gnutls/gnutls-implement-trust-store-dir.diff

From 513244e20eb057b37edfe326c164935758772a0f Mon Sep 17 00:00:00 2001
From: Ludwig Nussel <ludwig.nussel@suse.de>
Date: Tue, 8 May 2012 15:47:02 +0200
Subject: [PATCH gnutls] implement trust store dir

---
 configure.ac      |   18 ++++++++++++-
 lib/gnutls_x509.c |   72 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+), 1 deletions(-)

Index: gnutls-3.0.19/configure.ac
===================================================================
--- gnutls-3.0.19.orig/configure.ac
+++ gnutls-3.0.19/configure.ac
@@ -296,13 +296,23 @@ AC_ARG_WITH([default-trust-store-file],
   [AS_HELP_STRING([--with-default-trust-store-file=FILE],
     [use the given file default trust store])])
 
-if test "x$with_default_trust_store_pkcs11" = x -a "x$with_default_trust_store_file" = x; then
+AC_ARG_WITH([default-trust-store-dir],
+  [AS_HELP_STRING([--with-default-trust-store-dir=DIR],
+     [use the given directory default trust store])])
+
+if test "x$with_default_trust_store_pkcs11" = x -a "x$with_default_trust_store_file" = x \
+	 -a "x$with_default_trust_store_dir" = x; then
   # auto detect http://lists.gnu.org/archive/html/help-gnutls/2012-05/msg00004.html
   for i in \
+    /etc/ssl/certs \
     /etc/ssl/certs/ca-certificates.crt \
     /etc/pki/tls/cert.pem \
     /usr/local/share/certs/ca-root-nss.crt
     do
+    if test -d $i; then
+      with_default_trust_store_dir="$i"
+      break
+    fi
     if test -e $i; then
       with_default_trust_store_file="$i"
       break
@@ -315,6 +325,11 @@ if test "x$with_default_trust_store_file
     ["$with_default_trust_store_file"], [use the given file default trust store])
 fi
 
+if test "x$with_default_trust_store_dir" != x; then
+  AC_DEFINE_UNQUOTED([DEFAULT_TRUST_STORE_DIR],
+    ["$with_default_trust_store_dir"], [use the given directory default trust store])
+fi
+
 dnl Guile bindings.
 opt_guile_bindings=yes
 AC_MSG_CHECKING([whether building Guile bindings])
@@ -550,6 +565,7 @@ if features are disabled)
   Anon auth support:$ac_enable_anon
   Trust store pkcs: $with_default_trust_store_pkcs11
   Trust store file: $with_default_trust_store_file
+  Trust store dir:  $with_default_trust_store_dir
 ])
 
 AC_MSG_NOTICE([Optional applications:
Index: gnutls-3.0.19/lib/gnutls_x509.c
===================================================================
--- gnutls-3.0.19.orig/lib/gnutls_x509.c
+++ gnutls-3.0.19/lib/gnutls_x509.c
@@ -36,6 +36,7 @@
 #include <gnutls_pk.h>
 #include <gnutls_str.h>
 #include <debug.h>
+#include <dirent.h>
 #include <x509_b64.h>
 #include <gnutls_x509.h>
 #include "x509/common.h"
@@ -1618,6 +1619,72 @@ _gnutls_certificate_set_x509_system_trus
 }
 #endif
 
+#ifdef DEFAULT_TRUST_STORE_DIR
+static int
+_gnutls_certificate_set_x509_system_trust_dir (gnutls_certificate_credentials_t cred)
+{
+  DIR* dir;
+  struct dirent* buf, *de;
+  int ret, r = 0;
+  gnutls_datum_t cas;
+  size_t size;
+  char cafile[PATH_MAX];
+
+  dir = opendir(DEFAULT_TRUST_STORE_DIR);
+  if (dir == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  buf = alloca(offsetof(struct dirent, d_name) + pathconf(DEFAULT_TRUST_STORE_DIR, _PC_NAME_MAX) + 1);
+
+  while (1)
+    {
+      if (readdir_r(dir, buf, &de))
+	{
+	  gnutls_assert();
+	  break;
+	}
+      if (de == NULL)
+	{
+	  break;
+	}
+      if (strlen(de->d_name) < 4 || strcmp(de->d_name+strlen(de->d_name)-4, ".pem"))
+	{
+	  continue;
+	}
+
+      strcpy(cafile, DEFAULT_TRUST_STORE_DIR "/");
+      strncat(cafile, de->d_name, sizeof(cafile)-strlen(cafile)-1);
+      cas.data = (void*)read_binary_file (cafile, &size);
+      if (cas.data == NULL)
+	{
+	  gnutls_assert ();
+	  continue;
+	}
+
+      cas.size = size;
+
+      ret = gnutls_certificate_set_x509_trust_mem(cred, &cas, GNUTLS_X509_FMT_PEM);
+
+      free (cas.data);
+
+      if (ret < 0)
+	{
+	  gnutls_assert ();
+	}
+      else
+	{
+	  r += ret;
+	}
+    }
+  closedir(dir);
+
+  return r;
+}
+#endif
+
 /**
  * gnutls_certificate_set_x509_system_trust:
  * @cred: is a #gnutls_certificate_credentials_t structure.
@@ -1640,6 +1707,11 @@ gnutls_certificate_set_x509_system_trust
   if (ret > 0)
     r += ret;
 #endif
+#ifdef DEFAULT_TRUST_STORE_DIR
+  ret = _gnutls_certificate_set_x509_system_trust_dir(cred);
+  if (ret > 0)
+    r += ret;
+#endif
   return r;
 }