Re: [PATCH proxmox-websocket-tunnel v4 8/8] use proxmox-http's openssl callback

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Jul 1, 2026 at 12:30 PM CEST, Dominik Csapak wrote:
> no functional change intended, since the callback there should implement
> the same behavior.
>
> With this change, we can now drop the hex and itertools dependency.
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  Cargo.toml  |  4 +--
>  src/main.rs | 76 +++++++++++++++++++++++++----------------------------
>  2 files changed, 37 insertions(+), 43 deletions(-)
>
> diff --git a/Cargo.toml b/Cargo.toml
> index 02ac3d1..7b5ced6 100644
> --- a/Cargo.toml
> +++ b/Cargo.toml
> @@ -13,11 +13,9 @@ anyhow = "1.0"
>  proxmox-base64 = "1"
>  futures = "0.3"
>  futures-util = "0.3"
> -hex = "0.4"
>  http = "1"
>  hyper = "1"
>  hyper-util = "0.1"
> -itertools = "0.13"
>  openssl = "0.10"
>  percent-encoding = "2"
>  serde = { version = "1.0", features = ["derive"] }
> @@ -26,5 +24,5 @@ tokio = { version = "1", features = ["io-std", "io-util", "macros", "rt-multi-th
>  tokio-stream = { version = "0.1", features = ["io-util"] }
>  tokio-util = "0.7"
>
> -proxmox-http = { version = "1", features = ["websocket", "client"] }
> +proxmox-http = { version = "1", features = ["websocket", "client", "tls"] }
>  proxmox-sys = "1"
> diff --git a/src/main.rs b/src/main.rs
> index 6d86575..b79528e 100644
> --- a/src/main.rs
> +++ b/src/main.rs
> @@ -1,6 +1,7 @@
>  use anyhow::{bail, format_err, Error};
>
>  use std::collections::VecDeque;
> +use std::str::FromStr;
>  use std::sync::Arc;
>
>  use futures::future::FutureExt;
> @@ -25,7 +26,7 @@ use tokio_stream::StreamExt;
>
>  use proxmox_http::client::HttpsConnector;
>  use proxmox_http::websocket::{OpCode, WebSocket, WebSocketReader, WebSocketWriter};
> -use proxmox_http::Body;
> +use proxmox_http::{Body, Fingerprint, SslVerifyError};
>
>  #[derive(Serialize, Deserialize, Debug)]
>  #[serde(rename_all = "kebab-case")]
> @@ -141,49 +142,44 @@ impl CtrlTunnel {

-->8 snip 8<--
>              headers.insert(name, value);
> +                move |valid, ctx| match proxmox_http::openssl_verify_callback(
> +                    valid,
> +                    ctx,
> +                    fingerprint.clone(),
> +                ) {
> +                    Ok(()) => true,
> +                    Err(err) => {
> +                        match err {
> +                            SslVerifyError::NoCertificate => {
> +                                eprintln!("SSL context lacks current certificate");
> +                            }

similar to the nit in 6/8. though this is imo already better, but i'd
personally would like to avoid the word "context".

-->8 snip 8<--