api: fold TLS supplemental headers into nng.h

25 files changed, 37 insertions, 94 deletions

diff --git a/docs/ref/migrate/nng1.md b/docs/ref/migrate/nng1.md
index bf377930..584a0f00 100644
--- a/docs/ref/migrate/nng1.md
+++ b/docs/ref/migrate/nng1.md
@@ -40,6 +40,7 @@ Simply remove any references to them.
 - `nng/protocol/reqrep0/req.h`
 - `nng/protocol/survey0/respond.h`
 - `nng/protocol/survey0/survey.h`
+- `nng/supplemental/tls/tls.h`
 - `nng/transport/inproc/inproc.h`
 - `nng/transport/ipc/ipc.h`
 - `nng/transport/tcp/tcp.h`
diff --git a/include/nng/nng.h b/include/nng/nng.h
index 56105034..43824d61 100644
--- a/include/nng/nng.h
+++ b/include/nng/nng.h
@@ -1593,6 +1593,17 @@ NNG_DECL int nng_tls_config_psk(
 NNG_DECL int nng_tls_config_version(
     nng_tls_config *, nng_tls_version, nng_tls_version);
 
+// nng_tls_engine_name returns the "name" of the TLS engine.  If no
+// TLS engine support is enabled, then "none" is returned.
+NNG_DECL const char *nng_tls_engine_name(void);
+
+// nng_tls_engine_description returns the "description" of the TLS engine.
+// If no TLS engine support is enabled, then an empty string is returned.
+NNG_DECL const char *nng_tls_engine_description(void);
+
+// nng_tls_engine_fips_mode returns true if the engine is in FIPS 140 mode.
+NNG_DECL bool nng_tls_engine_fips_mode(void);
+
 // Protocol specific values.  These were formerly located in protocol specific
 // headers, but we are bringing them here for ease of use.
 
diff --git a/include/nng/supplemental/tls/tls.h b/include/nng/supplemental/tls/tls.h
deleted file mode 100644
index f877a4b9..00000000
--- a/include/nng/supplemental/tls/tls.h
+++ /dev/null
@@ -1,41 +0,0 @@
-//
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
-// Copyright 2018 Capitar IT Group BV <info@capitar.com>
-//
-// This software is supplied under the terms of the MIT License, a
-// copy of which should be located in the distribution where this
-// file was obtained (LICENSE.txt).  A copy of the license may also be
-// found online at https://opensource.org/licenses/MIT.
-//
-
-#ifndef NNG_SUPPLEMENTAL_TLS_TLS_H
-#define NNG_SUPPLEMENTAL_TLS_TLS_H
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <nng/nng.h>
-
-// Note that TLS functions may be stubbed out if TLS is not enabled in
-// the build.
-
-// nng_tls_engine_name returns the "name" of the TLS engine.  If no
-// TLS engine support is enabled, then "none" is returned.
-NNG_DECL const char *nng_tls_engine_name(void);
-
-// nng_tls_engine_description returns the "description" of the TLS engine.
-// If no TLS engine support is enabled, then an empty string is returned.
-NNG_DECL const char *nng_tls_engine_description(void);
-
-// nng_tls_engine_fips_mode returns true if the engine is in FIPS 140-2 mode.
-NNG_DECL bool nng_tls_engine_fips_mode(void);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // NNG_SUPPLEMENTAL_TLS_TLS_H
diff --git a/src/core/stream.c b/src/core/stream.c
index 8686e5b2..1af8e572 100644
--- a/src/core/stream.c
+++ b/src/core/stream.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 //
 // This software is supplied under the terms of the MIT License, a
 // copy of which should be located in the distribution where this
@@ -13,7 +13,6 @@
 #include <string.h>
 
 #include "core/nng_impl.h"
-#include <nng/supplemental/tls/tls.h>
 
 #include "core/sockfd.h"
 #include "core/tcp.h"
diff --git a/src/sp/transport/tls/tls.c b/src/sp/transport/tls/tls.c
index c8926c41..a0072ddd 100644
--- a/src/sp/transport/tls/tls.c
+++ b/src/sp/transport/tls/tls.c
@@ -15,7 +15,6 @@
 #include "core/nng_impl.h"
 
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
 
 // TLS over TCP transport.   Platform specific TCP operations must be
 // supplied as well, and uses the supplemental TLS v1.2 code.  It is not
diff --git a/src/sp/transport/tls/tls_tran_test.c b/src/sp/transport/tls/tls_tran_test.c
index 4e3ea00b..23471e59 100644
--- a/src/sp/transport/tls/tls_tran_test.c
+++ b/src/sp/transport/tls/tls_tran_test.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2018 Devolutions <info@devolutions.net>
 // Copyright 2018 Cody Piersall <cody.piersall@gmail.com>
@@ -11,7 +11,6 @@
 //
 
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
 #include <nuts.h>
 
 // TLS tests.
diff --git a/src/sp/transport/ws/websocket.c b/src/sp/transport/ws/websocket.c
index ec71af0a..e236a5d6 100644
--- a/src/sp/transport/ws/websocket.c
+++ b/src/sp/transport/ws/websocket.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -16,8 +16,6 @@
 #include "core/nng_impl.h"
 #include "supplemental/websocket/websocket.h"
 
-#include <nng/supplemental/tls/tls.h>
-
 typedef struct ws_dialer   ws_dialer;
 typedef struct ws_listener ws_listener;
 typedef struct ws_pipe     ws_pipe;
diff --git a/src/supplemental/http/http_api.h b/src/supplemental/http/http_api.h
index 5e2d52fa..29a8c5c1 100644
--- a/src/supplemental/http/http_api.h
+++ b/src/supplemental/http/http_api.h
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -14,7 +14,6 @@
 
 #include "core/nng_impl.h"
 #include <nng/supplemental/http/http.h>
-#include <nng/supplemental/tls/tls.h>
 
 // This represents the "internal" HTTP API.  It should not be used
 // or exposed to applications directly.
diff --git a/src/supplemental/http/http_client.c b/src/supplemental/http/http_client.c
index 003e7fc9..52b6874d 100644
--- a/src/supplemental/http/http_client.c
+++ b/src/supplemental/http/http_client.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -15,8 +15,6 @@
 
 #include "core/nng_impl.h"
 
-#include <nng/supplemental/tls/tls.h>
-
 #include "http_api.h"
 
 static nni_mtx http_txn_lk = NNI_MTX_INITIALIZER;
diff --git a/src/supplemental/http/http_conn.c b/src/supplemental/http/http_conn.c
index 44ad3a01..44860fe6 100644
--- a/src/supplemental/http/http_conn.c
+++ b/src/supplemental/http/http_conn.c
@@ -18,8 +18,6 @@
 
 #include "http_api.h"
 
-#include <nng/supplemental/tls/tls.h>
-
 // We insist that individual headers fit in 8K.
 // If you need more than that, you need something we can't do.
 #define HTTP_BUFSIZE 8192
diff --git a/src/supplemental/http/http_public.c b/src/supplemental/http/http_public.c
index 32f1e275..88ebaa68 100644
--- a/src/supplemental/http/http_public.c
+++ b/src/supplemental/http/http_public.c
@@ -11,7 +11,6 @@
 #include "core/nng_impl.h"
 #include "http_api.h"
 #include "nng/supplemental/http/http.h"
-#include "nng/supplemental/tls/tls.h"
 
 // Symbols in this file are "public" versions of the HTTP API.
 // These are suitable for exposure to applications.
diff --git a/src/supplemental/http/http_server.c b/src/supplemental/http/http_server.c
index 74dd76a3..c6c453c9 100644
--- a/src/supplemental/http/http_server.c
+++ b/src/supplemental/http/http_server.c
@@ -18,7 +18,6 @@
 #include <string.h>
 
 #include "core/nng_impl.h"
-#include "nng/supplemental/tls/tls.h"
 
 #include "http_api.h"
 
diff --git a/src/supplemental/http/http_server_test.c b/src/supplemental/http/http_server_test.c
index 3c9cb545..37c45f14 100644
--- a/src/supplemental/http/http_server_test.c
+++ b/src/supplemental/http/http_server_test.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2020 Dirac Research <robert.bielik@dirac.com>
 //
@@ -12,7 +12,6 @@
 // Basic HTTP server tests.
 #include <nng/nng.h>
 #include <nng/supplemental/http/http.h>
-#include <nng/supplemental/tls/tls.h>
 
 #include <nuts.h>
 
diff --git a/src/supplemental/tls/CMakeLists.txt b/src/supplemental/tls/CMakeLists.txt
index 17d957ff..78fb10b7 100644
--- a/src/supplemental/tls/CMakeLists.txt
+++ b/src/supplemental/tls/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright 2020 Staysail Systems, Inc. <info@staysail.tech>
+# Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 # Copyright 2018 Capitar IT Group BV <info@capitar.com>
 # Copyright 2019 Devolutions <info@devolutions.net>
 #
@@ -20,10 +20,6 @@ else ()
     set(NNG_TLS_ENGINE none)
 endif ()
 
-# default TLS implementation for now is Mbed.
-nng_headers(nng/supplemental/tls/tls.h)
-nng_headers(nng/supplemental/tls/engine.h)
-
 if (NOT NNG_TLS_ENGINE STREQUAL "none")
     nng_test(tls_test)
 endif ()
@@ -32,4 +28,4 @@ add_subdirectory(mbedtls)
 add_subdirectory(wolfssl)
 
 nng_sources(tls_common.c)
-nng_sources(tls_api.h)
+nng_sources(tls_api.h tls_engine.h)
diff --git a/src/supplemental/tls/mbedtls/tls.c b/src/supplemental/tls/mbedtls/tls.c
index 9adae588..7764bbbf 100644
--- a/src/supplemental/tls/mbedtls/tls.c
+++ b/src/supplemental/tls/mbedtls/tls.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -22,7 +22,8 @@
 #endif
 
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
+
+#include "../tls_engine.h"
 
 // mbedTLS renamed this header for 2.4.0.
 #if MBEDTLS_VERSION_MAJOR > 2 || MBEDTLS_VERSION_MINOR >= 4
@@ -35,7 +36,6 @@
 #include "mbedtls/ssl.h"
 
 #include "core/nng_impl.h"
-#include <nng/supplemental/tls/engine.h>
 
 // pair holds a private key and the associated certificate.
 typedef struct {
diff --git a/src/supplemental/tls/tls_api.h b/src/supplemental/tls/tls_api.h
index 0c3e3155..afb8661c 100644
--- a/src/supplemental/tls/tls_api.h
+++ b/src/supplemental/tls/tls_api.h
@@ -1,5 +1,5 @@
 //
-// Copyright 2020 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -12,8 +12,6 @@
 #ifndef NNG_SUPPLEMENTAL_TLS_TLS_API_H
 #define NNG_SUPPLEMENTAL_TLS_TLS_API_H
 
-#include <nng/supplemental/tls/tls.h>
-
 // The implementation supplies this function to create the TLS connection
 // object.  All fields will be zeroed.
 extern int nni_tls_dialer_alloc(nng_stream_dialer **, const nng_url *);
diff --git a/src/supplemental/tls/tls_common.c b/src/supplemental/tls/tls_common.c
index 96255a72..d68a6197 100644
--- a/src/supplemental/tls/tls_common.c
+++ b/src/supplemental/tls/tls_common.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2019 Devolutions <info@devolutions.net>
 //
@@ -15,8 +15,7 @@
 
 #include "core/nng_impl.h"
 
-#include <nng/supplemental/tls/engine.h>
-#include <nng/supplemental/tls/tls.h>
+#include "tls_engine.h"
 
 // NNG_TLS_MAX_SEND_SIZE limits the amount of data we will buffer for sending,
 // exerting back-pressure if this size is exceeded.  The 16K is aligned to the
diff --git a/include/nng/supplemental/tls/engine.h b/src/supplemental/tls/tls_engine.h
index 5bfe339d..bbc5a944 100644
--- a/include/nng/supplemental/tls/engine.h
+++ b/src/supplemental/tls/tls_engine.h
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 //
 // This software is supplied under the terms of the MIT License, a
 // copy of which should be located in the distribution where this
@@ -10,10 +10,10 @@
 // This file is used to enable external TLS "engines", so
 // that third party TLS libraries can be plugged in
 
-#ifndef NNG_SUPPLEMENTAL_TLS_ENGINE_H
-#define NNG_SUPPLEMENTAL_TLS_ENGINE_H
+#ifndef NNG_SUPPLEMENTAL_TLS_TLS_ENGINE_H
+#define NNG_SUPPLEMENTAL_TLS_TLS_ENGINE_H
 
-#include <nng/supplemental/tls/tls.h>
+#include "core/defs.h"
 
 // Locking theory statement for TLS engines.  The engine is assumed
 // operate only from the context of threads called by the common
@@ -202,7 +202,7 @@ typedef struct nng_tls_engine_s {
 	bool fips_mode;
 } nng_tls_engine;
 
-NNG_DECL int nng_tls_engine_register(const nng_tls_engine *);
+extern int nng_tls_engine_register(const nng_tls_engine *);
 
 // nng_tls_engine_send is called by the engine to send data over the
 // underlying connection.  It returns zero on success, NNG_EAGAIN if
@@ -210,13 +210,13 @@ NNG_DECL int nng_tls_engine_register(const nng_tls_engine *);
 // accept more data yet), or some other error.  On success the count is
 // updated with the number of bytes actually sent.  The first argument
 // is the context structure passed in when starting the engine.
-NNG_DECL int nng_tls_engine_send(void *, const uint8_t *, size_t *);
+extern int nng_tls_engine_send(void *, const uint8_t *, size_t *);
 
 // nng_tls_engine_recv is called byu the engine to receive data over
 // the underlying connection.  It returns zero on success, NNG_EAGAIN
 // if the operation can't be completed yet (there is no data available
 // for reading), or some other error.  On success the count is updated
 // with the number of bytes actually received.
-NNG_DECL int nng_tls_engine_recv(void *, uint8_t *, size_t *);
+extern int nng_tls_engine_recv(void *, uint8_t *, size_t *);
 
-#endif // NNG_SUPPLEMENTAL_TLS_ENGINE_H
+#endif // NNG_SUPPLEMENTAL_TLS_TLS_ENGINE_H
diff --git a/src/supplemental/tls/tls_test.c b/src/supplemental/tls/tls_test.c
index 517be143..14b269bb 100644
--- a/src/supplemental/tls/tls_test.c
+++ b/src/supplemental/tls/tls_test.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>
 //
 // This software is supplied under the terms of the MIT License, a
 // copy of which should be located in the distribution where this
@@ -8,7 +8,6 @@
 //
 
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
 #include <nuts.h>
 
 void
diff --git a/src/supplemental/tls/wolfssl/wolfssl.c b/src/supplemental/tls/wolfssl/wolfssl.c
index c2d6196a..1510a02a 100644
--- a/src/supplemental/tls/wolfssl/wolfssl.c
+++ b/src/supplemental/tls/wolfssl/wolfssl.c
@@ -33,8 +33,8 @@
 
 #include "core/nng_impl.h"
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
-#include <nng/supplemental/tls/engine.h>
+
+#include "../tls_engine.h"
 
 struct nng_tls_engine_conn {
 	void        *tls; // parent conn
diff --git a/src/supplemental/websocket/wssfile_test.c b/src/supplemental/websocket/wssfile_test.c
index 9f059dc6..dde71129 100644
--- a/src/supplemental/websocket/wssfile_test.c
+++ b/src/supplemental/websocket/wssfile_test.c
@@ -10,7 +10,6 @@
 
 #include "core/nng_impl.h"
 #include "nng/nng.h"
-#include "nng/supplemental/tls/tls.h"
 
 #include <nuts.h>
 
diff --git a/src/testing/nuts.h b/src/testing/nuts.h
index 5f7ea513..50664211 100644
--- a/src/testing/nuts.h
+++ b/src/testing/nuts.h
@@ -48,9 +48,6 @@ extern void nuts_logger(
 #include <stdint.h>
 #include <string.h>
 
-// The following headers are provided for test code convenience.
-#include <nng/supplemental/tls/tls.h>
-
 #ifdef __cplusplus
 extern "C" {
 #endif
diff --git a/src/tools/nngcat/nngcat.c b/src/tools/nngcat/nngcat.c
index 29a8d928..dc998cf3 100644
--- a/src/tools/nngcat/nngcat.c
+++ b/src/tools/nngcat/nngcat.c
@@ -18,7 +18,6 @@
 #include <string.h>
 
 #include <nng/nng.h>
-#include <nng/supplemental/tls/tls.h>
 #include <nng/supplemental/util/options.h>
 
 // Globals.  We need this to avoid passing around everything.
diff --git a/tests/httpclient.c b/tests/httpclient.c
index 184fde31..ca6c521f 100644
--- a/tests/httpclient.c
+++ b/tests/httpclient.c
@@ -16,7 +16,6 @@
 
 #include <nng/nng.h>
 #include <nng/supplemental/http/http.h>
-#include <nng/supplemental/tls/tls.h>
 
 #include "core/nng_impl.h"
 
diff --git a/tests/wss.c b/tests/wss.c
index 670d8a55..4fef74e0 100644
--- a/tests/wss.c
+++ b/tests/wss.c
@@ -13,7 +13,6 @@
 #endif
 
 #include <nng/nng.h>
-#include <nng/supplemental/tls/tls.h>
 
 #include "convey.h"
 #include "stubs.h"