@@ -30,6 +30,7 @@ module Network.Wai.Handler.WarpTLS (
3030 , tlsCiphers
3131 , tlsWantClientCert
3232 , tlsServerHooks
33+ , tlsServerDHEParams
3334 , onInsecure
3435 , OnInsecure (..)
3536 -- * Runner
@@ -37,6 +38,8 @@ module Network.Wai.Handler.WarpTLS (
3738 , runTLSSocket
3839 -- * Exception
3940 , WarpTLSException (..)
41+ , DH.Params
42+ , DH.generateParams
4043 ) where
4144
4245#if __GLASGOW_HASKELL__ < 709
@@ -55,6 +58,7 @@ import Data.Typeable (Typeable)
5558import Network.Socket (Socket, sClose, withSocketsDo, SockAddr, accept)
5659import Network.Socket.ByteString (sendAll)
5760import qualified Network.TLS as TLS
61+import qualified Crypto.PubKey.DH as DH
5862import qualified Network.TLS.Extra as TLSExtra
5963import Network.Wai (Application)
6064import Network.Wai.Handler.Warp
@@ -118,6 +122,13 @@ data TLSSettings = TLSSettings {
118122 -- Default: def
119123 --
120124 -- Since 3.0.2
125+ , tlsServerDHEParams :: Maybe DH.Params
126+ -- ^ Configuration for ServerDHEParams
127+ -- more function lives in `cryptonite` package
128+ --
129+ -- Default: Nothing
130+ --
131+ -- Since 3.2.2
121132 }
122133
123134-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).
@@ -135,6 +146,7 @@ defaultTlsSettings = TLSSettings {
135146 , tlsCiphers = ciphers
136147 , tlsWantClientCert = False
137148 , tlsServerHooks = def
149+ , tlsServerDHEParams = Nothing
138150 }
139151
140152-- taken from stunnel example in tls-extra
@@ -250,7 +262,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
250262 params = def { -- TLS.ServerParams
251263 TLS.serverWantClientCert = tlsWantClientCert
252264 , TLS.serverCACertificates = []
253− , TLS.serverDHEParams = Nothing
265+ , TLS.serverDHEParams = tlsServerDHEParams
254266 , TLS.serverHooks = hooks
255267 , TLS.serverShared = shared
256268 , TLS.serverSupported = supported