Update lib/mbedtls submodule from 2.28.3 to 3.6.7

[dhalbert]

Note: this issue was written by Claude, and edited by @dhalbert.

lib/mbedtls is pinned at 981743de = v2.28.3 (March 2023). Claude proposes moving it to v3.6.7, the current 3.6 LTS patch.

This would fix #10339. 2.28.3's x509_crt_check_san() matches only dNSName; iPAddress falls through to /* Unrecognized type */ return -1. Since x509_crt_verify_name() has no CN fallback once a SAN extension is present, any TLS server addressed by IP address fails verification with MBEDTLS_X509_BADCERT_CN_MISMATCH → MBEDTLS_ERR_X509_CERT_VERIFY_FAILED (-9984) on raspberrypi. The identical certificate and CA verify fine on espressif, which links ESP-IDF's mbedtls (4.0.0 on main) and has x509_crt_check_san_ip().

Claude confirmed x509_crt_check_san_ip is present from v3.6.0 onward, so 3.6.x fixes this.

#10738 also proposed updating mbedtls, for different, crypto calculation reasons.

3.6.x vs 4.0.0: 4.0.0 moves crypto into separate submodules (tf-psa-crypto, framework), which would mean nested submodules, .gitmodules/tools/ci_fetch_deps.py/tools/ci.sh changes, and PSA init wiring. It also breaks the shared hashlib path: py/circuitpy_defns.mk compiles sha1.c/sha256.c/sha512.c from lib/mbedtls/library/ for CIRCUITPY_HASHLIB_MBEDTLS_ONLY ports, and in 4.0.0 those files move into tf-psa-crypto. In 3.6.7 they stay put, so hashlib-only ports are untouched.

Also: pico-sdk's pico_mbedtls names 2.28.8/3.6.2 as supported and probes only for major 2 vs 3, so it does not recognize 4.x. But Note that CircuitPython's raspberrypi port doesn't use pico_mbedtls currently.

Scope of work

raspberrypi is the only port that compiles lib/mbedtls for TLS. The CircuitPython C source is largely ready — shared-module/ssl/, shared-module/hashlib/, and lib/mbedtls_config/crt_bundle.c already carry MBEDTLS_VERSION_MAJOR guards for <3/==3/<4/>=4, because espressif builds 4.0.0. What needs doing:

1. Regenerate SRC_MBEDTLS in ports/raspberrypi/Makefile — 3.x split ssl_cli.c/ssl_srv.c into TLS 1.2 and 1.3 variants, so there are additions as well as removals.
2. Re-derive lib/mbedtls_config/mbedtls_config.h against 3.6 (3.0 removed and renamed many options), then trim for flash.
3. Regenerate lib/mbedtls_errors/mp_mbedtls_errors.c via lib/mbedtls_errors/do-mp.sh; it is #included directly by shared-module/ssl/SSLSocket.c and pre-commit checks generate_errors.diff.
4. Check flash impact on Pico W (RP2040, 2 MB), a possibly significant constraint

One risk worth flagging: the #if MBEDTLS_VERSION_MAJOR == 3 branches (e.g. urandom_adapter at shared-module/ssl/SSLSocket.c:203) are currently dead code, since no port builds 3.x. This bump makes them live for the first time, so they are unexercised rather than proven.

Entropy should be unaffected: MBEDTLS_ENTROPY_HARDWARE_ALT and mbedtls_hardware_poll() (lib/mbedtls_config/mbedtls_port.c) still exist in 3.x.

[tannewt]

Note that both Zephyr and ESP-IDF are on MBEDTLS 4 IIRC.

[dhalbert]

I will try 4.0.0; it has more churn than 3.6.x, through 3.6.x has plenty of churn too. I had some more detailed discussion with Claude last night about this. There may be some issues about making things fit on the RP2040.