@@ -248,7 +248,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
248248 runSettingsConnectionMakerSecure set get app
249249 where
250250 get = getter tlsset sock params
251− params = TLS.ServerParams {
251+ params = def { -- TLS.ServerParams
252252 TLS.serverWantClientCert = tlsWantClientCert
253253 , TLS.serverCACertificates = []
254254 , TLS.serverDHEParams = Nothing
@@ -264,7 +264,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
264264 shared = def {
265265 TLS.sharedCredentials = TLS.Credentials [credential]
266266 }
267− supported = TLS.Supported {
267+ supported = def { -- TLS.Supported
268268 TLS.supportedVersions = tlsAllowedVersions
269269 , TLS.supportedCiphers = tlsCiphers
270270 , TLS.supportedCompressions = [TLS.nullCompression]
@@ -440,7 +440,12 @@ plainHTTP TLSSettings{..} s bs0 = case onInsecure of
440440 }
441441 return (conn'', TCP)
442442 DenyInsecure lbs -> do
443− sendAll s "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n"
443+ -- FIXME: what about HTTP/2?
444+ -- http://tools.ietf.org/html/rfc2817#section-4.2
445+ sendAll s "HTTP/1.1 426 Upgrade Required\
446+ \r\nUpgrade: TLS/1.0, HTTP/1.1\
447+ \r\nConnection: Upgrade\
448+ \r\nContent-Type: text/plain\r\n\r\n"
444449 mapM_ (sendAll s) $ L.toChunks lbs
445450 sClose s
446451 throwIO InsecureConnectionDenied