warp-tls 3.4.15 → 3.4.16

raw patch · 5 files changed

+44/−16 lines, 5 filesPVP: major bump suggested

API removals or changes: PVP suggests a major version bump

API changes (from Hackage documentation)

Files

• ChangeLog.md +9/−0
• Network/Wai/Handler/WarpTLS.hs +2/−1
• Network/Wai/Handler/WarpTLS/Internal.hs +11/−0
• test/Spec.hs +21/−14
• warp-tls.cabal +1/−1

@@ -1,5 +1,14 @@ # ChangeLog +## 3.4.16++`tlsEarlyDataSize` defaults to 0, so 0-RTT is off unless a server asks for+it: a request in early data is replayable and warp-tls has no RFC 8470+handling.++* Let a server say how much TLS early data it accepts.+  [#1145](https://github.com/yesodweb/wai/pull/1145)+ ## 3.4.15  * The first read of a connection is given up on when the handshake

@@ -47,6 +47,7 @@     tlsServerDHEParams,     tlsSessionManagerConfig,     tlsSessionManager,+    tlsEarlyDataSize,     onInsecure,     OnInsecure (..), @@ -314,7 +315,7 @@             , TLS.serverShared = shared             , TLS.serverSupported = supported #if MIN_VERSION_tls(1,5,0)-            , TLS.serverEarlyDataSize = 2018+            , TLS.serverEarlyDataSize = tlsEarlyDataSize #endif             }     -- Adding alpn to user's tlsServerHooks.

@@ -124,6 +124,16 @@     -- priority. See the "Network.TLS" module for details     --     --   Since 3.3.3+    , tlsEarlyDataSize :: Int+    -- ^ The largest TLS 1.3 early data this server accepts, 0 for none.+    -- A request sent in early data can be replayed by anyone who+    -- recorded it, and warp-tls does nothing about that: it has no RFC+    -- 8470 handling and no 425 response. So 0-RTT is off unless this+    -- says otherwise.+    --+    -- Default: 0+    --+    --   Since 3.4.16     }  -- Since 3.3.1@@ -154,6 +164,7 @@         , tlsCredentials = Nothing         , tlsSessionManager = Nothing         , tlsSupportedHashSignatures = TLS.supportedHashSignatures TLS.defaultSupported+        , tlsEarlyDataSize = 0         }  -- taken from stunnel example in tls-extra

@@ -16,21 +16,28 @@ import Test.Hspec  main :: IO ()-main = hspec $ describe "pre-TLS exception peer (#1113)" $ do-    it "attributes sequential plaintext and premature-close failures to their sockets" $-        exercise [1, 1] False-    it "attributes concurrent plaintext and premature-close failures to their sockets" $-        exercise [1, 1] True+main = hspec $ do+    describe "early data" $+        -- A request in early data is replayable and warp-tls has no RFC+        -- 8470 handling, so 0-RTT is off until a server asks for it.+        it "is not accepted unless asked for" $+            TLS.tlsEarlyDataSize TLS.defaultTlsSettings `shouldBe` 0 -    -- Linux provides the whole 127/8 loopback range without interface aliases.-    -- Keep the original two-IP regression there; other platforms still check-    -- exact socket addresses (including source ports) above. The maker tests-    -- additionally check distinct IPs without binding sockets on every platform.-    when (os == "linux") $ do-        it "attributes sequential failures from distinct loopback IPs" $-            exercise [1, 2] False-        it "attributes concurrent failures from distinct loopback IPs" $-            exercise [1, 2] True+    describe "pre-TLS exception peer (#1113)" $ do+        it "attributes sequential plaintext and premature-close failures to their sockets" $+            exercise [1, 1] False+        it "attributes concurrent plaintext and premature-close failures to their sockets" $+            exercise [1, 1] True++        -- Linux provides the whole 127/8 loopback range without interface aliases.+        -- Keep the original two-IP regression there; other platforms still check+        -- exact socket addresses (including source ports) above. The maker tests+        -- additionally check distinct IPs without binding sockets on every platform.+        when (os == "linux") $ do+            it "attributes sequential failures from distinct loopback IPs" $+                exercise [1, 2] False+            it "attributes concurrent failures from distinct loopback IPs" $+                exercise [1, 2] True  -- These regressions deliberately leave Warp's accept and fork hooks alone. -- Keep both peers and failure kinds when changing the exception observer.

@@ -1,5 +1,5 @@ Name:                warp-tls-Version:             3.4.15+Version:             3.4.16 Synopsis:            HTTP over TLS support for Warp via the TLS package License:             MIT License-file:        LICENSE