From 143ebbfb7c32d0ba2a85ce58689be980a2cb92e7 Mon Sep 17 00:00:00 2001
From: Abtin Keshavarzian <abtink@google.com>
Date: Thu, 19 Dec 2024 14:43:45 -0800
Subject: [PATCH] [config] add guard checks for features that require DTLS/TLS
 support (#11068)

This commit adds guard checks for Border Agent, Commissioner, Joiner,
and CoAP Secure API features that use Secure Transport (DTLS/TLS) to
ensure `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE` is enabled. It
also moves the deprecation check for the earlier DTLS configuration
to `openthread-core-config-check.h` to be consistent with other
removed/deprecated configurations.
---
 src/core/coap/coap_secure.hpp                  | 4 ++++
 src/core/config/openthread-core-config-check.h | 4 ++++
 src/core/config/secure_transport.h             | 4 ----
 src/core/meshcop/border_agent.hpp              | 4 ++++
 src/core/meshcop/commissioner.hpp              | 4 ++++
 src/core/meshcop/joiner.hpp                    | 4 ++++
 src/core/radio/ble_secure.hpp                  | 4 ++++
 7 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/src/core/coap/coap_secure.hpp b/src/core/coap/coap_secure.hpp
index 11a24d1a8..ba15ee9ae 100644
--- a/src/core/coap/coap_secure.hpp
+++ b/src/core/coap/coap_secure.hpp
@@ -31,6 +31,10 @@
 
 #include "openthread-core-config.h"
 
+#if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE && !OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
+#error "CoAP Secure API feature requires `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE`"
+#endif
+
 #if OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
 
 #include "coap/coap.hpp"
diff --git a/src/core/config/openthread-core-config-check.h b/src/core/config/openthread-core-config-check.h
index c27cb8a54..b339a1722 100644
--- a/src/core/config/openthread-core-config-check.h
+++ b/src/core/config/openthread-core-config-check.h
@@ -694,4 +694,8 @@
 #error "OPENTHREAD_CONFIG_MLE_SEND_LINK_REQUEST_ON_ADV_TIMEOUT is removed, behavior is always applied"
 #endif
 
+#ifdef OPENTHREAD_CONFIG_DTLS_ENABLE
+#error "OPENTHREAD_CONFIG_DTLS_ENABLE was replaced by OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE"
+#endif
+
 #endif // OPENTHREAD_CORE_CONFIG_CHECK_H_
diff --git a/src/core/config/secure_transport.h b/src/core/config/secure_transport.h
index 9d3d77cca..cfb04076d 100644
--- a/src/core/config/secure_transport.h
+++ b/src/core/config/secure_transport.h
@@ -68,10 +68,6 @@
      OPENTHREAD_CONFIG_COMMISSIONER_ENABLE || OPENTHREAD_CONFIG_JOINER_ENABLE || OPENTHREAD_CONFIG_BLE_TCAT_ENABLE)
 #endif
 
-#ifdef OPENTHREAD_CONFIG_DTLS_ENABLE
-#error "OPENTHREAD_CONFIG_DTLS_ENABLE is deprecated please use OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE instead"
-#endif
-
 /**
  * @}
  */
diff --git a/src/core/meshcop/border_agent.hpp b/src/core/meshcop/border_agent.hpp
index 864edde03..a6b5f373e 100644
--- a/src/core/meshcop/border_agent.hpp
+++ b/src/core/meshcop/border_agent.hpp
@@ -56,6 +56,10 @@ namespace ot {
 
 namespace MeshCoP {
 
+#if !OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
+#error "Border Agent feature requires `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE`"
+#endif
+
 class BorderAgent : public InstanceLocator, private NonCopyable
 {
     friend class ot::Notifier;
diff --git a/src/core/meshcop/commissioner.hpp b/src/core/meshcop/commissioner.hpp
index 03f79044b..a70f1ac22 100644
--- a/src/core/meshcop/commissioner.hpp
+++ b/src/core/meshcop/commissioner.hpp
@@ -63,6 +63,10 @@ namespace ot {
 
 namespace MeshCoP {
 
+#if !OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
+#error "Commissioner feature requires `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE`"
+#endif
+
 class Commissioner : public InstanceLocator, private NonCopyable
 {
     friend class Tmf::Agent;
diff --git a/src/core/meshcop/joiner.hpp b/src/core/meshcop/joiner.hpp
index ca6549b8f..5c5f03383 100644
--- a/src/core/meshcop/joiner.hpp
+++ b/src/core/meshcop/joiner.hpp
@@ -59,6 +59,10 @@ namespace ot {
 
 namespace MeshCoP {
 
+#if !OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
+#error "Joiner feature requires `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE`"
+#endif
+
 class Joiner : public InstanceLocator, private NonCopyable
 {
     friend class Tmf::Agent;
diff --git a/src/core/radio/ble_secure.hpp b/src/core/radio/ble_secure.hpp
index 2eec3a393..8ff54d772 100644
--- a/src/core/radio/ble_secure.hpp
+++ b/src/core/radio/ble_secure.hpp
@@ -48,6 +48,10 @@ namespace ot {
 
 namespace Ble {
 
+#if !OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE
+#error "BLE TCAT feature requires `OPENTHREAD_CONFIG_SECURE_TRANSPORT_ENABLE`"
+#endif
+
 class BleSecure : public InstanceLocator, public MeshCoP::Tls::Extension, private NonCopyable
 {
 public: