The current trunk code doesn't handle correctly the timeout parameter. When
the timeout expires, "tls_pull" returns 0 (the number of read bytes) but
gnutls interpreters it as the TCP connection was closed. 

To make it behave correctly you have to use errno EAGAIN when returning
from "tls_pull". This change has been made directly to the "io_recv" so
that it behaves correctly in any situation (with or without TLS).

A patch (against r25) is attached to correct this wrong behaviour. It
should be correct.

I see there is a similar problem (with patch) in Issue 10, but the one
attached here is against current trunk.