[PATCH proxmox v4 3/8] http: tls: add warning if old check behavior is enabled and triggered

[Dominik Csapak <d.csapak@proxmox.com>]

only warn if we encounter the situation that a given fingerprint does
not match but we accept it anyway since openssl has priority due to
PROXMOX_OLD_TLS_CHECK=1.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 proxmox-http/Cargo.toml | 2 ++
 proxmox-http/src/tls.rs | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/proxmox-http/Cargo.toml b/proxmox-http/Cargo.toml
index cdc2861b..8a6af43c 100644
--- a/proxmox-http/Cargo.toml
+++ b/proxmox-http/Cargo.toml
@@ -21,6 +21,7 @@ http-body = { workspace = true, optional = true }
 http-body-util = { workspace = true, optional = true }
 hyper = { workspace = true, optional = true }
 hyper-util = { workspace = true, optional = true, features = ["http2"] }
+log = { workspace = true, optional = true }
 native-tls = { workspace = true, optional = true }
 openssl =  { version = "0.10", optional = true }
 serde = { workspace = true, optional = true }
@@ -110,6 +111,7 @@ websocket = [
     "body",
 ]
 tls = [
+    "dep:log",
     "dep:openssl",
     "dep:hex",
     "dep:thiserror",
diff --git a/proxmox-http/src/tls.rs b/proxmox-http/src/tls.rs
index abdf51e9..3c68be9d 100644
--- a/proxmox-http/src/tls.rs
+++ b/proxmox-http/src/tls.rs
@@ -176,6 +176,14 @@ pub fn openssl_verify_callback(
     let old_check = matches!(std::env::var(PROXMOX_OLD_TLS_CHECK_VAR).as_deref(), Ok("1"));
 
     if old_check && openssl_valid {
+        if ctx.error_depth() == 0 && expected_fp.is_some() && expected_fp != get_leaf_fp(ctx).ok() {
+            log::warn!(
+                "Mismatched fingerprint given, but openssl result was valid, ignoring fingerprint!"
+            );
+            log::warn!(
+                "To switch to new behavior remove PROXMOX_OLD_TLS_CHECK=1 from your environment."
+            );
+        }
         return Ok(());
     }
 
-- 
2.47.3