feat: Add Modbus TCP TLS support

.github/actions/build-openssl3-runtime/action.yml

@@ -50,7 +50,7 @@ runs:
         ./config \
           shared zlib no-apps no-docs no-tests
         make -j$(nproc) build_libs
-        make install_runtime_libs
+        make install_dev install_runtime_libs
 
     - name: Verify OpenSSL runtime libraries
       shell: bash

.github/actions/install-openssl/action.yml

@@ -0,0 +1,19 @@
+name: Install OpenSSL
+description: Install the selected OpenSSL development package and runtime for Windows.
+inputs:
+  version:
+    description: OpenSSL version family, 1.1 or 3.
+    default: '3'
+  architecture:
+    description: Target architecture, x64 or x86.
+    default: x64
+runs:
+  using: composite
+  steps:
+    - name: Install OpenSSL
+      shell: pwsh
+      run: |
+        python -m pip install aqtinstall
+        $root = & ./tools/install_openssl.ps1 -Architecture '${{ inputs.architecture }}' -Version '${{ inputs.version }}'
+        "OPENSSL_ROOT_DIR=$root" >> $env:GITHUB_ENV
+        "$root\bin" >> $env:GITHUB_PATH

.github/actions/install-openssl11/action.yml

@@ -0,0 +1,53 @@
+name: Install OpenSSL 1.1
+description: Install the shared development and TLS libraries used by Qt 5 builds.
+inputs:
+  architecture:
+    description: Windows target architecture, x64 or x86.
+    default: x64
+runs:
+  using: composite
+  steps:
+    - name: Cache Linux OpenSSL
+      if: runner.os == 'Linux'
+      id: linux-cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ runner.temp }}/qt5-openssl
+        key: qt5-openssl-1.1.1w-${{ runner.os }}-${{ runner.arch }}-v1
+
+    - name: Build Linux OpenSSL
+      if: runner.os == 'Linux' && steps.linux-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        source_root=$(python3 tools/fetch_openssl11.py "$RUNNER_TEMP/openssl11-src")
+        bash tools/build_openssl.sh "$source_root" "$RUNNER_TEMP/qt5-openssl" 1.1
+
+    - name: Configure Linux loader and build
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        test -f "$RUNNER_TEMP/qt5-openssl/lib/libssl.so.1.1"
+        echo "OPENSSL_ROOT_DIR=$RUNNER_TEMP/qt5-openssl" >> "$GITHUB_ENV"
+        echo "LD_LIBRARY_PATH=$RUNNER_TEMP/qt5-openssl/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" >> "$GITHUB_ENV"
+
+    - name: Cache Windows OpenSSL
+      if: runner.os == 'Windows'
+      id: windows-cache
+      uses: actions/cache/restore@v4
+      with:
+        path: C:/Qt/Tools/OpenSSL11/Win_${{ inputs.architecture }}
+        key: openssl-1.1.1w-Windows-${{ inputs.architecture }}-v1
+
+    - name: Install Windows OpenSSL
+      if: runner.os == 'Windows'
+      uses: ./.github/actions/install-openssl
+      with:
+        version: '1.1'
+        architecture: ${{ inputs.architecture }}
+
+    - name: Save Windows OpenSSL
+      if: runner.os == 'Windows' && steps.windows-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v4
+      with:
+        path: C:/Qt/Tools/OpenSSL11/Win_${{ inputs.architecture }}
+        key: openssl-1.1.1w-Windows-${{ inputs.architecture }}-v1

.github/workflows/build-appimage-qt6-x86_64.yml

@@ -104,12 +104,16 @@ jobs:
       - name: Set BUILD_DIR
         run: echo "BUILD_DIR=build-omodsim-Qt_${{ env.QT_VERSION }}-Release" >> $GITHUB_ENV
 
+      - name: Resolve latest OpenSSL 3.5 LTS version
+        uses: ./.github/actions/build-openssl3-runtime
+
       - name: Configure project
         run: |
           cmake src -B ${{ env.BUILD_DIR }} \
             -G Ninja \
             -DCMAKE_BUILD_TYPE=Release \
             -DCMAKE_PREFIX_PATH="$QT_ROOT_DIR" \
+            -DOPENSSL_ROOT_DIR=/usr/local \
             -DOMODSIM_BUILD_TESTS=OFF \
             -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }}
 
@@ -127,9 +131,6 @@ jobs:
         with:
           qt-prefix-path: ${{ steps.qt.outputs.qt-root-dir }}
 
-      - name: Resolve latest OpenSSL 3.5 LTS version
-        uses: ./.github/actions/build-openssl3-runtime
-
       - name: Bundle Qt libraries and plugins throught cqtdeployer
         run: |
           CQtDeployer -bin ${{ env.BUILD_DIR }}/omodsim \

.github/workflows/build-deb-qt5-amd64.yml

@@ -75,7 +75,7 @@ jobs:
             libxcb-shape0 libxcb-render-util0 libxcb-icccm4 libxcb-image0 \
             libfontconfig1 libfreetype6 libx11-6 libxext6 libxrender1 \
             zlib1g-dev libpng-dev libjpeg-dev libdbus-1-3 \
-            libssl1.1 \
+            libssl1.1 libssl-dev \
             libwayland-cursor0 libwayland-egl1-mesa \
             libgtk-3-0 libgdk-pixbuf2.0-0 libpangocairo-1.0-0 libpango-1.0-0 libatk1.0-0 libcairo2 libcairo-gobject2 \
             libcups2 \
@@ -146,7 +146,7 @@ jobs:
           CQtDeployer -bin ${{ env.BUILD_DIR }}/omodsim \
             -targetDir ${{ env.DEB_SRC_DIR }}${{ env.APP_INSTALL_PREFIX }}${{ env.VERSION_MAJOR }} \
             -libDir "$QT_ROOT_DIR/lib" \
-            -ignore libcrypto.so.3,libmysqlclient.so.21,libpq.so.5,libssl.so.3,libqsqlmimer.so,libqsqlmysql.so,libqsqlodbc.so,libqsqlpsql.so \
+            -ignore libmysqlclient.so.21,libpq.so.5,libqsqlmimer.so,libqsqlmysql.so,libqsqlodbc.so,libqsqlpsql.so \
             -extraLibs icudata,icui18n,icuuc,libxcb-util,libxcb-cursor
 
       - name: Copy OpenSSL 1 libraries

.github/workflows/build-deb-qt6-amd64.yml

@@ -108,12 +108,16 @@ jobs:
       - name: Set BUILD_DIR
         run: echo "BUILD_DIR=build-omodsim-Qt_${{ env.QT_VERSION }}-Release" >> $GITHUB_ENV
 
+      - name: Resolve latest OpenSSL 3.5 LTS version
+        uses: ./.github/actions/build-openssl3-runtime
+
       - name: Configure project
         run: |
           cmake src -B ${{ env.BUILD_DIR }} \
             -G Ninja \
             -DCMAKE_BUILD_TYPE=Release \
             -DCMAKE_PREFIX_PATH="$QT_ROOT_DIR" \
+            -DOPENSSL_ROOT_DIR=/usr/local \
             -DOMODSIM_BUILD_TESTS=OFF \
             -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }}
 
@@ -141,9 +145,6 @@ jobs:
         with:
           qt-prefix-path: ${{ steps.qt.outputs.qt-root-dir }}
 
-      - name: Resolve latest OpenSSL 3.5 LTS version
-        uses: ./.github/actions/build-openssl3-runtime
-
       - name: Bundle Qt libraries and plugins throught cqtdeployer
         run: |
           CQtDeployer -bin ${{ env.BUILD_DIR }}/omodsim \

.github/workflows/build-dmg-qt6-macos.yml

@@ -50,6 +50,7 @@ jobs:
         run: |
           brew list --versions ninja >/dev/null || brew install ninja
           brew list --versions cmake >/dev/null || brew install cmake
+          brew list --versions openssl@3 >/dev/null || brew install openssl@3
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
@@ -70,6 +71,7 @@ jobs:
             -G "${{ env.CMAKE_GENERATOR }}" \
             -DCMAKE_BUILD_TYPE=${{ env.BUILD_TYPE }} \
             -DCMAKE_PREFIX_PATH=${{ env.QT_ROOT_DIR }} \
+            -DOPENSSL_ROOT_DIR="$(brew --prefix openssl@3)" \
             -DCMAKE_INSTALL_PREFIX=/Applications \
             -DUSE_QT6=ON \
             -DOMODSIM_BUILD_TESTS=OFF \

.github/workflows/build-installer-qt5-win32.yml

@@ -117,9 +117,14 @@ jobs:
           echo VS_PATH=%VS_PATH%>>%GITHUB_ENV%
         shell: cmd
 
+      - name: Install OpenSSL 1.1
+        uses: ./.github/actions/install-openssl11
+        with:
+          architecture: x86
+
       - name: Configure CMake
         run: |
-          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A Win32 -T v142 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
+          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A Win32 -T v142 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DOPENSSL_ROOT_DIR="%OPENSSL_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
         shell: cmd
 
       - name: Build

.github/workflows/build-installer-qt5-win64.yml

@@ -117,9 +117,14 @@ jobs:
           echo VS_PATH=%VS_PATH%>>%GITHUB_ENV%
         shell: cmd
 
+      - name: Install OpenSSL 1.1
+        uses: ./.github/actions/install-openssl11
+        with:
+          architecture: x64
+
       - name: Configure CMake
         run: |
-          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A x64 -T v142 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
+          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A x64 -T v142 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DOPENSSL_ROOT_DIR="%OPENSSL_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
         shell: cmd
 
       - name: Build

.github/workflows/build-installer-qt6-win64.yml

@@ -113,9 +113,14 @@ jobs:
           echo VS_PATH=%VS_PATH%>>%GITHUB_ENV%
         shell: cmd
 
+      - name: Install OpenSSL 3
+        uses: ./.github/actions/install-openssl
+        with:
+          architecture: x64
+
       - name: Configure CMake
         run: |
-          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A x64 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
+          cmake src -B ${{ env.BUILD_DIR }} -G "Visual Studio 17 2022" -A x64 -DCMAKE_PREFIX_PATH="%QT_ROOT_DIR%" -DOPENSSL_ROOT_DIR="%OPENSSL_ROOT_DIR%" -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }} -DOMODSIM_BUILD_TESTS=OFF
         shell: cmd
 
       - name: Build

.github/workflows/build-rpm-qt6-x86_64.yml

@@ -108,12 +108,16 @@ jobs:
       - name: Set BUILD_DIR
         run: echo "BUILD_DIR=build-omodsim-Qt_${{ env.QT_VERSION }}-Release" >> $GITHUB_ENV
 
+      - name: Resolve latest OpenSSL 3.5 LTS version
+        uses: ./.github/actions/build-openssl3-runtime
+
       - name: Configure project
         run: |
           cmake src -B ${{ env.BUILD_DIR }} \
             -G Ninja \
             -DCMAKE_BUILD_TYPE=Release \
             -DCMAKE_PREFIX_PATH="$QT_ROOT_DIR" \
+            -DOPENSSL_ROOT_DIR=/usr/local \
             -DOMODSIM_BUILD_TESTS=OFF \
             -DPRERELEASE_SUFFIX=${{ env.PRERELEASE_SUFFIX }}
 
@@ -141,9 +145,6 @@ jobs:
         with:
           qt-prefix-path: ${{ steps.qt.outputs.qt-root-dir }}
 
-      - name: Resolve latest OpenSSL 3.5 LTS version
-        uses: ./.github/actions/build-openssl3-runtime
-
       - name: Bundle Qt libraries and plugins throught cqtdeployer
         run: |
           CQtDeployer -bin ${{ env.BUILD_DIR }}/omodsim \

.github/workflows/test-ci.yml

@@ -5,12 +5,16 @@ on:
     branches: [dev]
     paths:
       - '.github/workflows/test-ci.yml'
+      - '.github/actions/*openssl*/**'
+      - 'tools/*openssl*'
       - 'src/**'
       - 'tools/coverage.py'
   pull_request:
     branches: [main, dev]
     paths:
       - '.github/workflows/test-ci.yml'
+      - '.github/actions/*openssl*/**'
+      - 'tools/*openssl*'
       - 'src/**'
       - 'tools/coverage.py'
   workflow_dispatch:
@@ -52,6 +56,7 @@ jobs:
     env:
       # Run Qt GUI/Test binaries without a real display.
       QT_QPA_PLATFORM: offscreen
+      OMODSIM_REQUIRE_TLS: '1'
 
     steps:
       - name: Checkout
@@ -63,12 +68,14 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y \
             ninja-build \
-            libgl1-mesa-dev \
+            libgl1-mesa-dev libssl-dev \
             libxkbcommon-x11-0
 
       - name: Install Ninja (macOS)
         if: runner.os == 'macOS'
-        run: brew install ninja
+        run: |
+          brew install ninja openssl@3
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
 
       - name: Set up MSVC environment (Windows)
         if: runner.os == 'Windows'
@@ -81,6 +88,14 @@ jobs:
           modules: ${{ matrix.qt-modules }}
           cache: true
 
+      - name: Install OpenSSL 3 (Windows)
+        if: runner.os == 'Windows' && matrix.qt-version != '5.15.2'
+        uses: ./.github/actions/install-openssl
+
+      - name: Install OpenSSL 1.1 (Qt 5)
+        if: matrix.qt-version == '5.15.2'
+        uses: ./.github/actions/install-openssl11
+
       - name: Configure
         run: >
           cmake -S src -B build -G Ninja
@@ -94,6 +109,28 @@ jobs:
       - name: Run tests
         run: ctest --test-dir build --output-on-failure -R "^omodsim_tests"
 
+      - name: Print Windows test failures
+        if: failure() && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $failedTests = 'build/Testing/Temporary/LastTestsFailed.log'
+          if (Test-Path $failedTests) {
+            foreach ($entry in Get-Content $failedTests) {
+              $testName = ($entry -split ':', 2)[1]
+              $testLog = "build/tests/$testName.testlog.txt"
+              if (Test-Path $testLog) { Get-Content $testLog }
+            }
+          }
+
+      - name: Upload test diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-logs-${{ matrix.os }}-qt${{ matrix.qt-version }}
+          path: |
+            build/Testing/Temporary/
+            build/tests/*.testlog.txt
+
   coverage:
     name: Coverage (${{ matrix.os }}, Qt ${{ matrix.qt-version }})
     runs-on: ${{ matrix.os }}
@@ -108,6 +145,7 @@ jobs:
 
     env:
       QT_QPA_PLATFORM: offscreen
+      OMODSIM_REQUIRE_TLS: '1'
 
     steps:
       - name: Checkout
@@ -118,7 +156,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y \
             ninja-build \
-            libgl1-mesa-dev \
+            libgl1-mesa-dev libssl-dev \
             libxkbcommon-x11-0
           python3 -m pip install --upgrade gcovr
 

README.md

@@ -13,6 +13,8 @@ Open ModSim is a free implimentation of modbus slave (server) utility for modbus
 
 # Features
 
+Modbus TCP over TLS supports encrypted connections and built-in server certificate generation. See [TLS setup](docs/modbus-tls.md).
+
 The following Modbus functions are available:
 
 - Discrete Coils/Flags
@@ -180,6 +182,8 @@ src/
 The core library does not depend on Qt Widgets. Each layer has its own `CMakeLists.txt`.
 
 # Building
+
+Certificate generation requires OpenSSL development libraries (`libcrypto`): version 1.1.1 with Qt 5, or version 3 with Qt 6. The build scripts install this dependency; for manual builds, set `OPENSSL_ROOT_DIR` when CMake cannot locate it.
   Building is available via cmake (with installed Qt version 5.15 and above) or Qt Creator. Supports both OS Microsoft Windows and Linux.
 
 > [!NOTE]

README.md.in

@@ -13,6 +13,8 @@ Open ModSim is a free implimentation of modbus slave (server) utility for modbus
 
 # Features
 
+Modbus TCP over TLS supports encrypted connections and built-in server certificate generation. See [TLS setup](docs/modbus-tls.md).
+
 The following Modbus functions are available:
 
 - Discrete Coils/Flags
@@ -180,6 +182,8 @@ src/
 The core library does not depend on Qt Widgets. Each layer has its own `CMakeLists.txt`.
 
 # Building
+
+Certificate generation requires OpenSSL development libraries (`libcrypto`): version 1.1.1 with Qt 5, or version 3 with Qt 6. The build scripts install this dependency; for manual builds, set `OPENSSL_ROOT_DIR` when CMake cannot locate it.
   Building is available via cmake (with installed Qt version 5.15 and above) or Qt Creator. Supports both OS Microsoft Windows and Linux.
 
 > [!NOTE]