http: Revamp TLS API.

* configure.ac (NEED_GNUTLS_VERSION): New.
(HTTP_USE_GNUTLS, LIBGNUTLS_CFLAGS, LIBGNUTLS_LIBS): New ac_subst.

* common/http.h (http_session_t): New.
* common/http.c: Remove compatibility for gnutls < 3.0.
(http_session_s): New.
(cookie_s): Replace gnutls_session_t by http_session_t.
(tls_callback, tls_ca_certlist): New variables.
(my_socket_unref): Add preclose args.
(my_npth_read, my_npth_write): New.
(make_header_line): Fix bug using int* instead of char*.
(http_register_tls_callback): New.
(http_register_tls_ca): New.
(http_session_new): New.
(http_session_release): New.
(http_get_header_names): New.
(escape_data): Add hack to escape in forms mode.
(send_request) [HTTP_USE_GNUTLS]: Support SNI.
(send_request) [HTTP_USE_GNUTLS]: Fix use of make_header_line.
(send_gnutls_bye): New.
(cookie_close): Make use of preclose feature.
(http_verify_server_credentials): New.
(main) [TEST]: Remove test code.
* common/t-http.c: New.
* common/tls-ca.pem: New.
* common/Makefile.am (tls_sources): New. Move http code to here.
(libcommontls_a_SOURCES): New.
(libcommontlsnpth_a_SOURCES): New.
(EXTRA_DIST): Add tls-ca.pem
(module_maint_tests): Add t-http.
(t_http_SOURCES, t_http_CFLAGS, t_http_LDADD): New.

* dirmngr/Makefile.am (dirmngr_LDADD): Add libcommontlsnpth.
--

This new TLS API for http.c is much more flexible than the crude old
hack.

1 files changed, 24 insertions, 0 deletions

diff --git a/configure.ac b/configure.ac
index 19c98162d..21f5fb6fa 100644
--- a/configure.ac
+++ b/configure.ac
@@ -58,6 +58,8 @@ NEED_KSBA_VERSION=1.2.0
 NEED_NPTH_API=1
 NEED_NPTH_VERSION=0.91
 
+NEED_GNUTLS_VERSION=3.0
+
 
 development_version=mym4_isgit
 PACKAGE=$PACKAGE_NAME
@@ -912,6 +914,26 @@ else
 ***]])
 fi
 
+#
+# Check whether GNUTLS is available
+#
+PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= $NEED_GNUTLS_VERSION],
+                               [have_gnutls=yes],
+                               [have_gnutls=no])
+if test "$have_gnutls" = "yes"; then
+  AC_SUBST([LIBGNUTLS_CFLAGS])
+  AC_SUBST([LIBGNUTLS_LIBS])
+  AC_DEFINE(HTTP_USE_GNUTLS, 1, [Enable GNUTLS support in http.c])
+else
+  tmp=$(echo "$LIBGNUTLS_PKG_ERRORS" | tr '\n' '\v' | sed 's/\v/\n*** /g')
+  AC_MSG_WARN([[
+***
+*** Building without GNUTLS - no TLS access to keyservers.
+***
+*** $tmp]])
+fi
+
+
 
 AC_MSG_NOTICE([checking for networking options])
 
@@ -1867,6 +1889,8 @@ echo "
         Use standard socket: $use_standard_socket
         Dirmngr auto start:  $dirmngr_auto_start
         Readline support:    $gnupg_cv_have_readline
+        DNS SRV support:     $use_dns_srv
+        TLS support:         $have_gnutls
 "
 if test x"$use_regex" != xyes ; then
 echo "