git.iko.soy/typeable/wai
on master help sign in
tls 1.1
727a4dcMichael Snoyman
warp-tls/Network/Wai/Handler/WarpTLS.hs+6−26
compare with master
unifiedsplit
@@ -1,6 +1,5 @@
1{-# LANGUAGE OverloadedStrings #-}
1{-# LANGUAGE OverloadedStrings #-}
2{-# LANGUAGE RankNTypes #-}
2{-# LANGUAGE RankNTypes #-}
3−{-# LANGUAGE CPP #-}
4module Network.Wai.Handler.WarpTLS
3module Network.Wai.Handler.WarpTLS
5 ( TLSSettings (..)
4 ( TLSSettings (..)
6 , runTLS
5 , runTLS
@@ -11,12 +10,11 @@ import qualified Network.TLS as TLS
11import Network.Wai.Handler.Warp
10import Network.Wai.Handler.Warp
12import Network.Wai
11import Network.Wai
13import Network.Socket
12import Network.Socket
14−import Crypto.Random
15import qualified Data.ByteString.Lazy as L
13import qualified Data.ByteString.Lazy as L
16import Data.Conduit.Binary (sourceFileRange)
14import Data.Conduit.Binary (sourceFileRange)
17import qualified Data.Conduit as C
15import qualified Data.Conduit as C
18import qualified Data.Conduit.List as CL
16import qualified Data.Conduit.List as CL
19−import Control.Exception (bracket, handle, SomeException)
17+import Control.Exception (bracket)
20import qualified Network.TLS.Extra as TLSExtra
18import qualified Network.TLS.Extra as TLSExtra
21import qualified Data.Certificate.X509 as X509
19import qualified Data.Certificate.X509 as X509
22import qualified Data.ByteString as B
20import qualified Data.ByteString as B
@@ -29,6 +27,7 @@ import Data.Conduit.Network (sourceSocket, sinkSocket, acceptSafe)
29import Data.Maybe (fromMaybe)
27import Data.Maybe (fromMaybe)
30import qualified Data.IORef as I
28import qualified Data.IORef as I
31import Control.Monad (unless)
29import Control.Monad (unless)
30+import Crypto.Random.API (getSystemRandomGen)
32
31
33data TLSSettings = TLSSettings
32data TLSSettings = TLSSettings
34 { certFile :: FilePath
33 { certFile :: FilePath
@@ -39,7 +38,6 @@ runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()
39runTLSSocket tset set sock app = do
38runTLSSocket tset set sock app = do
40 certs <- readCertificates $ certFile tset
39 certs <- readCertificates $ certFile tset
41 pk <- readPrivateKey $ keyFile tset
40 pk <- readPrivateKey $ keyFile tset
42−#if MIN_VERSION_tls(1, 0, 0)
43 let params =
41 let params =
44 TLS.updateServerParams
42 TLS.updateServerParams
45 (\sp -> sp { TLS.serverWantClientCert = False }) $
43 (\sp -> sp { TLS.serverWantClientCert = False }) $
@@ -48,17 +46,9 @@ runTLSSocket tset set sock app = do
48 , TLS.pCiphers = ciphers
46 , TLS.pCiphers = ciphers
49 , TLS.pCertificates = zip certs $ (Just pk):repeat Nothing
47 , TLS.pCertificates = zip certs $ (Just pk):repeat Nothing
50 }
48 }
51−#else
52− let params = TLS.defaultParams
53− { TLS.pWantClientCert = False
54− , TLS.pAllowedVersions = [TLS.SSL3,TLS.TLS10,TLS.TLS11,TLS.TLS12]
55− , TLS.pCiphers = ciphers
56− , TLS.pCertificates = zip certs $ (Just pk):repeat Nothing
57− }
58−#endif
59− runSettingsConnectionMaker set (getter params sock) app
49+ runSettingsConnectionMaker set (getter params) app
60 where
50 where
61− getter params sock = do
51+ getter params = do
62 (s, sa) <- acceptSafe sock
52 (s, sa) <- acceptSafe sock
63 let mkConn = do
53 let mkConn = do
64 (fromClient, firstBS) <- sourceSocket s C.$$+ CL.peek
54 (fromClient, firstBS) <- sourceSocket s C.$$+ CL.peek
@@ -71,8 +61,7 @@ runTLSSocket tset set sock app = do
71 return bs
61 return bs
72 if maybe False ((== 0x16) . fst) (firstBS >>= B.uncons)
62 if maybe False ((== 0x16) . fst) (firstBS >>= B.uncons)
73 then do
63 then do
74− gen <- newGenIO
64+ gen <- getSystemRandomGen
75−#if MIN_VERSION_tls(1, 0, 0)
76 ctx <- TLS.contextNew
65 ctx <- TLS.contextNew
77 TLS.Backend
66 TLS.Backend
78 { TLS.backendFlush = return ()
67 { TLS.backendFlush = return ()
@@ -81,16 +70,7 @@ runTLSSocket tset set sock app = do
81 , TLS.backendRecv = getNext . takeMost
70 , TLS.backendRecv = getNext . takeMost
82 }
71 }
83 params
72 params
84− (gen :: SystemRandom)
73+ gen
85−#else
86− ctx <- TLS.serverWith
87− params
88− (gen :: SystemRandom)
89− s
90− (return ()) -- flush
91− (\bs -> C.yield bs C.$$ toClient)
92− (getNext . takeMost)
93−#endif
94 TLS.handshake ctx
74 TLS.handshake ctx
95 let conn = Connection
75 let conn = Connection
96 { connSendMany = TLS.sendData ctx . L.fromChunks
76 { connSendMany = TLS.sendData ctx . L.fromChunks
warp-tls/warp-tls.cabal+8−8
@@ -1,5 +1,5 @@
1Name: warp-tls
1Name: warp-tls
2−Version: 1.3.4
2+Version: 1.3.5
3Synopsis: SSL support for Warp via the TLS package
3Synopsis: SSL support for Warp via the TLS package
4License: MIT
4License: MIT
5License-file: LICENSE
5License-file: LICENSE
@@ -17,15 +17,15 @@ Library
17 , bytestring >= 0.9
17 , bytestring >= 0.9
18 , wai >= 1.3 && < 1.4
18 , wai >= 1.3 && < 1.4
19 , warp >= 1.3.5 && < 1.4
19 , warp >= 1.3.5 && < 1.4
20− , transformers >= 0.2 && < 0.4
20+ , transformers >= 0.2
21 , conduit >= 0.5 && < 0.6
21 , conduit >= 0.5 && < 0.6
22 , network-conduit >= 0.6 && < 0.7
22 , network-conduit >= 0.6 && < 0.7
23− , certificate >= 1.2 && < 1.4
23+ , certificate >= 1.2
24− , pem >= 0.1 && < 0.2
24+ , pem >= 0.1
25− , cryptocipher >= 0.3 && < 0.4
25+ , cryptocipher >= 0.3
26− , tls-extra >= 0.4.5 && < 0.6
26+ , tls-extra >= 0.6
27− , tls >= 0.9.6 && < 1.1
27+ , tls >= 1.1
28− , crypto-api >= 0.8 && < 0.11
28+ , crypto-random-api >= 0.2
29 , network >= 2.2.1
29 , network >= 2.2.1
30 Exposed-modules: Network.Wai.Handler.WarpTLS
30 Exposed-modules: Network.Wai.Handler.WarpTLS
31 ghc-options: -Wall
31 ghc-options: -Wall