From a2f920185b727c23fee544783255bf15e6971742 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 12 Nov 2016 16:35:08 +0100
Subject: [PATCH] mbedtls: provide random to libcurl via the vtls API

---
 lib/vtls/mbedtls.c | 17 +++++++++++++++++
 lib/vtls/mbedtls.h |  8 +++-----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
index 7797c3e..28f4207 100644
--- a/lib/vtls/mbedtls.c
+++ b/lib/vtls/mbedtls.c
@@ -881,6 +881,23 @@ int Curl_mbedtls_data_pending(const struct connectdata *conn, int sockindex)
   mbedtls_ssl_context *ssl =
     (mbedtls_ssl_context *)&conn->ssl[sockindex].ssl;
   return ssl->in_msglen != 0;
 }
 
+int Curl_mbedtls_random(struct Curl_easy *data,
+                        unsigned char *entropy,
+                        size_t length)
+{
+  static mbedtls_ctr_drbg_context ctr_drbg;
+  static bool inited = FALSE;
+  (void)data;
+
+  if(!inited) {
+    mbedtls_ctr_drbg_init(&ctr_drbg);
+    inited = TRUE;
+  }
+
+  /* non-zero return means error */
+  return mbedtls_ctr_drbg_random(&ctr_drbg, entropy, length);
+}
+
 #endif /* USE_MBEDTLS */
diff --git a/lib/vtls/mbedtls.h b/lib/vtls/mbedtls.h
index 1021d54..0e5c1a6 100644
--- a/lib/vtls/mbedtls.h
+++ b/lib/vtls/mbedtls.h
@@ -47,10 +47,12 @@ void Curl_mbedtls_close_all(struct Curl_easy *data);
 void Curl_mbedtls_close(struct connectdata *conn, int sockindex);
 
 void Curl_mbedtls_session_free(void *ptr);
 size_t Curl_mbedtls_version(char *buffer, size_t size);
 int Curl_mbedtls_shutdown(struct connectdata *conn, int sockindex);
+int Curl_mbedtls_random(struct Curl_easy *data, unsigned char *entropy,
+                        size_t length);
 
 /* this backends supports CURLOPT_PINNEDPUBLICKEY */
 #define have_curlssl_pinnedpubkey 1
 
 /* API setup for mbedTLS */
@@ -68,13 +70,9 @@ int Curl_mbedtls_shutdown(struct connectdata *conn, int sockindex);
 #define curlssl_version Curl_mbedtls_version
 #define curlssl_check_cxn(x) (x=x, -1)
 #define curlssl_data_pending(x,y) Curl_mbedtls_data_pending(x, y)
 #define CURL_SSL_BACKEND CURLSSLBACKEND_MBEDTLS
 #define curlssl_sha256sum(a,b,c,d) mbedtls_sha256(a,b,c,0)
-
-/* This might cause libcurl to use a weeker random!
-   TODO: implement proper use of Polarssl's CTR-DRBG or HMAC-DRBG and use that
-*/
-#define curlssl_random(x,y,z) (x=x, y=y, z=z, CURLE_NOT_BUILT_IN)
+#define curlssl_random(x,y,z) Curl_mbedtls_random(x,y,z)
 
 #endif /* USE_MBEDTLS */
 #endif /* HEADER_CURL_MBEDTLS_H */
-- 
2.10.2