[padelsbach]

Merge #39 #40 and #41 first

[Copilot]

🟡 Changes recommended

Client certificate verification can falsely report success for unauthenticated peers, and unconditional filesystem APIs break NO_FILESYSTEM builds.

8 open issues

• Treat missing client certificate as a verification failure · New
• Honor NO_FILESYSTEM when enabling file APIs · New
• Map retryable accept errors to WANT_READ · New
• Propagate latched configuration errors in session_reset() · New
• Clear backend SNI and verification names when hostname is cleared · New
• Preserve zero-return semantics for SSL reads · New
• Allow successful zero-length SSL writes · New
• Add sanitizer and coverage flags to the test sub-build · New

What changed in this PR

Adds an Mbed TLS 4.x compatibility layer over wolfPSA and wolfSSL, alongside TF-PSA-Crypto extensions and generated feature configuration from the prerequisite work.

Changes:

• Adds TLS, certificate, networking, private-key parsing, and optional threading compatibility APIs.
• Updates builds, exported symbols, and generated capability headers.
• Adds compatibility and regression tests, plus usage documentation.

File	Description
zephyr/​CMakeLists.txt	Uses the relocated configuration-generation tools.
wolfpsa/​tf-psa-crypto/​build_info.h	Defines TF-PSA-Crypto feature macros.
wolfpsa/​psa/​crypto.h	Includes compatibility features and extensions.
wolfpsa/​psa/​crypto_extra.h	Declares service-key helpers and cleanup API.
wolfpsa/​psa/​crypto_config.h	Uses generated standalone capabilities.
wolfpsa/​psa_engine.h	Declares internal crypto cleanup.
wolfpsa/​mbedtls/​x509.h	Defines certificate types and error constants.
wolfpsa/​mbedtls/​x509_crt.h	Declares certificate-chain parsing APIs.
wolfpsa/​mbedtls/​timing.h	Adds a placeholder timing header.
wolfpsa/​mbedtls/​threading.h	Declares pthread-backed threading APIs.
wolfpsa/​mbedtls/​ssl.h	Defines TLS contexts and compatibility APIs.
wolfpsa/​mbedtls/​platform.h	Maps platform functions to the C library.
wolfpsa/​mbedtls/​platform_util.h	Declares secure buffer zeroization.
wolfpsa/​mbedtls/​pk.h	Declares private-key parsing APIs.
wolfpsa/​mbedtls/​net_sockets.h	Declares socket compatibility APIs.
wolfpsa/​mbedtls/​error.h	Adds a placeholder error header.
wolfpsa/​mbedtls/​debug.h	Exposes the TLS debug configuration declaration.
wolfpsa/​mbedtls/​build_info.h	Defines compatibility-layer feature macros.
wolfpsa/​mbedtls/​asn1.h	Defines the ASN.1 buffer type.
wolfpsa.map	Exports compatibility symbols.
user_settings.h	Adds TLS and threading build settings.
tools/​psa_want_probe.c	Extends standalone capability probing.
tools/​gen-crypto-config.py	Supports both builds and avoids unchanged rewrites.
test/​psa_server/​psa_want_surface_test.c	Tests advertised capabilities and buffer sizes.
test/​psa_server/​psa_tf_psa_extra_test.c	Tests cleanup, service-key helpers, and zeroization.
test/​psa_server/​psa_devid_cryptocb_test.c	Tests callback behavior after cleanup and reinitialization.
test/​mbedtls_compat/​x509_crt_test.c	Tests certificate parsing and chain handling.
test/​mbedtls_compat/​threading_test.c	Tests threading primitives and concurrent key operations.
test/​mbedtls_compat/​programs.sh	Runs compatibility and interoperability scenarios.
test/​mbedtls_compat/​pk_test.c	Tests private-key parsing.
test/​mbedtls_compat/​Makefile	Builds compatibility tests and external sample programs.
test/​mbedtls_compat/​client-tls-mbedtls.c	Adds a migration-guide TLS client.
test/​Makefile	Registers new PSA regression tests.
src/​psa_tf_psa.c	Implements TF-PSA-Crypto compatibility functions.
src/​psa_crypto.c	Implements crypto-state cleanup.
src/​mbedtls_compat.c	Implements TLS, certificate, and networking wrappers.
README.md	Documents configuration, API coverage, limitations, and tests.
Makefile	Integrates compatibility builds and capability generation.
.gitignore	Ignores generated configuration and test binaries.

_{Review effort: Balanced}