[PATCH proxmox v3 2/6] http: tls: use legacy behavior when PROXMOX_NEW_TLS_CHECK is not set

[Dominik Csapak <d.csapak@proxmox.com>]

if that environment variable is not set to "1", give the openssl result
priority, and potentially ignore a given fingerprint that is not
matching. If that's the case, print a warning.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 proxmox-http/Cargo.toml |  2 ++
 proxmox-http/src/tls.rs | 31 +++++++++++++++++++++++++------
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/proxmox-http/Cargo.toml b/proxmox-http/Cargo.toml
index e4bff930..aadb6a42 100644
--- a/proxmox-http/Cargo.toml
+++ b/proxmox-http/Cargo.toml
@@ -20,6 +20,7 @@ http-body = { workspace = true, optional = true }
 http-body-util = { workspace = true, optional = true }
 hyper = { workspace = true, optional = true }
 hyper-util = { workspace = true, optional = true, features = ["http2"] }
+log = { workspace = true, optional = true }
 native-tls = { workspace = true, optional = true }
 openssl =  { version = "0.10", optional = true }
 serde_json = { workspace = true, optional = true }
@@ -107,6 +108,7 @@ websocket = [
     "body",
 ]
 tls = [
+    "dep:log",
     "dep:openssl",
     "dep:thiserror",
 ]
diff --git a/proxmox-http/src/tls.rs b/proxmox-http/src/tls.rs
index 7365230e..635b0e7f 100644
--- a/proxmox-http/src/tls.rs
+++ b/proxmox-http/src/tls.rs
@@ -27,19 +27,31 @@ pub enum SslVerifyError {
 
 /// Intended as an openssl verification callback.
 ///
-/// The following things are checked:
+/// If the 'PROXMOX_NEW_TLS_CHECK' environment variable is set to "1",
+/// the following things are checked:
 ///
 /// * If no fingerprint is given, return the openssl verification result
-/// * If a fingerprint is given, do:
-///     * Ignore all non-leaf certificates/
+/// * If a fingerprint is given, ignore all non-leaf certificates
+///
+/// Otherwise, we trust the openssl result if the whole chain was trusted
 pub fn openssl_verify_callback(
     openssl_valid: bool,
     ctx: &mut X509StoreContextRef,
     expected_fp: Option<&str>,
 ) -> Result<(), SslVerifyError> {
     let trust_openssl = ctx.error() != X509VerifyResult::APPLICATION_VERIFICATION;
-    if expected_fp.is_none() && openssl_valid && trust_openssl {
-        return Ok(());
+
+    let new_check = matches!(std::env::var("PROXMOX_NEW_TLS_CHECK").as_deref(), Ok("1"));
+
+    if openssl_valid && trust_openssl {
+        if new_check && expected_fp.is_none() {
+            return Ok(());
+        }
+
+        // legacy mode: skip all valid certs except the leaf, so we can warn if fingerprint does not match
+        if !new_check && ctx.error_depth() > 0 {
+            return Ok(());
+        }
     }
 
     let cert = match ctx.current_cert() {
@@ -50,7 +62,7 @@ pub fn openssl_verify_callback(
     };
 
     if ctx.error_depth() > 0 {
-        // openssl was not valid, but we want to continue, so save that we don't trust openssl
+        // if openssl is not valid, and we want to continue, save that we don't trust openssl
         ctx.set_error(X509VerifyResult::APPLICATION_VERIFICATION);
         return Ok(());
     }
@@ -65,6 +77,13 @@ pub fn openssl_verify_callback(
             ctx.set_error(X509VerifyResult::OK);
             Ok(())
         } else {
+            if !new_check && openssl_valid && trust_openssl {
+                log::warn!(
+                    "Certificate chain valid, but fingerprint does not match, ignoring fingerprint! To prioritize the fingerprint, set `PROXMOX_NEW_TLS_CHECK=1` in your environment."
+                );
+                return Ok(());
+            }
+
             Err(SslVerifyError::FingerprintMismatch {
                 fingerprint,
                 expected: expected_fp.to_string(),
-- 
2.47.3