From 1977c5fcc7c44a7c01a295954d3ed1d55ef8fd8f Mon Sep 17 00:00:00 2001
From: Ludwig Nussel <ludwig.nussel@suse.de>
Date: Tue, 6 Aug 2013 15:12:04 +0200
Subject: [PATCH] use system's default certificate store

instead of hardcoding the path to some bundle file call
gnutls_certificate_set_x509_system_trust() which knows what kind of
store the operating system uses as not all use a bundle file. Moreover,
there are efforts to change gnutls to use the pkcs11 interface as trust
store in the future. Therefore no actually usable filesystem location
might exist in the future anymore.
---
 CMakeLists.txt         | 9 +++++----
 config.h.cmake         | 2 +-
 configure.ac           | 7 +++----
 src/core/wee-config.c  | 5 ++++-
 src/core/wee-network.c | 6 ++++++
 5 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 06ee1d5..988e808 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -100,11 +100,12 @@ MARK_AS_ADVANCED(CLEAR WEECHAT_HOME)
 
 # option CA_FILE
 IF(NOT DEFINED CA_FILE OR "${CA_FILE}" STREQUAL "")
-  SET(CA_FILE "/etc/ssl/certs/ca-certificates.crt")
-ENDIF(NOT DEFINED CA_FILE OR "${CA_FILE}" STREQUAL "")
-SET(CA_FILE "${CA_FILE}" CACHE
-  STRING "File containing the certificate authorities (default is \"/etc/ssl/certs/ca-certificates.crt\"). This is the default value of option \"weechat.network.gnutls_ca_file\"."
+  SET(CA_FILE NULL)
+ELSE(NOT DEFINED CA_FILE OR "${CA_FILE}" STREQUAL "")
+SET(CA_FILE "\"${CA_FILE}\"" CACHE
+  STRING "File containing the certificate authorities (default is to use system defaults). This is the default value of option \"weechat.network.gnutls_ca_file\"."
   FORCE)
+ENDIF(NOT DEFINED CA_FILE OR "${CA_FILE}" STREQUAL "")
 MARK_AS_ADVANCED(CLEAR CA_FILE)
 
 IF(ENABLE_NLS)
diff --git a/config.h.cmake b/config.h.cmake
index 6e1fd06..6847d58 100644
--- a/config.h.cmake
+++ b/config.h.cmake
@@ -14,5 +14,5 @@
 #define WEECHAT_SHAREDIR "@SHAREDIR@"
 #define LOCALEDIR "@LOCALEDIR@"
 #define WEECHAT_HOME "@WEECHAT_HOME@"
-#define CA_FILE "@CA_FILE@"
+#define CA_FILE @CA_FILE@
 #define _GNU_SOURCE 1
diff --git a/configure.ac b/configure.ac
index ac3755f..96afea7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -163,10 +163,9 @@ if test "x$WEECHAT_HOME" = "x" ; then
 fi
 AC_DEFINE_UNQUOTED(WEECHAT_HOME, "$WEECHAT_HOME")
 
-if test "x$CA_FILE" = "x" ; then
-    CA_FILE="/etc/ssl/certs/ca-certificates.crt"
+if test "x$CA_FILE" != "x" ; then
+  AC_DEFINE_UNQUOTED(CA_FILE, "$CA_FILE")
 fi
-AC_DEFINE_UNQUOTED(CA_FILE, "$CA_FILE")
 
 not_asked=""
 not_found=""
@@ -1241,7 +1240,7 @@ echo "   Optional features...... :$listoptional"
 echo "   Compile with debug..... : $msg_debug"
 echo "   Man page............... : $msg_man"
 echo "   Documentation.......... : $msg_doc"
-echo "   Certificate authorities : ${CA_FILE}"
+echo "   Certificate authorities : ${CA_FILE:-(system defaults)}"
 
 if test "x$not_asked" != "x" || test "x$not_found" != "x"; then
     echo ""
diff --git a/src/core/wee-config.c b/src/core/wee-config.c
index a7218a0..d3ef1c3 100644
--- a/src/core/wee-config.c
+++ b/src/core/wee-config.c
@@ -61,6 +61,9 @@
 #include "../gui/gui-window.h"
 #include "../plugins/plugin.h"
 
+#ifndef CA_FILE
+#define CA_FILE NULL
+#endif
 
 struct t_config_file *weechat_config_file = NULL;
 struct t_config_section *weechat_config_section_debug = NULL;
@@ -3018,7 +3021,7 @@ config_weechat_init_options ()
         "gnutls_ca_file", "string",
         N_("file containing the certificate authorities (\"%h\" will be "
            "replaced by WeeChat home, \"~/.weechat\" by default)"),
-        NULL, 0, 0, CA_FILE, NULL, 0, NULL, NULL,
+        NULL, 0, 0, CA_FILE, NULL, 1, NULL, NULL,
         &config_change_network_gnutls_ca_file, NULL, NULL, NULL);
     config_network_gnutls_handshake_timeout = config_file_new_option (
         weechat_config_file, ptr_section,
diff --git a/src/core/wee-network.c b/src/core/wee-network.c
index aa5ea10..3ea087a 100644
--- a/src/core/wee-network.c
+++ b/src/core/wee-network.c
@@ -102,6 +102,12 @@ network_set_gnutls_ca_file ()
         }
         free (ca_path);
     }
+#if LIBGNUTLS_VERSION_NUMBER >= 0x030013 // was introduced in 3.0.19
+    else
+    {
+        gnutls_certificate_set_x509_system_trust(gnutls_xcred);
+    }
+#endif
 #endif
 }
 
-- 
1.8.1.4

