add flags for TLS option control

2 files changed, 31 insertions, 9 deletions

diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
index 4917f62b..7bb0e084 100644
--- a/src/include/microhttpd.h
+++ b/src/include/microhttpd.h
@@ -126,7 +126,7 @@ typedef intptr_t ssize_t;
  * Current version of the library.
  * 0x01093001 = 1.9.30-1.
  */
-#define MHD_VERSION 0x00096301
+#define MHD_VERSION 0x00096302
 
 /**
  * MHD-internal return code for "YES".
@@ -1147,7 +1147,19 @@ enum MHD_FLAG
    * This is combination of #MHD_USE_AUTO and #MHD_USE_INTERNAL_POLLING_THREAD
    * flags.
    */
-  MHD_USE_AUTO_INTERNAL_THREAD = MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD
+  MHD_USE_AUTO_INTERNAL_THREAD = MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD,
+
+  /**
+   * Flag set to enable post-handshake client authentication
+   * (only useful in combination with #MHD_USE_TLS).
+   */
+  MHD_USE_POST_HANDSHAKE_AUTH_SUPPORT = 1U <<17,
+
+  /**
+   * Flag set to enable TLS 1.3 early data.  This has
+   * security implications, be VERY careful when using this.
+   */
+  MHD_USE_INSECURE_TLS_EARLY_DATA = 1U <<18
 
 };
 
diff --git a/src/microhttpd/daemon.c b/src/microhttpd/daemon.c
index ab75273b..af137a80 100644
--- a/src/microhttpd/daemon.c
+++ b/src/microhttpd/daemon.c
@@ -2460,17 +2460,27 @@ internal_add_connection (struct MHD_Daemon *daemon,
   else
     {
 #ifdef HTTPS_SUPPORT
-      connection->tls_state = MHD_TLS_CONN_INIT;
-      MHD_set_https_callbacks (connection);
-      gnutls_init (&connection->tls_session,
-                   GNUTLS_SERVER
+      gnutls_init_flags_t flags;
+
+      flags = GNUTLS_SERVER;
 #if (GNUTLS_VERSION_NUMBER+0 >= 0x030402)
-                   | GNUTLS_NO_SIGNAL
+      flags |= GNUTLS_NO_SIGNAL;
 #endif /* GNUTLS_VERSION_NUMBER >= 0x030402 */
 #if GNUTLS_VERSION_MAJOR >= 3
-                   | GNUTLS_NONBLOCK
+      flags |= GNUTLS_NONBLOCK;
 #endif /* GNUTLS_VERSION_MAJOR >= 3*/
-                  );
+#if (GNUTLS_VERSION_NUMBER+0 >= 0x030603)
+      if (0 != (daemon->options & MHD_USE_POST_HANDSHAKE_AUTH_SUPPORT))
+        flags |= GNUTLS_POST_HANDSHAKE_AUTH;
+#endif
+#if (GNUTLS_VERSION_NUMBER+0 >= 0x030605)
+      if (0 != (daemon->options & MHD_USE_INSECURE_TLS_EARLY_DATA))
+        flags |= GNUTLS_ENABLE_EARLY_DATA;
+#endif      
+      connection->tls_state = MHD_TLS_CONN_INIT;
+      MHD_set_https_callbacks (connection);
+      gnutls_init (&connection->tls_session,
+                   flags);
       gnutls_priority_set (connection->tls_session,
                            daemon->priority_cache);
       gnutls_session_set_ptr (connection->tls_session,