@@ -90,19 +90,37 @@ data TLSSettings = TLSSettings {
9090 --
9191 -- Since 1.4.0
9292 , tlsAllowedVersions :: [TLS.Version]
93+#if MIN_VERSION_tls(1,5,0)
94+ -- ^ The TLS versions this server accepts.
95+ --
96+ -- >>> tlsAllowedVersions defaultTlsSettings
97+ -- [TLS13,TLS12,TLS11,TLS10]
98+ --
99+ -- Since 1.4.2
100+#else
93101 -- ^ The TLS versions this server accepts.
94102 --
95103 -- >>> tlsAllowedVersions defaultTlsSettings
96104 -- [TLS12,TLS11,TLS10]
97105 --
98106 -- Since 1.4.2
107+#endif
99108 , tlsCiphers :: [TLS.Cipher]
109+#if MIN_VERSION_tls(1,5,0)
110+ -- ^ The TLS ciphers this server accepts.
111+ --
112+ -- >>> tlsCiphers defaultTlsSettings
113+ -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]
114+ --
115+ -- Since 1.4.2
116+#else
100117 -- ^ The TLS ciphers this server accepts.
101118 --
102119 -- >>> tlsCiphers defaultTlsSettings
103120 -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1]
104121 --
105122 -- Since 1.4.2
123+#endif
106124 , tlsWantClientCert :: Bool
107125 -- ^ Whether or not to demand a certificate from the client. If this
108126 -- is set to True, you must handle received certificates in a server hook
@@ -149,7 +167,11 @@ defaultTlsSettings = TLSSettings {
149167 , keyMemory = Nothing
150168 , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
151169 , tlsLogging = def
170+#if MIN_VERSION_tls(1,5,0)
171+ , tlsAllowedVersions = [TLS.TLS13,TLS.TLS12,TLS.TLS11,TLS.TLS10]
172+#else
152173 , tlsAllowedVersions = [TLS.TLS12,TLS.TLS11,TLS.TLS10]
174+#endif
153175 , tlsCiphers = ciphers
154176 , tlsWantClientCert = False
155177 , tlsServerHooks = def
@@ -264,6 +286,9 @@ runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
264286 , TLS.serverHooks = hooks
265287 , TLS.serverShared = shared
266288 , TLS.serverSupported = supported
289+#if MIN_VERSION_tls(1,5,0)
290+ , TLS.serverEarlyDataSize = 2018
291+#endif
267292 }
268293 -- Adding alpn to user's tlsServerHooks.
269294 hooks = tlsServerHooks {
@@ -282,6 +307,9 @@ runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
282307 , TLS.supportedClientInitiatedRenegotiation = False
283308 , TLS.supportedSession = True
284309 , TLS.supportedFallbackScsv = True
310+#if MIN_VERSION_tls(1,5,0)
311+ , TLS.supportedGroups = [TLS.X25519,TLS.P256,TLS.P384]
312+#endif
285313 }
286314
287315alpn :: [S.ByteString] -> IO S.ByteString
@@ -427,6 +455,9 @@ getTLSinfo ctx = do
427455 TLS.TLS10 -> (3,1)
428456 TLS.TLS11 -> (3,2)
429457 TLS.TLS12 -> (3,3)
458+#if MIN_VERSION_tls(1,5,0)
459+ TLS.TLS13 -> (3,4)
460+#endif
430461 return TLS {
431462 tlsMajorVersion = major
432463 , tlsMinorVersion = minor