[PATCH proxmox-backup v4 7/8] pbs-client: honor already verified fingerprint

[Dominik Csapak <d.csapak@proxmox.com>]

When there is an invalid fingerprint or a mismatch and the client is
executed in an interactive way, the user is asked if he wants to trust
the fingerprint.

OpenSSL might evaluate the verify callback multiple times per
certificate (for different errors for example), so we have to check
if the fingerprint matches the one we already verified.

Otherwise the user gets multiple prompts directly after another.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 pbs-client/src/http_client.rs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pbs-client/src/http_client.rs b/pbs-client/src/http_client.rs
index 27f5a1782..f953a1e58 100644
--- a/pbs-client/src/http_client.rs
+++ b/pbs-client/src/http_client.rs
@@ -431,6 +431,18 @@ impl HttpClient {
             let interactive = options.interactive;
             let fingerprint_cache = options.fingerprint_cache;
             let prefix = options.prefix.clone();
+            let check_fp_verified = |verified_fingerprint: &Arc<Mutex<Option<String>>>,
+                                     fingerprint: &Fingerprint|
+             -> bool {
+                let verified = verified_fingerprint.lock().unwrap();
+                if let Some(verified) = &*verified {
+                    if *verified == fingerprint.to_string() {
+                        // already verified
+                        return true;
+                    }
+                }
+                false
+            };
             ssl_connector_builder.set_verify_callback(
                 openssl::ssl::SslVerifyMode::PEER,
                 move |valid, ctx| match openssl_verify_callback(
@@ -453,6 +465,9 @@ impl HttpClient {
                                 error!("certificate validation failed - failed to calculate FP - {error_stack}")
                             },
                             SslVerifyError::UntrustedCertificate { fingerprint } => {
+                                if check_fp_verified(&verified_fingerprint, &fingerprint) {
+                                    return true;
+                                }
                                 if interactive && std::io::stdin().is_terminal() {
                                     match Self::interactive_fp_check(prefix.as_deref(), &server, verified_fingerprint.clone(), fingerprint_cache, fingerprint) {
                                         Ok(()) => return true,
@@ -461,6 +476,9 @@ impl HttpClient {
                                 }
                             }
                             SslVerifyError::FingerprintMismatch { fingerprint, expected } => {
+                                if check_fp_verified(&verified_fingerprint, &fingerprint) {
+                                    return true;
+                                }
                                 warn!("WARNING: certificate fingerprint does not match expected fingerprint!");
                                 warn!("expected:    {expected}");
 
-- 
2.47.3