openHiTLS 从源码到命令行工具构建(官方版)

openHiTLS 从源码到命令行工具构建（官方版）

一、环境信息

操作系统

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# cat /etc/os-release

PRETTY_NAME="Kali GNU/Linux Rolling"

NAME="Kali GNU/Linux"

VERSION_ID="2026.3"

VERSION="2026.3"

VERSION_CODENAME=kali-rolling

ID=kali

ID_LIKE=debian

HOME_URL="https://www.kali.org/"

SUPPORT_URL="https://forums.kali.org/"

BUG_REPORT_URL="https://bugs.kali.org/"

ANSI_COLOR="1;31"

┌──(root㉿kali)-[/home/kali/M]

└─# uname -a

Linux kali 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux

工作目录

所有操作在 /home/kali/M 下进行。

工具链

以下为每个工具的完整检测命令与输出。本环境所有工具已预装。

1.3.1 GCC 编译器

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which gcc

/usr/bin/gcc

┌──(root㉿kali)-[/home/kali/M]

└─# gcc --version

gcc (Debian 15.3.0-2) 15.3.0

This is free software; see the source for copying conditions. There is NO

warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

┌──(root㉿kali)-[/home/kali/M]

└─# gcc -dumpmachine

x86_64-linux-gnu

编译器架构 x86_64-linux-gnu，后续 configure.py --bits 64 --asm_type x8664 与此对应。

1.3.2 CMake 构建系统

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which cmake

/usr/bin/cmake

┌──(root㉿kali)-[/home/kali/M]

└─# cmake --version

cmake version 4.3.4

CMake suite maintained and supported by Kitware (kitware.com/cmake).

1.3.3 Python 3

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which python3

/usr/bin/python3

┌──(root㉿kali)-[/home/kali/M]

└─# python3 --version

Python 3.13.14

configure.py 使用 python3 解释器，Python 3.6+ 即可。

1.3.4 Git

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which git

/usr/bin/git

┌──(root㉿kali)-[/home/kali/M]

└─# git --version

git version 2.53.0

1.3.5 GNU Make

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which make

/usr/bin/make

┌──(root㉿kali)-[/home/kali/M]

└─# make --version

GNU Make 4.4.1

为 x86_64-pc-linux-gnu 编译

License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

1.3.6 tcpdump

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# which tcpdump

/usr/bin/tcpdump

┌──(root㉿kali)-[/home/kali/M]

└─# tcpdump --version

tcpdump version 4.99.6

libpcap version 1.10.6 (64-bit time_t, with TPACKET_V3)

OpenSSL 3.6.3 9 Jun 2026

64-bit build, 64-bit time_t

1.3.7 一键安装（本环境无需执行）

如果上述任一工具缺失，执行：

...bash

sudo apt-get update && sudo apt-get install -y cmake gcc make python3 git tcpdump

预期输出：

...Code

┌──(root㉿kali)-[/home/kali/M]

└─# sudo apt-get update && sudo apt-get install -y cmake gcc make python3 git tcpdump

命中:1 https://mirrors.sjtug.sjtu.edu.cn/kali kali-rolling InRelease

命中:2 https://dl.google.com/linux/chrome-stable/deb stable InRelease

正在读取软件包列表... 完成

正在分析软件包的依赖关系树... 完成

正在读取状态信息... 完成

cmake 已经是最新版 (4.3.4-1)。

gcc 已经是最新版 (4:15.2.0-5)。

make 已经是最新版 (4.4.1-3)。

python3 已经是最新版 (3.13.9-3+b1)。

git 已经是最新版 (1:2.53.0-1)。

tcpdump 已经是最新版 (4.99.6-2)。

正在解析依赖... 完成

升级了 0 个软件包，新安装了 0 个软件包，要卸载 0 个软件包，有 0 个软件包未被升级。

终端规划

终端	用途	运行方式
终端1	服务端 s_server	前台阻塞，监听连接
终端2	客户端 s_client	连接后发送测试数据，打印结果后退出
终端3	tcpdump 抓包	前台阻塞，测试完成后 Ctrl+C 终止（自动化脚本中以后台 & 方式运行）

每个新终端必须先执行:

...bash

export LD_LIBRARY_PATH=/home/kali/M/openhitls/build:$LD_LIBRARY_PATH

二、获取源码与证书体系

克隆仓库

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# cd /home/kali/M

┌──(root㉿kali)-[/home/kali/M]

└─# git clone -b openhitls-0.3 https://gitcode.com/openHiTLS/openhitls

正克隆到 'openhitls'...

警告：重定向到 https://gitcode.com/openHiTLS/openhitls.git/

remote: Enumerating objects: 42727, done.

remote: Counting objects: 100% (8774/8774), done.

remote: Compressing objects: 100% (1418/1418), done.

remote: Total 42727 (delta 7945), reused 7485 (delta 7342), pack-reused 33953 (from 1)

接收对象中: 100% (42727/42727), 62.19 MiB | 10.33 MiB/s, 完成.

处理 delta 中: 100% (28358/28358), 完成.

确认分支与 HEAD

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# git checkout openhitls-0.3

已经位于 'openhitls-0.3'

您的分支与上游分支 'origin/openhitls-0.3' 一致。

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# git log --oneline -3

064ed65c (HEAD -> openhitls-0.3, origin/openhitls-0.3) fix(codecskey): preserve input buffer during PEM key decoding

e6ff6293 (tag: openhitls-0.3.4-alpha1) feat:Rename slhdsa algorithm internal interface

feda3bc5 update version to openHiTLS 0.3.4 release

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# git branch -vv

* openhitls-0.3 064ed65c [origin/openhitls-0.3] fix(codecskey): preserve input buffer during PEM key decoding

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# git describe --tags --always

openhitls-0.3.4-alpha1-1-g064ed65c

源码关键目录结构

...Code

/home/kali/M/openhitls/

├── apps/src/ # 命令行工具源码 (4 个 .c 文件)

│ ├── app_server.c # 服务端主程序

│ │ L119-159: g_serverOptions[] 参数定义表（-noverify at L133）

│ │ L241-244: HandleServerNoVerify() 设置 verifyClient=false

│ │ L299-319: g_serverOptHandleFuncMap[] 参数→处理函数映射

│ ├── app_client.c # 客户端主程序

│ ├── app_tls_common.c # 公共配置模块

│ │ L408-498: ConfCertVerification() 证书验证配置

│ │ L470: HITLS_CFG_SetVerifyNoneSupport() 无验证模式开关

│ │ L475: HITLS_CFG_SetClientVerifySupport() 客户端证书需求开关

│ │ L480-486: 条件禁止空证书 (if verifyPeer)

│ └── hitls.c # 命令行入口 (main 函数)

├── include/tls/hitls_error.h # 完整错误码枚举

│ L165: HITLS_MSG_HANDLE_NO_PEER_CERTIFIACATE (0x2040017)

│ ↑ 注意：此常量名中 "CERTIFIACATE" 系源码拼写错误（应为 CERTIFICATE），文档保留原始拼写

│ L340: HITLS_CERT_ERR_ENCODE (0x20c0029)

├── tls/

│ ├── handshake/send/src/send_server_key_exchange.c

│ │ L291-302: #ifdef HITLS_TLS_FEATURE_CERT_MODE_CLIENT_VERIFY

│ │ 常规 TLS CertificateRequest 判断（-noverify 可绕过）

│ │ L305-310: #ifdef HITLS_TLS_PROTO_TLCP11

│ │ TLCP ECDHE 强制 CertificateRequest（-noverify 无法绕过）

│ │ L311: 默认路径 → ServerHelloDone

│ ├── handshake/parse/src/parse_server_key_exchange.c

│ │ L494-498: SAL_CERT_ClntGmEncodeEncCert() 调用 + 失败 → 0x20c0029

│ ├── handshake/recv/src/recv_certificate.c

│ │ L340-354: 空证书处理 → 0x2040017

│ └── cert/cert_adapt/cert.c

│ L677-710: EncodeEncCert() 静态函数

│ L679: cert==NULL → return NULL ← 单向失败的物理根因

│ L734-736: SAL_CERT_ClntGmEncodeEncCert() 公开接口

├── testcode/testdata/tls/certificate/der/sm2_with_userid/

├── testcode/testdata/tls/certificate/der/sm2_cert/ # 备用证书（纯PKCS #8私钥）

├── platform/Secure_C/ # securec 安全 C 库（39 个源文件）

├── configure.py # 构建配置入口 Python 脚本

├── CMakeLists.txt

└── build/ # 编译输出目录

证书文件详解（sm2_with_userid）

TLCP 使用 SM2 双证书体系（签名证书 + 加密证书），对应 GM/T 0024 国密 TLS 规范。

...bash

$ cd /home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_with_userid

$ ls -lh

total 88K

-rw-r--r-- 1 kali kali 843 Jul 4 07:13 ca.crt

-rw-r--r-- 1 kali kali 582 Jul 4 07:13 ca.der

-rw-r--r-- 1 kali kali 241 Jul 4 07:13 ca.key

-rw-r--r-- 1 kali kali 121 Jul 4 07:13 ca.key.der

-rw-r--r-- 1 kali kali 532 Jul 4 07:13 enc.der

-rw-r--r-- 1 kali kali 2.4K Jul 4 07:13 enc.crt

-rw-r--r-- 1 kali kali 316 Jul 4 07:13 enc.key

-rw-r--r-- 1 kali kali 121 Jul 4 07:13 enc.key.der

-rw-r--r-- 1 kali kali 778 Jul 4 07:13 enc22.crt

-rw-r--r-- 1 kali kali 532 Jul 4 07:13 enc22.der

-rw-r--r-- 1 kali kali 316 Jul 4 07:13 enc22.key

-rw-r--r-- 1 kali kali 121 Jul 4 07:13 enc22.key.der

-rw-r--r-- 1 kali kali 794 Jul 4 07:13 inter.crt

-rw-r--r-- 1 kali kali 546 Jul 4 07:13 inter.der

-rw-r--r-- 1 kali kali 533 Jul 4 07:13 sign.der

-rw-r--r-- 1 kali kali 2.4K Jul 4 07:13 sign.crt

-rw-r--r-- 1 kali kali 316 Jul 4 07:13 sign.key

-rw-r--r-- 1 kali kali 121 Jul 4 07:13 sign.key.der

-rw-r--r-- 1 kali kali 782 Jul 4 07:13 sign22.crt

-rw-r--r-- 1 kali kali 535 Jul 4 07:13 sign22.der

-rw-r--r-- 1 kali kali 316 Jul 4 07:13 sign22.key

-rw-r--r-- 1 kali kali 121 Jul 4 07:13 sign22.key.der

文件分类与格式:

文件	大小	实测格式	用途
ca.crt	843B	PEM	CA 根证书
ca.der	582B	纯 DER	CA 根证书 (DER格式)
ca.key	241B	EC PARAMETERS + PRIVATE KEY (PEM)	CA 私钥
ca.key.der	121B	纯 DER	CA 私钥 (DER格式)
inter.crt	794B	PEM	中间 CA 证书链
inter.der	546B	纯 DER	中间 CA 证书 (DER格式)
sign.crt	2.4KB	文本转储 + PEM	TLCP 签名证书
sign.key	316B	EC PARAMETERS + PRIVATE KEY (PEM)	TLCP 签名私钥
sign.der	533B	纯 DER	签名证书 (DER)
sign.key.der	121B	纯 DER	签名私钥 (DER)
sign22.crt	782B	文本转储 + PEM	备用签名证书 (v2)
sign22.der	535B	纯 DER	备用签名证书 (DER)
sign22.key	316B	EC PARAMETERS + PRIVATE KEY (PEM)	备用签名私钥
enc.crt	2.4KB	文本转储 + PEM	TLCP 加密证书
enc.key	316B	EC PARAMETERS + PRIVATE KEY (PEM)	TLCP 加密私钥
enc.der	532B	纯 DER	加密证书 (DER)
enc.key.der	121B	纯 DER	加密私钥 (DER)
enc22.crt	778B	文本转储 + PEM	备用加密证书 (v2)
enc22.der	532B	纯 DER	备用加密证书 (DER)
enc22.key	316B	EC PARAMETERS + PRIVATE KEY (PEM)	备用加密私钥

.crt 文件内部结构（以 sign.crt 为例）:

...Code

Certificate: ← OpenSSL x509 -text 人类可读输出

Data:

Version: 3 (0x2)

Signature Algorithm: 1.2.156.10197.1.501 ← SM2 with SM3 OID

Issuer: C=CN, O=openHiTLS, OU=testsign, CN=testca

Subject: C=CN, O=openHiTLS, OU=testsign, CN=testserver

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey ← SM2 公钥

...

-----BEGIN CERTIFICATE----- ← hitls 的 PEM 解析器实际解析此部分

MIICETCCAbegAwIBAgIBAjAMBggqgR...

-----END CERTIFICATE-----

hitls 内置 PEM 解析器（hitls_bsl/pem.c），自动跳过前缀文本并解析 PEM block。

双证书用途区分:

证书	Subject 标识	Key Usage	握手阶段使用
sign.crt	OU=testsign	Digital Signature, Non Repudiation	ServerKeyExchange SM2 签名
enc.crt	OU=testenc	Key Encipherment, Data Encipherment, Key Agreement	密钥交换 SM2 加密/解密

备用证书（sm2_cert）

除 sm2_with_userid 外，源码还提供了另一套证书示例，位于 sm2_cert 目录，使用纯 PKCS #8 格式私钥，可替代前述证书进行测试。

...bash

$ cd /home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_cert

$ ls -1 *.pem

# 以下注释为人工添加，非 ls 命令实际输出:

root.pem # 根 CA 证书

intCa.pem # 中间 CA 证书

server_sign.pem # 服务端签名证书

server_sign.key.pem # 服务端签名私钥 (纯PKCS #8)

server_enc.pem # 服务端加密证书

server_enc.key.pem # 服务端加密私钥 (纯PKCS #8)

client_sign.pem # 客户端签名证书

client_sign.key.pem # 客户端签名私钥 (纯PKCS #8)

client_enc.pem # 客户端加密证书

client_enc.key.pem # 客户端加密私钥 (纯PKCS #8)

文件说明:

文件	Key Usage	用途
root.pem	CA:TRUE, KeyCertSign	根 CA 自签名证书
intCa.pem	CA:TRUE, KeyCertSign	中间 CA 证书
server_sign.pem	Digital Signature	服务端 TLCP 签名证书
server_sign.key.pem	—	服务端签名私钥（PKCS #8）
server_enc.pem	Key Encipherment	服务端 TLCP 加密证书
server_enc.key.pem	—	服务端加密私钥（PKCS #8）
client_sign.pem	Digital Signature	客户端 TLCP 签名证书
client_sign.key.pem	—	客户端签名私钥（PKCS #8）
client_enc.pem	Key Encipherment	客户端 TLCP 加密证书
client_enc.key.pem	—	客户端加密私钥（PKCS #8）

创建证书链文件:

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# cd /home/kali/M/openhitls/testcode/testdata/tls/certificate/der/sm2_cert

┌──(root㉿kali)-[/home/…/tls/certificate/der/sm2_cert]

└─# cat root.pem intCa.pem > chain.pem

证书链验证:

...bash

export LD_LIBRARY_PATH=/home/kali/M/openhitls/build:$LD_LIBRARY_PATH

/home/kali/M/openhitls/build/hitls verify -CAfile chain.pem -nokeyusage server_sign.pem

# 输出: OK

/home/kali/M/openhitls/build/hitls verify -CAfile chain.pem -nokeyusage server_enc.pem

# 输出: OK

私钥格式注意:

...bash

$ head -5 server_sign.key.pem

-----BEGIN PRIVATE KEY-----

MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQg...

sm2_cert 目录的命令行参数对照（与 sm2_with_userid 对比）:

参数	sm2_with_userid	sm2_cert
-CAfile	ca.crt	chain.pem （root+intCa 合并）
-chainCAfile	inter.crt	不需要（已合并到 -CAfile）
-tlcp_sign_cert	sign.crt	server_sign.pem
-tlcp_sign_key	sign.key	server_sign.key.pem
-tlcp_enc_cert	enc.crt	server_enc.pem
-tlcp_enc_key	enc.key	server_enc.key.pem

三、编译构建

克隆并编译安全函数库 Secure_C

（非子模块，需手动克隆到 platform/ 目录）

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# git clone https://gitee.com/openeuler/libboundscheck platform/Secure_C

正克隆到 'platform/Secure_C'...

remote: Enumerating objects: 189, done.

remote: Total 189 (delta 0), reused 0 (delta 0), pack-reused 189 (from 1)

接收对象中: 100% (189/189), 113.63 KiB | 1.42 MiB/s, 完成.

处理 delta 中: 100% (113/113), 完成.

编译 Secure_C 安全库（可选）

注意：configure.py（§3.2）会自动编译 Secure_C 为静态库 libboundscheck.a（39 个 C 源文件）。以下手动编译步骤可选，产物为动态库

libboundscheck.so，两者功能等价。

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# cd /home/kali/M/openhitls/platform/Secure_C

┌──(root㉿kali)-[/home/…/M/openhitls/platform/Secure_C]

└─# make -j$(nproc) 2>&1 | tail -n 10

cc -c src/wcscpy_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wcscpy_s.o

cc -c src/wcsncat_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wcsncat_s.o

cc -c src/wcsncpy_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wcsncpy_s.o

cc -c src/wcstok_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wcstok_s.o

cc -c src/wmemcpy_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wmemcpy_s.o

cc -c src/wmemmove_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wmemmove_s.o

cc -c src/wscanf_s.c -Wall -DNDEBUG -O2 -fPIC -fstack-protector-all -D_FORTIFY_SOURCE=2 -O2 -Wformat=2 -Wfloat-equal -Wshadow -Wconversion -Wformat-security -Wextra --param ssp-buffer-size=4 -Warray-bounds -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Wstrict-overflow=1 -Wstrict-aliasing=2 -Wswitch -Wswitch-default -Iinclude -o obj/wscanf_s.o

mkdir -p lib

cc -shared -o lib/libboundscheck.so obj/fscanf_s.o obj/fwscanf_s.o obj/gets_s.o obj/memcpy_s.o obj/memmove_s.o obj/memset_s.o obj/scanf_s.o obj/securecutil.o obj/secureinput_a.o obj/secureinput_w.o obj/secureprintoutput_a.o obj/secureprintoutput_w.o obj/snprintf_s.o obj/sprintf_s.o obj/sscanf_s.o obj/strcat_s.o obj/strcpy_s.o obj/strncat_s.o obj/strncpy_s.o obj/strtok_s.o obj/swprintf_s.o obj/swscanf_s.o obj/vfscanf_s.o obj/vfwscanf_s.o obj/vscanf_s.o obj/vsnprintf_s.o obj/vsprintf_s.o obj/vsscanf_s.o obj/vswprintf_s.o obj/vswscanf_s.o obj/vwscanf_s.o obj/wcscat_s.o obj/wcscpy_s.o obj/wcsncat_s.o obj/wcsncpy_s.o obj/wcstok_s.o obj/wmemcpy_s.o obj/wmemmove_s.o obj/wscanf_s.o -fPIC -s -Wl,-z,relro,-z,now,-z,noexecstack -fstack-protector-all

finish libboundscheck.so

产物：/home/kali/M/openhitls/platform/Secure_C/lib/libboundscheck.so

实际复现时可直接跳过此手动步骤，configure.py 会自动检测并编译 Secure_C。

配置 openHiTLS 构建

关键：必须显式启用 TLCP 国密协议相关编译宏，HITLS_BUILD_PROFILE=full 不足以启用国密 provider。

HITLS_CRYPTO_PROVIDER_DEFAULT_SM 将 SM2/SM3/SM4 集成到默认 Provider，是 0.3 版本可用性的必要条件。

...bash

┌──(root㉿kali)-[/home/…/M/openhitls/platform/Secure_C]

└─# cd /home/kali/M/openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# mkdir -p build

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# python3 configure.py --system linux --bits 64 --asm_type x8664 --build_dir build --output_dir build --enable all --executes hitls --add_options="-DHITLS_TLS_PROTO_TLCP11 -DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3 -DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3 -DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3 -DHITLS_CRYPTO_PROVIDER_DEFAULT_SM -DHITLS_TLS_SUITE_AUTH_SM2"

======================================================================

Checking securec dependency...

======================================================================

[INFO] Securec library already built, skipping build...

参数说明:

参数	含义
--system linux --bits 64 --asm_type x8664	目标平台 Linux x86-64，SM3/SM4 使用汇编优化
--build_dir build --output_dir build	编译输出到 build/
--enable all	启用所有非国密模块（AES, RSA, ECDSA, SHA2 等）
--executes hitls	指定编译 hitls 命令行工具作为可执行目标
--add_options="..."	额外传递 7 个国密宏

生成的 compile_config.json:

...json

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# cd /home/kali/M/openhitls/build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cat compile_config.json

{

"compileFlag": {

"CC_USER_DEFINE_FLAGS": {

"CC_FLAGS_ADD": [

"-DHITLS_TLS_PROTO_TLCP11",

"-DHITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3",

"-DHITLS_TLS_SUITE_ECC_SM4_CBC_SM3",

"-DHITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3",

"-DHITLS_TLS_SUITE_ECC_SM4_GCM_SM3",

"-DHITLS_CRYPTO_PROVIDER_DEFAULT_SM",

"-DHITLS_TLS_SUITE_AUTH_SM2"

]

}

"linkFlag": {}

}

configure.py 内部执行流程：解析命令行参数 → 编译 securec 依赖库（39 个 C 文件 → libboundscheck.a）→ 生成 feature_config.json（各模块 C/ASM 源文件清单）→ 生成 compile_config.json（编译宏 -D 定义和链接参数）→ 生成 CMake 辅助模块文件。

编译宏详解

#	宏名称	作用	状态
1	HITLS_TLS_PROTO_TLCP11	启用 TLCP v1.1 协议栈（含 DTLCP over UDP）	必须
2	HITLS_TLS_SUITE_ECDHE_SM4_CBC_SM3	注册 ECDHE_SM4_CBC_SM3 密码套件	必须
3	HITLS_TLS_SUITE_ECC_SM4_CBC_SM3	注册 ECC_SM4_CBC_SM3 密码套件	必须
4	HITLS_CRYPTO_PROVIDER_DEFAULT_SM	SM2/SM3/SM4 加载到默认 Provider	必须
5	HITLS_TLS_SUITE_AUTH_SM2	启用 SM2 证书身份认证	必须
6	HITLS_TLS_SUITE_ECDHE_SM4_GCM_SM3	注册 ECDHE_SM4_GCM_SM3 密码套件	已测试
7	HITLS_TLS_SUITE_ECC_SM4_GCM_SM3	注册 ECC_SM4_GCM_SM3 密码套件	已测试

--enable all 仅启用非国密模块。国密 TLCP 需上述 5 个高优先级宏显式启用。GCM 套件（#6、#7）与 CBC 套件共用相同的密钥交换算法（ECDHE/ECC），仅 AEAD 加密模式不同，行为完全一致。

CMake 生成构建文件

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cd /home/kali/M/openhitls/build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cmake .. -DCMAKE_BUILD_TYPE=Debug

-- The C compiler identification is GNU 15.3.0

-- The CXX compiler identification is GNU 15.3.0

-- Detecting C compiler ABI info

-- Detecting C compiler ABI info - done

-- Check for working C compiler: /usr/bin/cc - skipped

-- Detecting C compile features

-- Detecting C compile features - done

-- Detecting CXX compiler ABI info

-- Detecting CXX compiler ABI info - done

-- Check for working CXX compiler: /usr/bin/c++ - skipped

-- Detecting CXX compile features

-- Detecting CXX compile features - done

-- Configuring securec dependency...

-- === Configuring libboundscheck (Secure C) ===

-- Searching for sources in: /home/kali/M/openhitls/platform/Secure_C/src

-- Found 39 securec source files

-- System: Linux

-- Compiler: GNU 15.3.0

-- Securec library configured:

-- Source dir: /home/kali/M/openhitls/platform/Secure_C/src

-- Include dir: /home/kali/M/openhitls/platform/Secure_C/include

-- Output dir: /home/kali/M/openhitls/platform/Secure_C/lib

-- Library type: STATIC

-- Library name: libboundscheck.a (Linux/macOS) / boundscheck.lib (Windows)

-- ========================================

-- The ASM compiler identification is GNU

-- Found assembler: /usr/bin/cc

-- Provider library for apps: libhitls.so

-- Configuring done (1.1s)

-- Generating done (0.5s)

-- Build files have been written to: /home/kali/M/openhitls/build

Make 编译

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cd /home/kali/M/openhitls/build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# make -j$(nproc) hitls 2>&1 | tail -n 10

[ 98%] Building C object CMakeFiles/handshake-objs.dir/tls/handshake/send/src/send_server_hello.c.o

[ 98%] Building C object CMakeFiles/handshake-objs.dir/tls/handshake/send/src/send_server_hello_done.c.o

[100%] Building C object CMakeFiles/handshake-objs.dir/tls/handshake/send/src/send_server_key_exchange.c.o

[100%] Building C object CMakeFiles/handshake-objs.dir/tls/handshake/sm/src/hs_init.c.o

[100%] Building C object CMakeFiles/handshake-objs.dir/tls/handshake/sm/src/hs_sm.c.o

[100%] Built target handshake-objs

[100%] Linking C shared library libhitls_tls.so

[100%] Built target hitls_tls-shared

[100%] Linking C executable hitls

[100%] Built target hitls

编译耗时约 30~60 秒（8 核）。SM3/SM4 使用 x86-64 汇编优化。

编译产物验证

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# ls -lh /home/kali/M/openhitls/build/hitls

-rwxr-xr-x 1 root root 908K 7月30日 19:36 /home/kali/M/openhitls/build/hitls

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# ls -lh /home/kali/M/openhitls/build/libhitls_*.so

-rwxr-xr-x 1 root root 912K 7月30日 19:36 /home/kali/M/openhitls/build/libhitls_bsl.so

-rwxr-xr-x 1 root root 6.2M 7月30日 19:36 /home/kali/M/openhitls/build/libhitls_crypto.so

-rwxr-xr-x 1 root root 1010K 7月30日 19:36 /home/kali/M/openhitls/build/libhitls_pki.so

-rwxr-xr-x 1 root root 5.7M 7月30日 19:36 /home/kali/M/openhitls/build/libhitls_tls.so

库路径

...bash

export LD_LIBRARY_PATH=/home/kali/M/openhitls/build:$LD_LIBRARY_PATH

每个运行 hitls 的新终端必须先执行此命令。

CMake 构建

main 分支已转向纯 CMake 构建，configure.py 已为空文件，请优先使用纯 CMake 方式。如果你拉取的是旧版本/旧分支（含有效 configure.py），再使用 configure.py 方式。

配置并编译 openHiTLS（纯 CMake 方式 — 推荐）

适用于 main 分支（2026年4月后）。所有模块和特性开关现在直接通过 CMake -D 参数控制，无需 configure.py，也无需 Python。

快速开始

...bash

┌──(root㉿kali)-[/home/kali/M]

└─# cd /home/kali/M

┌──(root㉿kali)-[/home/kali/M]

└─# git clone https://gitcode.com/openhitls/openhitls.git

正克隆到 'openhitls'...

remote: Enumerating objects: 42727, done.

remote: Counting objects: 100% (8774/8774), done.

remote: Compressing objects: 100% (1418/1418), done.

remote: Total 42727 (delta 7943), reused 7485 (delta 7342), pack-reused 33953 (from 1)

接收对象中: 100% (42727/42727), 62.19 MiB | 10.94 MiB/s, 完成.

处理 delta 中: 100% (28356/28356), 完成.

正在更新文件: 100% (3880/3880), 完成.

┌──(root㉿kali)-[/home/kali/M]

└─# cd openhitls

┌──(root㉿kali)-[/home/kali/M/openhitls]

└─# mkdir -p build && cd build

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cmake .. && make 2>&1 | tail -n 10 && make install 2>&1 | tail -n 10

-- The C compiler identification is GNU 15.3.0

-- The CXX compiler identification is GNU 15.3.0

-- Detecting C compiler ABI info

-- Detecting C compiler ABI info - done

-- Check for working C compiler: /usr/bin/cc - skipped

-- Detecting C compile features

-- Detecting C compile features - done

-- Detecting CXX compiler ABI info

-- Detecting CXX compiler ABI info - done

-- Check for working CXX compiler: /usr/bin/c++ - skipped

-- Detecting CXX compile features

-- Detecting CXX compile features - done

-- Loading default build profile: full

-- Loading preset: FULL (all features enabled)

-- Looking for sys/types.h

-- Looking for sys/types.h - found

-- Looking for stdint.h

-- Looking for stdint.h - found

-- Looking for stddef.h

-- Looking for stddef.h - found

-- Check size of void*

-- Check size of void* - done

-- ========= Platform information =========

-- Endianness: little

-- Bitness: 64

-- ASM: none

-- ========================================

-- Performing Test _HAS_STACK_CLASH_PROTECTION

-- Performing Test _HAS_STACK_CLASH_PROTECTION - Success

-- Performing Test _HAS_CF_PROTECTION

-- Performing Test _HAS_CF_PROTECTION - Success

-- ====== HiTLS Build Options ======

-- CMAKE_POSITION_INDEPENDENT_CODE : ON

-- HITLS_COMPILE_OPTIONS : -D_FORTIFY_SOURCE=2;-O2;-pipe;-Werror;-Wextra;-Wcast-qual;-Wall;-Wfloat-equal;-Wshadow;-Wformat=2;-fsigned-char;-fno-common;-fno-strict-aliasing;-fno-omit-frame-pointer;-fstack-protector-strong;-Wdate-time;--param=ssp-buffer-size=4;-fstack-clash-protection;-fcf-protection=full

-- HITLS_SHARED_LINKER_FLAGS : -Wl,--no-undefined;-Wl,-z,noexecstack;-Wl,-z,relro;-Wl,-z,now;-Wl,--build-id=none

-- HITLS_EXE_LINKER_FLAGS : -pie;-Wl,-z,noexecstack;-Wl,-z,relro;-Wl,-z,now;-Wl,--build-id=none

-- CMAKE_C_FLAGS :

-- CMAKE_ASM_FLAGS :

-- CMAKE_SHARED_LINKER_FLAGS :

-- CMAKE_EXE_LINKER_FLAGS :

-- =================================

-- === Propagating Features to Children ===

-- Auto-enabled HITLS_AUTH_PRIVPASS_TOKEN (child of HITLS_AUTH)

-- Auto-enabled HITLS_AUTH_OTP (child of HITLS_AUTH)

-- Auto-enabled HITLS_AUTH_PAKE (child of HITLS_AUTH)

-- Auto-enabled HITLS_AUTH_PAKE_CORE (child of HITLS_AUTH_PAKE)

-- Auto-enabled HITLS_AUTH_SPAKE2PLUS (child of HITLS_AUTH_PAKE)

-- Auto-enabled HITLS_BSL_SAL (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_DL (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_FILE (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_LOCK (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_MEM (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_NET (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_STR (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_THREAD (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_TIME (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_PID (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_SAL_IP (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_ASN1 (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_BASE64 (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_BUFFER (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_CONF (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_ERR (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_HASH (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_INIT (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_LIST (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_LOG (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_OBJ (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_OBJ_DEFAULT (child of HITLS_BSL_OBJ)

-- Auto-enabled HITLS_BSL_OBJ_CUSTOM (child of HITLS_BSL_OBJ)

-- Auto-enabled HITLS_BSL_PARAMS (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_PEM (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_PRINT (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_TLV (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_UI (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_UIO (child of HITLS_BSL)

-- Auto-enabled HITLS_BSL_UIO_BUFFER (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_FILE (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_MEM (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_PLT (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_SCTP (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_TCP (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_BSL_UIO_UDP (child of HITLS_BSL_UIO)

-- Auto-enabled HITLS_CRYPTO_EAL (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_EALINIT (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_MD (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_MD5 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_SM3 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_SHA1 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_SHA2 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_SHA224 (child of HITLS_CRYPTO_SHA2)

-- Auto-enabled HITLS_CRYPTO_SHA256 (child of HITLS_CRYPTO_SHA2)

-- Auto-enabled HITLS_CRYPTO_SHA384 (child of HITLS_CRYPTO_SHA2)

-- Auto-enabled HITLS_CRYPTO_SHA512 (child of HITLS_CRYPTO_SHA2)

-- Auto-enabled HITLS_CRYPTO_SHA3 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_BLAKE2 (child of HITLS_CRYPTO_MD)

-- Auto-enabled HITLS_CRYPTO_BLAKE2S256 (child of HITLS_CRYPTO_BLAKE2)

-- Auto-enabled HITLS_CRYPTO_MD_MB (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_SHA2_MB (child of HITLS_CRYPTO_MD_MB)

-- Auto-enabled HITLS_CRYPTO_SHA256_MB (child of HITLS_CRYPTO_SHA2_MB)

-- Auto-enabled HITLS_CRYPTO_MAC (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_HMAC (child of HITLS_CRYPTO_MAC)

-- Auto-enabled HITLS_CRYPTO_CMAC (child of HITLS_CRYPTO_MAC)

-- Auto-enabled HITLS_CRYPTO_CMAC_AES (child of HITLS_CRYPTO_CMAC)

-- Auto-enabled HITLS_CRYPTO_CMAC_SM4 (child of HITLS_CRYPTO_CMAC)

-- Auto-enabled HITLS_CRYPTO_GMAC (child of HITLS_CRYPTO_MAC)

-- Auto-enabled HITLS_CRYPTO_SIPHASH (child of HITLS_CRYPTO_MAC)

-- Auto-enabled HITLS_CRYPTO_CBC_MAC (child of HITLS_CRYPTO_MAC)

-- Auto-enabled HITLS_CRYPTO_HPKE (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_KDF (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_PBKDF2 (child of HITLS_CRYPTO_KDF)

-- Auto-enabled HITLS_CRYPTO_HKDF (child of HITLS_CRYPTO_KDF)

-- Auto-enabled HITLS_CRYPTO_KDFTLS12 (child of HITLS_CRYPTO_KDF)

-- Auto-enabled HITLS_CRYPTO_SCRYPT (child of HITLS_CRYPTO_KDF)

-- Auto-enabled HITLS_CRYPTO_DRBG (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_DRBG_HASH (child of HITLS_CRYPTO_DRBG)

-- Auto-enabled HITLS_CRYPTO_DRBG_HMAC (child of HITLS_CRYPTO_DRBG)

-- Auto-enabled HITLS_CRYPTO_DRBG_CTR (child of HITLS_CRYPTO_DRBG)

-- Auto-enabled HITLS_CRYPTO_ENTROPY (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_MODES (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_CTR (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_CBC (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_ECB (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_GCM (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_CCM (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_XTS (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_CFB (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_OFB (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_WRAP (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_CHACHA20POLY1305 (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_HCTR (child of HITLS_CRYPTO_MODES)

-- Auto-enabled HITLS_CRYPTO_CIPHER (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_AES (child of HITLS_CRYPTO_CIPHER)

-- Auto-enabled HITLS_CRYPTO_SM4 (child of HITLS_CRYPTO_CIPHER)

-- Auto-enabled HITLS_CRYPTO_CHACHA20 (child of HITLS_CRYPTO_CIPHER)

-- Auto-enabled HITLS_CRYPTO_PKEY (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_PKEY_CMP (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_RSA_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_DSA_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_DH_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_ECDSA_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_ECDH_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_SM2_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_CURVE25519_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_MLDSA_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_MLKEM_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_SM9_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_FRODOKEM_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_MCELIECE_CMP (child of HITLS_CRYPTO_PKEY_CMP)

-- Auto-enabled HITLS_CRYPTO_RSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_RSA_SIGN (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_VERIFY (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_RECOVER (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_ENCRYPT (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_DECRYPT (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_BLINDING (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_GEN (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_PAD (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_EMSA_PSS (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSA_EMSA_ISO9796_2 (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSA_EMSA_PKCSV15 (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSAES_OAEP (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSAES_PKCSV15 (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSAES_PKCSV15_TLS (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSA_NO_PAD (child of HITLS_CRYPTO_RSA_PAD)

-- Auto-enabled HITLS_CRYPTO_RSA_CHECK (child of HITLS_CRYPTO_RSA)

-- Auto-enabled HITLS_CRYPTO_RSA_BSSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_CURVE25519 (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_X25519 (child of HITLS_CRYPTO_CURVE25519)

-- Auto-enabled HITLS_CRYPTO_ED25519 (child of HITLS_CRYPTO_CURVE25519)

-- Auto-enabled HITLS_CRYPTO_X25519_CHECK (child of HITLS_CRYPTO_CURVE25519)

-- Auto-enabled HITLS_CRYPTO_ED25519_CHECK (child of HITLS_CRYPTO_CURVE25519)

-- Auto-enabled HITLS_CRYPTO_DSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_DSA_CHECK (child of HITLS_CRYPTO_DSA)

-- Auto-enabled HITLS_CRYPTO_DH (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_DH_CHECK (child of HITLS_CRYPTO_DH)

-- Auto-enabled HITLS_CRYPTO_ECC (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_CURVE_NISTP192 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_NISTP224 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_NISTP256 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_NISTP384 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_NISTP521 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_BP256R1 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_BP384R1 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_BP512R1 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_CURVE_SM2 (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_ECC_CHECK (child of HITLS_CRYPTO_ECC)

-- Auto-enabled HITLS_CRYPTO_ECDH (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_ECDH_CHECK (child of HITLS_CRYPTO_ECDH)

-- Auto-enabled HITLS_CRYPTO_ECDSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_ECDSA_CHECK (child of HITLS_CRYPTO_ECDSA)

-- Auto-enabled HITLS_CRYPTO_SM2 (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_SM2_SIGN (child of HITLS_CRYPTO_SM2)

-- Auto-enabled HITLS_CRYPTO_SM2_CRYPT (child of HITLS_CRYPTO_SM2)

-- Auto-enabled HITLS_CRYPTO_SM2_EXCH (child of HITLS_CRYPTO_SM2)

-- Auto-enabled HITLS_CRYPTO_SM2_CHECK (child of HITLS_CRYPTO_SM2)

-- Auto-enabled HITLS_CRYPTO_SM9 (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_SM9_SIGN (child of HITLS_CRYPTO_SM9)

-- Auto-enabled HITLS_CRYPTO_SM9_CRYPT (child of HITLS_CRYPTO_SM9)

-- Auto-enabled HITLS_CRYPTO_SM9_CHECK (child of HITLS_CRYPTO_SM9)

-- Auto-enabled HITLS_CRYPTO_PAILLIER (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_ELGAMAL (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_MLKEM (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_MLKEM_CHECK (child of HITLS_CRYPTO_MLKEM)

-- Auto-enabled HITLS_CRYPTO_FRODOKEM (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_MCELIECE (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_MLDSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_MLDSA_CHECK (child of HITLS_CRYPTO_MLDSA)

-- Auto-enabled HITLS_CRYPTO_COMPOSITE (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_COMPOSITE_CHECK (child of HITLS_CRYPTO_COMPOSITE)

-- Auto-enabled HITLS_CRYPTO_HYBRIDKEM (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_SLH_DSA (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_SLH_DSA_CHECK (child of HITLS_CRYPTO_SLH_DSA)

-- Auto-enabled HITLS_CRYPTO_XMSS (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_XMSS_CHECK (child of HITLS_CRYPTO_XMSS)

-- Auto-enabled HITLS_CRYPTO_XMSSMT (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_XMSSMT_CHECK (child of HITLS_CRYPTO_XMSSMT)

-- Auto-enabled HITLS_CRYPTO_HSS_LMS (child of HITLS_CRYPTO_PKEY)

-- Auto-enabled HITLS_CRYPTO_PROVIDER (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_BN (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_BN_BASIC (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_BN_RAND (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_BN_PRIME (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_BN_RFC_PRIME (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_BN_STR_CONV (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_BN_CB (child of HITLS_CRYPTO_BN)

-- Auto-enabled HITLS_CRYPTO_CODECSKEY (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_KEY_ENCODE (child of HITLS_CRYPTO_CODECSKEY)

-- Auto-enabled HITLS_CRYPTO_KEY_DECODE (child of HITLS_CRYPTO_CODECSKEY)

-- Auto-enabled HITLS_CRYPTO_KEY_EPKI (child of HITLS_CRYPTO_CODECSKEY)

-- Auto-enabled HITLS_CRYPTO_KEY_INFO (child of HITLS_CRYPTO_CODECSKEY)

-- Auto-enabled HITLS_CRYPTO_KEY_DECODE_CHAIN (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_CODECS (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_CRYPTO_GHASH (child of HITLS_CRYPTO)

-- Auto-enabled HITLS_PKI_X509 (child of HITLS_PKI)

-- Auto-enabled HITLS_PKI_X509_CRT (child of HITLS_PKI_X509)

-- Auto-enabled HITLS_PKI_X509_CRT_GEN (child of HITLS_PKI_X509_CRT)

-- Auto-enabled HITLS_PKI_X509_CRT_PARSE (child of HITLS_PKI_X509_CRT)

-- Auto-enabled HITLS_PKI_X509_CRT_AUTH (child of HITLS_PKI_X509_CRT)

-- Auto-enabled HITLS_PKI_X509_CSR (child of HITLS_PKI_X509)

-- Auto-enabled HITLS_PKI_X509_CSR_GEN (child of HITLS_PKI_X509_CSR)

-- Auto-enabled HITLS_PKI_X509_CSR_PARSE (child of HITLS_PKI_X509_CSR)

-- Auto-enabled HITLS_PKI_X509_CSR_ATTR (child of HITLS_PKI_X509_CSR)

-- Auto-enabled HITLS_PKI_X509_CSR_GET (child of HITLS_PKI_X509_CSR)

-- Auto-enabled HITLS_PKI_X509_CRL (child of HITLS_PKI_X509)

-- Auto-enabled HITLS_PKI_X509_CRL_GEN (child of HITLS_PKI_X509_CRL)

-- Auto-enabled HITLS_PKI_X509_CRL_PARSE (child of HITLS_PKI_X509_CRL)

-- Auto-enabled HITLS_PKI_X509_VFY (child of HITLS_PKI_X509)

-- Auto-enabled HITLS_PKI_X509_VFY_DEFAULT (child of HITLS_PKI_X509_VFY)

-- Auto-enabled HITLS_PKI_X509_VFY_CB (child of HITLS_PKI_X509_VFY)

-- Auto-enabled HITLS_PKI_X509_VFY_LOCATION (child of HITLS_PKI_X509_VFY)

-- Auto-enabled HITLS_PKI_X509_VFY_IDENTITY (child of HITLS_PKI_X509_VFY)

-- Auto-enabled HITLS_PKI_CMS (child of HITLS_PKI)

-- Auto-enabled HITLS_PKI_CMS_DATA (child of HITLS_PKI_CMS)

-- Auto-enabled HITLS_PKI_CMS_DIGESTINFO (child of HITLS_PKI_CMS)

-- Auto-enabled HITLS_PKI_CMS_SIGNEDDATA (child of HITLS_PKI_CMS)

-- Auto-enabled HITLS_PKI_CMS_ENCRYPTDATA (child of HITLS_PKI_CMS)

-- Auto-enabled HITLS_PKI_PKCS12 (child of HITLS_PKI)

-- Auto-enabled HITLS_PKI_PKCS12_GEN (child of HITLS_PKI_PKCS12)

-- Auto-enabled HITLS_PKI_PKCS12_PARSE (child of HITLS_PKI_PKCS12)

-- Auto-enabled HITLS_PKI_INFO (child of HITLS_PKI)

-- Auto-enabled HITLS_PKI_INFO_DN_CONF (child of HITLS_PKI_INFO)

-- Auto-enabled HITLS_PKI_INFO_DN_HASH (child of HITLS_PKI_INFO)

-- Auto-enabled HITLS_PKI_INFO_CRT (child of HITLS_PKI_INFO)

-- Auto-enabled HITLS_PKI_INFO_CSR (child of HITLS_PKI_INFO)

-- Auto-enabled HITLS_PKI_INFO_CRL (child of HITLS_PKI_INFO)

-- Auto-enabled HITLS_TLS_PROTO_VERSION (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_PROTO_TLS12 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_PROTO_TLS13 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_PROTO_TLCP11 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_PROTO_DTLCP11 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_PROTO_DTLS12 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_PROTO_DTLS13 (child of HITLS_TLS_PROTO_VERSION)

-- Auto-enabled HITLS_TLS_FEATURE_DTLS_CID (child of HITLS_TLS_PROTO_DTLS13)

-- Auto-enabled HITLS_TLS_HOST (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_HOST_SERVER (child of HITLS_TLS_HOST)

-- Auto-enabled HITLS_TLS_HOST_CLIENT (child of HITLS_TLS_HOST)

-- Auto-enabled HITLS_TLS_CALLBACK (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_FEATURE_PROVIDER (child of HITLS_TLS_CALLBACK)

-- Auto-enabled HITLS_TLS_FEATURE_PROVIDER_HARD_CODING (child of HITLS_TLS_FEATURE_PROVIDER)

-- Auto-enabled HITLS_TLS_FEATURE_PROVIDER_DYNAMIC (child of HITLS_TLS_FEATURE_PROVIDER)

-- Auto-enabled HITLS_TLS_CALLBACK_SAL (child of HITLS_TLS_CALLBACK)

-- Auto-enabled HITLS_TLS_CALLBACK_CERT (child of HITLS_TLS_CALLBACK)

-- Auto-enabled HITLS_TLS_CALLBACK_CRYPT (child of HITLS_TLS_CALLBACK)

-- Auto-enabled HITLS_TLS_FEATURE (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_FEATURE_RENEGOTIATION (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_ALPN (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_SNI (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_PHA (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_PSK (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_SECURITY (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_INDICATOR (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_SESSION (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_SESSION_TICKET (child of HITLS_TLS_FEATURE_SESSION)

-- Auto-enabled HITLS_TLS_FEATURE_SESSION_ID (child of HITLS_TLS_FEATURE_SESSION)

-- Auto-enabled HITLS_TLS_FEATURE_SESSION_CACHE_CB (child of HITLS_TLS_FEATURE_SESSION)

-- Auto-enabled HITLS_TLS_FEATURE_SESSION_CUSTOM_TICKET (child of HITLS_TLS_FEATURE_SESSION)

-- Auto-enabled HITLS_TLS_FEATURE_KEY_UPDATE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_MODE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_MODE_FALL_BACK_SCSV (child of HITLS_TLS_FEATURE_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_MODE_AUTO_RETRY (child of HITLS_TLS_FEATURE_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_MODE_ACCEPT_MOVING_WRITE_BUFFER (child of HITLS_TLS_FEATURE_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_MODE_RELEASE_BUFFERS (child of HITLS_TLS_FEATURE_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_KEM (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_FLIGHT (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CERT_MODE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CERT_MODE_VERIFY_PEER (child of HITLS_TLS_FEATURE_CERT_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_CERT_MODE_CLIENT_VERIFY (child of HITLS_TLS_FEATURE_CERT_MODE)

-- Auto-enabled HITLS_TLS_FEATURE_CLIENT_HELLO_CB (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CERT_CB (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_MAX_SEND_FRAGMENT (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CUSTOM_EXTENSION (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_ANTI_REPLAY (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_EXTENDED_MASTER_SECRET (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_REC_INBUFFER_SIZE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CERTIFICATE_AUTHORITIES (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_SM_TLS13 (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_SUITE_SM4_GCM_SM3 (child of HITLS_TLS_FEATURE_SM_TLS13)

-- Auto-enabled HITLS_TLS_SUITE_SM4_CCM_SM3 (child of HITLS_TLS_FEATURE_SM_TLS13)

-- Auto-enabled HITLS_TLS_FEATURE_MTU_QUERY (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_EXPORT_KEY_MATERIAL (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_RECORD_SIZE_LIMIT (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_DEFAULT_COOKIE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_FEATURE_CUSTOM_REC_TYPE (child of HITLS_TLS_FEATURE)

-- Auto-enabled HITLS_TLS_PROTO (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_PROTO_DFX (child of HITLS_TLS_PROTO)

-- Auto-enabled HITLS_TLS_PROTO_DFX_CHECK (child of HITLS_TLS_PROTO_DFX)

-- Auto-enabled HITLS_TLS_PROTO_DFX_INFO (child of HITLS_TLS_PROTO_DFX)

-- Auto-enabled HITLS_TLS_PROTO_DFX_ALERT_NUMBER (child of HITLS_TLS_PROTO_DFX)

-- Auto-enabled HITLS_TLS_PROTO_DFX_SERVER_PREFER (child of HITLS_TLS_PROTO_DFX)

-- Auto-enabled HITLS_TLS_PROTO_CLOSE_STATE (child of HITLS_TLS_PROTO)

-- Auto-enabled HITLS_TLS_CONFIG (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_CONFIG_MANUAL_DH (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_CERT (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_CERT_LOAD_FILE (child of HITLS_TLS_CONFIG_CERT)

-- Auto-enabled HITLS_TLS_CONFIG_CERT_CALLBACK (child of HITLS_TLS_CONFIG_CERT)

-- Auto-enabled HITLS_TLS_CONFIG_CERT_BUILD_CHAIN (child of HITLS_TLS_CONFIG_CERT)

-- Auto-enabled HITLS_TLS_CONFIG_CERT_VERIFY_LOCATION (child of HITLS_TLS_CONFIG_CERT)

-- Auto-enabled HITLS_TLS_CONFIG_CERT_CRL (child of HITLS_TLS_CONFIG_CERT)

-- Auto-enabled HITLS_TLS_CONFIG_KEY_USAGE (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_STATE (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_RECORD_PADDING (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_USER_DATA (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_CIPHER_SUITE (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONFIG_VERSION (child of HITLS_TLS_CONFIG)

-- Auto-enabled HITLS_TLS_CONNECTION (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_CONNECTION_INFO_NEGOTIATION (child of HITLS_TLS_CONNECTION)

-- Auto-enabled HITLS_TLS_SUITE_CIPHER (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_SUITE_CIPHER_AEAD (child of HITLS_TLS_SUITE_CIPHER)

-- Auto-enabled HITLS_TLS_SUITE_CIPHER_CBC (child of HITLS_TLS_SUITE_CIPHER)

-- Auto-enabled HITLS_TLS_SUITE_KX (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_SUITE_KX_ECDHE (child of HITLS_TLS_SUITE_KX)

-- Auto-enabled HITLS_TLS_SUITE_KX_DHE (child of HITLS_TLS_SUITE_KX)

-- Auto-enabled HITLS_TLS_SUITE_KX_RSA (child of HITLS_TLS_SUITE_KX)

-- Auto-enabled HITLS_TLS_SUITE_AUTH (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_SUITE_AUTH_RSA (child of HITLS_TLS_SUITE_AUTH)

-- Auto-enabled HITLS_TLS_SUITE_AUTH_ECDSA (child of HITLS_TLS_SUITE_AUTH)

-- Auto-enabled HITLS_TLS_SUITE_AUTH_DSS (child of HITLS_TLS_SUITE_AUTH)

-- Auto-enabled HITLS_TLS_SUITE_AUTH_PSK (child of HITLS_TLS_SUITE_AUTH)

-- Auto-enabled HITLS_TLS_SUITE_AUTH_SM2 (child of HITLS_TLS_SUITE_AUTH)

-- Auto-enabled HITLS_TLS_MAINTAIN (child of HITLS_TLS)

-- Auto-enabled HITLS_TLS_MAINTAIN_KEYLOG (child of HITLS_TLS_MAINTAIN)

-- === Children Propagated ===

-- Auto-enabled HITLS_TLS_SUITE (required by HITLS_TLS_SUITE_AES_128_GCM_SHA256)

-- === Resolving Feature Dependencies ===

-- Auto-enabled HITLS_CRYPTO_CURVE_MONT_PRIME (required by HITLS_CRYPTO_CURVE_BP256R1)

-- Auto-enabled HITLS_CRYPTO_CURVE_MONT (required by HITLS_CRYPTO_CURVE_MONT_PRIME)

-- Auto-enabled HITLS_CRYPTO_PKEY_EXCH (required by HITLS_CRYPTO_DH)

-- Auto-enabled HITLS_CRYPTO_PKEY_SIGN (required by HITLS_CRYPTO_DSA)

-- Auto-enabled HITLS_CRYPTO_ECC_CMP (required by HITLS_CRYPTO_ECDH_CMP)

-- Auto-enabled HITLS_CRYPTO_PKEY_KEM (required by HITLS_CRYPTO_FRODOKEM)

-- Auto-enabled HITLS_CRYPTO_PKEY_CRYPT (required by HITLS_CRYPTO_PAILLIER)

-- Auto-enabled HITLS_TLS_PROTO_DATAGRAM (required by HITLS_TLS_PROTO_DTLCP11)

-- Auto-enabled HITLS_TLS_PROTO_DTLS (required by HITLS_TLS_PROTO_DTLS12)

-- Auto-enabled HITLS_TLS_EXTENSION_COOKIE (required by HITLS_TLS_PROTO_DTLS12)

-- Auto-enabled HITLS_TLS_PROTO_TLS13_FAMILY (required by HITLS_TLS_PROTO_DTLS13)

-- Auto-enabled HITLS_TLS_PROTO_TLS (required by HITLS_TLS_PROTO_TLCP11)

-- Auto-enabled HITLS_TLS_PROTO_TLS_BASIC (required by HITLS_TLS_PROTO_TLCP11)

-- Auto-enabled HITLS_TLS_FEATURE_ETM (required by HITLS_TLS_SUITE_CIPHER_CBC)

-- Auto-enabled HITLS_TLS_CALLBACK_CRYPT_HMAC_PRIMITIVES (required by HITLS_TLS_SUITE_CIPHER_CBC)

-- === Dependencies Resolved ===

-- [BSL] Configuring BSL modules

-- [BSL] BSL configuration complete

-- [HiTLS] Created shared library hitls_bsl-shared

-- [HiTLS] Created static library hitls_bsl-static

-- The ASM compiler identification is GNU

-- Found assembler: /usr/bin/cc

-- [Crypto] Configuring Crypto modules

-- [Crypto] Crypto configuration complete

-- [HiTLS] Created shared library hitls_crypto-shared

-- [HiTLS] Created static library hitls_crypto-static

-- [PKI] Configuring PKI modules

-- [PKI] PKI configuration complete

-- [HiTLS] Created shared library hitls_pki-shared

-- [HiTLS] Created static library hitls_pki-static

-- [TLS] Configuring TLS modules

-- [TLS] TLS configuration complete

-- [HiTLS] Created shared library hitls_tls-shared

-- [HiTLS] Created static library hitls_tls-static

-- [AUTH] Configuring AUTH modules

-- [AUTH] AUTH configuration complete

-- [HiTLS] Created shared library hitls_auth-shared

-- [HiTLS] Created static library hitls_auth-static

-- Configuring done (1.9s)

-- Generating done (0.5s)

-- Build files have been written to: /home/kali/M/openhitls/build

[ 99%] Building C object auth/privpass_token/CMakeFiles/_hitls_auth_privpass_token.dir/src/privpass_token_wrapper.c.o

[ 99%] Built target _hitls_auth_privpass_token

[ 99%] Building C object auth/otp/CMakeFiles/_hitls_auth_otp.dir/src/otp.c.o

[ 99%] Building C object auth/otp/CMakeFiles/_hitls_auth_otp.dir/src/otp_util.c.o

[ 99%] Building C object auth/otp/CMakeFiles/_hitls_auth_otp.dir/src/otp_wrapper.c.o

[ 99%] Built target _hitls_auth_otp

[100%] Linking C shared library libhitls_auth.so

[100%] Built target hitls_auth-shared

[100%] Linking C static library libhitls_auth.a

[100%] Built target hitls_auth-static

-- Installing: /usr/local/include/hitls/bsl/bsl_list.h

-- Installing: /usr/local/include/hitls/bsl/bsl_obj.h

-- Installing: /usr/local/include/hitls/bsl/bsl_log.h

-- Installing: /usr/local/include/hitls/bsl/bsl_base64.h

-- Up-to-date: /usr/local/include/hitls/auth

-- Installing: /usr/local/include/hitls/auth/auth_pake.h

-- Installing: /usr/local/include/hitls/auth/auth_errno.h

-- Installing: /usr/local/include/hitls/auth/auth_privpass_token.h

-- Installing: /usr/local/include/hitls/auth/auth_otp.h

-- Installing: /usr/local/include/hitls/auth/auth_params.h

配置（按需选择）

默认构建（启用所有特性，同时生成静态库和共享库）：

...bash

cmake ..

全量构建（使用预设）：

...bash

cmake .. -DHITLS_BUILD_PROFILE=full

手动选择特性：

...bash

cmake .. -DHITLS_BUILD_PROFILE=none -DHITLS_CRYPTO_SHA256=ON

启用汇编优化（自动检测平台类型）：

...bash

cmake .. -DHITLS_ASM=ON

x86_64 汇编优化全量构建：

...bash

cmake .. -DHITLS_BUILD_PROFILE=full -DHITLS_ASM_X8664=ON

构建命令行工具：

...bash

cmake .. -DHITLS_BUILD_EXE=ON

打包为单个库：

...bash

cmake .. -DHITLS_BUNDLE_LIB=ON

执行构建和安装:

...bash

make && make install

构建命令行工具

...bash

┌──(root㉿kali)-[/home/kali/M/openhitls/build]

└─# cmake .. -DHITLS_BUILD_EXE=ON && make 2>&1 | tail -n 10 && make install 2>&1 | tail -n 10

-- Preset already loaded via -C or external configuration, skipping default profile loading