Re: [PATCH proxmox{,-backup,-websocket-tunnel} v3 0/6] unify openssl callback logic

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Jun 17, 2026 at 10:59 AM CEST, Dominik Csapak wrote:
> There are currently 3+ slightly different implementations of the openssl
> verify callback in place. They differ in how an explicit fingerprint
> would be checked:

first off, thanks for tackling this. unifying this behavior makes a lot
of sense imo.

-->8 snip 8<--

> The last patch of the proxmox-http crate is to preserve backwards compatibility
> with the current pbs client behavior, but can be switched to the new 'correct'
> one via environment variable (which we might want to enable automatically for
> the websocket-tunnel?)

after discussing this with fabian we came to conclusion that this
behavior should probably be opt-out, not opt-in. we can opt-in existing
installs on update, but avoid having new installs and new users use the
old behavior by accident.

personally, websocket-tunnel should definitively be kept at its current
behavior. leting it regress to "wrong" behavior sounds wrong to me.

-->8 snip 8<--

> I tried to implement some tests, but due to the openssl interface this
> seems to be not really possible, except if we'd start a server + client
> in the tests (which seems overkill). But if anyone has an idea how we
> could test this code (and i mean not only it's interface, but the
> openssl connection behavior), I'd be glad.

as discussed off list, adding tests for this does make a lot of sense.
even if it means manually spawning a server that we can test against. we
already do something similar for other crates such as `proxmox-ldap` and
as you pointed out, we managed to get this "wrong" several times over,
so the effort is imo justified.

attached to this review, i send three patches that implement such tests.
these three are intended to be applied on top of your patches for the
"proxmox" repo. feel free to either incorporate them into your series or
adjust them/provide feedback on them :)

> This series partially overlaps/interferes with shannons recent series:
> https://lore.proxmox.com/pdm-devel/20260611120327.257523-1-s.sterz@proxmox.com/
>
> Depending on whether this or shannons series is applied first, I'd either
> send a follow-up for PDM or a new version rebased on shannons.

btw. same here, i'd also be up for merging parts of these series if it
makes reviewing/applying them easier.

-->8 snip 8<--