Allow specifying a directory as trust store

diff --git a/configure.ac b/configure.ac
index f7e8aaf250cbbb7858d2865e248a03410eb93a63..e3882af28e1c3c7d3a638cb35acc975fc5d1eaf0 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -492,11 +492,20 @@ if test "x$with_default_trust_store_pkcs11" != x; then
     ["$with_default_trust_store_pkcs11"], [use the given pkcs11 uri as default trust store])
 fi
 
+AC_ARG_WITH([default-trust-store-dir],
+  [AS_HELP_STRING([--with-default-trust-store-dir=DIR],
+    [use the given directory as default trust store])])
+
+if test "x$with_default_trust_store_dir" != x; then
+  AC_DEFINE_UNQUOTED([DEFAULT_TRUST_STORE_DIR],
+    ["$with_default_trust_store_dir"], [use the given directory as default trust store])
+fi
+
 dnl auto detect http://lists.gnu.org/archive/html/help-gnutls/2012-05/msg00004.html
 AC_ARG_WITH([default-trust-store-file],
   [AS_HELP_STRING([--with-default-trust-store-file=FILE],
     [use the given file default trust store])], with_default_trust_store_file="$withval",
-  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x;then
+  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x && test x$with_default_trust_store_dir = x;then
   for i in \
     /etc/ssl/ca-bundle.pem \
     /etc/ssl/certs/ca-certificates.crt \
@@ -823,6 +832,7 @@ AC_MSG_NOTICE([Optional libraries:
 AC_MSG_NOTICE([System files:
 
   Trust store pkcs11:   $with_default_trust_store_pkcs11
+  Trust store dir:      $with_default_trust_store_dir
   Trust store file:     $with_default_trust_store_file
   Blacklist file:       $with_default_blacklist_file
   CRL file:             $with_default_crl_file

diff --git a/lib/system.c b/lib/system.c
index 6677de0db42e077a6085397f8cfc5fa8d94101a4..42b4f43808e3eef43896e07b37caf7027bd61ead 100644 (file)
--- a/lib/system.c
+++ b/lib/system.c
@@ -468,13 +468,15 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
 
        return r;
 }
-#elif defined(ANDROID) || defined(__ANDROID__)
-#include <dirent.h>
-#include <unistd.h>
-static int load_dir_certs(const char *dirname,
-                         gnutls_x509_trust_list_t list,
-                         unsigned int tl_flags, unsigned int tl_vflags,
-                         unsigned type)
+#elif defined(ANDROID) || defined(__ANDROID__) || defined(DEFAULT_TRUST_STORE_DIR)
+
+# include <dirent.h>
+# include <unistd.h>
+
+# if defined(ANDROID) || defined(__ANDROID__)
+#  define DEFAULT_TRUST_STORE_DIR "/system/etc/security/cacerts/"
+
+static int load_revoked_certs(gnutls_x509_trust_list_t list, unsigned type)
 {
        DIR *dirp;
        struct dirent *d;
@@ -482,18 +484,18 @@ static int load_dir_certs(const char *dirname,
        int r = 0;
        char path[GNUTLS_PATH_MAX];
 
-       dirp = opendir(dirname);
+       dirp = opendir("/data/misc/keychain/cacerts-removed/");
        if (dirp != NULL) {
                do {
                        d = readdir(dirp);
                        if (d != NULL && d->d_type == DT_REG) {
-                               snprintf(path, sizeof(path), "%s/%s",
-                                        dirname, d->d_name);
+                               snprintf(path, sizeof(path),
+                                        "/data/misc/keychain/cacerts-removed/%s",
+                                        d->d_name);
 
                                ret =
-                                   gnutls_x509_trust_list_add_trust_file
-                                   (list, path, NULL, type, tl_flags,
-                                    tl_vflags);
+                                   gnutls_x509_trust_list_remove_trust_file
+                                   (list, path, type);
                                if (ret >= 0)
                                        r += ret;
                        }
@@ -504,8 +506,12 @@ static int load_dir_certs(const char *dirname,
 
        return r;
 }
+# endif
 
-static int load_revoked_certs(gnutls_x509_trust_list_t list, unsigned type)
+static int load_dir_certs(const char *dirname,
+                         gnutls_x509_trust_list_t list,
+                         unsigned int tl_flags, unsigned int tl_vflags,
+                         unsigned type)
 {
        DIR *dirp;
        struct dirent *d;
@@ -513,18 +519,18 @@ static int load_revoked_certs(gnutls_x509_trust_list_t list, unsigned type)
        int r = 0;
        char path[GNUTLS_PATH_MAX];
 
-       dirp = opendir("/data/misc/keychain/cacerts-removed/");
+       dirp = opendir(dirname);
        if (dirp != NULL) {
                do {
                        d = readdir(dirp);
                        if (d != NULL && d->d_type == DT_REG) {
-                               snprintf(path, sizeof(path),
-                                        "/data/misc/keychain/cacerts-removed/%s",
-                                        d->d_name);
+                               snprintf(path, sizeof(path), "%s/%s",
+                                        dirname, d->d_name);
 
                                ret =
-                                   gnutls_x509_trust_list_remove_trust_file
-                                   (list, path, type);
+                                   gnutls_x509_trust_list_add_trust_file
+                                   (list, path, NULL, type, tl_flags,
+                                    tl_vflags);
                                if (ret >= 0)
                                        r += ret;
                        }
@@ -536,6 +542,7 @@ static int load_revoked_certs(gnutls_x509_trust_list_t list, unsigned type)
        return r;
 }
 
+
 /* This works on android 4.x 
  */
 static
@@ -545,11 +552,12 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
        int r = 0, ret;
 
        ret =
-           load_dir_certs("/system/etc/security/cacerts/", list, tl_flags,
+           load_dir_certs(DEFAULT_TRUST_STORE_DIR, list, tl_flags,
                           tl_vflags, GNUTLS_X509_FMT_PEM);
        if (ret >= 0)
                r += ret;
 
+# if defined(ANDROID) || defined(__ANDROID__)
        ret = load_revoked_certs(list, GNUTLS_X509_FMT_DER);
        if (ret >= 0)
                r -= ret;
@@ -559,6 +567,7 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
                           tl_flags, tl_vflags, GNUTLS_X509_FMT_DER);
        if (ret >= 0)
                r += ret;
+# endif
 
        return r;
 }