Make the Root CA certificates bundle file for gnutls a configure-time setting

(as it is highly distribution dependant)
On Debian --with-x509-ca-bundle=/etc/ssl/certs/ca-certificates.crt will do
(provided you have the ca-certificates package)

diff --git a/configure.ac b/configure.ac
index 82984b8e407744248b49e2a3f080014cbf91e4d1..63ca0ed51ec86081251f7388e3a6685d798fc2ba 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1465,39 +1465,6 @@ AS_IF([test "${enable_growl}" != "no"], [
 )
 
 
-dnl
-dnl TLS/SSL
-dnl
-AC_ARG_ENABLE(gnutls,
-  [  --enable-gnutls         gnutls TLS/SSL support (default enabled)])
-AS_IF([test "${enable_gnutls}" != "no"], [
-
-  gcrypt_LIBS="-lgpg-error"
-  AS_IF([test "${SYS}" = "mingw32"],
-    [gcrypt_LIBS="${gcrypt_LIBS} -lws2_32"
-     VLC_ADD_LDFLAGS([gnutls],[-lws2_32])]
-  )
-
-  gnutls_LIBS="-lgcrypt -lz ${gcrypt_LIBS}"
-
-  AC_CHECK_HEADER(gcrypt.h,
-    [AC_CHECK_LIB(gcrypt, gcry_control,
-      [AC_CHECK_HEADER(gnutls/gnutls.h,
-        [AC_CHECK_LIB(gnutls, gnutls_certificate_verify_peers2,
-         [have_gnutls="yes"],[old_gnutls="yes"], ${gnutls_LIBS})])],,
-     ${gcrypt_LIBS})])
-
-  AS_IF([test "${have_gnutls}" = "yes"], [
-    VLC_ADD_PLUGINS([gnutls])
-    VLC_ADD_LDFLAGS([gnutls], [-lgnutls ${gnutls_LIBS}])
-  ], [
-    AS_IF([test "${enable_gnutls}" = "yes"], [
-      AC_MSG_ERROR([gnutls not present or too old (version 1.0.17 required)])]
-    )]
-  )]
-)
-
-
 dnl
 dnl  Input plugins
 dnl
@@ -4897,6 +4864,63 @@ AM_CONDITIONAL(ENABLE_CORBA, test "$enablecorba" = "true")
 
 AC_ARG_WITH(,[Misc options:])
 
+dnl
+dnl TLS/SSL
+dnl
+AC_ARG_ENABLE(gnutls,
+  [  --enable-gnutls         gnutls TLS/SSL support (default enabled)])
+AC_ARG_WITH(x509-ca-bunble,
+  [  --with-x509-ca-bundle   x509 PEM certificate bundle path (no default)])
+
+AS_IF([test "${enable_gnutls}" != "no"], [
+  gcrypt_LIBS="-lgpg-error"
+  AS_IF([test "${SYS}" = "mingw32"], [
+    gcrypt_LIBS="${gcrypt_LIBS} -lws2_32"
+    VLC_ADD_LDFLAGS([gnutls],[-lws2_32])
+  ])
+
+  gnutls_LIBS="-lgcrypt -lz ${gcrypt_LIBS}"
+
+  AC_CHECK_HEADER(gcrypt.h, [
+    AC_CHECK_LIB(gcrypt, gcry_control, [
+      AC_CHECK_HEADER(gnutls/gnutls.h, [
+        AC_CHECK_LIB(gnutls, gnutls_certificate_verify_peers2,
+          [have_gnutls="yes"],[old_gnutls="yes"],[${gnutls_LIBS}])
+      ])
+    ],,[${gcrypt_LIBS}])
+  ])
+
+  AS_IF([test "${have_gnutls}" = "yes"], [
+    VLC_ADD_PLUGINS([gnutls])
+    VLC_ADD_LDFLAGS([gnutls], [-lgnutls ${gnutls_LIBS}])
+
+    AC_MSG_CHECKING([for root CA certificates path])
+    AS_IF([test -z "${with_x509_ca_bundle}"], [
+      AC_MSG_RESULT([not specified])
+      AC_MSG_WARN([No root CA certificates for gnutls])
+      AS_IF([test "${enable_gnutls}"], [
+       AC_MSG_ERROR([Use --with-x509-ca-bundle=... (or --without-x509-ca-bundle though gnutls won't work properly).])
+      ])
+    ], [
+      AS_IF([test "${with_x509_ca_bundle}" != "no"], [
+        AC_MSG_RESULT([${with_x509_ca_bundle}])
+       AC_CHECK_FILE([${with_x509_ca_bundle}],,[
+         AC_MSG_WARN([${with_x509_ca_bundle} does not exist (are you cross-compiling?)])
+       ])
+        AC_DEFINE_UNQUOTED(X509_CA_BUNDLE, ["${with_x509_ca_bundle}"],
+          [Define to the path of the host's root CA PEM certificates bundle file])
+      ], [
+        AC_MSG_RESULT([none])
+      ])
+    ])
+  ], [
+    AS_IF([test "${enable_gnutls}" = "yes"], [
+      AC_MSG_ERROR([gnutls not present or too old (version 1.0.17 required)])
+    ])
+  ])
+])
+
+
 dnl
 dnl  Endianness check, AC_C_BIGENDIAN doesn't work if we are cross-compiling
 dnl

diff --git a/modules/misc/gnutls.c b/modules/misc/gnutls.c
index c6569974de7b3a16ee30963a11086b22f5ccd25b..0441fd7955d91141ceea15e684065b7582568255 100644 (file)
--- a/modules/misc/gnutls.c
+++ b/modules/misc/gnutls.c
@@ -88,12 +88,6 @@ static void Close( vlc_object_t * );
 #define CHECK_HOSTNAME_LONGTEXT N_( \
     "Ensures that server hostname in certificate match requested host name." )
 
-#if defined (WIN32) || defined (UNDER_CE)
-# undef HOST_CA_PATH
-#else
-# define HOST_CA_PATH "/etc/ssl/certs/ca-certificates.crt"
-#endif
-
 vlc_module_begin();
     set_shortname( "GnuTLS" );
     set_description( _("GnuTLS TLS encryption layer") );
@@ -600,9 +594,9 @@ gnutls_ClientCreate( tls_t *p_tls )
 
         gnutls_Addx509Directory( (vlc_object_t *)p_session, p_sys->x509_cred,
                                  psz_path, VLC_FALSE );
-#ifdef HOST_CA_PATH
+#ifdef X509_CA_BUNDLE
         gnutls_Addx509File( (vlc_object_t *)p_session, p_sys->x509_cred,
-                            HOST_CA_PATH, VLC_FALSE );
+                            X509_CA_BUNDLE, VLC_FALSE );
 #endif
 
         free( psz_path );