feat: add openHiTLS backend support

- Add openHiTLS DTLS/TLS backend
- Integrate openHiTLS crypto into libcoap (D)TLS and OSCORE paths.
- Extend TLS tests and add interop validation script.

.github/workflows/main.yml

@@ -16,6 +16,9 @@ env:
   PLATFORM: posix
   TESTS: yes
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  OPENHITLS_REPO: https://gitcode.com/openHiTLS/openhitls.git
+  # Pinned until the next openHiTLS release
+  OPENHITLS_REF: 0a7d5a3748f94c594832a16a7a970cb19d8b4b12
 
 jobs:
   pre-commit:
@@ -57,13 +60,37 @@ jobs:
     strategy:
       matrix:
         CC: ["gcc", "clang"]
-        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl"]
+        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "openhitls"]
     steps:
       - uses: actions/checkout@v6
       - name: setup
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev libtool libtool-bin exuberant-ctags valgrind
           ./autogen.sh
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure no-TLS
         if: matrix.TLS == 'no'
         run: |
@@ -90,7 +117,7 @@ jobs:
     strategy:
       matrix:
         CC: ["gcc", "clang"]
-        TLS: ["mbedtls"]
+        TLS: ["mbedtls", "openhitls"]
         OSCORE_ONLY: ["yes", "no"]
     steps:
       - uses: actions/checkout@v6
@@ -98,6 +125,30 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev libtool libtool-bin exuberant-ctags valgrind
           ./autogen.sh
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure OSCORE Only
         if: matrix.OSCORE_ONLY == 'yes'
         run: |
@@ -142,7 +193,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "tinydtls"]
+        TLS: ["no", "openssl", "gnutls", "mbedtls", "wolfssl", "tinydtls", "openhitls"]
     steps:
       - uses: actions/checkout@v6
         with:
@@ -151,6 +202,30 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev valgrind
           cmake -E make_directory $GITHUB_WORKSPACE/build-${{matrix.TLS}}-cmake
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure no-TLS
         if: matrix.TLS == 'no'
         run: |
@@ -174,7 +249,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        TLS: ["mbedtls"]
+        TLS: ["mbedtls", "openhitls"]
         OSCORE_ONLY: ["yes", "no"]
     steps:
       - uses: actions/checkout@v6
@@ -184,6 +259,30 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libcunit1-dev libmbedtls-dev libgnutls28-dev libwolfssl-dev valgrind
           cmake -E make_directory $GITHUB_WORKSPACE/build-${{matrix.TLS}}-${{matrix.OSCORE_ONLY}}-cmake
+      - name: cache openHiTLS
+        if: matrix.TLS == 'openhitls'
+        id: cache_openhitls
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/openhitls-prefix
+          key: openhitls-${{ runner.os }}-${{ runner.arch }}-${{ env.OPENHITLS_REF }}-full
+      - name: build openHiTLS
+        if: matrix.TLS == 'openhitls' && steps.cache_openhitls.outputs.cache-hit != 'true'
+        run: |
+          rm -rf "$RUNNER_TEMP/openhitls-src" "$RUNNER_TEMP/openhitls-prefix"
+          git init "$RUNNER_TEMP/openhitls-src"
+          cd "$RUNNER_TEMP/openhitls-src"
+          git remote add origin "$OPENHITLS_REPO"
+          git fetch --depth 1 origin "$OPENHITLS_REF"
+          git checkout FETCH_HEAD
+          cmake -S . -B build -DHITLS_BUILD_PROFILE=full -DCMAKE_BUILD_TYPE=Release
+          cmake --build build --parallel "$(nproc)"
+          cmake --install build --prefix "$RUNNER_TEMP/openhitls-prefix"
+      - name: install openHiTLS
+        if: matrix.TLS == 'openhitls'
+        run: |
+          sudo cp -a "$RUNNER_TEMP/openhitls-prefix/." /usr/local/
+          sudo ldconfig
       - name: configure OSCORE Only
         if: matrix.OSCORE_ONLY == 'yes'
         run: |

CMakeLists.txt

@@ -119,11 +119,11 @@ set(DTLS_BACKEND
       STRING
       "\
 Name of the dtls backend, only relevant if `ENABLE_DTLS` is ON which is default. \
-Possible values: default, gnutls, openssl, wolfssl, mbedtls and tinydtls. \
+Possible values: default, gnutls, openssl, wolfssl, mbedtls, tinydtls and openhitls. \
 If specified then this library will be searched and if found also used. \
 If not found then the cmake configuration will stop with an error. \
 If not specified, then cmake will try to use the first one found in the following order: \
-gnutls, openssl, wolfssl, mbedtls, tinydtls \
+gnutls, openssl, wolfssl, mbedtls, tinydtls, openhitls \
     ")
 set_property(
   CACHE DTLS_BACKEND
@@ -134,14 +134,15 @@ set_property(
            openssl
            wolfssl
            mbedtls
-           tinydtls)
+           tinydtls
+           openhitls)
 set(OSCORE_BACKEND
     "none"
     CACHE
       STRING
       "\
 Name of the oscore backend, only relevant if `ENABLE_DTLS` is OFF which is not the \
-default. Possible values: none and mbedtls. \
+default. Possible values: none, mbedtls and openhitls. \
 If specified then this library will be searched and if found also used. \
 If not found then the cmake configuration will stop with an error. \
     ")
@@ -149,7 +150,8 @@ set_property(
   CACHE OSCORE_BACKEND
   PROPERTY STRINGS
            none
-           mbedtls)
+           mbedtls
+           openhitls)
 option(
   USE_VENDORED_TINYDTLS
   "compile with the tinydtls project in the submodule if on, otherwise try to find the compiled lib with find_package"
@@ -528,6 +530,8 @@ set(WITH_TINYDTLS OFF)
 set(WITH_MBEDTLS OFF)
 set(WITH_MBEDTLS_OSCORE OFF)
 set(WITH_WOLFSSL OFF)
+set(WITH_OPENHITLS OFF)
+set(WITH_OPENHITLS_OSCORE OFF)
 
 if(ENABLE_DTLS)
   message(STATUS "compiling with DTLS support")
@@ -616,6 +620,17 @@ if(ENABLE_DTLS)
     endif()
   endif()
 
+  if((DTLS_BACKEND STREQUAL "openhitls") OR ((DTLS_BACKEND STREQUAL "default") AND (NOT DTLS_FOUND)))
+    # libopenhitls
+    find_package(openHiTLS ${DTLS_REQUIRED})
+    if(openHiTLS_FOUND)
+      set(WITH_OPENHITLS_OSCORE ON)
+      message(STATUS "compiling with openHiTLS support")
+      set(COAP_WITH_LIBOPENHITLS 1)
+      set(DTLS_FOUND ON)
+    endif()
+  endif()
+
   if(((DTLS_BACKEND STREQUAL "default") OR (DTLS_BACKEND STREQUAL "ignore")) AND (NOT DTLS_FOUND))
     # no cryto lib found
     message(
@@ -639,6 +654,17 @@ elseif(NOT ((OSCORE_BACKEND STREQUAL "none") OR (OSCORE_BACKEND STREQUAL "")))
     endif()
   endif()
 
+  if((OSCORE_BACKEND STREQUAL "openhitls") AND (NOT DTLS_FOUND))
+    # libopenhitls
+    find_package(openHiTLS REQUIRED)
+    if(openHiTLS_FOUND)
+      set(WITH_OPENHITLS_OSCORE ON)
+      message(STATUS "compiling with openHiTLS OSCORE support")
+      set(COAP_WITH_LIBOPENHITLS_OSCORE 1)
+      set(DTLS_FOUND ON)
+    endif()
+  endif()
+
   if((ZEPHYR_BASE) AND (OSCORE_BACKEND STREQUAL "zephyr") AND (NOT DTLS_FOUND))
     set(WITH_MBEDTLS_OSCORE ON)
     message(STATUS "compiling with mbedtls OSCORE support")
@@ -721,11 +747,14 @@ message(STATUS "WITH_OPENSSL:....................${WITH_OPENSSL}")
 message(STATUS "WITH_WOLFSSL:....................${WITH_WOLFSSL}")
 message(STATUS "WITH_MBEDTLS:....................${WITH_MBEDTLS}")
 message(STATUS "WITH_MBEDTLS_OSCORE:.............${WITH_MBEDTLS_OSCORE}")
+message(STATUS "WITH_OPENHITLS:..................${WITH_OPENHITLS}")
+message(STATUS "WITH_OPENHITLS_OSCORE:...........${WITH_OPENHITLS_OSCORE}")
 message(STATUS "HAVE_LIBTINYDTLS:................${TinyDTLS_VERSION}")
 message(STATUS "HAVE_LIBGNUTLS:..................${GNUTLS_VERSION}")
 message(STATUS "HAVE_LIBOPENSSL:.................${OPENSSL_VERSION}")
 message(STATUS "HAVE_LIBWOLFSSL:.................${wolfssl_VERSION}")
 message(STATUS "HAVE_LIBMBEDTLS:.................${MbedTLS_VERSION}")
+message(STATUS "HAVE_LIBOPENHITLS:...............${openHiTLS_VERSION}")
 message(STATUS "WITH_EPOLL:......................${WITH_EPOLL}")
 message(STATUS "WITH_OBSERVE_PERSIST:............${WITH_OBSERVE_PERSIST}")
 message(STATUS "BUILD_SHARED_LIBS:...............${BUILD_SHARED_LIBS}")
@@ -809,6 +838,8 @@ target_sources(
           $<$<BOOL:${COAP_WITH_LIBGNUTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_gnutls.c>
           $<$<BOOL:${COAP_WITH_LIBMBEDTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_mbedtls.c>
           $<$<BOOL:${COAP_WITH_LIBMBEDTLS_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_mbedtls.c>
+          $<$<BOOL:${COAP_WITH_LIBOPENHITLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_openhitls.c>
+          $<$<BOOL:${COAP_WITH_LIBOPENHITLS_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_openhitls.c>
           # needed for OSCORE if enabled
           $<$<BOOL:${COAP_OSCORE_SUPPORT}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore.c>
           $<$<BOOL:${COAP_OSCORE_SUPPORT}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_cbor.c>
@@ -856,6 +887,8 @@ target_link_libraries(
          $<$<BOOL:${COAP_WITH_LIBMBEDTLS}>:MbedTLS::mbedtls>
          $<$<BOOL:${COAP_WITH_LIBMBEDTLS_OSCORE}>:MbedTLS::mbedtls>
          $<$<BOOL:${COAP_WITH_LIBWOLFSSL}>:wolfssl::wolfssl>
+         $<$<BOOL:${COAP_WITH_LIBOPENHITLS}>:openHiTLS::openhitls>
+         $<$<BOOL:${COAP_WITH_LIBOPENHITLS_OSCORE}>:openHiTLS::openhitls>
          $<$<BOOL:${WIN32}>:ws2_32>
          $<$<BOOL:${WIN32}>:iphlpapi>
          $<$<BOOL:${MINGW}>:pthread>)

LICENSE

@@ -122,6 +122,13 @@ When compiled with wolfSSL support, this software includes components
 that are licensed under the terms of the GPLv2 license
 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).
 
+========================================================================
+openHiTLS
+
+When compiled with openHiTLS support, this software includes components
+that are licensed under the terms of the Mulan PSL v2 license
+(http://license.coscl.org.cn/MulanPSL2).
+
 ========================================================================
 SHA1
 

Makefile.am

@@ -38,6 +38,7 @@ EXTRA_DIST = \
   cmake/FindCUnit.cmake \
   cmake/FindMbedTLS.cmake \
   cmake/FindTinyDTLS.cmake \
+  cmake/FindopenHiTLS.cmake \
   cmake/Findwolfssl.cmake \
   coap_config.h.contiki \
   coap_config.h.riot \
@@ -215,6 +216,7 @@ libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES = \
   src/coap_net.c \
   src/coap_netif.c \
   src/coap_notls.c \
+  src/coap_openhitls.c \
   src/coap_openssl.c \
   src/coap_option.c \
   src/coap_oscore.c \

README.md

@@ -81,6 +81,8 @@ There is (D)TLS support for the following libraries
 
 * [TinyDTLS](https://github.com/eclipse/tinydtls) [PSK and RPK] [DTLS Only]
 
+* [openHiTLS](https://gitcode.com/openHiTLS/openhitls) (Minimum version 0.4.0) [PKI and PSK]
+
 The examples directory contain a CoAP client, CoAP Resource Directory server
 and a CoAP server to demonstrate the use of this library.
 

cmake/FindopenHiTLS.cmake

@@ -0,0 +1,102 @@
+# FindopenHiTLS
+# -------------
+#
+# Find the openHiTLS crypto and (D)TLS libraries.
+#
+# Imported Targets
+# ^^^^^^^^^^^^^^^^
+#
+# ``openHiTLS::openhitls``
+#   The openHiTLS libraries, if found.
+#
+# Result Variables
+# ^^^^^^^^^^^^^^^^
+#
+# ``openHiTLS_FOUND``, ``openHiTLS_VERSION``, ``OPENHITLS_INCLUDE_DIRS``,
+# ``OPENHITLS_LIBRARIES``.
+#
+# Hints
+# ^^^^^
+#
+# ``OPENHITLS_ROOT_DIR``   openHiTLS installation prefix.
+
+set(OPENHITLS_ROOT_DIR "" CACHE PATH "openHiTLS installation prefix")
+
+find_path(
+  OPENHITLS_INCLUDE_DIR
+  NAMES hitls/crypto/crypt_eal_init.h
+  HINTS ${OPENHITLS_ROOT_DIR}
+  PATH_SUFFIXES include)
+find_library(
+  OPENHITLS_CRYPTO_LIBRARY
+  NAMES hitls_crypto
+  HINTS ${OPENHITLS_ROOT_DIR}
+  PATH_SUFFIXES lib lib64)
+find_library(
+  OPENHITLS_BSL_LIBRARY
+  NAMES hitls_bsl
+  HINTS ${OPENHITLS_ROOT_DIR}
+  PATH_SUFFIXES lib lib64)
+find_library(
+  OPENHITLS_TLS_LIBRARY
+  NAMES hitls_tls
+  HINTS ${OPENHITLS_ROOT_DIR}
+  PATH_SUFFIXES lib lib64)
+find_library(
+  OPENHITLS_PKI_LIBRARY
+  NAMES hitls_pki
+  HINTS ${OPENHITLS_ROOT_DIR}
+  PATH_SUFFIXES lib lib64)
+
+set(_OPENHITLS_REQUIRED_VARS
+    OPENHITLS_INCLUDE_DIR
+    OPENHITLS_TLS_LIBRARY
+    OPENHITLS_PKI_LIBRARY
+    OPENHITLS_CRYPTO_LIBRARY
+    OPENHITLS_BSL_LIBRARY)
+set(OPENHITLS_INCLUDE_DIRS
+    "${OPENHITLS_INCLUDE_DIR}"
+    # TBD: openhitls internal header include sub module use bare path
+    # (e.g. hitls/tls/hitls.h has #include "bsl_obj.h"), which only resolves when
+    # each module directory is on the include path.
+    # once openHiTLS adjust internal header include, below lines should be removed.
+    "${OPENHITLS_INCLUDE_DIR}/hitls/tls"
+    "${OPENHITLS_INCLUDE_DIR}/hitls/pki"
+    "${OPENHITLS_INCLUDE_DIR}/hitls/bsl"
+    "${OPENHITLS_INCLUDE_DIR}/hitls/crypto")
+if(OPENHITLS_INCLUDE_DIR AND EXISTS "${OPENHITLS_INCLUDE_DIR}/hitls/bsl/bsl_version.h")
+  file(STRINGS "${OPENHITLS_INCLUDE_DIR}/hitls/bsl/bsl_version.h" openHiTLS_VERSION_STR
+    REGEX "#[\t ]*define[\t ]+OPENHITLS_VERSION_S[\t ]+\"[^\"]+\"")
+  string(REGEX REPLACE "^.*OPENHITLS_VERSION_S[\t ]+\"openHiTLS[\t ]+([0-9]+\\.[0-9]+\\.[0-9]+).*$"
+    "\\1" openHiTLS_VERSION_STR "${openHiTLS_VERSION_STR}")
+  set(openHiTLS_VERSION "${openHiTLS_VERSION_STR}")
+  unset(openHiTLS_VERSION_STR)
+endif()
+set(OPENHITLS_LIBRARIES
+    "${OPENHITLS_TLS_LIBRARY}"
+    "${OPENHITLS_PKI_LIBRARY}"
+    "${OPENHITLS_CRYPTO_LIBRARY}"
+    "${OPENHITLS_BSL_LIBRARY}"
+    "${CMAKE_DL_LIBS}")
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(
+  openHiTLS
+  FAIL_MESSAGE "Could NOT find openHiTLS, set OPENHITLS_ROOT_DIR to the openHiTLS installation prefix"
+  REQUIRED_VARS ${_OPENHITLS_REQUIRED_VARS}
+  VERSION_VAR openHiTLS_VERSION)
+
+if(openHiTLS_FOUND AND NOT TARGET openHiTLS::openhitls)
+  add_library(openHiTLS::openhitls INTERFACE IMPORTED)
+  set_target_properties(
+    openHiTLS::openhitls
+    PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${OPENHITLS_INCLUDE_DIRS}"
+               INTERFACE_LINK_LIBRARIES "${OPENHITLS_LIBRARIES}")
+endif()
+
+mark_as_advanced(
+  OPENHITLS_INCLUDE_DIR
+  OPENHITLS_CRYPTO_LIBRARY
+  OPENHITLS_BSL_LIBRARY
+  OPENHITLS_TLS_LIBRARY
+  OPENHITLS_PKI_LIBRARY)

cmake_coap_defines.h.in

@@ -80,6 +80,12 @@
 /* Define to 1 if the system has openssl */
 #cmakedefine COAP_WITH_LIBOPENSSL @COAP_WITH_LIBOPENSSL@
 
+/* Define to 1 if the system has openHiTLS */
+#cmakedefine COAP_WITH_LIBOPENHITLS @COAP_WITH_LIBOPENHITLS@
+
+/* Define to 1 if the system has openHiTLS and OSCORE only */
+#cmakedefine COAP_WITH_LIBOPENHITLS_OSCORE @COAP_WITH_LIBOPENHITLS_OSCORE@
+
 /* Define to 1 if the system has libtinydtls */
 #cmakedefine COAP_WITH_LIBTINYDTLS @COAP_WITH_LIBTINYDTLS@
 

configure.ac

@@ -400,18 +400,22 @@ AM_CONDITIONAL(BUILD_MANPAGES, [test "x$build_manpages" = "xyes"])
 # __dtls__
 # The Datagram Transport Layer Security (DTLS) feature needs cryptography
 # functions.
-# We currently support the GnuTLS, OpenSSL, WolfSSL, MbedTLS and TinyDLTS libraries.
+# We currently support the GnuTLS, OpenSSL, WolfSSL, MbedTLS, TinyDTLS
+# and openHiTLS libraries.
 # The user can preselect the cryptography library that should be used by adding '--with-gnutls',
-# '--with-openssl', --with-wolfssl, --with-mbedtls or --with-tinydtls.
+# '--with-openssl', --with-wolfssl, --with-mbedtls, --with-tinydtls or
+# --with-openhitls.
 #
 # If the user isn't using a selection we first search for GnuTLS and fallback
-# to OpenSSL, WolfSSL, mbedtls or TinyDTLS if a TLS library couldn't be found.
+# to OpenSSL, WolfSSL, mbedtls, TinyDTLS or openHiTLS if a TLS library couldn't
+# be found.
 
 gnutls_version_required=3.3.0
 openssl_version_required=1.1.0
 mbedtls_version_required=2.7.10
 wolfssl_version_required=5.2.0
 tinydtls_version_required=0.8.6
+openhitls_version_required=0.4.0
 
 AC_ARG_ENABLE([dtls],
               [AS_HELP_STRING([--enable-dtls],
@@ -455,22 +459,52 @@ AC_ARG_WITH([tinydtls],
            [with_tinydtls="$withval"],
            [with_tinydtls="no"])
 
+AC_ARG_WITH([openhitls],
+           [AS_HELP_STRING([--with-openhitls],
+                           [Use openHiTLS for DTLS/TLS functions])],
+           [with_openhitls="$withval"],
+           [with_openhitls="no"])
+
+AC_ARG_WITH([openhitls-oscore],
+           [AS_HELP_STRING([--with-openhitls-oscore],
+                           [Use openHiTLS for OSCORE functions])],
+           [with_openhitls_oscore="$withval"],
+           [with_openhitls_oscore="no"])
+
 AC_ARG_WITH([submodule-tinydtls],
            [AS_HELP_STRING([--with-submodule-tinydtls],
                            [Use the TinyDTLS provided in the git submodule over the system-provided version [default=fallback to submodule if --with-tinydtls is explicitly set and no system-provided version was found])])],
            [with_submodule_tinydtls="$withval"],
            [with_submodule_tinydtls="explicit_fallback"])
 
-if test "x$with_gnutls" = "xyes" -o "x$with_openssl" = "xyes" -o "x$with_wolfssl" = "xyes" -o "x$with_mbedtls" = "xyes" -o "x$with_tinydtls" = "xyes"; then
+case "$with_openhitls" in
+yes|no) ;;
+*) AC_MSG_ERROR([==> --with-openhitls only accepts yes or no. Use OpenHiTLS_CFLAGS/OpenHiTLS_LIBS for a non-default installation prefix.]) ;;
+esac
+
+case "$with_openhitls_oscore" in
+yes|no) ;;
+*) AC_MSG_ERROR([==> --with-openhitls-oscore only accepts yes or no. Use OpenHiTLS_CFLAGS/OpenHiTLS_LIBS for a non-default installation prefix.]) ;;
+esac
+
+if test "x$build_dtls" = "xyes" -a "x$with_openhitls_oscore" = "xyes"; then
+    if test "x$with_openhitls" = "xno"; then
+        with_openhitls="yes"
+        with_openhitls_oscore="no"
+    fi
+fi
+
+if test "x$with_gnutls" = "xyes" -o "x$with_openssl" = "xyes" -o "x$with_wolfssl" = "xyes" -o "x$with_mbedtls" = "xyes" -o "x$with_tinydtls" = "xyes" -o "x$with_openhitls" = "xyes"; then
     if test "x$build_dtls" = "xno"; then
-        # Give an advice that '--with_gnutls', '--with_openssl', '--with_wolfssl', '--with-mbedtls' or '--with-tinydtls' was used but
+        # Give an advice that '--with-gnutls', '--with-openssl', '--with-wolfssl', '--with-mbedtls', '--with-tinydtls' or '--with-openhitls' was used but
         # DTLS support isn't configured.
-        AC_MSG_WARN([==> Using the configure options '--with-gnutls', '--with-openssl', '--with_wolfssl', '--with-mbedtls' or '--with-tinydtls' without '--enable-dtls' is useless and will be ignored.])
+        AC_MSG_WARN([==> Using the configure options '--with-gnutls', '--with-openssl', '--with-wolfssl', '--with-mbedtls', '--with-tinydtls' or '--with-openhitls' without '--enable-dtls' is useless and will be ignored.])
         with_gnutls="no"
         with_openssl="no"
         with_wolfssl="no"
         with_mbedtls="no"
         with_tinydtls="no"
+        with_openhitls="no"
         with_submodule_tinydtls="no"
     fi
 fi
@@ -503,8 +537,14 @@ if test "x$build_dtls" = "xyes"; then
     if test "x$with_tinydtls" = "xyes"; then
         TLSCOUNT=`expr $TLSCOUNT + 1`
     fi
+    if test "x$with_openhitls" = "xyes"; then
+        TLSCOUNT=`expr $TLSCOUNT + 1`
+    fi
+    if test "x$with_openhitls_oscore" = "xyes"; then
+        TLSCOUNT=`expr $TLSCOUNT + 1`
+    fi
     if test "$TLSCOUNT" -gt 1; then
-        AC_MSG_ERROR([==> You can't use more than 1 of the options '--with-gnutls', '--with-openssl', '--with-mbedtls', '--with-mbedtls-odcore' or '--with-tinydtls' at the same time while '--enable-dtls' is selected!
+        AC_MSG_ERROR([==> You can't use more than 1 of the options '--with-gnutls', '--with-openssl', '--with-mbedtls', '--with-mbedtls-oscore', '--with-tinydtls', '--with-openhitls' or '--with-openhitls-oscore' at the same time while '--enable-dtls' is selected!
                   ==> Please note, the option '--enable-dtls' is turned on by default if not explicitly disabled!])
     fi
 
@@ -533,6 +573,11 @@ if test "x$build_dtls" = "xyes"; then
                          [have_mbedtls="yes"],
                          [have_mbedtls="no"])
 
+    # openHiTLS
+    AX_PKG_CHECK_OPENHITLS([dtls],
+                           [have_openhitls="yes"],
+                           [have_openhitls="no"])
+
     if test "${TinyDTLS_CFLAGS+set}" = "set"; then
         tinydtls_cflags_overridden="yes"
     fi
@@ -545,6 +590,20 @@ if test "x$build_dtls" = "xyes"; then
                       [have_tinydtls="yes"],
                       [have_tinydtls="no"])
 
+    if test "x$with_openhitls" = "xyes"; then
+        if test "x$have_openhitls" != "xyes"; then
+            AC_MSG_ERROR([==> You want to build libcoap with DTLS support by the openHiTLS library but the openHiTLS libraries could not be found!
+                      Build and install openHiTLS with HITLS_BUILD_PROFILE=full,
+                      or select a different TLS library or disable the DTLS support using '--disable-dtls'.])
+        fi
+        AC_MSG_NOTICE([The use of openHiTLS was explicitly requested with configure option '--with-openhitls'!])
+        have_gnutls="no"
+        have_openssl="no"
+        have_wolfssl="no"
+        have_mbedtls="no"
+        have_tinydtls="no"
+    fi
+
     # TBD ?
 
     # The user wants to use explicit GnuTLS if '--with-gnutls' was set.
@@ -731,11 +790,21 @@ if test "x$build_dtls" = "xyes"; then
         have_openssl="no" # don't confuse AC_MSG_RESULT at the end of the script
         have_wolfssl="no" # don't confuse AC_MSG_RESULT at the end of the script
 
+      # ... and if not found check openHiTLS is suitable.
+      elif test "x$have_openhitls" = "xyes"; then
+        AC_MSG_NOTICE([Using auto selected library openHiTLS for DTLS support!])
+        with_openhitls_auto="yes"
+        have_gnutls="no"
+        have_wolfssl="no"
+        have_openssl="no"
+        have_mbedtls="no"
+        have_tinydtls="no"
+
       # Note that the TinyDTLS submodule is used only when explicitly requested.
       # Giving out an error message if we haven't found at least one crypto library.
       else
-          AC_MSG_ERROR([==> Option '--enable-dtls' is set but none of the needed cryptography libraries GnuTLS, OpenSSL, wolfSSL, Mbed TLS or TinyDTLS could be found!
-                        Install at least one of the package(s) that contains the development files for GnuTLS (>= $gnutls_version_required), OpenSSL(>= $openssl_version_required), wolfSSL(>= $wolfssl_version_required), Mbed TLS(>= $mbedtls_version_required), or TinyDTLS(>= $tinydtls_version_required)
+          AC_MSG_ERROR([==> Option '--enable-dtls' is set but none of the needed cryptography libraries GnuTLS, OpenSSL, wolfSSL, Mbed TLS, TinyDTLS or openHiTLS could be found!
+                        Install at least one of the package(s) that contains the development files for GnuTLS (>= $gnutls_version_required), OpenSSL(>= $openssl_version_required), wolfSSL(>= $wolfssl_version_required), Mbed TLS(>= $mbedtls_version_required), TinyDTLS(>= $tinydtls_version_required), or openHiTLS(>= $openhitls_version_required),
                         or disable the DTLS support using '--disable-dtls'.])
       fi
     fi
@@ -774,6 +843,11 @@ if test "x$build_dtls" = "xyes"; then
         DTLS_LIBS="$TinyDTLS_LIBS"
         AC_DEFINE(COAP_WITH_LIBTINYDTLS, [1], [Define to 1 if the system has libtinydtls.])
     fi
+    if test "x$with_openhitls" = "xyes" -o "x$with_openhitls_auto" = "xyes"; then
+        DTLS_CFLAGS="$OpenHiTLS_CFLAGS"
+        DTLS_LIBS="$OpenHiTLS_LIBS"
+        AC_DEFINE(COAP_WITH_LIBOPENHITLS, [1], [Define to 1 if the system has openHiTLS.])
+    fi
     AC_SUBST(DTLS_CFLAGS)
     AC_SUBST(DTLS_LIBS)
 else
@@ -782,8 +856,11 @@ else
     if test "x$with_mbedtls_oscore" = "xyes"; then
         TLSCOUNT=`expr $TLSCOUNT + 1`
     fi
+    if test "x$with_openhitls_oscore" = "xyes"; then
+        TLSCOUNT=`expr $TLSCOUNT + 1`
+    fi
     if test "$TLSCOUNT" -gt 1; then
-        AC_MSG_ERROR([==> You can't use more than 1 of the options '--with-mbedtls-oscore' at the same time while '--disable-dtls' is selected!
+        AC_MSG_ERROR([==> You can't use more than 1 of the options '--with-mbedtls-oscore' or '--with-openhitls-oscore' at the same time while '--disable-dtls' is selected!
                   ==> Please note, the option '--enable-dtls' is turned on by default if not explicitly disabled!])
     fi
 
@@ -799,6 +876,22 @@ else
         AC_DEFINE(COAP_WITH_LIBMBEDTLS_OSCORE, [1], [Define to 1 if the system has libmbedtls2.7.10.])
     fi
 
+    if test "x$with_openhitls_oscore" = "xyes"; then
+        AX_PKG_CHECK_OPENHITLS([oscore],
+                               [have_openhitls_oscore="yes"],
+                               [have_openhitls_oscore="no"])
+        if test "x$have_openhitls_oscore" != "xyes"; then
+            AC_MSG_ERROR([==> You want to build libcoap with OSCORE support by the openHiTLS library but the openHiTLS libraries could not be found!
+                      Build and install openHiTLS with HITLS_BUILD_PROFILE=full,
+                      or disable the OSCORE support using '--disable-oscore'.])
+        fi
+        AC_MSG_NOTICE([The use of openHiTLS was explicitly requested with configure option '--with-openhitls-oscore'!])
+
+        DTLS_CFLAGS="$OpenHiTLS_CFLAGS"
+        DTLS_LIBS="$OpenHiTLS_LIBS"
+        AC_DEFINE(COAP_WITH_LIBOPENHITLS_OSCORE, [1], [Define to 1 if the system has openHiTLS OSCORE crypto support.])
+    fi
+
 fi
 
 # Define the Library name extension for the TLS the library was linked against
@@ -812,8 +905,12 @@ elif test "x$with_mbedtls" = "xyes" -o "x$with_mbedtls_auto" = "xyes"; then
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-mbedtls
 elif test "x$with_mbedtls_oscore" = "xyes"; then
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-mbedtls-oscore
+elif test "x$with_openhitls_oscore" = "xyes"; then
+    LIBCOAP_DTLS_LIB_EXTENSION_NAME=-openhitls-oscore
 elif test "x$with_tinydtls" = "xyes"; then
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-tinydtls
+elif test "x$with_openhitls" = "xyes" -o "x$with_openhitls_auto" = "xyes"; then
+    LIBCOAP_DTLS_LIB_EXTENSION_NAME=-openhitls
 else
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-notls
     AC_DEFINE(HAVE_NOTLS, [1], [Define to 1 if libcoap has no tls library support.])
@@ -841,7 +938,10 @@ if test "x$build_oscore" = "xyes"; then
     fi
 else
     if test "x$with_mbedtls_oscore" = "xyes"; then
-        AC_MSG_ERROR([==> --with-mbedtls-oscore and --dsable-oscore incompatible])
+        AC_MSG_ERROR([==> --with-mbedtls-oscore and --disable-oscore are incompatible])
+    fi
+    if test "x$with_openhitls_oscore" = "xyes"; then
+        AC_MSG_ERROR([==> --with-openhitls-oscore and --disable-oscore are incompatible])
     fi
 fi
 
@@ -1505,6 +1605,26 @@ if test "x$with_tinydtls" = "xyes"; then
     AC_MSG_RESULT([              TinyDTLS_CFLAGS        : "$DTLS_CFLAGS"])
     AC_MSG_RESULT([              TinyDTLS_LIBS          : "$DTLS_LIBS"])
 fi
+if test "x$with_openhitls" = "xyes" -o "x$with_openhitls_auto" = "xyes"; then
+    AC_MSG_RESULT([      build DTLS support             : "yes"])
+    if test "x$openhitls_has_pkgconfig" = "xyes"; then
+      AC_MSG_RESULT([         -->  openHiTLS around       : "yes" (found openHiTLS $openhitls_version using pkg-config)])
+    else
+      AC_MSG_RESULT([         -->  openHiTLS around       : "yes" (found openHiTLS $openhitls_version without pkg-config)])
+    fi
+    AC_MSG_RESULT([              openHiTLS_CFLAGS       : "$OpenHiTLS_CFLAGS"])
+    AC_MSG_RESULT([              openHiTLS_LIBS         : "$OpenHiTLS_LIBS"])
+fi
+if test "x$with_openhitls_oscore" = "xyes"; then
+    AC_MSG_RESULT([      build OSCORE support           : "yes"])
+    if test "x$openhitls_has_pkgconfig" = "xyes"; then
+      AC_MSG_RESULT([         -->  openHiTLS around       : "yes" (found openHiTLS $openhitls_version using pkg-config)])
+    else
+      AC_MSG_RESULT([         -->  openHiTLS around       : "yes" (found openHiTLS $openhitls_version without pkg-config)])
+    fi
+    AC_MSG_RESULT([              openHiTLS_CFLAGS       : "$OpenHiTLS_CFLAGS"])
+    AC_MSG_RESULT([              openHiTLS_LIBS         : "$OpenHiTLS_LIBS"])
+fi
 if test "x$build_dtls" != "xyes"; then
     AC_MSG_RESULT([      build DTLS support             : "no"])
 fi

examples/Makefile.am

@@ -20,6 +20,7 @@ EXTRA_DIST = \
   interop/e_client.conf \
   interop/f_client.conf \
   interop/g_client.conf \
+  tls_backend_testcases.sh \
   oscore_testcases.sh
 
 # just do nothing if 'BUILD_EXAMPLES' isn't defined

include/coap3/coap_dtls.h

@@ -78,6 +78,7 @@ typedef enum coap_tls_library_t {
   COAP_TLS_LIBRARY_GNUTLS,    /**< Using GnuTLS library */
   COAP_TLS_LIBRARY_MBEDTLS,   /**< Using Mbed TLS library */
   COAP_TLS_LIBRARY_WOLFSSL,   /**< Using wolfSSL library */
+  COAP_TLS_LIBRARY_OPENHITLS, /**< Using openHiTLS library */
 } coap_tls_library_t;
 
 /**

m4/ac_check_cryptolibs.m4

@@ -1,7 +1,7 @@
 #
 # SYNOPSIS
 #
-#   AX_CHECK_{GNUTLS|OPENSSL|MBEDTLS|WOLFSSL|TINYDTLS}_VERSION
+#   AX_CHECK_{GNUTLS|OPENSSL|MBEDTLS|WOLFSSL|TINYDTLS|OPENHITLS}_VERSION
 #
 # DESCRIPTION
 #
@@ -96,3 +96,50 @@ AC_DEFUN([AX_CHECK_TINYDTLS_VERSION],
         AC_MSG_ERROR([==> TinyDTLS $tinydtls_version too old. TinyDTLS >= $tinydtls_version_required required for suitable DTLS support build.])
     fi
 ]) dnl AX_CHECK_TINYDTLS_VERSION
+
+AC_DEFUN([AX_CHECK_OPENHITLS_VERSION],
+         [openhitls_version_check_result="no"
+          AC_MSG_CHECKING([for openHiTLS headers])
+          AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <hitls/bsl/bsl_version.h>
+#ifndef OPENHITLS_VERSION_I
+#error OPENHITLS_VERSION_I missing
+#endif
+]], [[]])],
+                            [AC_MSG_RESULT([yes])
+                             openhitls_version_check_result="yes"],
+                            [AC_MSG_RESULT([no])])
+          if test "x$openhitls_version_check_result" = "xyes"; then
+              AC_COMPUTE_INT([openhitls_version_i],
+                             [OPENHITLS_VERSION_I],
+                             [[#include <hitls/bsl/bsl_version.h>]],
+                             [openhitls_version_i=0])
+              if test "x$openhitls_version_i" = "x0"; then
+                  openhitls_version="unknown"
+              else
+                  openhitls_version_major=`expr $openhitls_version_i / 268435456`
+                  openhitls_version_minor=`expr \( $openhitls_version_i % 268435456 \) / 1048576`
+                  openhitls_version_patch=`expr \( $openhitls_version_i % 1048576 \) / 65536`
+                  openhitls_version="$openhitls_version_major.$openhitls_version_minor.$openhitls_version_patch"
+              fi
+              AC_MSG_CHECKING([for compatible openHiTLS version (>= $openhitls_version_required)])
+              openhitls_version_required_major=`printf '%s\n' "$openhitls_version_required" | sed -n 's/^\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)$/\1/p'`
+              openhitls_version_required_minor=`printf '%s\n' "$openhitls_version_required" | sed -n 's/^\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)$/\2/p'`
+              openhitls_version_required_patch=`printf '%s\n' "$openhitls_version_required" | sed -n 's/^\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)\.\([[0-9]][[0-9]]*\)$/\3/p'`
+              if test "x$openhitls_version_required_major" = "x" ||
+                 test "x$openhitls_version_required_minor" = "x" ||
+                 test "x$openhitls_version_required_patch" = "x"; then
+                  AC_MSG_ERROR([==> Invalid openHiTLS required version '$openhitls_version_required'.])
+              fi
+              openhitls_version_required_i=`expr \( $openhitls_version_required_major \* 268435456 \) + \( $openhitls_version_required_minor \* 1048576 \) + \( $openhitls_version_required_patch \* 65536 \)`
+              AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <hitls/bsl/bsl_version.h>
+#if OPENHITLS_VERSION_I < $openhitls_version_required_i
+#error openHiTLS version too old
+#endif
+]], [[]])],
+                                [AC_MSG_RESULT([yes])],
+                                [AC_MSG_RESULT([no])
+                                 openhitls_version_check_result="no"])
+          fi
+]) dnl AX_CHECK_OPENHITLS_VERSION

m4/ax_pkg_check_openhitls.m4

@@ -0,0 +1,140 @@
+#
+# SYNOPSIS
+#
+#   AX_PKG_CHECK_OPENHITLS(MODE, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+#
+# DESCRIPTION
+#
+#   This m4 file contains helper functions for checking the headers and
+#   libraries for openHiTLS which does not always have a pkg-config file.
+#
+# LICENSE
+#
+#   Copyright (c) 2026 openHiTLS Project
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+AC_DEFUN([AX_PKG_CHECK_OPENHITLS], [
+AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+AC_REQUIRE([AC_PROG_CC])
+AC_ARG_VAR([OpenHiTLS_CFLAGS], [C compiler flags for openHiTLS, overriding pkg-config])
+AC_ARG_VAR([OpenHiTLS_LIBS], [linker flags for openHiTLS, overriding pkg-config])
+AC_LANG_PUSH([C])
+
+if test "x$1" != "xdtls" -a "x$1" != "xoscore"; then
+    AC_MSG_ERROR([==> Invalid openHiTLS check mode '$1'.])
+fi
+
+# pkg-config module name and manual fallback flags per mode. openHiTLS does not
+# yet ship a .pc file, so the pkg-config probe below normally fails and we fall
+# back to the default flags.
+# pkg-config metadata. Update openhitls_pc_module when that name is known.
+if test "x$1" = "xdtls"; then
+    openhitls_pc_module="hitls"
+    if test -d /usr/local/include/hitls ; then
+      openhitls_default_cflags="-I/usr/local/include -I/usr/local/include/hitls/tls -I/usr/local/include/hitls/bsl -I/usr/local/include/hitls/crypto -I/usr/local/include/hitls/pki"
+    else
+      openhitls_default_cflags="-I/usr/include/hitls/tls -I/usr/include/hitls/bsl -I/usr/include/hitls/crypto -I/usr/include/hitls/pki"
+    fi
+    openhitls_default_libs="-lhitls_tls -lhitls_crypto -lhitls_pki -lhitls_bsl -ldl"
+else
+    openhitls_pc_module="hitls_crypto"
+    if test -d /usr/local/include/hitls ; then
+      openhitls_default_cflags="-I/usr/local/include -I/usr/local/include/hitls/bsl -I/usr/local/include/hitls/crypto"
+    else
+      openhitls_default_cflags="-I/usr/include/hitls/bsl -I/usr/include/hitls/crypto"
+    fi
+    openhitls_default_libs="-lhitls_crypto -lhitls_bsl -ldl"
+fi
+
+if test "x${OpenHiTLS_CFLAGS+set}" = "xset"; then
+    openhitls_cflags_overridden="yes"
+else
+    openhitls_cflags_overridden="no"
+fi
+if test "x${OpenHiTLS_LIBS+set}" = "xset"; then
+    openhitls_libs_overridden="yes"
+else
+    openhitls_libs_overridden="no"
+fi
+
+# If OpenHiTLS_CFLAGS and OpenHiTLS_LIBS are overridden, pkg-config would always
+# assume the library was found, so skip it and use the supplied flags directly.
+openhitls_has_pkgconfig="no"
+if test "x$openhitls_libs_overridden" = "xyes" -a "x$openhitls_cflags_overridden" = "xyes"; then
+    openhitls_has_pkgconfig="no"
+else
+    # When statically linking against libcoap, all transitive dependencies need
+    # to be specified as linker flags as well. Use pkg-config --static for that.
+    if test "x$enable_static" = "xyes"; then
+        KEEP_PKG_CONFIG=$PKG_CONFIG
+        PKG_CONFIG="$PKG_CONFIG --static"
+        PKG_CHECK_MODULES([OpenHiTLS],
+                          [$openhitls_pc_module],
+                          [openhitls_has_pkgconfig="yes"],
+                          [openhitls_has_pkgconfig="no"])
+        PKG_CONFIG=$KEEP_PKG_CONFIG
+    else
+        PKG_CHECK_MODULES([OpenHiTLS],
+                          [$openhitls_pc_module],
+                          [openhitls_has_pkgconfig="yes"],
+                          [openhitls_has_pkgconfig="no"])
+    fi
+fi
+
+# Fall back to the default flags when pkg-config did not provide them.
+openhitls_lib_dir=""
+if test "x$OpenHiTLS_CFLAGS" = "x"; then
+    OpenHiTLS_CFLAGS="$openhitls_default_cflags"
+    openhitls_lib_dir="-L/usr/local/lib -L/usr/local/lib64"
+fi
+
+if test "x$OpenHiTLS_LIBS" = "x"; then
+    OpenHiTLS_LIBS="$openhitls_lib_dir $openhitls_default_libs"
+fi
+openhitls_version="openHiTLS"
+
+coap_OpenHiTLS_save_CFLAGS="$CFLAGS"
+coap_OpenHiTLS_save_LIBS="$LIBS"
+CFLAGS="$CFLAGS $OpenHiTLS_CFLAGS"
+LIBS="$OpenHiTLS_LIBS $LIBS"
+AX_CHECK_OPENHITLS_VERSION
+if test "x$openhitls_version_check_result" != "xyes"; then
+    openhitls_check_result="no"
+elif test "x$1" = "xdtls"; then
+    AC_MSG_CHECKING([for openHiTLS DTLS/TLS backend APIs])
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+#include <hitls/crypto/crypt_eal_init.h>
+#include <hitls/tls/hitls.h>
+]], [[
+  (void)CRYPT_EAL_Init(CRYPT_EAL_INIT_ALL);
+  (void)HITLS_New(NULL);
+  return 0;
+]])],
+                   [openhitls_check_result="yes"],
+                   [openhitls_check_result="no"])
+    AC_MSG_RESULT([$openhitls_check_result])
+else
+    AC_MSG_CHECKING([for openHiTLS OSCORE backend APIs])
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+#include <hitls/crypto/crypt_eal_init.h>
+]], [[
+  (void)CRYPT_EAL_Init(CRYPT_EAL_INIT_ALL);
+  return 0;
+]])],
+                   [openhitls_check_result="yes"],
+                   [openhitls_check_result="no"])
+    AC_MSG_RESULT([$openhitls_check_result])
+fi
+CFLAGS="$coap_OpenHiTLS_save_CFLAGS"
+LIBS="$coap_OpenHiTLS_save_LIBS"
+if test "x$openhitls_check_result" = "xyes"; then
+    $2
+else
+    $3
+fi
+AC_LANG_POP
+]) dnl AX_PKG_CHECK_OPENHITLS

man/coap-client.txt.in

@@ -14,6 +14,7 @@ coap-client,
 coap-client-gnutls,
 coap-client-mbedtls,
 coap-client-openssl,
+coap-client-openhitls,
 coap-client-notls
 - CoAP Client based on libcoap
 
@@ -35,8 +36,9 @@ SYNOPSIS
 
 For *coap-client* versions that use libcoap compiled for different
 (D)TLS libraries, *coap-client-notls*, *coap-client-gnutls*,
-*coap-client-openssl*, *coap-client-mbedtls* or *coap-client-tinydtls* may be
-available.  Otherwise, *coap-client* uses the default libcoap (D)TLS support.
+*coap-client-openssl*, *coap-client-mbedtls*, *coap-client-tinydtls* or
+*coap-client-openhitls* may be available. Otherwise, *coap-client* uses the
+default libcoap (D)TLS support.
 
 DESCRIPTION
 -----------

man/coap-rd.txt.in

@@ -14,6 +14,7 @@ coap-rd,
 coap-rd-gnutls ,
 coap-rd-mbedtls,
 coap-rd-openssl,
+coap-rd-openhitls,
 coap-rd-notls
 - CoAP Resource Directory based on libcoap
 
@@ -26,8 +27,9 @@ SYNOPSIS
 
 For *coap-rd* versions that use libcoap compiled for different
 (D)TLS libraries, *coap-rd-notls*, *coap-rd-gnutls*,
-*coap-rd-openssl*, *coap-rd-mbedtls* or *coap-rd-tinydtls* may be
-available.  Otherwise, *coap-rd* uses the default libcoap (D)TLS support.
+*coap-rd-openssl*, *coap-rd-mbedtls*, *coap-rd-tinydtls* or
+*coap-rd-openhitls* may be available. Otherwise, *coap-rd* uses the default
+libcoap (D)TLS support.
 
 DESCRIPTION
 -----------

man/coap-server.txt.in

@@ -14,6 +14,7 @@ coap-server,
 coap-server-gnutls,
 coap-server-mbedtls,
 coap-server-openssl,
+coap-server-openhitls,
 coap-server-notls
 - CoAP Server based on libcoap
 
@@ -39,8 +40,9 @@ SYNOPSIS
 
 For *coap-server* versions that use libcoap compiled for different
 (D)TLS libraries, *coap-server-notls*, *coap-server-gnutls*,
-*coap-server-openssl*, *coap-server-mbedtls* or *coap-server-tinydtls* may be
-available.  Otherwise, *coap-server* uses the default libcoap (D)TLS support.
+*coap-server-openssl*, *coap-server-mbedtls*, *coap-server-tinydtls* or
+*coap-server-openhitls* may be available. Otherwise, *coap-server* uses the
+default libcoap (D)TLS support.
 
 DESCRIPTION
 -----------

man/coap_address.txt.in

@@ -73,8 +73,9 @@ const uint8_t *_host_, size_t _host_len_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_async.txt.in

@@ -44,8 +44,9 @@ coap_cache_app_data_free_callback_t _app_cb_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_attribute.txt.in

@@ -31,8 +31,9 @@ coap_str_const_t *_name_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_block.txt.in

@@ -65,8 +65,9 @@ size_t _length_, const uint8_t *_data_, size_t _offset_, size_t _total_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_cache.txt.in

@@ -64,8 +64,9 @@ void *_app_data_, coap_cache_app_data_free_callback_t _app_cb_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_call_home.txt.in

@@ -29,8 +29,9 @@ SYNOPSIS
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_context.txt.in

@@ -89,8 +89,9 @@ uint64_t _rate_limit_ppm_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_deprecated.txt.in

@@ -128,8 +128,9 @@ void *_data_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_encryption.txt.in

@@ -36,8 +36,9 @@ const char *_ca_file_, const char *_ca_dir_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION
@@ -49,7 +50,8 @@ specific underlying TLS implementation type (e.g. https://www.openssl.org[OpenSS
 https://www.gnutls.org[GnuTLS],
 https://www.trustedfirmware.org/projects/mbed-tls/[Mbed TLS],
 https://wolfssl.com[wolfSSL],
-https://github.com/eclipse/tinydtls[TinyDTLS] or noTLS).
+https://github.com/eclipse/tinydtls[TinyDTLS],
+https://gitcode.com/openHiTLS/openhitls[openHiTLS] or noTLS).
 When the libcoap library is linked into an application, it is possible
 that the application needs to dynamically determine whether DTLS or TLS is
 supported, what type of TLS implementation libcoap was compiled with, as well
@@ -67,6 +69,9 @@ version is 1.1.0.
 *NOTE:* If wolfSSL is being used, then the minimum wolfSSL library version is
 5.2.0.
 
+*NOTE:* If openHiTLS is being used, then the minimum openHiTLS library version is
+0.4.0.
+
 *NOTE:* If GnuTLS is going to interoperate with TinyDTLS, then a minimum
 revision of GnuTLS 3.5.5 which supports CCM algorithms is required
 by TinyDTLS as TinyDTLS currently only supports CCM.
@@ -79,8 +84,8 @@ as TinyDTLS currently only supports CCM.
 *NOTE:* For Raw Public Key support, GnuTLS library version must be 3.6.6 or
 later. For Raw Public Key support, wolfSSL library version must be 5.6.4 or
 later. TinyDTLS only supports TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, curve
-secp256r1 and hash SHA-256.  There currently is no OpenSSL or Mbed TLS RPK support
-(respective library limitations).
+secp256r1 and hash SHA-256.  There currently is no OpenSSL, Mbed TLS
+or openHiTLS RPK support (respective library limitations).
 
 Network traffic can be un-encrypted or encrypted with libcoap if there is an
 underlying TLS library.

man/coap_endpoint_client.txt.in

@@ -47,8 +47,9 @@ coap_app_data_free_callback_t _callback_, coap_str_const_t *_ws_host_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_endpoint_server.txt.in

@@ -46,8 +46,9 @@ const char *_groupname_, const char *_ifname_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_handler.txt.in

@@ -49,8 +49,9 @@ uint32_t _dynamic_max_)*;
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_init.txt.in

@@ -26,8 +26,9 @@ SYNOPSIS
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_io.txt.in

@@ -68,8 +68,9 @@ unsigned int *rem_timeout_ms)*;
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_keepalive.txt.in

@@ -24,8 +24,9 @@ unsigned int _seconds_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_locking.txt.in

@@ -61,8 +61,9 @@ coap_func_t _callback_function__, coap_code_t _failed_statement_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_logging.txt.in

@@ -103,8 +103,9 @@ char *_buffer_, size_t _length_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_observe.txt.in

@@ -35,8 +35,9 @@ coap_pdu_type_t _message_type_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_oscore.txt.in

@@ -70,8 +70,9 @@ coap_oscore_conf_t *_oscore_conf_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_pdu_access.txt.in

@@ -77,8 +77,9 @@ coap_opt_iterator_t *_oi_, const coap_opt_filter_t *_filter_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_pdu_options.txt.in

@@ -70,8 +70,9 @@ uint8_t *_buffer_, size_t *_buflen_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_pdu_setup.txt.in

@@ -60,8 +60,9 @@ const uint8_t *_data_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_pdu_transmit.txt.in

@@ -33,8 +33,9 @@ coap_pdu_t **_response_pdu_, uint32_t _timeout_ms_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_persist.txt.in

@@ -46,8 +46,9 @@ uint32_t _start_observe_no_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_proxy.txt.in

@@ -47,8 +47,9 @@ coap_proxy_response_handler_t _handler_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_recovery.txt.in

@@ -100,8 +100,9 @@ uint32_t _value_)*;
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_resource.txt.in

@@ -78,8 +78,9 @@ const coap_string_t *query_filter);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_session.txt.in

@@ -88,8 +88,9 @@ const coap_session_t *_session_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION
@@ -236,6 +237,7 @@ GnuTLS:   gnutls_session_t (implicit *)
 Mbed TLS: mbedtls_ssl_context*
 wolfSSL:  WOLFSSL*
 TinyDTLS: struct dtls_context*
+openHiTLS: HITLS_Ctx*
 ----
 
 The *coap_session_get_tls*() function is used to get the pointer to the TLS

man/coap_string.txt.in

@@ -56,8 +56,9 @@ SYNOPSIS
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_supported.txt.in

@@ -83,8 +83,9 @@ SYNOPSIS
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_threads.txt.in

@@ -35,8 +35,9 @@ uint32_t _thread_count_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

man/coap_tls_library.txt.in

@@ -38,8 +38,9 @@ SYNOPSIS
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION
@@ -49,7 +50,8 @@ specific TLS implementation type (e.g. https://www.openssl.org[OpenSSL],
 https://www.gnutls.org[GnuTLS],
 https://www.trustedfirmware.org/projects/mbed-tls/[Mbed TLS],
 https://wolfssl.com[wolfSSL],
-https://github.com/eclipse/tinydtls[TinyDTLS] or noTLS).
+https://github.com/eclipse/tinydtls[TinyDTLS],
+https://gitcode.com/openHiTLS/openhitls[openHiTLS] or noTLS).
 When the libcoap library is linked into an application, it is possible that
 the application needs to dynamically determine whether DTLS or TLS is
 supported, what type of TLS implementation libcoap was compiled with, as well
@@ -92,6 +94,7 @@ typedef enum coap_tls_library_t {
   COAP_TLS_LIBRARY_GNUTLS,    /* Using GnuTLS library */
   COAP_TLS_LIBRARY_MBEDTLS,   /* Using Mbed TLS library */
   COAP_TLS_LIBRARY_WOLFSSL,   /* Using wolfSSL library */
+  COAP_TLS_LIBRARY_OPENHITLS, /* Using openHiTLS library */
 } coap_tls_library_t;
 
 typedef struct coap_tls_version_t {

man/coap_uri.txt.in

@@ -58,8 +58,9 @@ int _create_port_host_opt_, uint8_t *_buf_, size_t _buflen_);*
 For specific (D)TLS library support, link with
 *-lcoap-@LIBCOAP_API_VERSION@-notls*, *-lcoap-@LIBCOAP_API_VERSION@-gnutls*,
 *-lcoap-@LIBCOAP_API_VERSION@-openssl*, *-lcoap-@LIBCOAP_API_VERSION@-mbedtls*,
-*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*
-or *-lcoap-@LIBCOAP_API_VERSION@-tinydtls*.   Otherwise, link with
+*-lcoap-@LIBCOAP_API_VERSION@-wolfssl*,
+*-lcoap-@LIBCOAP_API_VERSION@-tinydtls*
+or *-lcoap-@LIBCOAP_API_VERSION@-openhitls*. Otherwise, link with
 *-lcoap-@LIBCOAP_API_VERSION@* to get the default (D)TLS library support.
 
 DESCRIPTION

src/coap_debug.c

@@ -1294,6 +1294,16 @@ coap_string_tls_version(char *buffer, size_t bufsize) {
              (unsigned long)((tls_version->built_version >> 12) & 0xfff),
              (unsigned long)((tls_version->built_version >> 0) & 0xfff));
     break;
+  case COAP_TLS_LIBRARY_OPENHITLS:
+    snprintf(buffer, bufsize, "TLS Library: openHiTLS - runtime %lu.%lu.%lu, "
+             "libcoap built for %lu.%lu.%lu",
+             (unsigned long)((tls_version->version >> 28) & 0x0f),
+             (unsigned long)((tls_version->version >> 20) & 0xff),
+             (unsigned long)((tls_version->version >> 16) & 0x0f),
+             (unsigned long)((tls_version->built_version >> 28) & 0x0f),
+             (unsigned long)((tls_version->built_version >> 20) & 0xff),
+             (unsigned long)((tls_version->built_version >> 16) & 0x0f));
+    break;
   default:
     snprintf(buffer, bufsize, "Library type %d unknown", tls_version->type);
     break;

src/coap_notls.c

@@ -30,7 +30,7 @@ coap_tls_engine_remove(void) {
 }
 #endif /* ! COAP_WITH_LIBOPENSSL */
 
-#if ! COAP_WITH_LIBTINYDTLS && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBWOLFSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS
+#if ! COAP_WITH_LIBTINYDTLS && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBWOLFSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS && ! COAP_WITH_LIBOPENHITLS
 
 int
 coap_dtls_is_supported(void) {
@@ -96,7 +96,7 @@ coap_dtls_set_cid_tuple_change(coap_context_t *c_context, uint8_t every) {
 }
 #endif /* COAP_CLIENT_SUPPORT */
 
-#if ! COAP_WITH_LIBMBEDTLS_OSCORE
+#if ! COAP_WITH_LIBMBEDTLS_OSCORE && ! COAP_WITH_LIBOPENHITLS_OSCORE
 coap_tls_version_t *
 coap_get_tls_library_version(void) {
   static coap_tls_version_t version;
@@ -250,7 +250,7 @@ coap_digest_final(coap_digest_ctx_t *digest_ctx,
 }
 #endif /* COAP_SERVER_SUPPORT */
 
-#endif /* ! COAP_WITH_LIBMBEDTLS_OSCORE */
+#endif /* ! COAP_WITH_LIBMBEDTLS_OSCORE && ! COAP_WITH_LIBOPENHITLS_OSCORE */
 
 /* (D)TLS specific functions */
 

src/coap_oscore.c

@@ -3042,21 +3042,12 @@ coap_oscore_register_external_handlers(coap_context_t                       *con
 }
 
 COAP_API int
-coap_oscore_recipient_set_last_seq(coap_oscore_conf_t *oscore_conf,
-                                   const coap_bin_const_t *recipient_id,
-                                   uint64_t last_seq) {
+coap_oscore_recipient_set_latest_seq(coap_oscore_conf_t *oscore_conf,
+                                     const coap_bin_const_t *recipient_id,
+                                     uint64_t last_seq, uint64_t seq_window) {
   (void)oscore_conf;
   (void)recipient_id;
   (void)last_seq;
-  return 0;
-}
-
-COAP_API int
-coap_oscore_recipient_set_seq_window(coap_oscore_conf_t *oscore_conf,
-                                     const coap_bin_const_t *recipient_id,
-                                     uint64_t seq_window) {
-  (void)oscore_conf;
-  (void)recipient_id;
   (void)seq_window;
   return 0;
 }

src/coap_sha1.c

@@ -70,7 +70,7 @@
 
 #include "coap3/coap_libcoap_build.h"
 
-#if COAP_WS_SUPPORT && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS  && ! COAP_WITH_LIBMBEDTLS_OSCORE && ! COAP_WITH_LIBWOLFSSL
+#if COAP_WS_SUPPORT && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS && ! COAP_WITH_LIBMBEDTLS_OSCORE && ! COAP_WITH_LIBOPENHITLS && ! COAP_WITH_LIBOPENHITLS_OSCORE && ! COAP_WITH_LIBWOLFSSL
 /*
  *  Define the SHA1 circular left shift macro
  */
@@ -396,4 +396,4 @@ SHA1PadMessage(SHA1Context *context) {
 
   SHA1ProcessMessageBlock(context);
 }
-#endif /* COAP_WS_SUPPORT && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS && ! COAP_WITH_LIBMBEDTLS_OSCORE */
+#endif /* COAP_WS_SUPPORT && ! COAP_WITH_LIBOPENSSL && ! COAP_WITH_LIBGNUTLS && ! COAP_WITH_LIBMBEDTLS && ! COAP_WITH_LIBMBEDTLS_OSCORE && ! COAP_WITH_LIBOPENHITLS && ! COAP_WITH_LIBOPENHITLS_OSCORE && ! COAP_WITH_LIBWOLFSSL */