Example for wss, not just ws?

[barafael]

I managed to get the lib to work nicely for my server application. I can connect to the ws-based URL from my javascript console nicely. However, when I try to connect to the same URL but with wss, I get "invalid token", which I guess means that something goes wrong during the connection upgrade.

Can this lib be used with wss as well? If yes, would it make sense to add an example for it?

[Gelbpunkt]

The library includes support for client-side TLS. Server-side TLS setup is currently not supported out of the box, I recommend running it behind a reverse proxy like nginx for that.

[barafael]

Alright, I can work with that :) thanks!

[Gelbpunkt]

Alright, I can work with that :) thanks!

I've added an example of how to use tokio-websockets with rustls server-side in 1ebbc60. I hope that clears things up!
Corresponding client used for testing:

import asyncio
import pathlib
import ssl

from websockets.client import connect

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
localhost_pem = pathlib.Path("/path/to/certs/localhost.crt")
ssl_context.load_verify_locations(localhost_pem)


async def main():
    async with connect("wss://localhost:8080", ssl=ssl_context) as websocket:
        message = await websocket.recv()
        print(f"Received: {message}")


asyncio.run(main())

[barafael]

It works nicely!

I have tried to extend my Rust client to be like the Python one you are showing. Here's what I got:

use futures_util::SinkExt;
use http::Uri;
use native_tls::Identity;
use tokio_websockets::ClientBuilder;

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    let uri = Uri::from_static("wss://0.0.0.0:8080");
    let bytes = std::fs::read("certs/identity.pfx")?;
    let identity = Identity::from_pkcs12(&bytes, "")?;
    let connector = native_tls::TlsConnector::builder()
        .identity(identity)
        .build()?;
    let connector = tokio_websockets::Connector::NativeTls(connector.into());

    let mut client = ClientBuilder::from_uri(uri)
        .connector(&connector)
        .connect()
        .await?;

    client
        .send(tokio_websockets::Message::text(
            "Hi there server".to_string(),
        ))
        .await?;

    client.close(None, None).await?;
    Ok(())
}

When I run this, I get a friendly:

Error: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1889: (self-signed certificate)

I guess that's true - I did self-sign those using your shell script. However, with the python file it works, so what gives? Anything stands out to you?

[Gelbpunkt]

use http::Uri;
use tokio_native_tls::native_tls::{Certificate, TlsConnector};
use tokio_websockets::{ClientBuilder, Error};

#[tokio::main]
async fn main() -> Result<(), Error> {
    let uri = Uri::from_static("wss://127.0.0.1:8080");
    let bytes = std::fs::read("certs/localhost.crt")?;
    let cert = Certificate::from_pem(&bytes)?;
    let connector = TlsConnector::builder().add_root_certificate(cert).build()?;
    let connector = tokio_websockets::Connector::NativeTls(connector.into());

    let mut client = ClientBuilder::from_uri(uri)
        .connector(&connector)
        .connect()
        .await?;

    let msg = client.next().await;

    println!("Got message: {msg:?}");

    client.close(None, None).await?;

    Ok(())
}

This works for me. It obviously requires setting subjectAltName=IP:127.0.0.1 in the script (for some reason localhost just never works from me in Rust code so I quickly wrote that python client yesterday to demonstrate it. I only figured how to generate a certificate for an IP today...)

[barafael]

It works! Your "obvious" remark did the trick, I'd never have figured it out otherwise. I'm happy now and can go to sleep, knowing the bytes can traverse the websocket securely. On localhost no less. Thank you!