[Spice-devel] [spice-gtk] Use system-wide trust certificate store

[Christophe Fergeau]

Currently, spice-gtk will look in $HOME/.spicec/spice_truststore.pem
by default for its trust certificate store (to verify the certificates
used during SPICE TLS connections). However, these days a system-wide
trust store can be found in /etc/pki or /etc/ssl.
This commit checks at compile time where the trust store is located,
and then loads it before loading the user-specified trust store.
This can be disabled at compile time using --without-ca-certificates.
---
 configure.ac        | 25 +++++++++++++++++++++++++
 gtk/spice-channel.c | 21 ++++++++++++++-------
 2 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/configure.ac b/configure.ac
index 74738a3..bf08c42 100644
--- a/configure.ac
+++ b/configure.ac
@@ -108,6 +108,31 @@ AC_SUBST(SSL_CFLAGS)
 AC_SUBST(SSL_LIBS)
 SPICE_GLIB_REQUIRES="${SPICE_GLIB_REQUIRES} openssl"
 
+dnl Stolen from glib-networking - those guys rock
+AC_MSG_CHECKING([location of system Certificate Authority list])
+AC_ARG_WITH(ca-certificates,
+            [AC_HELP_STRING([--with-ca-certificates=@<:@path@:>@],
+                            [path to system Certificate Authority list])])
+if test "$with_ca_certificates" = "no"; then
+    AC_MSG_RESULT([disabled])
+else
+    if test -z "$with_ca_certificates"; then
+        for f in /etc/pki/tls/certs/ca-bundle.crt \
+                 /etc/ssl/certs/ca-certificates.crt \
+                 /etc/ssl/ca-bundle.pem; do
+            if test -f "$f"; then
+                with_ca_certificates="$f"
+            fi
+        done
+        if test -z "$with_ca_certificates"; then
+            AC_MSG_ERROR([could not find. Use --with-ca-certificates=path to set, or --without-ca-certificates to disable])
+        fi
+    fi
+
+    AC_MSG_RESULT($with_ca_certificates)
+    AC_DEFINE_UNQUOTED(SPICE_SYSTEM_CA_FILE, ["$with_ca_certificates"], [The system TLS CA list])
+fi
+
 dnl Cyrus SASL
 AC_ARG_WITH([sasl],
   [AS_HELP_STRING([--with-sasl=@<:@yes/no/auto@:>@], [use cyrus SASL for authentication @<:@default=auto@:>@])],
diff --git a/gtk/spice-channel.c b/gtk/spice-channel.c
index b01b820..ab07453 100644
--- a/gtk/spice-channel.c
+++ b/gtk/spice-channel.c
@@ -2159,6 +2159,7 @@ static int spice_channel_load_ca(SpiceChannel *channel)
     guint8 *ca;
     guint size;
     const gchar *ca_file;
+    int rc;
 
     g_return_val_if_fail(c->ctx != NULL, 0);
 
@@ -2189,13 +2190,19 @@ static int spice_channel_load_ca(SpiceChannel *channel)
         sk_X509_INFO_pop_free(inf, X509_INFO_free);
     }
 
-    if (ca_file != NULL) {
-        int rc = SSL_CTX_load_verify_locations(c->ctx, ca_file, NULL);
-        if (rc != 1)
-            g_warning("loading ca certs from %s failed", ca_file);
-        else
-            count++;
-    }
+#ifdef SPICE_SYSTEM_CA_FILE
+    rc = SSL_CTX_load_verify_locations(c->ctx, SPICE_SYSTEM_CA_FILE, NULL);
+    if (rc != 1)
+        g_warning("loading ca certs from %s failed", ca_file);
+    else
+        count++;
+#endif
+
+    rc = SSL_CTX_load_verify_locations(c->ctx, ca_file, NULL);
+    if (rc != 1)
+        g_warning("loading ca certs from %s failed", ca_file);
+    else
+        count++;
 
     return count;
 }
-- 
1.8.3.1