/* BearSSL specific */
#include <bearssl.h>
#include <curl/curl.h>
#include <stdio.h>
#include <time.h>

/*
 * CURLOPT_SSL_CTX_FUNCTION EXAMPLE: inject entropy into the BearSSL engine
 *
 * Inject entropy on OS/architecture that does not support an entropy
 * source that is implemented in BearSSL (RDRAND, getentropy,
 * /dev/urandom, CryptGenRandom).
 *
 * Excerpt from br_ssl_engine_inject_entropy documentation:
 *
 * In all generality, "entropy" must here be considered to mean "that which
 * the attacker cannot predict". If your OS/architecture does not have a
 * suitable source of randomness, then you can make do with the combination
 * of a large enough secret value (possibly a copy of an asymmetric private
 * key that you also store on the system) AND a non-repeating value (e.g.
 * current time, provided that the local clock cannot be reset or altered
 * by the attacker).
 */

static CURLcode my_sslctx_fn(CURL *curl, void *ssl_ctx,
                                         void *usr_ptr)
{
  br_ssl_client_context *cc = (br_ssl_client_context *) ssl_ctx;
  char *secret = (char *) usr_ptr;
  char buf[32];
  struct timespec ts;
  (void) curl;
  int i;

  if(clock_gettime(CLOCK_REALTIME, &ts))
    return CURLE_FAILED_INIT;

  /* Combine the clock and our secret to have a non-repeating value */
  for(i = 0; i < 32; i++)
    buf[i] = (char) (secret[i] ^ ((char *) &ts)[i % sizeof(ts)]);

  br_ssl_engine_inject_entropy(&cc->eng, buf, 32);
  return CURLE_OK;
}

int main(void)
{
  CURL *curl;
  CURLcode ret;
  /* If we do not have a suitable source of randomness, then we have
   * to resort to a secret string of bytes. */
  char secret[32] = "EXAMPLE \0NLY! USE A R\xEAL SECRET!!";

  curl_global_init(CURL_GLOBAL_ALL);
  curl = curl_easy_init();

  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");

  curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, my_sslctx_fn);
  curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, (void *) &secret);

  ret = curl_easy_perform(curl);
  if(!ret)
    printf("*** transfer succeeded ***\n");
  else
    printf("*** transfer failed %s***\n", curl_easy_strerror(ret));

  curl_easy_cleanup(curl);
  curl_global_cleanup();
  return ret;
}