Repository: openthread/openthread (language: python)

Issue:
[mbedtls] bump version to v3.6.0 (LTS)
This PR introduces native support for MbedTLS v3.6.0 (LTS). Backward compatibility is maintained, and a CI check for version 2.28.7 has been added. Note that this PR prepares for native [PSA API support](https://github.com/openthread/openthread/issues/10253), although it still utilizes the legacy `mbedtls_` crypto API.

The PR includes three independent commits:

**[mbedtls] Migrate to MbedTLS v3.6.0**

This commit updates the in-tree version of MbedTLS to v3.6.0.

Additionally, the build configuration has been modified by adding compiler options and isystem includes to address issues listed here: https://github.com/Mbed-TLS/mbedtls/issues/9156, which should be resolved in future revisions.

**[mbedtls] Modify GitHub workflows to test MbedTLS v2.28.8**

This commit adds a CI check for MbedTLS version 2.28.8, instead of testing version 3, which is now enabled by default.

**[mbedtls] Optimize AES configuration**

This commit optimizes the configuration of AES encryption specifically for OpenThread.

It partially addresses https://github.com/openthread/openthread/issues/10252. Further enhancements will follow.




Discussion / hints:

Fix patch:
diff --git a/src/cli/cli_tcp.cpp b/src/cli/cli_tcp.cpp
index 6d3158d1cf4..d243251a4d4 100644
--- a/src/cli/cli_tcp.cpp
+++ b/src/cli/cli_tcp.cpp
@@ -143,16 +143,12 @@ template <> otError TcpExample::Process<Cmd("init")>(Arg aArgs[])
             mUseCircularSendBuffer = true;
             mUseTls                = true;
 
-            // mbedtls_debug_set_threshold(0);
-
-            otPlatCryptoRandomInit();
             mbedtls_x509_crt_init(&mSrvCert);
             mbedtls_pk_init(&mPKey);
 
             mbedtls_ssl_init(&mSslContext);
             mbedtls_ssl_config_init(&mSslConfig);
             mbedtls_ssl_conf_rng(&mSslConfig, Crypto::MbedTls::CryptoSecurePrng, nullptr);
-            // mbedtls_ssl_conf_dbg(&mSslConfig, MbedTlsDebugOutput, this);
             mbedtls_ssl_conf_authmode(&mSslConfig, MBEDTLS_SSL_VERIFY_NONE);
             mbedtls_ssl_conf_ciphersuites(&mSslConfig, sCipherSuites);
 
@@ -261,6 +257,23 @@ template <> otError TcpExample::Process<Cmd("init")>(Arg aArgs[])
     mInitialized = true;
 
 exit:
+    if (error != OT_ERROR_NONE)
+    {
+#if OPENTHREAD_CONFIG_TLS_ENABLE
+        if (mUseTls)
+        {
+            mbedtls_ssl_config_free(&mSslConfig);
+            mbedtls_ssl_free(&mSslContext);
+
+            mbedtls_pk_free(&mPKey);
+            mbedtls_x509_crt_free(&mSrvCert);
+        }
+#endif // OPENTHREAD_CONFIG_TLS_ENABLE
+
+        otTcpCircularSendBufferForceDiscardAll(&mSendBuffer);
+        OT_UNUSED_VARIABLE(otTcpCircularSendBufferDeinitialize(&mSendBuffer));
+    }
+
     return error;
 }
 
@@ -286,7 +299,6 @@ template <> otError TcpExample::Process<Cmd("deinit")>(Arg aArgs[])
 #if OPENTHREAD_CONFIG_TLS_ENABLE
     if (mUseTls)
     {
-        otPlatCryptoRandomDeinit();
         mbedtls_ssl_config_free(&mSslConfig);
         mbedtls_ssl_free(&mSslContext);
 


Test patch:
diff --git a/tests/fuzz/fuzzer_platform.cpp b/tests/fuzz/fuzzer_platform.cpp
index e616fc25e00..abc8baae356 100644
--- a/tests/fuzz/fuzzer_platform.cpp
+++ b/tests/fuzz/fuzzer_platform.cpp
@@ -35,8 +35,10 @@
 #include <openthread/platform/alarm-micro.h>
 #include <openthread/platform/alarm-milli.h>
 #include <openthread/platform/diag.h>
+#include <openthread/platform/dnssd.h>
 #include <openthread/platform/entropy.h>
 #include <openthread/platform/logging.h>
+#include <openthread/platform/mdns_socket.h>
 #include <openthread/platform/misc.h>
 #include <openthread/platform/multipan.h>
 #include <openthread/platform/radio.h>
@@ -147,6 +149,8 @@ void FuzzerPlatformProcess(otInstance *aInstance)
 
 bool FuzzerPlatformResetWasRequested(void) { return sResetWasRequested; }
 
+extern "C" {
+
 uint32_t otPlatAlarmMilliGetNow(void) { return sAlarmNow / 1000; }
 
 void otPlatAlarmMilliStartAt(otInstance *aInstance, uint32_t aT0, uint32_t aDt)
@@ -515,3 +519,129 @@ void otPlatDiagRadioReceived(otInstance *aInstance, otRadioFrame *aFrame, otErro
 }
 
 void otPlatDiagAlarmCallback(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
+
+otPlatDnssdState otPlatDnssdGetState(otInstance *aInstance)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+
+    return OT_PLAT_DNSSD_STOPPED;
+}
+
+void otPlatDnssdRegisterService(otInstance                 *aInstance,
+                                const otPlatDnssdService   *aService,
+                                otPlatDnssdRequestId        aRequestId,
+                                otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aService);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+void otPlatDnssdUnregisterService(otInstance                 *aInstance,
+                                  const otPlatDnssdService   *aService,
+                                  otPlatDnssdRequestId        aRequestId,
+                                  otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aService);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+void otPlatDnssdRegisterHost(otInstance                 *aInstance,
+                             const otPlatDnssdHost      *aHost,
+                             otPlatDnssdRequestId        aRequestId,
+                             otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aHost);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+void otPlatDnssdUnregisterHost(otInstance                 *aInstance,
+                               const otPlatDnssdHost      *aHost,
+                               otPlatDnssdRequestId        aRequestId,
+                               otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aHost);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+void otPlatDnssdRegisterKey(otInstance                 *aInstance,
+                            const otPlatDnssdKey       *aKey,
+                            otPlatDnssdRequestId        aRequestId,
+                            otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aKey);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+void otPlatDnssdUnregisterKey(otInstance                 *aInstance,
+                              const otPlatDnssdKey       *aKey,
+                              otPlatDnssdRequestId        aRequestId,
+                              otPlatDnssdRegisterCallback aCallback)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aKey);
+    OT_UNUSED_VARIABLE(aRequestId);
+    OT_UNUSED_VARIABLE(aCallback);
+}
+
+otError otPlatMdnsSetListeningEnabled(otInstance *aInstance, bool aEnable, uint32_t aInfraIfIndex)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aEnable);
+    OT_UNUSED_VARIABLE(aInfraIfIndex);
+
+    return OT_ERROR_NOT_IMPLEMENTED;
+}
+
+void otPlatMdnsSendMulticast(otInstance *aInstance, otMessage *aMessage, uint32_t aInfraIfIndex)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aMessage);
+    OT_UNUSED_VARIABLE(aInfraIfIndex);
+}
+
+void otPlatMdnsSendUnicast(otInstance *aInstance, otMessage *aMessage, const otPlatMdnsAddressInfo *aAddress)
+{
+    OT_UNUSED_VARIABLE(aInstance);
+    OT_UNUSED_VARIABLE(aMessage);
+    OT_UNUSED_VARIABLE(aAddress);
+}
+
+bool otPlatInfraIfHasAddress(uint32_t aInfraIfIndex, const otIp6Address *aAddress)
+{
+    OT_UNUSED_VARIABLE(aInfraIfIndex);
+    OT_UNUSED_VARIABLE(aAddress);
+
+    return false;
+}
+
+otError otPlatInfraIfSendIcmp6Nd(uint32_t            aInfraIfIndex,
+                                 const otIp6Address *aDestAddress,
+                                 const uint8_t      *aBuffer,
+                                 uint16_t            aBufferLength)
+{
+    OT_UNUSED_VARIABLE(aInfraIfIndex);
+    OT_UNUSED_VARIABLE(aDestAddress);
+    OT_UNUSED_VARIABLE(aBuffer);
+    OT_UNUSED_VARIABLE(aBufferLength);
+
+    return OT_ERROR_FAILED;
+}
+
+otError otPlatInfraIfDiscoverNat64Prefix(uint32_t aInfraIfIndex)
+{
+    OT_UNUSED_VARIABLE(aInfraIfIndex);
+
+    return OT_ERROR_FAILED;
+}
+
+} // extern "C"
diff --git a/tests/fuzz/oss-fuzz-build b/tests/fuzz/oss-fuzz-build
index 9a511b5ba46..3f03af8f5ba 100755
--- a/tests/fuzz/oss-fuzz-build
+++ b/tests/fuzz/oss-fuzz-build
@@ -44,6 +44,7 @@ set -euxo pipefail
         -DOT_RCP=OFF \
         -DOT_BORDER_AGENT=ON \
         -DOT_BORDER_ROUTER=ON \
+        -DOT_BORDER_ROUTING=ON \
         -DOT_CHANNEL_MANAGER=ON \
         -DOT_CHANNEL_MONITOR=ON \
         -DOT_COAP=ON \
@@ -55,6 +56,7 @@ set -euxo pipefail
         -DOT_DHCP6_CLIENT=ON \
         -DOT_DHCP6_SERVER=ON \
         -DOT_DNS_CLIENT=ON \
+        -DOT_DNSSD_SERVER=ON \
         -DOT_ECDSA=ON \
         -DOT_HISTORY_TRACKER=ON \
         -DOT_IP6_FRAGM=ON \
@@ -63,13 +65,14 @@ set -euxo pipefail
         -DOT_LINK_RAW=ON \
         -DOT_LOG_OUTPUT=APP \
         -DOT_MAC_FILTER=ON \
+        -DOT_MDNS=ON \
         -DOT_NETDATA_PUBLISHER=ON \
         -DOT_NETDIAG_CLIENT=ON \
         -DOT_PING_SENDER=ON \
         -DOT_SERVICE=ON \
         -DOT_SLAAC=ON \
         -DOT_SNTP_CLIENT=ON \
-        -DOT_SRN_ADV_PROXY=ON \
+        -DOT_SRP_ADV_PROXY=ON \
         -DOT_SRP_CLIENT=ON \
         -DOT_SRP_SERVER=ON \
         -DOT_THREAD_VERSION=1.3 \