@@ -31,6 +31,7 @@ module Network.Wai.Handler.WarpTLS (
3131 , tlsWantClientCert
3232 , tlsServerHooks
3333 , tlsServerDHEParams
34+ , tlsSessionManagerConfig
3435 , onInsecure
3536 , OnInsecure (..)
3637 -- * Runner
@@ -60,6 +61,7 @@ import Network.Socket.ByteString (sendAll)
6061import qualified Network.TLS as TLS
6162import qualified Crypto.PubKey.DH as DH
6263import qualified Network.TLS.Extra as TLSExtra
64+import qualified Network.TLS.SessionManager as SM
6365import Network.Wai (Application)
6466import Network.Wai.Handler.Warp
6567import Network.Wai.Handler.Warp.Internal
@@ -129,6 +131,15 @@ data TLSSettings = TLSSettings {
129131 -- Default: Nothing
130132 --
131133 -- Since 3.2.2
134+ , tlsSessionManagerConfig :: Maybe SM.Config
135+ -- ^ Configuration for in-memory TLS session manager.
136+ -- If Nothing, 'TLS.noSessionManager' is used.
137+ -- Otherwise, an in-memory TLS session manager is created
138+ -- according to 'Config'.
139+ --
140+ -- Default: Nothing
141+ --
142+ -- Since 3.2.4
132143 }
133144
134145-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).
@@ -147,6 +158,7 @@ defaultTlsSettings = TLSSettings {
147158 , tlsWantClientCert = False
148159 , tlsServerHooks = def
149160 , tlsServerDHEParams = Nothing
161+ , tlsSessionManagerConfig = Nothing
150162 }
151163
152164-- taken from stunnel example in tls-extra
@@ -239,10 +251,13 @@ runTLSSocket tlsset@TLSSettings{..} set sock app = do
239251 key <- maybe (S.readFile keyFile) return mkey
240252 either error return $
241253 TLS.credentialLoadX509ChainFromMemory cert chainCertsMemory key
242− runTLSSocket' tlsset set credential sock app
254+ mgr <- case tlsSessionManagerConfig of
255+ Nothing -> return TLS.noSessionManager
256+ Just config -> SM.newSessionManager config
257+ runTLSSocket' tlsset set credential mgr sock app
243258
244−runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> Socket -> Application -> IO ()
245−runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
259+runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> TLS.SessionManager -> Socket -> Application -> IO ()
260+runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
246261 runSettingsConnectionMakerSecure set get app
247262 where
248263 get = getter tlsset sock params
@@ -260,7 +275,8 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
260275 (if settingsHTTP2Enabled set then Just alpn else Nothing)
261276 }
262277 shared = def {
263− TLS.sharedCredentials = TLS.Credentials [credential]
278+ TLS.sharedCredentials = TLS.Credentials [credential]
279+ , TLS.sharedSessionManager = mgr
264280 }
265281 supported = def { -- TLS.Supported
266282 TLS.supportedVersions = tlsAllowedVersions