feat: add openHiTLS backend support

.github/workflows/main.yml

@@ -16,6 +16,9 @@ env:
   PLATFORM: posix
   TESTS: yes
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  OPENHITLS_REPO: https://gitcode.com/openHiTLS/openhitls.git
+  # Pinned until the next openHiTLS release
+  OPENHITLS_REF: 0a7d5a3748f94c594832a16a7a970cb19d8b4b12
 
 jobs:
   pre-commit:
@@ -57,13 +60,37 @@ jobs:
     strategy:
       matrix:
         CC: ["gcc", "clang"]
-        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl"]
+        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "openhitls"]
     steps:
       - uses: actions/checkout@v6
       - name: setup
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev libtool libtool-bin exuberant-ctags valgrind
           ./autogen.sh
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure no-TLS
         if: matrix.TLS == 'no'
         run: |
@@ -90,14 +117,38 @@ jobs:
     strategy:
       matrix:
         CC: ["gcc", "clang"]
-        TLS: ["mbedtls"]
+        TLS: ["mbedtls", "openhitls"]
         OSCORE_ONLY: ["yes", "no"]
     steps:
       - uses: actions/checkout@v6
       - name: setup
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev libtool libtool-bin exuberant-ctags valgrind
           ./autogen.sh
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure OSCORE Only
         if: matrix.OSCORE_ONLY == 'yes'
         run: |
@@ -142,7 +193,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "tinydtls"]
+        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "tinydtls", "openhitls"]
     steps:
       - uses: actions/checkout@v6
         with:
@@ -151,6 +202,30 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev valgrind
           cmake -E make_directory $GITHUB_WORKSPACE/build-${{matrix.TLS}}-cmake
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure no-TLS
         if: matrix.TLS == 'no'
         run: |
@@ -174,7 +249,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        TLS: ["mbedtls"]
+        TLS: ["mbedtls", "openhitls"]
         OSCORE_ONLY: ["yes", "no"]
     steps:
       - uses: actions/checkout@v6
@@ -184,6 +259,30 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev valgrind
           cmake -E make_directory $GITHUB_WORKSPACE/build-${{matrix.TLS}}-${{matrix.OSCORE_ONLY}}-cmake
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure OSCORE Only
         if: matrix.OSCORE_ONLY == 'yes'
         run: |

CMakeLists.txt

@@ -119,11 +119,11 @@ set(DTLS_BACKEND
       STRING
       "\
 Name of the dtls backend, only relevant if `ENABLE_DTLS` is ON which is default. \
-Possible values: default, gnutls, openssl, wolfssl, mbedtls and tinydtls. \
+Possible values: default, gnutls, openssl, wolfssl, mbedtls, tinydtls and openhitls. \
 If specified then this library will be searched and if found also used. \
 If not found then the cmake configuration will stop with an error. \
 If not specified, then cmake will try to use the first one found in the following order: \
-gnutls, openssl, wolfssl, mbedtls, tinydtls \
+gnutls, openssl, wolfssl, mbedtls, tinydtls, openhitls \
     ")
 set_property(
   CACHE DTLS_BACKEND
@@ -134,22 +134,24 @@ set_property(
            openssl
            wolfssl
            mbedtls
-           tinydtls)
+           tinydtls
+           openhitls)
 set(OSCORE_BACKEND
     "none"
     CACHE
       STRING
       "\
 Name of the oscore backend, only relevant if `ENABLE_DTLS` is OFF which is not the \
-default. Possible values: none and mbedtls. \
+default. Possible values: none, mbedtls and openhitls. \
 If specified then this library will be searched and if found also used. \
 If not found then the cmake configuration will stop with an error. \
     ")
 set_property(
   CACHE OSCORE_BACKEND
   PROPERTY STRINGS
            none
-           mbedtls)
+           mbedtls
+           openhitls)
 option(
   USE_VENDORED_TINYDTLS
   "compile with the tinydtls project in the submodule if on, otherwise try to find the compiled lib with find_package"
@@ -528,6 +530,8 @@ set(WITH_TINYDTLS OFF)
 set(WITH_MBEDTLS OFF)
 set(WITH_MBEDTLS_OSCORE OFF)
 set(WITH_WOLFSSL OFF)
+set(WITH_OPENHITLS OFF)
+set(WITH_OPENHITLS_OSCORE OFF)
 
 if(ENABLE_DTLS)
   message(STATUS "compiling with DTLS support")
@@ -616,6 +620,17 @@ if(ENABLE_DTLS)
     endif()
   endif()
 
+  if((DTLS_BACKEND STREQUAL "openhitls") OR ((DTLS_BACKEND STREQUAL "default") AND (NOT DTLS_FOUND)))
+    # libopenhitls
+    find_package(openHiTLS ${DTLS_REQUIRED})
+    if(openHiTLS_FOUND)
+      set(WITH_OPENHITLS_OSCORE ON)
+      message(STATUS "compiling with openHiTLS support")
+      set(COAP_WITH_LIBOPENHITLS 1)
+      set(DTLS_FOUND ON)
+    endif()
+  endif()
+
   if(((DTLS_BACKEND STREQUAL "default") OR (DTLS_BACKEND STREQUAL "ignore")) AND (NOT DTLS_FOUND))
     # no cryto lib found
     message(
@@ -639,6 +654,17 @@ elseif(NOT ((OSCORE_BACKEND STREQUAL "none") OR (OSCORE_BACKEND STREQUAL "")))
     endif()
   endif()
 
+  if((OSCORE_BACKEND STREQUAL "openhitls") AND (NOT DTLS_FOUND))
+    # libopenhitls
+    find_package(openHiTLS REQUIRED)
+    if(openHiTLS_FOUND)
+      set(WITH_OPENHITLS_OSCORE ON)
+      message(STATUS "compiling with openHiTLS OSCORE support")
+      set(COAP_WITH_LIBOPENHITLS_OSCORE 1)
+      set(DTLS_FOUND ON)
+    endif()
+  endif()
+
   if((ZEPHYR_BASE) AND (OSCORE_BACKEND STREQUAL "zephyr") AND (NOT DTLS_FOUND))
     set(WITH_MBEDTLS_OSCORE ON)
     message(STATUS "compiling with mbedtls OSCORE support")
@@ -721,11 +747,14 @@ message(STATUS "WITH_OPENSSL:....................${WITH_OPENSSL}")
 message(STATUS "WITH_WOLFSSL:....................${WITH_WOLFSSL}")
 message(STATUS "WITH_MBEDTLS:....................${WITH_MBEDTLS}")
 message(STATUS "WITH_MBEDTLS_OSCORE:.............${WITH_MBEDTLS_OSCORE}")
+message(STATUS "WITH_OPENHITLS:..................${WITH_OPENHITLS}")
+message(STATUS "WITH_OPENHITLS_OSCORE:...........${WITH_OPENHITLS_OSCORE}")
 message(STATUS "HAVE_LIBTINYDTLS:................${TinyDTLS_VERSION}")
 message(STATUS "HAVE_LIBGNUTLS:..................${GNUTLS_VERSION}")
 message(STATUS "HAVE_LIBOPENSSL:.................${OPENSSL_VERSION}")
 message(STATUS "HAVE_LIBWOLFSSL:.................${wolfssl_VERSION}")
 message(STATUS "HAVE_LIBMBEDTLS:.................${MbedTLS_VERSION}")
+message(STATUS "HAVE_LIBOPENHITLS:...............${openHiTLS_VERSION}")
 message(STATUS "WITH_EPOLL:......................${WITH_EPOLL}")
 message(STATUS "WITH_OBSERVE_PERSIST:............${WITH_OBSERVE_PERSIST}")
 message(STATUS "BUILD_SHARED_LIBS:...............${BUILD_SHARED_LIBS}")
@@ -809,6 +838,8 @@ target_sources(
           $<$<BOOL:${COAP_WITH_LIBGNUTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_gnutls.c>
           $<$<BOOL:${COAP_WITH_LIBMBEDTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_mbedtls.c>
           $<$<BOOL:${COAP_WITH_LIBMBEDTLS_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_mbedtls.c>
+          $<$<BOOL:${COAP_WITH_LIBOPENHITLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_openhitls.c>
+          $<$<BOOL:${COAP_WITH_LIBOPENHITLS_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_openhitls.c>
           # needed for OSCORE if enabled
           $<$<BOOL:${COAP_OSCORE_SUPPORT}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore.c>
           $<$<BOOL:${COAP_OSCORE_SUPPORT}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_cbor.c>
@@ -856,6 +887,8 @@ target_link_libraries(
          $<$<BOOL:${COAP_WITH_LIBMBEDTLS}>:MbedTLS::mbedtls>
          $<$<BOOL:${COAP_WITH_LIBMBEDTLS_OSCORE}>:MbedTLS::mbedtls>
          $<$<BOOL:${COAP_WITH_LIBWOLFSSL}>:wolfssl::wolfssl>
+         $<$<BOOL:${COAP_WITH_LIBOPENHITLS}>:openHiTLS::openhitls>
+         $<$<BOOL:${COAP_WITH_LIBOPENHITLS_OSCORE}>:openHiTLS::openhitls>
          $<$<BOOL:${WIN32}>:ws2_32>
          $<$<BOOL:${WIN32}>:iphlpapi>
          $<$<BOOL:${MINGW}>:pthread>)

LICENSE

@@ -122,6 +122,13 @@ When compiled with wolfSSL support, this software includes components
 that are licensed under the terms of the GPLv2 license
 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).
 
+========================================================================
+openHiTLS
+
+When compiled with openHiTLS support, this software includes components
+that are licensed under the terms of the Mulan PSL v2 license
+(http://license.coscl.org.cn/MulanPSL2).
+
 ========================================================================
 SHA1
 

Makefile.am

@@ -38,6 +38,7 @@ EXTRA_DIST = \
   cmake/FindCUnit.cmake \
   cmake/FindMbedTLS.cmake \
   cmake/FindTinyDTLS.cmake \
+  cmake/FindopenHiTLS.cmake \
   cmake/Findwolfssl.cmake \
   coap_config.h.contiki \
   coap_config.h.riot \
@@ -215,6 +216,7 @@ libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES = \
   src/coap_net.c \
   src/coap_netif.c \
   src/coap_notls.c \
+  src/coap_openhitls.c \
   src/coap_openssl.c \
   src/coap_option.c \
   src/coap_oscore.c \

README.md

@@ -81,6 +81,8 @@ There is (D)TLS support for the following libraries
 
 * [TinyDTLS](https://github.com/eclipse/tinydtls) [PSK and RPK] [DTLS Only]
 
+* [openHiTLS](https://gitcode.com/openHiTLS/openhitls) (Minimum version 0.4.0) [PKI and PSK]
+
 The examples directory contain a CoAP client, CoAP Resource Directory server
 and a CoAP server to demonstrate the use of this library.