diff --git a/CursesClient.hs b/CursesClient.hs --- a/CursesClient.hs +++ b/CursesClient.hs @@ -18,6 +18,7 @@ import Control.Concurrent import Control.Exception (bracket, bracket_) +import Control.Monad import Control.Monad.State import Data.Char (isSpace) import Data.Function (on) diff --git a/LookupPetname.hs b/LookupPetname.hs --- a/LookupPetname.hs +++ b/LookupPetname.hs @@ -8,7 +8,6 @@ -- You should have received a copy of the GNU General Public License -- along with this program. If not, see http://www.gnu.org/licenses/. -{-# LANGUAGE Safe #-} {-# LANGUAGE TupleSections #-} module LookupPetname (lookupPetname, lookupOrAddPetname) where diff --git a/Mundanities.hs b/Mundanities.hs --- a/Mundanities.hs +++ b/Mundanities.hs @@ -8,8 +8,6 @@ -- You should have received a copy of the GNU General Public License -- along with this program. If not, see http://www.gnu.org/licenses/. -{-# LANGUAGE Safe #-} - module Mundanities where import Control.Applicative (Alternative, empty) diff --git a/Petname.hs b/Petname.hs --- a/Petname.hs +++ b/Petname.hs @@ -8,8 +8,6 @@ -- You should have received a copy of the GNU General Public License -- along with this program. If not, see http://www.gnu.org/licenses/. -{-# LANGUAGE Safe #-} - module Petname where import Control.Monad (msum) diff --git a/TLSTalk.hs b/TLSTalk.hs --- a/TLSTalk.hs +++ b/TLSTalk.hs @@ -27,7 +27,6 @@ import Data.X509.Validation (FailedReason (..), defaultChecks, defaultHooks, validate) import Network.Simple.TCP (connectSock, connectSockSOCKS5) -import Network.TLS as TLS import Network.TLS.Extra.Cipher import System.Directory (createDirectoryIfMissing) import System.Exit (exitFailure) @@ -47,6 +46,7 @@ import qualified Data.X509 as X import qualified Network.Simple.TCP as TCP import qualified Network.Socket as S +import qualified Network.TLS as TLS import Certificate import Config @@ -75,18 +75,18 @@ S.listen sock 1 pure sock -serve :: FilePath -> Config -> Credential -> IO () +serve :: FilePath -> Config -> TLS.Credential -> IO () serve ddir conf cred = errorOnNoLock <=< withTryFileLock listenLockPath Exclusive $ \_ -> do let params = def - { serverShared = def { sharedCredentials = Credentials [cred] } - , serverSupported = def - { supportedCiphers = talkatCiphersuite - , supportedVersions = [TLS13] } - , serverHooks = def - { onUnverifiedClientCert = pure True - , onClientCertificate = \_ -> pure CertificateUsageAccept + { TLS.serverShared = def { TLS.sharedCredentials = TLS.Credentials [cred] } + , TLS.serverSupported = def + { TLS.supportedCiphers = talkatCiphersuite + , TLS.supportedVersions = [TLS.TLS13] } + , TLS.serverHooks = def + { TLS.onUnverifiedClientCert = pure True + , TLS.onClientCertificate = \_ -> pure TLS.CertificateUsageAccept } - , serverWantClientCert = True + , TLS.serverWantClientCert = True } let port = show $ listen_port conf hostPref = case listen_host conf of @@ -110,9 +110,9 @@ serialMVar <- newMVar 0 TCP.serve hostPref port $ \(sock,_) -> do S.setSocketOption sock S.NoDelay 1 - context <- contextNew sock params - handshake context - mCert <- (takeTailCert =<<) <$> getClientCertificateChain context + context <- TLS.contextNew sock params + TLS.handshake context + mCert <- (takeTailCert =<<) <$> TLS.getClientCertificateChain context case mCert of Nothing -> pure () Just cert -> (if accept_unnamed conf @@ -141,18 +141,18 @@ = NoSocksProxy | Socks5Proxy String String -connect :: FilePath -> Config -> Credential -> String -> SocksProxy -> Host -> Fingerprint -> IO () +connect :: FilePath -> Config -> TLS.Credential -> String -> SocksProxy -> Host -> Fingerprint -> IO () connect ddir conf cred name socksProxy (Host hostname port) fp = do let serverId = if port == defaultTalkatPort then BS.empty else TS.encodeUtf8 . TS.pack . (':':) $ show port params = (TLS.defaultParamsClient hostname serverId) - { clientSupported = def - { supportedCiphers = talkatCiphersuite - , supportedVersions = [TLS13] } - , clientHooks = def - { onServerCertificate = checkServerCert - , onCertificateRequest = \(_,_,_) -> + { TLS.clientSupported = def + { TLS.supportedCiphers = talkatCiphersuite + , TLS.supportedVersions = [TLS.TLS13] } + , TLS.clientHooks = def + { TLS.onServerCertificate = checkServerCert + , TLS.onCertificateRequest = \(_,_,_) -> pure $ Just cred } } @@ -160,7 +160,7 @@ sock <- openSocket S.setSocketOption sock S.NoDelay 1 c <- TLS.contextNew sock params - handshake c >> pure c + TLS.handshake c >> pure c withSystemTempDirectory "htalkat" $ \tdir -> do let path = tdir "sock" bindingNamedSocket path $ \dSock -> do @@ -177,7 +177,7 @@ checkServerCert store cache service chain | Just cert <- takeTailCert chain = do errors <- filter (not . ignoreError) <$> validate X.HashSHA256 defaultHooks - (defaultChecks { checkExhaustive = True , checkLeafV3 = False }) store cache service chain + (defaultChecks { TLS.checkExhaustive = True , TLS.checkLeafV3 = False }) store cache service chain if fp == spkiFingerprint cert then pure errors else do putStrLn "Server provides an unexpected certificate!" @@ -192,12 +192,12 @@ ignoreError _ = False checkServerCert _ _ _ _ = pure [ EmptyChain ] -talkatCiphersuite :: [Cipher] +talkatCiphersuite :: [TLS.Cipher] talkatCiphersuite = - [ cipher_TLS13_AES128GCM_SHA256 - , cipher_TLS13_AES256GCM_SHA384 - , cipher_TLS13_CHACHA20POLY1305_SHA256 - , cipher_TLS13_AES128CCM_SHA256 + [ cipher13_AES_128_GCM_SHA256 + , cipher13_AES_256_GCM_SHA384 + , cipher13_CHACHA20_POLY1305_SHA256 + , cipher13_AES_128_CCM_SHA256 ] answerLast :: FilePath -> Config -> Maybe Fingerprint -> IO () diff --git a/Version.hs b/Version.hs --- a/Version.hs +++ b/Version.hs @@ -16,4 +16,4 @@ programName = "htalkat" version :: String -version = "0.1.2.6" +version = "0.1.2.7" diff --git a/htalkat.cabal b/htalkat.cabal --- a/htalkat.cabal +++ b/htalkat.cabal @@ -1,6 +1,6 @@ cabal-version: 1.18 name: htalkat -version: 0.1.2.6 +version: 0.1.2.7 license: GPL-3 license-file: COPYING maintainer: mbays@sdf.org @@ -58,19 +58,19 @@ build-depends: base >=4.9 && <5, array >=0.3 && <0.6, - asn1-encoding <0.10, - asn1-types >=0.3.4 && <0.4, + crypton-asn1-encoding >= 0.10 && <0.11, + crypton-asn1-types >=0.4.0 && <0.5, bytestring >=0.10.8.0 && <0.13, - containers >=0.5.5.1 && <0.8, - crypton >=0.26 && <1.1, + containers >=0.5.5.1 && <0.9, + crypton >=1.0.7 && <1.2, data-default-class >=0.1.2.0 && <0.3, data-hash >=0.2.0.1 && <0.3, directory >=1.2.1.0 && <1.4, exceptions >=0.10.4 && <0.11, filelock <0.2, filepath >=1.3.0.2 && <1.6, - hourglass >=0.2.12 && <0.3, - memory >=0.14 && <0.19, + time-hourglass >=0.2.12 && <0.4, + ram >=0.14 && <0.23, mtl >=2.0 && <2.4, network >=2.4.2.3 && <3.3, network-simple >=0.4.3 && <0.5, @@ -80,11 +80,11 @@ safe >=0.3.19 && <0.4, temporary >= 1.2 && <1.4, text >=1.1.0.0 && <2.2, - time <1.15, - tls >=1.5.4 && <2.2, + time <1.17, + tls >=1.5.4 && <2.5, transformers >=0.3.0.0 && <0.7, - crypton-x509 >=1.7.5 && <1.8, - crypton-x509-validation >=1.6.11 && <1.7 + crypton-x509 >=1.9.0 && <1.10, + crypton-x509-validation >=1.9.0 && <1.10 if os(windows) cpp-options: -DWINDOWS