Add Mbed TLS 4.x support

.github/workflows/test.yaml

@@ -79,7 +79,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        tls_backend: [openssl, mbedtls, wolfssl]
+        tls_backend: [openssl, mbedtls, mbedtls4, wolfssl]
     name: ubuntu (${{ matrix.tls_backend }})
     steps:
       - name: checkout
@@ -91,9 +91,36 @@ jobs:
       - name: install OpenSSL
         if: matrix.tls_backend == 'openssl'
         run: sudo apt-get install -y libssl-dev
-      - name: install Mbed TLS
+      - name: install Mbed TLS 3.x
         if: matrix.tls_backend == 'mbedtls'
         run: sudo apt-get install -y libmbedtls-dev
+      - name: cache Mbed TLS 4.x prefix
+        if: matrix.tls_backend == 'mbedtls4'
+        id: mbedtls4-cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/mbedtls-4.2.0
+          key: mbedtls-4.2.0-${{ runner.os }}-cmake
+      - name: install Mbed TLS 4.x
+        if: matrix.tls_backend == 'mbedtls4'
+        env:
+          MBEDTLS_VERSION: "4.2.0"
+          MBEDTLS_PREFIX: ${{ runner.temp }}/mbedtls-4.2.0
+        run: |
+          set -euo pipefail
+          if [ ! -f "${MBEDTLS_PREFIX}/lib/libmbedtls.so" ] && [ ! -f "${MBEDTLS_PREFIX}/lib/libmbedtls.a" ]; then
+            curl -fsSL -o mbedtls.tar.bz2 \
+              "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2"
+            tar -xjf mbedtls.tar.bz2
+            cmake -S "mbedtls-${MBEDTLS_VERSION}" -B mbedtls-build \
+              -DCMAKE_BUILD_TYPE=Release \
+              -DCMAKE_INSTALL_PREFIX="${MBEDTLS_PREFIX}" \
+              -DENABLE_TESTING=OFF \
+              -DENABLE_PROGRAMS=OFF
+            cmake --build mbedtls-build -j"$(nproc)"
+            cmake --install mbedtls-build
+          fi
+          echo "MBEDTLS_DIR=${MBEDTLS_PREFIX}" >> "$GITHUB_ENV"
       - name: install wolfSSL
         if: matrix.tls_backend == 'wolfssl'
         run: sudo apt-get install -y libwolfssl-dev
@@ -103,7 +130,7 @@ jobs:
         env:
           LSAN_OPTIONS: suppressions=lsan_suppressions.txt
       - name: build and run tests (Mbed TLS)
-        if: matrix.tls_backend == 'mbedtls'
+        if: matrix.tls_backend == 'mbedtls' || matrix.tls_backend == 'mbedtls4'
         # Run mbedTLS shards with reduced parallelism — under ASAN+mbedTLS the
         # default 4 shards overload CI runners enough that timing-sensitive
         # ServerTest cases flake on first-request keep-alive reuse.
@@ -365,14 +392,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        tls_backend: [openssl, mbedtls, wolfssl]
+        tls_backend: [openssl, mbedtls, mbedtls4, wolfssl]
     name: macos (${{ matrix.tls_backend }})
     steps:
       - name: checkout
         uses: actions/checkout@v4
-      - name: install Mbed TLS
+      - name: install Mbed TLS 3.x
         if: matrix.tls_backend == 'mbedtls'
         run: brew install mbedtls@3
+      - name: install Mbed TLS 4.x
+        if: matrix.tls_backend == 'mbedtls4'
+        run: brew install mbedtls
       - name: install wolfSSL
         if: matrix.tls_backend == 'wolfssl'
         run: brew install wolfssl
@@ -382,11 +412,15 @@ jobs:
         env:
           LSAN_OPTIONS: suppressions=lsan_suppressions.txt
       - name: build and run tests (Mbed TLS)
-        if: matrix.tls_backend == 'mbedtls'
+        if: matrix.tls_backend == 'mbedtls' || matrix.tls_backend == 'mbedtls4'
         # macOS runners under ASAN+mbedTLS still flake at SHARDS=2 (rapid
         # bind/connect on the fixture's fixed port races on the slower
         # macos-latest runner). Serialize fully here; ubuntu stays at 2.
-        run: cd test && make test_split_mbedtls && SHARDS=1 make test_mbedtls_parallel
+        run: |
+          if [ "${{ matrix.tls_backend }}" = "mbedtls4" ]; then
+            export MBEDTLS_DIR="$(brew --prefix mbedtls)"
+          fi
+          cd test && make test_split_mbedtls && SHARDS=1 make test_mbedtls_parallel
       - name: build and run tests (wolfSSL)
         if: matrix.tls_backend == 'wolfssl'
         run: cd test && make test_split_wolfssl && make test_wolfssl_parallel

.github/workflows/test_proxy.yaml

@@ -8,7 +8,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     strategy:
       matrix:
-        tls_backend: [openssl, mbedtls]
+        tls_backend: [openssl, mbedtls, mbedtls4]
     name: proxy (${{ matrix.tls_backend }})
 
     steps:
@@ -21,17 +21,44 @@ jobs:
     - name: Install OpenSSL
       if: matrix.tls_backend == 'openssl'
       run: sudo apt-get install -y libssl-dev
-    - name: Install Mbed TLS
+    - name: Install Mbed TLS 3.x
       if: matrix.tls_backend == 'mbedtls'
       run: sudo apt-get install -y libmbedtls-dev
+    - name: Cache Mbed TLS 4.x prefix
+      if: matrix.tls_backend == 'mbedtls4'
+      id: mbedtls4-cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ runner.temp }}/mbedtls-4.2.0
+        key: mbedtls-4.2.0-${{ runner.os }}-cmake
+    - name: Install Mbed TLS 4.x
+      if: matrix.tls_backend == 'mbedtls4'
+      env:
+        MBEDTLS_VERSION: "4.2.0"
+        MBEDTLS_PREFIX: ${{ runner.temp }}/mbedtls-4.2.0
+      run: |
+        set -euo pipefail
+        if [ ! -f "${MBEDTLS_PREFIX}/lib/libmbedtls.so" ] && [ ! -f "${MBEDTLS_PREFIX}/lib/libmbedtls.a" ]; then
+          curl -fsSL -o mbedtls.tar.bz2 \
+            "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2"
+          tar -xjf mbedtls.tar.bz2
+          cmake -S "mbedtls-${MBEDTLS_VERSION}" -B mbedtls-build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_INSTALL_PREFIX="${MBEDTLS_PREFIX}" \
+            -DENABLE_TESTING=OFF \
+            -DENABLE_PROGRAMS=OFF
+          cmake --build mbedtls-build -j"$(nproc)"
+          cmake --install mbedtls-build
+        fi
+        echo "MBEDTLS_DIR=${MBEDTLS_PREFIX}" >> "$GITHUB_ENV"
 
     - name: Run proxy tests (OpenSSL)
       if: matrix.tls_backend == 'openssl'
       run: cd test && make proxy
       env:
         COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
     - name: Run proxy tests (Mbed TLS)
-      if: matrix.tls_backend == 'mbedtls'
+      if: matrix.tls_backend == 'mbedtls' || matrix.tls_backend == 'mbedtls4'
       run: cd test && make proxy_mbedtls
       env:
-        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
+        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml

CMakeLists.txt

@@ -216,6 +216,20 @@ elseif(HTTPLIB_USE_MBEDTLS_IF_AVAILABLE)
 	set(HTTPLIB_IS_USING_MBEDTLS ${MbedTLS_FOUND})
 endif()
 
+# Mbed TLS 4.x renamed MbedTLS::mbedcrypto -> MbedTLS::tfpsacrypto
+set(_HTTPLIB_MBEDTLS_LIBS "")
+if(HTTPLIB_IS_USING_MBEDTLS)
+	list(APPEND _HTTPLIB_MBEDTLS_LIBS MbedTLS::mbedtls)
+	if(TARGET MbedTLS::mbedx509)
+		list(APPEND _HTTPLIB_MBEDTLS_LIBS MbedTLS::mbedx509)
+	endif()
+	if(TARGET MbedTLS::tfpsacrypto)
+		list(APPEND _HTTPLIB_MBEDTLS_LIBS MbedTLS::tfpsacrypto)
+	elseif(TARGET MbedTLS::mbedcrypto)
+		list(APPEND _HTTPLIB_MBEDTLS_LIBS MbedTLS::mbedcrypto)
+	endif()
+endif()
+
 if(HTTPLIB_REQUIRE_ZLIB)
 	find_package(ZLIB REQUIRED)
 	set(HTTPLIB_IS_USING_ZLIB TRUE)
@@ -377,7 +391,7 @@ target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::SSL>
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::Crypto>
 		$<$<BOOL:${HTTPLIB_IS_USING_WOLFSSL}>:wolfssl::wolfssl>
-		$<$<BOOL:${HTTPLIB_IS_USING_MBEDTLS}>:MbedTLS::mbedtls>
+		${_HTTPLIB_MBEDTLS_LIBS}
 )
 
 # Set the definitions to enable optional features

README.md

@@ -67,7 +67,7 @@ cpp-httplib supports multiple TLS backends through an abstraction layer:
 | Backend | Define | Libraries | Notes |
 | :------ | :----- | :-------- | :---- |
 | OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` | [3.0 or later](https://www.openssl.org/policies/releasestrat.html) required |
-| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` | 2.x and 3.x supported (auto-detected) |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` (2.x/3.x) or `libtfpsacrypto` (4.x) | 2.x, 3.x, and 4.x supported (auto-detected) |
 | wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` | 5.x supported; must build with `--enable-opensslall` |
 
 > [!NOTE]

docs-src/pages/en/tour/05-tls-setup.md

@@ -76,7 +76,7 @@ cpp-httplib also supports Mbed TLS and wolfSSL in addition to OpenSSL. You can s
 | Backend | Macro | Libraries to link |
 | :--- | :--- | :--- |
 | OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
-| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` (2.x/3.x) or `libtfpsacrypto` (4.x) |
 | wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
 
 This tour assumes OpenSSL, but the API is the same regardless of which backend you choose.

docs-src/pages/ja/tour/05-tls-setup.md

@@ -76,7 +76,7 @@ cpp-httplibはOpenSSL以外にも、Mbed TLSとwolfSSLに対応しています
 | バックエンド | マクロ定義 | リンクするライブラリ |
 | :--- | :--- | :--- |
 | OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
-| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto`（2.x/3.x）または `libtfpsacrypto`（4.x） |
 | wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
 
 このTourではOpenSSLを前提に進めますが、APIはどのバックエンドでも共通です。