@@ -15,6 +15,8 @@ module Network.Wai.Handler.WarpTLS (
1515 , tlsLogging
1616 , tlsAllowedVersions
1717 , tlsCiphers
18+ , tlsWantClientCert
19+ , tlsServerHooks
1820 , defaultTlsSettings
1921 , tlsSettings
2022 , tlsSettingsMemory
@@ -81,6 +83,18 @@ data TLSSettings = TLSSettings {
8183 -- Default: '[TLSExtra.cipher_AES128_SHA1, TLSExtra.cipher_AES256_SHA1, TLSEtra.cipher_RC4_128_MD5, TLSExtra.cipher_RC4_128_SHA1]'
8284 --
8385 -- Since 1.4.2
86+ , tlsWantClientCert :: Bool
87+ -- ^ Whether or not to demand a certificate from the client. If this
88+ -- is set to True, you must handle received certificates in a server hook
89+ -- or all connections will fail.
90+ --
91+ -- Default: False
92+ , tlsServerHooks :: TLS.ServerHooks
93+ -- ^ The server-side hooks called by the tls package, including actions
94+ -- to take when a client certificate is received. See the "Network.TLS"
95+ -- module for details.
96+ --
97+ -- Default: def
8498 }
8599
86100-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name.
@@ -94,6 +108,8 @@ defaultTlsSettings = TLSSettings {
94108 , tlsLogging = def
95109 , tlsAllowedVersions = [TLS.TLS10,TLS.TLS11,TLS.TLS12]
96110 , tlsCiphers = ciphers
111+ , tlsWantClientCert = False
112+ , tlsServerHooks = def
97113 }
98114
99115-- taken from stunnel example in tls-extra
@@ -175,7 +191,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
175191 where
176192 get = getter tlsset sock params
177193 params = def {
178− TLS.serverWantClientCert = False
194+ TLS.serverWantClientCert = tlsWantClientCert
179195 , TLS.serverSupported = def {
180196 TLS.supportedVersions = tlsAllowedVersions
181197 , TLS.supportedCiphers = tlsCiphers
@@ -183,6 +199,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
183199 , TLS.serverShared = def {
184200 TLS.sharedCredentials = TLS.Credentials [credential]
185201 }
202+ , TLS.serverHooks = tlsServerHooks
186203 }
187204
188205----------------------------------------------------------------