2506986 · typeable/wai

git.iko.soy/typeable/wai

on master help sign in

using tls-session-manager in warp-tls.

2506986Kazu Yamamoto9 years ago

warp-tls/Network/Wai/Handler/WarpTLS.hs+20−4

compare with master

unifiedsplit

@@ -31,6 +31,7 @@ module Network.Wai.Handler.WarpTLS (

31 , tlsWantClientCert

32 , tlsServerHooks

33 , tlsServerDHEParams

34+ , tlsSessionManagerConfig

34 , onInsecure

35 , onInsecure

35 , OnInsecure (..)

36 , OnInsecure (..)

36 -- * Runner

37 -- * Runner

@@ -60,6 +61,7 @@ import Network.Socket.ByteString (sendAll)

60import qualified Network.TLS as TLS

61import qualified Network.TLS as TLS

61import qualified Crypto.PubKey.DH as DH

62import qualified Crypto.PubKey.DH as DH

62import qualified Network.TLS.Extra as TLSExtra

63import qualified Network.TLS.Extra as TLSExtra

64+import qualified Network.TLS.SessionManager as SM

63import Network.Wai (Application)

65import Network.Wai (Application)

64import Network.Wai.Handler.Warp

66import Network.Wai.Handler.Warp

65import Network.Wai.Handler.Warp.Internal

67import Network.Wai.Handler.Warp.Internal

@@ -129,6 +131,15 @@ data TLSSettings = TLSSettings {

129 -- Default: Nothing

131 -- Default: Nothing

130 --

132 --

131 -- Since 3.2.2

133 -- Since 3.2.2

134+ , tlsSessionManagerConfig :: Maybe SM.Config

135+ -- ^ Configuration for in-memory TLS session manager.

136+ -- If Nothing, 'TLS.noSessionManager' is used.

137+ -- Otherwise, an in-memory TLS session manager is created

138+ -- according to 'Config'.

139+ --

140+ -- Default: Nothing

141+ --

142+ -- Since 3.2.4

132 }

143 }

133

144

134-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).

145-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).

@@ -147,6 +158,7 @@ defaultTlsSettings = TLSSettings {

147 , tlsWantClientCert = False

158 , tlsWantClientCert = False

148 , tlsServerHooks = def

159 , tlsServerHooks = def

149 , tlsServerDHEParams = Nothing

160 , tlsServerDHEParams = Nothing

161+ , tlsSessionManagerConfig = Nothing

150 }

162 }

151

163

152-- taken from stunnel example in tls-extra

164-- taken from stunnel example in tls-extra

@@ -239,10 +251,13 @@ runTLSSocket tlsset@TLSSettings{..} set sock app = do

239 key <- maybe (S.readFile keyFile) return mkey

251 key <- maybe (S.readFile keyFile) return mkey

240 either error return $

252 either error return $

241 TLS.credentialLoadX509ChainFromMemory cert chainCertsMemory key

253 TLS.credentialLoadX509ChainFromMemory cert chainCertsMemory key

254+ mgr <- case tlsSessionManagerConfig of

255+ Nothing -> return TLS.noSessionManager

256+ Just config -> SM.newSessionManager config

242− runTLSSocket' tlsset set credential sock app

257+ runTLSSocket' tlsset set credential mgr sock app

243

258

244−runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> Socket -> Application -> IO ()

259+runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> TLS.SessionManager -> Socket -> Application -> IO ()

245−runTLSSocket' tlsset@TLSSettings{..} set credential sock app =

260+runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =

246 runSettingsConnectionMakerSecure set get app

261 runSettingsConnectionMakerSecure set get app

247 where

262 where

248 get = getter tlsset sock params

263 get = getter tlsset sock params

@@ -260,7 +275,8 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =

260 (if settingsHTTP2Enabled set then Just alpn else Nothing)

275 (if settingsHTTP2Enabled set then Just alpn else Nothing)

261 }

276 }

262 shared = def {

277 shared = def {

263− TLS.sharedCredentials = TLS.Credentials [credential]

278+ TLS.sharedCredentials = TLS.Credentials [credential]

279+ , TLS.sharedSessionManager = mgr

264 }

280 }

265 supported = def { -- TLS.Supported

281 supported = def { -- TLS.Supported

266 TLS.supportedVersions = tlsAllowedVersions

282 TLS.supportedVersions = tlsAllowedVersions

warp-tls/warp-tls.cabal+1

@@ -27,6 +27,7 @@ Library

27 , cryptonite >= 0.12

28 , network >= 2.2.1

29 , streaming-commons

30+ , tls-session-manager

30 Exposed-modules: Network.Wai.Handler.WarpTLS

31 Exposed-modules: Network.Wai.Handler.WarpTLS

31 ghc-options: -Wall

32 ghc-options: -Wall