#ifndef _WIN_USER_SETTINGS_H_
#define _WIN_USER_SETTINGS_H_

/* Verify this is Windows */
#ifndef _WIN32
#error This user_settings.h header is only designed for Windows
#endif

/*------------------------------------------------*/
/* New for Curl build 7/13/2021*/
#define OPENSSL_EXTRA
#define WOLFSSL_DES_ECB	// for wolfSSL_DES_ecb_encrypt()

/* Per: https://www.wolfssl.com/building-wolfssl-tls-1-3-windows/ */
#define WOLFSSL_TLS13
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define HAVE_ECC
#define HAVE_HKDF
#define HAVE_FFDHE_8192 
#define WC_RSA_PSS

/* Fix in curl - not fixed:
    subject alt name(s) or common name do not match
    SSL peer certificate or SSH remote key was not OK
     see: https://www.wolfssl.com/forums/topic1649-error-in-using-curl-and-wolfssl-to-implement-https.html*/
#define HAVE_SNI

/* More options to fix curl.
    Out of frustration, adding all possible options that build
    from user_settings_all.h. Build size is not relevent. */   
/*
#define WC_RSA_BLINDING
#define NO_MULTIBYTE_PRINT
#define OPENSSL_EXTRA
#define WOLFSSL_RIPEMD
#define NO_PSK
#define HAVE_EXTENDED_MASTER
#define WOLFSSL_SNIFFER
#define HAVE_SECURE_RENEGOTIATION

#define HAVE_AESGCM
#define WOLFSSL_SHA384
#define WOLFSSL_SHA512

#define HAVE_SUPPORTED_CURVES
#define HAVE_TLS_EXTENSIONS

#define HAVE_ECC
#define ECC_SHAMIR
#define ECC_TIMING_RESISTANT

#define WOLFSSL_SP
#define WOLFSSL_HAVE_SP_ECC
#define WOLFSSL_HAVE_SP_DH
#define WOLFSSL_HAVE_SP_RSA

// TLS Features
#define WOLFSSL_DTLS
#define WOLFSSL_TLS13
#define WOLFSSL_EITHER_SIDE // allow generic server/client method for WOLFSSL_CTX new

// TLS Extensions
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define HAVE_ONE_TIME_AUTH
#define HAVE_SNI
#define HAVE_ALPN
#define HAVE_MAX_FRAGMENT
#define HAVE_TRUNCATED_HMAC
#define HAVE_SESSION_TICKET
#define HAVE_EXTENDED_MASTER
#define HAVE_TRUSTED_CA
#define HAVE_ENCRYPT_THEN_MAC

// TLS Session Cache
#define SESSION_CERTS
#define PERSIST_SESSION_CACHE
#define PERSIST_CERT_CACHE

// Key and Certificate Generation
#define WOLFSSL_KEY_GEN
#define WOLFSSL_CERT_GEN
#define WOLFSSL_CERT_REQ
#define WOLFSSL_CERT_EXT

// Certificate Revocation
#define HAVE_OCSP
//#define HAVE_CERTIFICATE_STATUS_REQUEST		-no build
//#define HAVE_CERTIFICATE_STATUS_REQUEST_V2		-no build
#define HAVE_CRL
#define HAVE_CRL_IO
//#define HAVE_IO_TIMEOUT						-no build

// Fast math key size 4096-bit max
//#define USE_FAST_MATH							-warnings
//#define FP_MAX_BITS 8192						-no build

// Timing Resistance 
#define TFM_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
#define WC_RSA_BLINDING

// DH Key Sizes
#define HAVE_FFDHE_2048	
#define HAVE_FFDHE_3072

// ECC Features
#define HAVE_ECC
#define TFM_ECC256
#define ECC_SHAMIR
#define WOLFSSL_CUSTOM_CURVES	// enable other curves (not just prime)
#define HAVE_ECC_SECPR2
#define HAVE_ECC_SECPR3
#define HAVE_ECC_BRAINPOOL
#define HAVE_ECC_KOBLITZ
#define HAVE_ECC_CDH				// Co-factor
#define HAVE_COMP_KEY			// Compressed key support
#define FP_ECC					// Fixed point caching - speed repeated operations against same key
#define HAVE_ECC_ENCRYPT

// RSA 
#define WC_RSA_PSS

// AES
#define HAVE_AES_DECRYPT
#define HAVE_AES_ECB
#define WOLFSSL_AES_DIRECT
#define WOLFSSL_AES_COUNTER
#define HAVE_AESGCM
#define HAVE_AESCCM
#define WOLFSSL_AES_OFB
#define WOLFSSL_AES_CFB
#define WOLFSSL_AES_XTS
#define HAVE_AES_KEYWRAP

// Hashing
#define WOLFSSL_SHA224
#define WOLFSSL_SHA512
#define WOLFSSL_SHA384
#define WOLFSSL_SHAKE256
#define WOLFSSL_SHA3
#define WOLFSSL_HASH_FLAGS // enable hash flag API's 

// Additional Algorithms
#define HAVE_HASHDRBG

#define HAVE_CURVE25519
#define HAVE_ED25519
//#define CURVED25519_SMALL						-no build
//#define HAVE_CURVE448							-no build
#define HAVE_POLY1305
#define HAVE_CHACHA
#define HAVE_HKDF
#define HAVE_X963_KDF
#define WOLFSSL_CMAC
#define WOLFSSL_DES_ECB
*/
// end for curl
/*------------------------------------------------*/


/* Configurations */
#if defined(HAVE_FIPS)
    /* FIPS */
    #define OPENSSL_EXTRA
    #define HAVE_THREAD_LS
    #define WOLFSSL_KEY_GEN
    #define HAVE_AESGCM
    #define HAVE_HASHDRBG
    #define WOLFSSL_SHA384
    #define WOLFSSL_SHA512
    #define NO_PSK
    #define NO_HC128
    #define NO_RC4
    #define NO_RABBIT
    #define NO_DSA
    #define NO_MD4

    #define GCM_NONCE_MID_SZ 12
#else
    /* Enables blinding mode, to prevent timing attacks */
    #define WC_RSA_BLINDING
    #define NO_MULTIBYTE_PRINT

    #if defined(WOLFSSL_LIB)
        /* The lib */
        #define OPENSSL_EXTRA
        #define WOLFSSL_RIPEMD
        #define NO_PSK
        #define HAVE_EXTENDED_MASTER
        #define WOLFSSL_SNIFFER
        #define HAVE_SECURE_RENEGOTIATION

        #define HAVE_AESGCM
        #define WOLFSSL_SHA384
        #define WOLFSSL_SHA512

        #define HAVE_SUPPORTED_CURVES
        #define HAVE_TLS_EXTENSIONS

        #define HAVE_ECC
        #define ECC_SHAMIR
        #define ECC_TIMING_RESISTANT

        /* Optional Performance Speedups */
        #if 0
            /* AESNI on x64 */
            #ifdef _WIN64
                #define HAVE_INTEL_RDSEED
                #define WOLFSSL_AESNI
            #endif

            /* Single Precision Support for RSA/DH 1024/2048/3072 and
             * ECC P-256/P-384 */
            #define WOLFSSL_SP
            #define WOLFSSL_HAVE_SP_ECC
            #define WOLFSSL_HAVE_SP_DH
            #define WOLFSSL_HAVE_SP_RSA

            #ifdef _WIN64
                /* Old versions of MASM compiler do not recognize newer
                 * instructions. */
                #if 0
                    #define NO_AVX2_SUPPORT
                    #define NO_MOVBE_SUPPORT
                #endif
                #define WOLFSSL_SP_ASM
                #define WOLFSSL_SP_X86_64_ASM
            #endif
        #endif

    #else
        /* The servers and clients */
        #define OPENSSL_EXTRA
        #define NO_PSK
    #endif
#endif /* HAVE_FIPS */

#endif /* _WIN_USER_SETTINGS_H_ */
