Network.Wai.Handler.WarpTLS

warp-tls-3.2.3: HTTP over TLS support for Warp via the TLS package

Safe Haskell | None
Language | Haskell98

Network.Wai.Handler.WarpTLS

Contents

- Settings
- Smart constructors
- Accessors
- Runner
- Exception

Description

HTTP over TLS support for Warp via the TLS package.

If HTTP/2 is negotiated by ALPN, HTTP/2 over TLS is used. Otherwise HTTP/1.1 over TLS is used.

Support for SSL is now obsoleted.

Synopsis

- data TLSSettings
- defaultTlsSettings :: TLSSettings
- tlsSettings :: FilePath -> FilePath -> TLSSettings
- tlsSettingsMemory :: ByteString -> ByteString -> TLSSettings
- tlsSettingsChain :: FilePath -> [FilePath] -> FilePath -> TLSSettings
- tlsSettingsChainMemory :: ByteString -> [ByteString] -> ByteString -> TLSSettings
- certFile :: TLSSettings -> FilePath
- keyFile :: TLSSettings -> FilePath
- tlsLogging :: TLSSettings -> Logging
- tlsAllowedVersions :: TLSSettings -> [Version]
- tlsCiphers :: TLSSettings -> [Cipher]
- tlsWantClientCert :: TLSSettings -> Bool
- tlsServerHooks :: TLSSettings -> ServerHooks
- tlsServerDHEParams :: TLSSettings -> Maybe Params
- onInsecure :: TLSSettings -> OnInsecure
- data OnInsecure
  - = DenyInsecure ByteString
  - | AllowInsecure
- runTLS :: TLSSettings -> Settings -> Application -> IO ()
- runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()
- data WarpTLSException = InsecureConnectionDenied
- data Params :: *
- generateParams :: MonadRandom m => Int -> Integer -> m Params

# Settings

data TLSSettings #

Settings for WarpTLS.

defaultTlsSettings :: TLSSettings #

Default `TLSSettings`. Use this to create `TLSSettings` with the field record name (aka accessors).

# Smart constructors

tlsSettings #

Arguments

:: FilePath | Certificate file
-> FilePath | Key file
-> TLSSettings |

A smart constructor for `TLSSettings` based on `defaultTlsSettings`.

tlsSettingsMemory #

Arguments

:: ByteString | Certificate bytes
-> ByteString | Key bytes
-> TLSSettings |

A smart constructor for `TLSSettings`, but uses in-memory representations of the certificate and key based on `defaultTlsSettings`.

Since 3.0.1

tlsSettingsChain #

Arguments

:: FilePath | Certificate file
-> [FilePath] | Chain certificate files
-> FilePath | Key file
-> TLSSettings |

A smart constructor for `TLSSettings` that allows specifying chain certificates based on `defaultTlsSettings`.

Since 3.0.3

tlsSettingsChainMemory #

Arguments

:: ByteString | Certificate bytes
-> [ByteString] | Chain certificate bytes
-> ByteString | Key bytes
-> TLSSettings |

A smart constructor for `TLSSettings`, but uses in-memory representations of the certificate and key based on `defaultTlsSettings`.

Since 3.0.3

# Accessors

certFile :: TLSSettings -> FilePath #

File containing the certificate.

keyFile :: TLSSettings -> FilePath #

File containing the key

tlsLogging :: TLSSettings -> Logging #

The level of logging to turn on.

Default: `defaultLogging`.

Since 1.4.0

tlsAllowedVersions :: TLSSettings -> [Version] #

The TLS versions this server accepts.

    >>> tlsAllowedVersions defaultTlsSettings
    [TLS12,TLS11,TLS10]

Since 1.4.2

tlsCiphers :: TLSSettings -> [Cipher] #

The TLS ciphers this server accepts.

    >>> tlsCiphers defaultTlsSettings
    [ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256-SHA256,DHE-RSA-AES128-SHA256,DHE-RSA-AES256-SHA1,DHE-RSA-AES128-SHA1,DHE-DSA-AES128-SHA1,DHE-DSA-AES256-SHA1,RSA-aes128-sha1,RSA-aes256-sha1]

Since 1.4.2

tlsWantClientCert :: TLSSettings -> Bool #

Whether or not to demand a certificate from the client. If this is set to True, you must handle received certificates in a server hook or all connections will fail.

    >>> tlsWantClientCert defaultTlsSettings
    False

Since 3.0.2

tlsServerHooks :: TLSSettings -> ServerHooks #

The server-side hooks called by the tls package, including actions to take when a client certificate is received. See the Network.TLS module for details.

Default: def

Since 3.0.2

tlsServerDHEParams :: TLSSettings -> Maybe Params #

Configuration for ServerDHEParams more function lives in `cryptonite` package

Default: Nothing

Since 3.2.2

onInsecure :: TLSSettings -> OnInsecure #

Do we allow insecure connections with this server as well?

    >>> onInsecure defaultTlsSettings
    DenyInsecure "This server only accepts secure HTTPS connections."

Since 1.4.0

data OnInsecure #

An action when a plain HTTP comes to HTTP over TLS/SSL port.

Constructors

DenyInsecure ByteString |
AllowInsecure |

Instances

Show OnInsecure # |
Methods showsPrec :: Int -> OnInsecure -> ShowS # show :: OnInsecure -> String # showList :: [OnInsecure] -> ShowS #

# Runner

runTLS :: TLSSettings -> Settings -> Application -> IO () #

Running `Application` with `TLSSettings` and `Settings`.

runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO () #

Running `Application` with `TLSSettings` and `Settings` using specified `Socket`.

# Exception

data WarpTLSException #

Constructors

InsecureConnectionDenied |

Instances

Show WarpTLSException # |
Methods showsPrec :: Int -> WarpTLSException -> ShowS # show :: WarpTLSException -> String # showList :: [WarpTLSException] -> ShowS #
Exception WarpTLSException # |
Methods toException :: WarpTLSException -> SomeException # fromException :: SomeException -> Maybe WarpTLSException # displayException :: WarpTLSException -> String #

data Params :: * #

Represent Diffie Hellman parameters namely P (prime), and G (generator).

Instances

Eq Params |
Methods (==) :: Params -> Params -> Bool # (/=) :: Params -> Params -> Bool #
Data Params |
Methods gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> Params -> c Params # gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c Params # toConstr :: Params -> Constr # dataTypeOf :: Params -> DataType # dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c Params) # dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c Params) # gmapT :: (forall b. Data b => b -> b) -> Params -> Params # gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> Params -> r # gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> Params -> r # gmapQ :: (forall d. Data d => d -> u) -> Params -> [u] # gmapQi :: Int -> (forall d. Data d => d -> u) -> Params -> u # gmapM :: Monad m => (forall d. Data d => d -> m d) -> Params -> m Params # gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> Params -> m Params # gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> Params -> m Params #
Read Params |
Methods readsPrec :: Int -> ReadS Params # readList :: ReadS [Params] # readPrec :: ReadPrec Params # readListPrec :: ReadPrec [Params] #
Show Params |
Methods showsPrec :: Int -> Params -> ShowS # show :: Params -> String # showList :: [Params] -> ShowS #

generateParams #

Arguments

:: MonadRandom m |
=> Int | number of bits
-> Integer | generator
-> m Params |

generate params from a specific generator (2 or 5 are common values) we generate a safe prime (a prime number of the form 2p+1 where p is also prime)