git.iko.soy/typeable/wai
on master help sign in
supporting TLS 1.3 with tls 1.5.x.
8d1581eKazu Yamamoto
warp-tls/Network/Wai/Handler/WarpTLS.hs+31
compare with master
unifiedsplit
@@ -90,19 +90,37 @@ data TLSSettings = TLSSettings {
90 --
90 --
91 -- Since 1.4.0
91 -- Since 1.4.0
92 , tlsAllowedVersions :: [TLS.Version]
92 , tlsAllowedVersions :: [TLS.Version]
93+#if MIN_VERSION_tls(1,5,0)
94+ -- ^ The TLS versions this server accepts.
95+ --
96+ -- >>> tlsAllowedVersions defaultTlsSettings
97+ -- [TLS13,TLS12,TLS11,TLS10]
98+ --
99+ -- Since 1.4.2
100+#else
93 -- ^ The TLS versions this server accepts.
101 -- ^ The TLS versions this server accepts.
94 --
102 --
95 -- >>> tlsAllowedVersions defaultTlsSettings
103 -- >>> tlsAllowedVersions defaultTlsSettings
96 -- [TLS12,TLS11,TLS10]
104 -- [TLS12,TLS11,TLS10]
97 --
105 --
98 -- Since 1.4.2
106 -- Since 1.4.2
107+#endif
99 , tlsCiphers :: [TLS.Cipher]
108 , tlsCiphers :: [TLS.Cipher]
109+#if MIN_VERSION_tls(1,5,0)
110+ -- ^ The TLS ciphers this server accepts.
111+ --
112+ -- >>> tlsCiphers defaultTlsSettings
113+ -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]
114+ --
115+ -- Since 1.4.2
116+#else
100 -- ^ The TLS ciphers this server accepts.
117 -- ^ The TLS ciphers this server accepts.
101 --
118 --
102 -- >>> tlsCiphers defaultTlsSettings
119 -- >>> tlsCiphers defaultTlsSettings
103 -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1]
120 -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1]
104 --
121 --
105 -- Since 1.4.2
122 -- Since 1.4.2
123+#endif
106 , tlsWantClientCert :: Bool
124 , tlsWantClientCert :: Bool
107 -- ^ Whether or not to demand a certificate from the client. If this
125 -- ^ Whether or not to demand a certificate from the client. If this
108 -- is set to True, you must handle received certificates in a server hook
126 -- is set to True, you must handle received certificates in a server hook
@@ -149,7 +167,11 @@ defaultTlsSettings = TLSSettings {
149 , keyMemory = Nothing
167 , keyMemory = Nothing
150 , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
168 , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
151 , tlsLogging = def
169 , tlsLogging = def
170+#if MIN_VERSION_tls(1,5,0)
171+ , tlsAllowedVersions = [TLS.TLS13,TLS.TLS12,TLS.TLS11,TLS.TLS10]
172+#else
152 , tlsAllowedVersions = [TLS.TLS12,TLS.TLS11,TLS.TLS10]
173 , tlsAllowedVersions = [TLS.TLS12,TLS.TLS11,TLS.TLS10]
174+#endif
153 , tlsCiphers = ciphers
175 , tlsCiphers = ciphers
154 , tlsWantClientCert = False
176 , tlsWantClientCert = False
155 , tlsServerHooks = def
177 , tlsServerHooks = def
@@ -264,6 +286,9 @@ runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
264 , TLS.serverHooks = hooks
286 , TLS.serverHooks = hooks
265 , TLS.serverShared = shared
287 , TLS.serverShared = shared
266 , TLS.serverSupported = supported
288 , TLS.serverSupported = supported
289+#if MIN_VERSION_tls(1,5,0)
290+ , TLS.serverEarlyDataSize = 2018
291+#endif
267 }
292 }
268 -- Adding alpn to user's tlsServerHooks.
293 -- Adding alpn to user's tlsServerHooks.
269 hooks = tlsServerHooks {
294 hooks = tlsServerHooks {
@@ -282,6 +307,9 @@ runTLSSocket' tlsset@TLSSettings{..} set credential mgr sock app =
282 , TLS.supportedClientInitiatedRenegotiation = False
307 , TLS.supportedClientInitiatedRenegotiation = False
283 , TLS.supportedSession = True
308 , TLS.supportedSession = True
284 , TLS.supportedFallbackScsv = True
309 , TLS.supportedFallbackScsv = True
310+#if MIN_VERSION_tls(1,5,0)
311+ , TLS.supportedGroups = [TLS.X25519,TLS.P256,TLS.P384]
312+#endif
285 }
313 }
286
314
287alpn :: [S.ByteString] -> IO S.ByteString
315alpn :: [S.ByteString] -> IO S.ByteString
@@ -427,6 +455,9 @@ getTLSinfo ctx = do
427 TLS.TLS10 -> (3,1)
455 TLS.TLS10 -> (3,1)
428 TLS.TLS11 -> (3,2)
456 TLS.TLS11 -> (3,2)
429 TLS.TLS12 -> (3,3)
457 TLS.TLS12 -> (3,3)
458+#if MIN_VERSION_tls(1,5,0)
459+ TLS.TLS13 -> (3,4)
460+#endif
430 return TLS {
461 return TLS {
431 tlsMajorVersion = major
462 tlsMajorVersion = major
432 , tlsMinorVersion = minor
463 , tlsMinorVersion = minor