[cli-tcp] add TLS mode to TCP CLI tool and TLS callbacks to TCP API (#8257)

This commit adds support for TLS in the TCP CLI tool, along with a
test of TLS functionality.

The main purpose of this is to provide an example of how to use
mbedTLS with TCPlp to run TLS. I felt it is important to have an
example because I expect that many applications that use TCP,
particularly those in which a Thread device exchanges data with a
device outside the Thread mesh, will need to run TLS over TCP for
security reasons.

A secondary benefit is to add TCP functionality to the TCP CLI
tool. Additionally, by having the example code be part of a "real"
application (the CLI tool), there is less risk of the code going stale
as OpenThread evolves.

I added an "expects" test for the TLS functionality in the CLI tool. I
also ran the code on two Nordic NRF52840-DK boards to make sure it
works.

The performance impact of TLS appears to be small. When using TCP
without TLS, I am able to achieve ~80 kb/s goodput between two
NRF52840-DK boards. With TLS in the same setup, I am able to achieve
~70-75 kb/s goodput.

tests/scripts/expect/cli-tcp-tls.exp

@@ -0,0 +1,165 @@
+#!/usr/bin/expect -f
+#
+#  Copyright (c) 2022, The OpenThread Authors.
+#  All rights reserved.
+#
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that the following conditions are met:
+#  1. Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+#  2. Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#  3. Neither the name of the copyright holder nor the
+#     names of its contributors may be used to endorse or promote products
+#     derived from this software without specific prior written permission.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+#  POSSIBILITY OF SUCH DAMAGE.
+#
+
+source "tests/scripts/expect/_common.exp"
+source "tests/scripts/expect/_multinode.exp"
+
+setup_two_nodes
+
+switch_node 1
+send "tcp init tls\n"
+expect_line "Done"
+
+switch_node 2
+send "tcp init tls\n"
+expect_line "Done"
+set addr_2 [get_ipaddr mleid]
+send "tcp listen :: 30000\n"
+expect_line "Done"
+send "tcp stoplistening\n"
+expect_line "Done"
+
+switch_node 1
+send "tcp connect $addr_2 30000\n"
+expect_line "Done"
+expect "TCP: Connection refused"
+
+switch_node 2
+send "tcp listen :: 30000\n"
+expect_line "Done"
+
+switch_node 1
+set addr_1 [get_ipaddr mleid]
+send "tcp bind $addr_1 25000\n"
+expect_line "Done"
+send "tcp connect $addr_2 30000\n"
+expect_line "Done"
+expect "TCP: Connection established"
+expect "TLS Handshake Complete"
+
+switch_node 2
+expect "Accepted connection from \\\[$addr_1\\\]:25000"
+expect "TCP: Connection established"
+expect "TLS Handshake Complete"
+
+switch_node 1
+send "tcp send hello\n"
+expect_line "Done"
+
+switch_node 2
+expect "TLS: Received 5 bytes: hello"
+expect "(TCP: Received 26 bytes)"
+send "tcp send world\n"
+expect_line "Done"
+
+switch_node 1
+expect "TLS: Received 5 bytes: world"
+expect "(TCP: Received 26 bytes)"
+send "tcp sendend\n"
+expect_line "Done"
+send "tcp send more\n"
+expect_line "Error 1: Failed"
+
+switch_node 2
+expect "TCP: Reached end of stream"
+send "tcp send goodbye\n"
+expect_line "Done"
+
+switch_node 1
+expect "TLS: Received 7 bytes: goodbye"
+expect "(TCP: Received 28 bytes)"
+
+switch_node 2
+send "tcp sendend\n"
+expect_line "Done"
+expect "TCP: Disconnected"
+
+switch_node 1
+expect "TCP: Reached end of stream"
+expect "TCP: Entered TIME-WAIT state"
+set timeout 130
+expect "TCP: Disconnected"
+
+# Test second connection with roles reversed (to be sure we're managing TLS state correctly)
+
+send "tcp listen :: 30000\n"
+expect_line "Done"
+
+switch_node 2
+send "tcp bind $addr_2 25000\n"
+expect_line "Done"
+send "tcp connect $addr_1 30000\n"
+expect_line "Done"
+expect "TCP: Connection established"
+expect "TLS Handshake Complete"
+
+switch_node 1
+expect "Accepted connection from \\\[$addr_2\\\]:25000"
+expect "TCP: Connection established"
+expect "TLS Handshake Complete"
+
+switch_node 2
+send "tcp send hello\n"
+expect_line "Done"
+
+switch_node 1
+expect "TLS: Received 5 bytes: hello"
+expect "(TCP: Received 26 bytes)"
+send "tcp send world\n"
+expect_line "Done"
+
+switch_node 2
+expect "TLS: Received 5 bytes: world"
+expect "(TCP: Received 26 bytes)"
+send "tcp sendend\n"
+expect_line "Done"
+send "tcp send more\n"
+expect_line "Error 1: Failed"
+
+switch_node 1
+expect "TCP: Reached end of stream"
+send "tcp send goodbye\n"
+expect_line "Done"
+
+switch_node 2
+expect "TLS: Received 7 bytes: goodbye"
+expect "(TCP: Received 28 bytes)"
+
+switch_node 1
+send "tcp sendend\n"
+expect_line "Done"
+expect "TCP: Disconnected"
+
+switch_node 2
+expect "TCP: Reached end of stream"
+expect "TCP: Entered TIME-WAIT state"
+set timeout 130
+expect "TCP: Disconnected"
+
+dispose_all