5 files changed, 62 insertions, 11 deletions

diff --git a/src/gmcerts.c b/src/gmcerts.c
index 27b226a0..f7475348 100644
--- a/src/gmcerts.c
+++ b/src/gmcerts.c
@@ -381,6 +381,7 @@ iBool checkTrust_GmCerts(iGmCerts *d, iRangecc domain, const iTlsCertificate *ce
     if (!verifyDomain_TlsCertificate(cert, domain)) {
         return iFalse;
     }
+    /* TODO: Could call setTrusted_GmCerts() instead of duplicating the trust-setting. */
     /* Good certificate. If not already trusted, add it now. */
     iString *key = newRange_String(domain);
     iDate until;
@@ -415,6 +416,22 @@ iBool checkTrust_GmCerts(iGmCerts *d, iRangecc domain, const iTlsCertificate *ce
     return iTrue;
 }
 
+void setTrusted_GmCerts(iGmCerts *d, iRangecc domain, const iBlock *fingerprint,
+                        const iDate *validUntil) {
+    iString *key = collect_String(newRange_String(domain));
+    lock_Mutex(d->mtx);
+    iTrustEntry *trust = value_StringHash(d->trusted, key);
+    if (trust) {
+        init_Time(&trust->validUntil, validUntil);
+        set_Block(&trust->fingerprint, fingerprint);
+    }
+    else {
+        insert_StringHash(d->trusted, key, iClob(trust = new_TrustEntry(fingerprint, validUntil)));
+    }
+    save_GmCerts_(d);
+    unlock_Mutex(d->mtx);
+}
+
 iGmIdentity *identity_GmCerts(iGmCerts *d, unsigned int id) {
     return at_PtrArray(&d->idents, id);
 }
diff --git a/src/gmcerts.h b/src/gmcerts.h
index f0ed37b5..2fd1023a 100644
--- a/src/gmcerts.h
+++ b/src/gmcerts.h
@@ -60,7 +60,8 @@ iDeclareTypeConstructionArgs(GmCerts, const char *saveDir)
 typedef iBool (*iGmCertsIdentityFilterFunc)(void *context, const iGmIdentity *);
 
 iBool               checkTrust_GmCerts      (iGmCerts *, iRangecc domain, const iTlsCertificate *cert);
-
+void                setTrusted_GmCerts      (iGmCerts *, iRangecc domain, const iBlock *fingerprint,
+                                             const iDate *validUntil);
 /**
  * Create a new self-signed TLS client certificate for identifying the user.
  * @a commonName and the other name parameters are inserted in the subject field
diff --git a/src/gmrequest.c b/src/gmrequest.c
index e65847e1..32b71922 100644
--- a/src/gmrequest.c
+++ b/src/gmrequest.c
@@ -45,6 +45,7 @@ void init_GmResponse(iGmResponse *d) {
     init_String(&d->meta);
     init_Block(&d->body, 0);
     d->certFlags = 0;
+    init_Block(&d->certFingerprint, 0);
     iZap(d->certValidUntil);
     init_String(&d->certSubject);
     iZap(d->when);
@@ -55,6 +56,7 @@ void initCopy_GmResponse(iGmResponse *d, const iGmResponse *other) {
     initCopy_String(&d->meta, &other->meta);
     initCopy_Block(&d->body, &other->body);
     d->certFlags = other->certFlags;
+    initCopy_Block(&d->certFingerprint, &other->certFingerprint);
     d->certValidUntil = other->certValidUntil;
     initCopy_String(&d->certSubject, &other->certSubject);
     d->when = other->when;
@@ -63,6 +65,7 @@ void initCopy_GmResponse(iGmResponse *d, const iGmResponse *other) {
 void deinit_GmResponse(iGmResponse *d) {
     deinit_String(&d->certSubject);
     deinit_Block(&d->body);
+    deinit_Block(&d->certFingerprint);
     deinit_String(&d->meta);
 }
 
@@ -71,6 +74,7 @@ void clear_GmResponse(iGmResponse *d) {
     clear_String(&d->meta);
     clear_Block(&d->body);
     d->certFlags = 0;
+    clear_Block(&d->certFingerprint);
     iZap(d->certValidUntil);
     clear_String(&d->certSubject);
     iZap(d->when);
@@ -86,7 +90,8 @@ void serialize_GmResponse(const iGmResponse *d, iStream *outs) {
     write32_Stream(outs, d->statusCode);
     serialize_String(&d->meta, outs);
     serialize_Block(&d->body, outs);
-    write32_Stream(outs, d->certFlags);
+    /* TODO: Add certificate fingerprint, but need to bump file version first. */
+    write32_Stream(outs, d->certFlags & ~haveFingerprint_GmCertFlag);
     serialize_Date(&d->certValidUntil, outs);
     serialize_String(&d->certSubject, outs);
     writeU64_Stream(outs, d->when.ts.tv_sec);
@@ -100,6 +105,7 @@ void deserialize_GmResponse(iGmResponse *d, iStream *ins) {
     deserialize_Date(&d->certValidUntil, ins);
     deserialize_String(&d->certSubject, ins);
     iZap(d->when);
+    clear_Block(&d->certFingerprint);
     if (version_Stream(ins) >= addedResponseTimestamps_FileVersion) {
         d->when.ts.tv_sec = readU64_Stream(ins);
     }
@@ -138,6 +144,8 @@ static void checkServerCertificate_GmRequest_(iGmRequest *d) {
     if (cert) {
         const iRangecc domain = range_String(hostName_Address(address_TlsRequest(d->req)));
         d->resp.certFlags |= available_GmCertFlag;
+        set_Block(&d->resp.certFingerprint, collect_Block(fingerprint_TlsCertificate(cert)));
+        d->resp.certFlags |= haveFingerprint_GmCertFlag;
         if (!isExpired_TlsCertificate(cert)) {
             d->resp.certFlags |= timeVerified_GmCertFlag;
         }
diff --git a/src/gmrequest.h b/src/gmrequest.h
index 311b9ad6..31059a44 100644
--- a/src/gmrequest.h
+++ b/src/gmrequest.h
@@ -31,10 +31,11 @@ iDeclareType(GmCerts)
 iDeclareType(GmResponse)
 
 enum iGmCertFlags {
-    available_GmCertFlag      = iBit(1), /* certificate provided by server */
-    trusted_GmCertFlag        = iBit(2), /* TOFU status */
-    timeVerified_GmCertFlag   = iBit(3), /* has not expired */
-    domainVerified_GmCertFlag = iBit(4), /* cert matches server domain */
+    available_GmCertFlag       = iBit(1), /* certificate provided by server */
+    trusted_GmCertFlag         = iBit(2), /* TOFU status */
+    timeVerified_GmCertFlag    = iBit(3), /* has not expired */
+    domainVerified_GmCertFlag  = iBit(4), /* cert matches server domain */
+    haveFingerprint_GmCertFlag = iBit(5),
 };
 
 struct Impl_GmResponse {
@@ -42,6 +43,7 @@ struct Impl_GmResponse {
     iString            meta; /* MIME type or other metadata */
     iBlock             body;
     int                certFlags;
+    iBlock             certFingerprint;
     iDate              certValidUntil;
     iString            certSubject;
     iTime              when;
diff --git a/src/ui/documentwidget.c b/src/ui/documentwidget.c
index 33f49ad9..94168d28 100644
--- a/src/ui/documentwidget.c
+++ b/src/ui/documentwidget.c
@@ -26,6 +26,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
 #include "audio/player.h"
 #include "command.h"
 #include "defs.h"
+#include "gmcerts.h"
 #include "gmdocument.h"
 #include "gmrequest.h"
 #include "gmutil.h"
@@ -137,6 +138,7 @@ struct Impl_DocumentWidget {
     iTime          sourceTime;
     iGmDocument *  doc;
     int            certFlags;
+    iBlock *       certFingerprint;
     iDate          certExpiry;
     iString *      certSubject;
     int            redirectCount;
@@ -177,6 +179,7 @@ void init_DocumentWidget(iDocumentWidget *d) {
     init_PersistentDocumentState(&d->mod);
     d->flags = 0;
     iZap(d->certExpiry);
+    d->certFingerprint  = new_Block(0);
     d->certFlags        = 0;
     d->certSubject      = new_String();
     d->state            = blank_RequestState;
@@ -242,6 +245,7 @@ void deinit_DocumentWidget(iDocumentWidget *d) {
     }
     deinit_PtrArray(&d->visiblePlayers);
     deinit_PtrArray(&d->visibleLinks);
+    delete_Block(d->certFingerprint);
     delete_String(d->certSubject);
     delete_String(d->titleUser);
     deinit_PersistentDocumentState(&d->mod);
@@ -881,6 +885,7 @@ static void updateTrust_DocumentWidget_(iDocumentWidget *d, const iGmResponse *r
     if (response) {
         d->certFlags  = response->certFlags;
         d->certExpiry = response->certValidUntil;
+        set_Block(d->certFingerprint, &response->certFingerprint);
         set_String(d->certSubject, &response->certSubject);
     }
     iLabelWidget *lock = findWidget_App("navbar.lock");
@@ -1271,9 +1276,14 @@ static iBool handleCommand_DocumentWidget_(iDocumentWidget *d, const char *cmd)
         return iFalse;
     }
     else if (equal_Command(cmd, "server.showcert") && d == document_App()) {
-        const char *unchecked = red_ColorEscape   "\u2610";
-        const char *checked   = green_ColorEscape "\u2611";
-        makeMessage_Widget(
+        const char *unchecked      = red_ColorEscape "\u2610";
+        const char *checked        = green_ColorEscape "\u2611";
+        const char *actionLabels[] = { "Dismiss", uiTextCaution_ColorEscape "Trust" };
+        const char *actionCmds[]   = { "message.ok", "server.trustcert" };
+        const iBool canTrust =
+            (d->certFlags == (available_GmCertFlag | haveFingerprint_GmCertFlag |
+                              timeVerified_GmCertFlag | domainVerified_GmCertFlag));
+        iWidget *dlg = makeQuestion_Widget(
             uiHeading_ColorEscape "CERTIFICATE STATUS",
             format_CStr("%s%s  Domain name %s%s\n"
                         "%s%s  %s (%04d-%02d-%02d %02d:%02d:%02d)\n"
@@ -1295,8 +1305,21 @@ static iBool handleCommand_DocumentWidget_(iDocumentWidget *d, const char *cmd)
                         d->certExpiry.second,
                         d->certFlags & trusted_GmCertFlag ? checked : unchecked,
                         uiText_ColorEscape,
-                        d->certFlags & trusted_GmCertFlag ? "Trusted on first use"
-                                                          : "Not trusted"));
+                        d->certFlags & trusted_GmCertFlag ? "Trusted" : "Not trusted"),
+            actionLabels,
+            actionCmds,
+            canTrust ? 2 : 1);
+        addAction_Widget(dlg, SDLK_ESCAPE, 0, "message.ok");
+        addAction_Widget(dlg, SDLK_SPACE, 0, "message.ok");
+        return iTrue;
+    }
+    else if (equal_Command(cmd, "server.trustcert")) {
+        const iRangecc host = urlHost_String(d->mod.url);
+        if (!isEmpty_Block(d->certFingerprint) && !isEmpty_Range(&host)) {
+            setTrusted_GmCerts(certs_App(), host, d->certFingerprint, &d->certExpiry);
+            d->certFlags |= trusted_GmCertFlag;
+            postCommand_App("server.showcert");
+        }
         return iTrue;
     }
     else if (equal_Command(cmd, "copy") && document_App() == d && !focus_Widget()) {