1"
+    sleep 1
+    if {[catch {exec docker exec -i $server pgrep radvd} radvd_pid]} {
+        if {![catch {exec docker exec -i $server cat /var/log/radvd.log} radvd_log]} {
+            send_user "\n=== radvd.log ===\n$radvd_log\n=== end of radvd.log ===\n"
+        }
+        fail "Failed to start radvd on $server: $radvd_pid"
+    }
+    send_user "radvd started on $server with PID: [string trim $radvd_pid]\n"
+}
+
+
 set pty1 [create_socat_tcp 1 9000]
 set container "otbr-test-container"
 set eth2_server "eth2-server"
@@ -52,11 +65,12 @@ exec docker run -d \
 # Wait for eth2-server eth0 to be ready
 sleep 2
 
-# Add 2002:1234::1234 IP to loopback of eth2-server
+# Add 2002:1234::1234 IP to loopback and 2001:db8:1::1 to eth0 of eth2-server
 exec docker exec -i $eth2_server ip -6 addr add 2002:1234::1234/128 dev lo
+exec docker exec -i $eth2_server ip -6 addr add 2001:db8:1::1/64 dev eth0
 
 # Configure and start Kea DHCPv6 PD server on eth2-server (delegating 2005:1234:abcd:0::/56)
-set kea_conf {{"Dhcp6": {"interfaces-config": {"interfaces": ["eth0"]}, "lease-database": {"type": "memfile", "persist": true, "name": "/var/lib/kea/kea-leases6.csv"}, "preferred-lifetime": 54000, "valid-lifetime": 86400, "subnet6": [{"subnet": "fd00:db8:1::/64", "interface": "eth0", "pd-pools": [{"prefix": "2005:1234:abcd:0::", "prefix-len": 56, "delegated-len": 64}], "rapid-commit": true}], "loggers": [{"name": "kea-dhcp6", "output_options": [{"output": "stdout"}], "severity": "DEBUG", "debuglevel": 99}]}}}
+set kea_conf {{"Dhcp6": {"interfaces-config": {"interfaces": ["eth0"]}, "lease-database": {"type": "memfile", "persist": true, "name": "/var/lib/kea/kea-leases6.csv"}, "preferred-lifetime": 54000, "valid-lifetime": 86400, "subnet6": [{"subnet": "2001:db8:1::/64", "interface": "eth0", "pd-pools": [{"prefix": "2005:1234:abcd:0::", "prefix-len": 56, "delegated-len": 64}], "rapid-commit": true}], "loggers": [{"name": "kea-dhcp6", "output_options": [{"output": "stdout"}], "severity": "DEBUG", "debuglevel": 99}]}}}
 exec docker exec -i $eth2_server bash -c "echo '$kea_conf' > /etc/kea/kea-dhcp6.conf"
 exec docker exec -i $eth2_server mkdir -p /var/lib/kea /var/run/kea
 exec docker exec -d $eth2_server /usr/sbin/kea-dhcp6 -c /etc/kea/kea-dhcp6.conf
@@ -70,16 +84,7 @@ exec docker exec -i $eth2_server sysctl -w net.ipv6.conf.eth0.forwarding=1
 set radvd_conf "interface eth0\n{\n  AdvSendAdvert on;\n  MinRtrAdvInterval 3;\n  MaxRtrAdvInterval 10;\n  prefix 2001:db8:1::/64\n  {\n    AdvOnLink on;\n    AdvAutonomous on;\n    AdvRouterAddr on;\n  };\n};"
 exec docker exec -i $eth2_server bash -c "echo '$radvd_conf' > /etc/radvd.conf"
 exec docker exec -i $eth2_server chmod 600 /etc/radvd.conf
-exec docker exec -d $eth2_server bash -c "radvd -C /etc/radvd.conf -u root -n -m stderr >/var/log/radvd.log 2>&1"
-sleep 1
-
-if {[catch {exec docker exec -i $eth2_server pgrep radvd} radvd_pid]} {
-    if {![catch {exec docker exec -i $eth2_server cat /var/log/radvd.log} radvd_log]} {
-        send_user "\n=== radvd.log ===\n$radvd_log\n=== end of radvd.log ===\n"
-    }
-    fail "Failed to start radvd on eth2-server: $radvd_pid"
-}
-send_user "radvd started on eth2-server with PID: [string trim $radvd_pid]\n"
+start_radvd $eth2_server
 
 # 2. Start Eth_1 container (Local Infrastructure Host)
 send_user "Starting Eth_1 container (Local Host)...\n"
@@ -122,15 +127,14 @@ start_otbr_docker_dind $container $::env(EXP_OT_RCP_PATH) 2 $pty1
 # Wait for otbr-agent to create the domain socket
 wait_for_otbr_agent [list $container]
 
+# Delete Docker's static default route so the DUT only relies on RAs
+# We can run it via docker exec now that iproute2 package is added to the container
+catch { exec docker exec -i $container ip -6 route del default dev eth0 }
+
 # Enable accept_ra=2 on DUT so it configures default route and GUA via SLAAC
 exec docker exec -i $container sysctl -w net.ipv6.conf.all.accept_ra=2
 exec docker exec -i $container sysctl -w net.ipv6.conf.eth0.accept_ra=2
 
-# Delete Docker's static default route so the DUT only relies on RAs
-set dut_pid [exec docker inspect -f {{{.State.Pid}}} $container]
-set dut_pid [string trim $dut_pid]
-exec nsenter -t $dut_pid -n ip -6 route del default dev eth0
-
 # Setup active dataset on OTBR via ot-ctl
 exec docker exec -i $container ot-ctl thread stop
 exec docker exec -i $container ot-ctl ifconfig down
@@ -170,12 +174,11 @@ if {!$prefix_acquired} {
 }
 send_user "Successfully Discovered Delegated Prefix: $delegated_prefix\n"
 
-
 # Verify OMR prefix properties in netdata (subprefix of 2005:1234:abcd:0::/56, /64, default route, med preference)
 # AND verify default route ::/0 with Route sub-TLV (NP=0)
 proc verify_netdata {container} {
     set omr_regex {2005:1234:abcd:(?:[0-9a-fA-F]{1,2})?::/64\s+([a-z]*r[a-z]*)\s+med}
-    set route_regex {::/0\s+([a-z]*)\s+med}
+    set route_regex {::/0(?:\s+([a-z]+))?\s+med}
     set netdata_verified false
     for {set i 0} {$i < 10} {incr i} {
         if {![catch {exec docker exec -i $container ot-ctl netdata show} netdata]} {
@@ -331,10 +334,17 @@ send_user "Ping to Internet Server verified successfully.\n"
 # Step 7: Reconfigure radvd on eth2-server to stop advertising default route
 send_user "Step 7: Reconfiguring radvd to stop advertising default route...\n"
 catch {exec docker exec -i $eth2_server pkill radvd}
+# Wait for radvd to fully terminate to avoid port/socket binding conflicts
+for {set j 0} {$j < 50} {incr j} {
+    if {[catch {exec docker exec -i $eth2_server pgrep radvd}]} {
+        break
+    }
+    after 100
+}
 set radvd_conf_no_default "interface eth0\n{\n  AdvSendAdvert on;\n  MinRtrAdvInterval 3;\n  MaxRtrAdvInterval 10;\n  AdvDefaultLifetime 0;\n  prefix 2001:db8:1::/64\n  {\n    AdvOnLink on;\n    AdvAutonomous on;\n    AdvRouterAddr on;\n  };\n};"
 exec docker exec -i $eth2_server bash -c "echo '$radvd_conf_no_default' > /etc/radvd.conf"
-exec docker exec -d $eth2_server bash -c "radvd -C /etc/radvd.conf -u root -n -m stderr >/var/log/radvd.log 2>&1"
-sleep 5
+start_radvd $eth2_server
+sleep 4
 
 # Step 8: Verify DUT *still* advertises default route in Thread Network Data
 send_user "Step 8: Verifying default route is still advertised in Thread Network Data...\n"
@@ -392,9 +402,9 @@ send_user "Ping to Local Host verified successfully.\n"
 # Step 10: Ping 2002:1234::1234 from ED_1. Ping response MUST NOT be received. Ping request MUST NOT be sent on AIL.
 send_user "Step 10: Verifying Ping to Internet Server does NOT work and is NOT forwarded...\n"
 
-# Start tcpdump on eth2-server to detect any ICMPv6 echo requests
+# Start tcpdump on eth2-server to detect any ICMPv6 echo requests (line-buffered with -l)
 # Run in background via exec docker exec -d. Timeout in 8 seconds to allow ping tool to finish.
-exec docker exec -d $eth2_server bash -c "timeout 8 tcpdump -c 1 -i eth0 'icmp6 and ip6\[40\] == 128' > /var/log/tcpdump.log 2>&1"
+exec docker exec -d $eth2_server bash -c "timeout 8 tcpdump -l -c 1 -i eth0 'icmp6 and icmp6\[0\] == 128' > /var/log/tcpdump.log 2>&1"
 sleep 1
 
 # Send ping from ED_1
@@ -415,11 +425,15 @@ expect {
     }
 }
 if {$ping_received} {
+    catch {
+        set radvd_log [exec docker exec -i $eth2_server cat /var/log/radvd.log]
+        send_user "\n=== radvd.log ===\n$radvd_log\n=== end of radvd.log ===\n"
+    }
     fail "Ping from ED_1 to Internet Server succeeded, but it was expected to fail"
 }
 
 # Check if tcpdump captured any packet
-sleep 5
+sleep 9
 set tcpdump_log [exec docker exec -i $eth2_server cat /var/log/tcpdump.log]
 send_user "tcpdump log on eth2-server:\n$tcpdump_log\n"
 if {![string match "*listening on*" $tcpdump_log]} {
@@ -433,10 +447,17 @@ send_user "Verified: Ping request was not forwarded to AIL and no response was r
 # Step 11: Reconfigure radvd on eth2-server to start advertising default route again
 send_user "Step 11: Reconfiguring radvd to start advertising default route again...\n"
 catch {exec docker exec -i $eth2_server pkill radvd}
+# Wait for radvd to fully terminate to avoid port/socket binding conflicts
+for {set j 0} {$j < 50} {incr j} {
+    if {[catch {exec docker exec -i $eth2_server pgrep radvd}]} {
+        break
+    }
+    after 100
+}
 set radvd_conf_with_default "interface eth0\n{\n  AdvSendAdvert on;\n  MinRtrAdvInterval 3;\n  MaxRtrAdvInterval 10;\n  AdvDefaultLifetime 875;\n  prefix 2001:db8:1::/64\n  {\n    AdvOnLink on;\n    AdvAutonomous on;\n    AdvRouterAddr on;\n  };\n};"
 exec docker exec -i $eth2_server bash -c "echo '$radvd_conf_with_default' > /etc/radvd.conf"
-exec docker exec -d $eth2_server bash -c "radvd -C /etc/radvd.conf -u root -n -m stderr >/var/log/radvd.log 2>&1"
-sleep 5
+start_radvd $eth2_server
+sleep 4
 
 # Step 12: Verify default route is advertised in Thread Network Data
 send_user "Step 12: Verifying default route is advertised in Thread Network Data again...\n"

tests/scripts/test_dind_dns_sd.sh

@@ -75,10 +75,14 @@ test_teardown()
     echo "Active and inactive containers:"
     docker ps -a || true
     echo "Container logs:"
-    for c in "${CONTAINER_NAME}" "otbr-test-container-1" "otbr-test-container-2" "otbr-test-container-3" "otbr-test-container-web" "test-client" "dhcp6-server"; do
+    for c in "${CONTAINER_NAME}" "otbr-test-container-1" "otbr-test-container-2" "otbr-test-container-3" "otbr-test-container-web" "test-client" "dhcp6-server" "eth1-server" "eth2-server"; do
         docker logs "$c" || true
     done
 
+    echo "Radvd/Tcpdump logs on eth2-server:"
+    docker exec -i eth2-server cat /var/log/radvd.log || true
+    docker exec -i eth2-server cat /var/log/tcpdump.log || true
+
     echo "Agent logs:"
     for c in "${CONTAINER_NAME}" "otbr-test-container-1" "otbr-test-container-2" "otbr-test-container-3" "otbr-test-container-web"; do
         docker exec -i "$c" cat /var/log/otbr-agent.log || true
@@ -141,7 +145,7 @@ test_setup()
     echo "Building test client image with mdns-scan and ping/ndisc6 tools..."
     docker build -t "${TEST_CLIENT_IMAGE}" - <<EOF
 FROM ubuntu:24.04
-RUN apt-get update && apt-get install -y mdns-scan iputils-ping ndisc6 python3-zeroconf iproute2 kea-dhcp6-server dnsmasq python3-scapy radvd tcpdump --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y mdns-scan iputils-ping ndisc6 python3-zeroconf iproute2 kea-dhcp6-server dnsmasq python3-scapy radvd tcpdump procps --no-install-recommends && rm -rf /var/lib/apt/lists/*
 ENTRYPOINT ["mdns-scan"]
 EOF