1bd7b4
From 346683631ae0f83ad4f09a69cfa5e5c6ea49e5d9 Mon Sep 17 00:00:00 2001
89a891
From: Evan Hunt <each@isc.org>
89a891
Date: Tue, 12 Sep 2017 19:05:46 -0700
89a891
Subject: [PATCH] rebased rt31459c
89a891
89a891
[rt31459d] update the newer tools
89a891
89a891
[rt31459d] setup entropy in dns_lib_init()
89a891
89a891
[rt31459d] silence compiler warning
89a891
89a891
DNS_OPENSSL_LIBS -> DST_OPENSSL_LIBS
89a891
89a891
Include new unit test
89a891
---
89a891
 bin/confgen/keygen.c                     |   7 +
89a891
 bin/dnssec/dnssec-dsfromkey.c            |   8 +-
89a891
 bin/dnssec/dnssec-importkey.c            |   8 +-
89a891
 bin/dnssec/dnssec-revoke.c               |   8 +-
89a891
 bin/dnssec/dnssec-settime.c              |   8 +-
89a891
 bin/dnssec/dnssec-signzone.c             |  11 +-
89a891
 bin/dnssec/dnssec-verify.c               |   8 +-
89a891
 bin/dnssec/dnssectool.c                  |  11 +-
89a891
 bin/named/server.c                       |   6 +
10d019
 bin/nsupdate/nsupdate.c                  |  14 +-
89a891
 bin/tests/makejournal.c                  |   6 +-
10d019
 bin/tests/system/pipelined/pipequeries.c |  20 +-
89a891
 bin/tests/system/pipelined/tests.sh      |   4 +-
89a891
 bin/tests/system/rsabigexponent/bigkey.c |   4 +
10d019
 bin/tests/system/tkey/keycreate.c        |  26 ++-
10d019
 bin/tests/system/tkey/keydelete.c        |  26 ++-
89a891
 bin/tests/system/tkey/tests.sh           |   8 +-
89a891
 bin/tools/mdig.c                         |   3 +-
10d019
 configure                                | 250 +++++++++++++----------
10d019
 configure.ac                             |  77 ++++++-
10d019
 lib/dns/dst_api.c                        |  21 +-
89a891
 lib/dns/include/dst/dst.h                |   8 +
10d019
 lib/dns/lib.c                            |  15 +-
10d019
 lib/dns/openssl_link.c                   |  72 ++++++-
10d019
 lib/dns/pkcs11.c                         |  29 ++-
89a891
 lib/dns/tests/Kyuafile                   |   1 +
89a891
 lib/dns/tests/Makefile.in                |   7 +
10d019
 lib/dns/tests/dstrandom_test.c           | 115 +++++++++++
89a891
 lib/dns/win32/libdns.def.in              |   7 +
89a891
 lib/isc/entropy.c                        |  24 +++
89a891
 lib/isc/include/isc/entropy.h            |  12 ++
89a891
 lib/isc/include/isc/platform.h.in        |   5 +
89a891
 lib/isc/include/isc/types.h              |   2 +
89a891
 lib/isc/pk11.c                           |  12 +-
89a891
 lib/isc/win32/include/isc/platform.h.in  |   5 +
10d019
 win32utils/Configure                     |  28 ++-
10d019
 36 files changed, 701 insertions(+), 175 deletions(-)
89a891
 create mode 100644 lib/dns/tests/dstrandom_test.c
89a891
89a891
diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
943bc6
index 40cf74c..bd269e7 100644
89a891
--- a/bin/confgen/keygen.c
89a891
+++ b/bin/confgen/keygen.c
89a891
@@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
89a891
 		randomfile = NULL;
89a891
 		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
89a891
 	}
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(ectx, true);
89a891
+	}
89a891
+#endif
89a891
 	DO("start entropy source", isc_entropy_usebestsource(ectx,
89a891
 							     &entropy_source,
89a891
 							     randomfile,
89a891
diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
943bc6
index 4420f2d..9cb63a8 100644
89a891
--- a/bin/dnssec/dnssec-dsfromkey.c
89a891
+++ b/bin/dnssec/dnssec-dsfromkey.c
230545
@@ -498,14 +498,14 @@ main(int argc, char **argv) {
89a891
 
89a891
 	if (ectx == NULL)
89a891
 		setup_entropy(mctx, NULL, &ectx);
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("could not initialize hash");
89a891
 	result = dst_lib_init(mctx, ectx,
89a891
 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("could not initialize hash");
89a891
 	isc_entropy_stopcallbacksources(ectx);
89a891
 
89a891
 	setup_logging(mctx, &log;;
230545
@@ -574,8 +574,8 @@ main(int argc, char **argv) {
89a891
 	if (dns_rdataset_isassociated(&rdataset))
89a891
 		dns_rdataset_disassociate(&rdataset);
89a891
 	cleanup_logging(&log;;
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	cleanup_entropy(&ectx);
89a891
 	dns_name_destroy();
89a891
 	if (verbose > 10)
89a891
diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
943bc6
index dc9a293..52863a1 100644
89a891
--- a/bin/dnssec/dnssec-importkey.c
89a891
+++ b/bin/dnssec/dnssec-importkey.c
230545
@@ -404,14 +404,14 @@ main(int argc, char **argv) {
89a891
 
89a891
 	if (ectx == NULL)
89a891
 		setup_entropy(mctx, NULL, &ectx);
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("could not initialize hash");
89a891
 	result = dst_lib_init(mctx, ectx,
89a891
 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("could not initialize hash");
89a891
 	isc_entropy_stopcallbacksources(ectx);
89a891
 
89a891
 	setup_logging(mctx, &log;;
230545
@@ -455,8 +455,8 @@ main(int argc, char **argv) {
89a891
 	if (dns_rdataset_isassociated(&rdataset))
89a891
 		dns_rdataset_disassociate(&rdataset);
89a891
 	cleanup_logging(&log;;
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	cleanup_entropy(&ectx);
89a891
 	dns_name_destroy();
89a891
 	if (verbose > 10)
89a891
diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
943bc6
index 0121a34..74a99b0 100644
89a891
--- a/bin/dnssec/dnssec-revoke.c
89a891
+++ b/bin/dnssec/dnssec-revoke.c
10d019
@@ -184,14 +184,14 @@ main(int argc, char **argv) {
89a891
 
89a891
 	if (ectx == NULL)
89a891
 		setup_entropy(mctx, NULL, &ectx);
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("Could not initialize hash");
89a891
 	result = dst_lib_init2(mctx, ectx, engine,
89a891
 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("Could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("Could not initialize hash");
89a891
 	isc_entropy_stopcallbacksources(ectx);
89a891
 
89a891
 	result = dst_key_fromnamedfile(filename, dir,
10d019
@@ -273,8 +273,8 @@ main(int argc, char **argv) {
89a891
 
89a891
 cleanup:
89a891
 	dst_key_free(&key);
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	cleanup_entropy(&ectx);
89a891
 	if (verbose > 10)
89a891
 		isc_mem_stats(mctx, stdout);
89a891
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
943bc6
index f017895..2c568fc 100644
89a891
--- a/bin/dnssec/dnssec-settime.c
89a891
+++ b/bin/dnssec/dnssec-settime.c
943bc6
@@ -391,14 +391,14 @@ main(int argc, char **argv) {
89a891
 
89a891
 	if (ectx == NULL)
89a891
 		setup_entropy(mctx, NULL, &ectx);
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("Could not initialize hash");
89a891
 	result = dst_lib_init2(mctx, ectx, engine,
89a891
 			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("Could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("Could not initialize hash");
89a891
 	isc_entropy_stopcallbacksources(ectx);
89a891
 
89a891
 	if (predecessor != NULL) {
943bc6
@@ -683,8 +683,8 @@ main(int argc, char **argv) {
89a891
 	if (prevkey != NULL)
89a891
 		dst_key_free(&prevkey);
89a891
 	dst_key_free(&key);
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	cleanup_entropy(&ectx);
89a891
 	if (verbose > 10)
89a891
 		isc_mem_stats(mctx, stdout);
89a891
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
1bd7b4
index a097ac8..6567421 100644
89a891
--- a/bin/dnssec/dnssec-signzone.c
89a891
+++ b/bin/dnssec/dnssec-signzone.c
1bd7b4
@@ -3472,14 +3472,15 @@ main(int argc, char *argv[]) {
89a891
 	if (!pseudorandom)
89a891
 		eflags |= ISC_ENTROPY_GOODONLY;
89a891
 
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("could not create hash context");
89a891
-
89a891
 	result = dst_lib_init2(mctx, ectx, engine, eflags);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
+
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("could not create hash context");
89a891
+
89a891
 	isc_stdtime_get(&now;;
89a891
 
89a891
 	if (startstr != NULL) {
1bd7b4
@@ -3896,8 +3897,8 @@ main(int argc, char *argv[]) {
89a891
 	dns_master_styledestroy(&dsstyle, mctx);
89a891
 
89a891
 	cleanup_logging(&log;;
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	cleanup_entropy(&ectx);
89a891
 	dns_name_destroy();
89a891
 	if (verbose > 10)
89a891
diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
943bc6
index 087cd5d..07c7294 100644
89a891
--- a/bin/dnssec/dnssec-verify.c
89a891
+++ b/bin/dnssec/dnssec-verify.c
10d019
@@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
89a891
 	if (ectx == NULL)
89a891
 		setup_entropy(mctx, NULL, &ectx);
89a891
 
89a891
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
-	if (result != ISC_R_SUCCESS)
89a891
-		fatal("could not create hash context");
89a891
-
89a891
 	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		fatal("could not initialize dst: %s",
89a891
 		      isc_result_totext(result));
89a891
 
89a891
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		fatal("could not create hash context");
89a891
+
89a891
 	isc_stdtime_get(&now;;
89a891
 
89a891
 	rdclass = strtoclass(classname);
89a891
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
943bc6
index 7f045e8..2a0f9c6 100644
89a891
--- a/bin/dnssec/dnssectool.c
89a891
+++ b/bin/dnssec/dnssectool.c
10d019
@@ -34,6 +34,7 @@
89a891
 #include <isc/heap.h>
89a891
 #include <isc/list.h>
89a891
 #include <isc/mem.h>
89a891
+#include <isc/platform.h>
89a891
 #include <isc/print.h>
89a891
 #include <isc/string.h>
89a891
 #include <isc/time.h>
10d019
@@ -235,7 +236,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
89a891
 	if (*ectx == NULL) {
89a891
 		result = isc_entropy_create(mctx, ectx);
89a891
 		if (result != ISC_R_SUCCESS)
89a891
-			fatal("could not create entropy object");
89a891
+			fatal("could not create entropy object: %s",
89a891
+			      isc_result_totext(result));
89a891
 		ISC_LIST_INIT(sources);
89a891
 	}
89a891
 
10d019
@@ -244,6 +246,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
89a891
 		randomfile = NULL;
89a891
 	}
89a891
 
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(*ectx, true);
89a891
+	}
89a891
+#endif
89a891
 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
89a891
 					   usekeyboard);
89a891
 
89a891
diff --git a/bin/named/server.c b/bin/named/server.c
1bd7b4
index 9826588..b3e3fc3 100644
89a891
--- a/bin/named/server.c
89a891
+++ b/bin/named/server.c
10d019
@@ -36,6 +36,7 @@
89a891
 #include <isc/lex.h>
89a891
 #include <isc/meminfo.h>
89a891
 #include <isc/parseint.h>
89a891
+#include <isc/platform.h>
89a891
 #include <isc/portset.h>
89a891
 #include <isc/print.h>
89a891
 #include <isc/random.h>
1bd7b4
@@ -8291,6 +8292,10 @@ load_configuration(const char *filename, ns_server_t *server,
89a891
 				      "no source of entropy found");
89a891
 		} else {
89a891
 			const char *randomdev = cfg_obj_asstring(obj);
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+			if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)
10d019
+				isc_entropy_usehook(ns_g_entropy, true);
89a891
+#else
89a891
 			int level = ISC_LOG_ERROR;
89a891
 			result = isc_entropy_createfilesource(ns_g_entropy,
89a891
 							      randomdev);
1bd7b4
@@ -8325,6 +8330,7 @@ load_configuration(const char *filename, ns_server_t *server,
89a891
 				}
89a891
 				isc_entropy_detach(&ns_g_fallbackentropy);
89a891
 			}
89a891
+#endif
89a891
 #endif
89a891
 		}
10d019
 
89a891
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
1bd7b4
index 52b0274..23b69c9 100644
89a891
--- a/bin/nsupdate/nsupdate.c
89a891
+++ b/bin/nsupdate/nsupdate.c
1bd7b4
@@ -279,7 +279,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
89a891
 	if (*ectx == NULL) {
89a891
 		result = isc_entropy_create(mctx, ectx);
89a891
 		if (result != ISC_R_SUCCESS)
89a891
-			fatal("could not create entropy object");
89a891
+			fatal("could not create entropy object: %s",
89a891
+			      isc_result_totext(result));
89a891
 		ISC_LIST_INIT(sources);
89a891
 	}
89a891
 
1bd7b4
@@ -288,6 +289,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
89a891
 		randomfile = NULL;
89a891
 	}
89a891
 
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(*ectx, true);
89a891
+	}
89a891
+#endif
89a891
 	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
89a891
 					   usekeyboard);
89a891
 
1bd7b4
@@ -990,11 +998,11 @@ setup_system(void) {
89a891
 		}
89a891
 	}
89a891
 
89a891
-	setup_entropy(gmctx, NULL, &entropy);
89a891
+	if (entropy == NULL)
89a891
+		setup_entropy(gmctx, NULL, &entropy);
89a891
 
89a891
 	result = isc_hash_create(gmctx, entropy, DNS_NAME_MAXWIRE);
89a891
 	check_result(result, "isc_hash_create");
89a891
-	isc_hash_init();
89a891
 
89a891
 	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
89a891
 	check_result(result, "dns_dispatchmgr_create");
89a891
diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
943bc6
index 68b5e5a..cd54c8d 100644
89a891
--- a/bin/tests/makejournal.c
89a891
+++ b/bin/tests/makejournal.c
10d019
@@ -102,12 +102,12 @@ main(int argc, char **argv) {
89a891
 	CHECK(isc_mem_create(0, 0, &mctx));
89a891
 	CHECK(isc_entropy_create(mctx, &ectx));
89a891
 
89a891
-	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
10d019
-	hash_active = true;
89a891
-
89a891
 	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));
10d019
 	dst_active = true;
89a891
 
89a891
+	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
10d019
+	hash_active = true;
89a891
+
89a891
 	CHECK(isc_log_create(mctx, &lctx, &logconfig));
89a891
 	isc_log_registercategories(lctx, categories);
89a891
 	isc_log_setcontext(lctx);
89a891
diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
943bc6
index e16ec11..95b65bf 100644
89a891
--- a/bin/tests/system/pipelined/pipequeries.c
89a891
+++ b/bin/tests/system/pipelined/pipequeries.c
10d019
@@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
89a891
 
89a891
 int
89a891
 main(int argc, char *argv[]) {
89a891
+	char *randomfile = NULL;
89a891
 	isc_sockaddr_t bind_any;
89a891
 	struct in_addr inaddr;
89a891
 	isc_result_t result;
89a891
@@ -222,7 +223,7 @@ main(int argc, char *argv[]) {
10d019
 	int c;
89a891
 
10d019
 	isc_commandline_errprint = false;
89a891
-	while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {
89a891
+	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
89a891
 		switch (c) {
89a891
 		case 'p':
89a891
 			result = isc_parse_uint16(&port,
89a891
@@ -233,6 +234,9 @@ main(int argc, char *argv[]) {
89a891
 				exit(1);
89a891
 			}
89a891
 			break;
89a891
+		case 'r':
89a891
+			randomfile = isc_commandline_argument;
89a891
+			break;
89a891
 		case '?':
89a891
 			fprintf(stderr, "%s: invalid argument '%c'",
89a891
 				argv[0], c);
10d019
@@ -275,10 +279,18 @@ main(int argc, char *argv[]) {
89a891
 
89a891
 	ectx = NULL;
89a891
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
89a891
-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
89a891
-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(ectx, true);
89a891
+	}
89a891
+#endif
89a891
+	if (randomfile != NULL)
89a891
+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
89a891
 
89a891
 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
89a891
+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
 
89a891
 	taskmgr = NULL;
89a891
 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
10d019
@@ -331,8 +343,8 @@ main(int argc, char *argv[]) {
89a891
 	isc_task_detach(&task);
89a891
 	isc_taskmgr_destroy(&taskmgr);
89a891
 
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	isc_entropy_detach(&ectx);
89a891
 
89a891
 	isc_log_destroy(&lctx);
89a891
diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
943bc6
index c0a99a2..0245527 100644
89a891
--- a/bin/tests/system/pipelined/tests.sh
89a891
+++ b/bin/tests/system/pipelined/tests.sh
89a891
@@ -19,7 +19,7 @@ status=0
89a891
 
89a891
 echo_i "check pipelined TCP queries"
89a891
 ret=0
89a891
-$PIPEQUERIES -p ${PORT} < input > raw || ret=1
89a891
+$PIPEQUERIES -p ${PORT} -r $RANDFILE < input > raw || ret=1
89a891
 awk '{ print $1 " " $5 }' < raw > output
89a891
 sort < output > output-sorted
10d019
 $DIFF ref output-sorted || { ret=1 ; echo_i "diff sorted failed"; }
89a891
@@ -43,7 +43,7 @@ status=`expr $status + $ret`
89a891
 
89a891
 echo_i "check keep-response-order"
89a891
 ret=0
89a891
-$PIPEQUERIES -p ${PORT} ++ < inputb > rawb || ret=1
89a891
+$PIPEQUERIES -p ${PORT} -r $RANDFILE ++ < inputb > rawb || ret=1
89a891
 awk '{ print $1 " " $5 }' < rawb > outputb
10d019
 $DIFF refb outputb || ret=1
89a891
 if [ $ret != 0 ]; then echo_i "failed"; fi
89a891
diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
943bc6
index abf12ed..fa5182c 100644
89a891
--- a/bin/tests/system/rsabigexponent/bigkey.c
89a891
+++ b/bin/tests/system/rsabigexponent/bigkey.c
89a891
@@ -20,6 +20,7 @@
89a891
 #include <isc/buffer.h>
89a891
 #include <isc/entropy.h>
89a891
 #include <isc/mem.h>
89a891
+#include <isc/platform.h>
89a891
 #include <isc/print.h>
89a891
 #include <isc/region.h>
89a891
 #include <isc/stdio.h>
89a891
@@ -183,6 +184,9 @@ main(int argc, char **argv) {
89a891
 
89a891
 	CHECK(isc_mem_create(0, 0, &mctx), "isc_mem_create()");
89a891
 	CHECK(isc_entropy_create(mctx, &ectx), "isc_entropy_create()");
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
10d019
+	isc_entropy_usehook(ectx, true);
89a891
+#endif
89a891
 	CHECK(isc_entropy_usebestsource(ectx, &source,
89a891
 					"../random.data",
89a891
 					ISC_ENTROPY_KEYBOARDNO),
89a891
diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
943bc6
index 34360aa..3236968 100644
89a891
--- a/bin/tests/system/tkey/keycreate.c
89a891
+++ b/bin/tests/system/tkey/keycreate.c
89a891
@@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
89a891
 int
89a891
 main(int argc, char *argv[]) {
89a891
 	char *ourkeyname;
89a891
+	char *randomfile;
89a891
 	isc_taskmgr_t *taskmgr;
89a891
 	isc_timermgr_t *timermgr;
89a891
 	isc_socketmgr_t *socketmgr;
89a891
@@ -225,10 +226,21 @@ main(int argc, char *argv[]) {
89a891
 
89a891
 	RUNCHECK(isc_app_start());
89a891
 
89a891
+	randomfile = NULL;
89a891
+
89a891
 	if (argc < 2) {
89a891
 		fprintf(stderr, "I:no DH key provided\n");
89a891
 		exit(-1);
89a891
 	}
89a891
+	if (strcmp(argv[1], "-r") == 0) {
89a891
+		if (argc < 4) {
89a891
+			fprintf(stderr, "I:no DH key provided\n");
89a891
+			exit(-1);
89a891
+		}
89a891
+		randomfile = argv[2];
89a891
+		argv += 2;
89a891
+		argc -= 2;
89a891
+	}
89a891
 	ourkeyname = argv[1];
89a891
 
89a891
 	if (argc >= 3)
89a891
@@ -242,14 +254,22 @@ main(int argc, char *argv[]) {
89a891
 
89a891
 	ectx = NULL;
89a891
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
89a891
-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
89a891
-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(ectx, true);
89a891
+	}
89a891
+#endif
89a891
+	if (randomfile != NULL)
89a891
+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
89a891
 
89a891
 	log = NULL;
89a891
 	logconfig = NULL;
89a891
 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
89a891
 
89a891
 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
89a891
+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
 
89a891
 	taskmgr = NULL;
89a891
 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
89a891
@@ -328,8 +348,8 @@ main(int argc, char *argv[]) {
89a891
 
89a891
 	isc_log_destroy(&log;;
89a891
 
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	isc_entropy_detach(&ectx);
89a891
 
89a891
 	isc_mem_destroy(&mctx);
89a891
diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
1bd7b4
index a3dd450..350723f 100644
89a891
--- a/bin/tests/system/tkey/keydelete.c
89a891
+++ b/bin/tests/system/tkey/keydelete.c
1bd7b4
@@ -137,6 +137,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
89a891
 int
89a891
 main(int argc, char **argv) {
89a891
 	char *keyname;
89a891
+	char *randomfile;
89a891
 	isc_taskmgr_t *taskmgr;
89a891
 	isc_timermgr_t *timermgr;
89a891
 	isc_socketmgr_t *socketmgr;
1bd7b4
@@ -157,10 +158,21 @@ main(int argc, char **argv) {
89a891
 
89a891
 	RUNCHECK(isc_app_start());
89a891
 
89a891
+	randomfile = NULL;
89a891
+
89a891
 	if (argc < 2) {
89a891
 		fprintf(stderr, "I:no key to delete\n");
89a891
 		exit(-1);
89a891
 	}
89a891
+	if (strcmp(argv[1], "-r") == 0) {
89a891
+		if (argc < 4) {
89a891
+			fprintf(stderr, "I:no DH key provided\n");
89a891
+			exit(-1);
89a891
+		}
89a891
+		randomfile = argv[2];
89a891
+		argv += 2;
89a891
+		argc -= 2;
89a891
+	}
89a891
 	keyname = argv[1];
89a891
 
89a891
 	dns_result_register();
1bd7b4
@@ -170,14 +182,22 @@ main(int argc, char **argv) {
89a891
 
89a891
 	ectx = NULL;
89a891
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
89a891
-	RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));
89a891
-	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (randomfile != NULL &&
89a891
+	    strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {
89a891
+		randomfile = NULL;
10d019
+		isc_entropy_usehook(ectx, true);
89a891
+	}
89a891
+#endif
89a891
+	if (randomfile != NULL)
89a891
+		RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));
89a891
 
89a891
 	log = NULL;
89a891
 	logconfig = NULL;
89a891
 	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
89a891
 
89a891
 	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
89a891
+	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
 
89a891
 	taskmgr = NULL;
89a891
 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
1bd7b4
@@ -265,8 +285,8 @@ main(int argc, char **argv) {
89a891
 
89a891
 	isc_log_destroy(&log;;
89a891
 
89a891
-	dst_lib_destroy();
89a891
 	isc_hash_destroy();
89a891
+	dst_lib_destroy();
89a891
 	isc_entropy_detach(&ectx);
89a891
 
89a891
 	isc_mem_destroy(&mctx);
89a891
diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
943bc6
index b265156..bcd60a6 100644
89a891
--- a/bin/tests/system/tkey/tests.sh
89a891
+++ b/bin/tests/system/tkey/tests.sh
89a891
@@ -33,7 +33,7 @@ for owner in . foo.example.
89a891
 do
943bc6
 	echo_i "creating new key using owner name \"$owner\" ($n)"
89a891
 	ret=0
89a891
-	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
89a891
+	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1
89a891
 	if [ $ret != 0 ]; then
943bc6
 		echo_i "failed"
943bc6
 		status=$((status+ret))
943bc6
@@ -57,7 +57,7 @@ do
89a891
 
943bc6
 	echo_i "deleting new key ($n)"
89a891
 	ret=0
89a891
-	$KEYDELETE $keyname || ret=1
89a891
+	$KEYDELETE -r $RANDFILE $keyname || ret=1
89a891
 	if [ $ret != 0 ]; then
943bc6
 		echo_i "failed"
89a891
 	fi
943bc6
@@ -79,7 +79,7 @@ done
89a891
 
943bc6
 echo_i "creating new key using owner name bar.example. ($n)"
89a891
 ret=0
89a891
-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
89a891
+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
89a891
 if [ $ret != 0 ]; then
943bc6
         echo_i "failed"
943bc6
 	status=$((status+ret))
943bc6
@@ -124,7 +124,7 @@ n=$((n+1))
89a891
 
943bc6
 echo_i "recreating the bar.example. key ($n)"
89a891
 ret=0
89a891
-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
89a891
+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
89a891
 if [ $ret != 0 ]; then
943bc6
         echo_i "failed"
943bc6
 	status=$((status+ret))
89a891
diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
943bc6
index 26fa609..fb34aa0 100644
89a891
--- a/bin/tools/mdig.c
89a891
+++ b/bin/tools/mdig.c
943bc6
@@ -2005,12 +2005,11 @@ main(int argc, char *argv[]) {
89a891
 
89a891
 	ectx = NULL;
89a891
 	RUNCHECK(isc_entropy_create(mctx, &ectx));
89a891
+	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
89a891
 	RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
89a891
 	RUNCHECK(isc_entropy_getdata(ectx, cookie_secret,
89a891
 				     sizeof(cookie_secret), NULL, 0));
89a891
 
89a891
-	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
89a891
-
89a891
 	ISC_LIST_INIT(queries);
10d019
 	parse_args(false, argc, argv);
89a891
 	if (server == NULL)
89a891
diff --git a/configure b/configure
1bd7b4
index 368112f..e060e9d 100755
89a891
--- a/configure
89a891
+++ b/configure
89a891
@@ -640,6 +640,7 @@ ac_includes_default="\
89a891
 
89a891
 ac_subst_vars='LTLIBOBJS
89a891
 LIBOBJS
89a891
+LIBDIR_SUFFIX
89a891
 BUILD_LIBS
89a891
 BUILD_LDFLAGS
89a891
 BUILD_CPPFLAGS
1bd7b4
@@ -822,6 +823,7 @@ LIBXML2_CFLAGS
89a891
 NZDTARGETS
89a891
 NZDSRCS
89a891
 NZD_TOOLS
89a891
+ISC_PLATFORM_CRYPTORANDOM
89a891
 PKCS11_TEST
89a891
 PKCS11_ED25519
89a891
 PKCS11_GOST
1bd7b4
@@ -1046,6 +1048,7 @@ with_eddsa
89a891
 with_aes
89a891
 enable_openssl_hash
89a891
 with_cc_alg
89a891
+enable_crypto_rand
89a891
 with_lmdb
89a891
 with_libxml2
89a891
 with_libjson
1bd7b4
@@ -1747,6 +1750,7 @@ Optional Features:
89a891
   --enable-threads        enable multithreading
89a891
   --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
89a891
   --enable-openssl-hash   use OpenSSL for hash functions [default=no]
89a891
+  --enable-crypto-rand    use the crypto provider for random [default=yes]
89a891
   --enable-largefile      64-bit file support
89a891
   --enable-backtrace      log stack backtrace on abort [default=yes]
89a891
   --enable-symtable       use internal symbol table for backtrace
1bd7b4
@@ -17204,6 +17208,7 @@ case "$use_openssl" in
89a891
 $as_echo "disabled because of native PKCS11" >&6; }
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO="-DPKCS11CRYPTO"
89a891
+		CRYPTOLIB="pkcs11"
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -17218,6 +17223,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
89a891
 $as_echo "no" >&6; }
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO=""
89a891
+		CRYPTOLIB=""
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -17230,6 +17236,7 @@ $as_echo "no" >&6; }
89a891
 	auto)
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO=""
89a891
+		CRYPTOLIB=""
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -17239,7 +17246,7 @@ $as_echo "no" >&6; }
89a891
 		OPENSSLLINKOBJS=""
89a891
 		OPENSSLLINKSRCS=""
89a891
 		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
89a891
-If you don't want OpenSSL, use --without-openssl" "$LINENO" 5
89a891
+If you do not want OpenSSL, use --without-openssl" "$LINENO" 5
89a891
 		;;
89a891
 	*)
89a891
 		if test "yes" = "$want_native_pkcs11"
1bd7b4
@@ -17270,6 +17277,7 @@ $as_echo "not found" >&6; }
89a891
 			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
89a891
 		fi
89a891
 		CRYPTO='-DOPENSSL'
89a891
+		CRYPTOLIB="openssl"
89a891
 		if test "/usr" = "$use_openssl"
89a891
 		then
89a891
 			DST_OPENSSL_INC=""
1bd7b4
@@ -17904,8 +17912,6 @@ fi
89a891
 # Use OpenSSL for hash functions
89a891
 #
89a891
 
89a891
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using OpenSSL for hash functions" >&5
89a891
-$as_echo_n "checking for using OpenSSL for hash functions... " >&6; }
89a891
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
89a891
 case $want_openssl_hash in
89a891
 	yes)
1bd7b4
@@ -18280,6 +18286,86 @@ if test "rt" = "$have_clock_gt"; then
89a891
 	LIBS="-lrt $LIBS"
89a891
 fi
89a891
 
89a891
+#
89a891
+# Use the crypto provider (OpenSSL/PKCS#11) for random functions
89a891
+#
89a891
+
89a891
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using the crypto library (vs. builtin) for random functions" >&5
89a891
+$as_echo_n "checking for using the crypto library (vs. builtin) for random functions... " >&6; }
89a891
+# Check whether --enable-crypto-rand was given.
89a891
+if test "${enable_crypto_rand+set}" = set; then :
89a891
+  enableval=$enable_crypto_rand; want_crypto_rand="$enableval"
89a891
+else
89a891
+  want_crypto_rand="auto"
89a891
+fi
89a891
+
89a891
+if test "$want_crypto_rand" = "auto"
89a891
+then
89a891
+	case "$CRYPTOLIB" in
89a891
+	"")
89a891
+		want_crypto_rand="no"
89a891
+		;;
89a891
+	pkcs11)
89a891
+		want_crypto_rand="yes"
89a891
+		;;
89a891
+	openssl)
89a891
+		saved_cflags="$CFLAGS"
89a891
+		saved_libs="$LIBS"
89a891
+		CFLAGS="$CFLAGS $DST_OPENSSL_INC"
89a891
+		LIBS="$LIBS $DST_OPENSSL_LIBS"
89a891
+		if test "$cross_compiling" = yes; then :
89a891
+  want_crypto_rand="yes"
89a891
+else
89a891
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
89a891
+/* end confdefs.h.  */
89a891
+
89a891
+#include <openssl/rand.h>
89a891
+
89a891
+unsigned char buf[128];
89a891
+
89a891
+int main()
89a891
+{
89a891
+	if (RAND_bytes(buf, 128) != 1)
89a891
+		return (1);
89a891
+	return (0);
89a891
+}
89a891
+
89a891
+_ACEOF
89a891
+if ac_fn_c_try_run "$LINENO"; then :
89a891
+  want_crypto_rand="yes"
89a891
+else
89a891
+  want_crypto_rand="no"
89a891
+fi
89a891
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
89a891
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
89a891
+fi
89a891
+
89a891
+		CFLAGS="$saved_cflags"
89a891
+		LIBS="$saved_libs"
89a891
+		;;
89a891
+	*)
89a891
+		as_fn_error $? "Unknown crypto library define $CRYPTOLIB" "$LINENO" 5
89a891
+		;;
89a891
+	esac
89a891
+fi
89a891
+case $want_crypto_rand in
89a891
+	yes)
89a891
+		if test "$CRYPTOLIB" = ""
89a891
+		then
89a891
+			as_fn_error $? "No crypto library for random functions" "$LINENO" 5
89a891
+		fi
89a891
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$CRYPTOLIB\"" >&5
89a891
+$as_echo "\"$CRYPTOLIB\"" >&6; }
89a891
+		ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""
89a891
+		;;
89a891
+	no)
89a891
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
89a891
+$as_echo "no" >&6; }
89a891
+		ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"
89a891
+		;;
89a891
+esac
89a891
+
89a891
+
89a891
 #
89a891
 # was --with-lmdb specified?
89a891
 #
1bd7b4
@@ -20556,9 +20642,12 @@ _ACEOF
89a891
 if ac_fn_c_try_compile "$LINENO"; then :
89a891
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
89a891
 $as_echo "size_t for buflen; int for flags" >&6; }
89a891
-	 $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T size_t" >>confdefs.h
89a891
+	# Changed to solve multilib conflict on Fedora
89a891
+	# AC_DEFINE(IRS_GETNAMEINFO_SOCKLEN_T, size_t)
89a891
+	# AC_DEFINE(IRS_GETNAMEINFO_BUFLEN_T, size_t)
89a891
+	 $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T socklen_t" >>confdefs.h
89a891
 
89a891
-	 $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T size_t" >>confdefs.h
89a891
+	 $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T socklen_t" >>confdefs.h
89a891
 
89a891
 	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
89a891
 
1bd7b4
@@ -21856,12 +21945,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
89a891
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
89a891
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
89a891
 if test "yes" = "$use_atomic"; then
89a891
-	have_atomic=yes		# set default
89a891
-	case "$host" in
89a891
-	i[3456]86-*)
89a891
-		# XXX: some old x86 architectures actually do not support
89a891
-		#      (some of) these operations.  Do we need stricter checks?
89a891
-		# The cast to long int works around a bug in the HP C Compiler
89a891
+	# The cast to long int works around a bug in the HP C Compiler
89a891
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
89a891
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
89a891
 # This bug is HP SR number 8606223364.
1bd7b4
@@ -21894,6 +21978,11 @@ cat >>confdefs.h <<_ACEOF
89a891
 _ACEOF
89a891
 
89a891
 
89a891
+	have_atomic=yes		# set default
89a891
+	case "$host" in
89a891
+	i[3456]86-*)
89a891
+		# XXX: some old x86 architectures actually do not support
89a891
+		#      (some of) these operations.  Do we need stricter checks?
89a891
 		if test $ac_cv_sizeof_void_p = 8; then
89a891
 			arch=x86_64
89a891
 			have_xaddq=yes
1bd7b4
@@ -21902,39 +21991,6 @@ _ACEOF
89a891
 		fi
89a891
 	;;
89a891
 	x86_64-*|amd64-*)
89a891
-		# The cast to long int works around a bug in the HP C Compiler
89a891
-# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
89a891
-# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
89a891
-# This bug is HP SR number 8606223364.
89a891
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of void *" >&5
89a891
-$as_echo_n "checking size of void *... " >&6; }
89a891
-if ${ac_cv_sizeof_void_p+:} false; then :
89a891
-  $as_echo_n "(cached) " >&6
89a891
-else
89a891
-  if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (void *))" "ac_cv_sizeof_void_p"        "$ac_includes_default"; then :
89a891
-
89a891
-else
89a891
-  if test "$ac_cv_type_void_p" = yes; then
89a891
-     { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
89a891
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
89a891
-as_fn_error 77 "cannot compute sizeof (void *)
89a891
-See \`config.log' for more details" "$LINENO" 5; }
89a891
-   else
89a891
-     ac_cv_sizeof_void_p=0
89a891
-   fi
89a891
-fi
89a891
-
89a891
-fi
89a891
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_void_p" >&5
89a891
-$as_echo "$ac_cv_sizeof_void_p" >&6; }
89a891
-
89a891
-
89a891
-
89a891
-cat >>confdefs.h <<_ACEOF
89a891
-#define SIZEOF_VOID_P $ac_cv_sizeof_void_p
89a891
-_ACEOF
89a891
-
89a891
-
89a891
 		if test $ac_cv_sizeof_void_p = 8; then
89a891
 			arch=x86_64
89a891
 			have_xaddq=yes
1bd7b4
@@ -21965,6 +22021,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
89a891
 $as_echo "$arch" >&6; }
89a891
 fi
89a891
 
89a891
+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then
89a891
+	as_fn_error $? "XADDQ present but disabled by Fedora patch!" "$LINENO" 5
89a891
+fi
89a891
+
89a891
 if test "yes" = "$have_atomic"; then
89a891
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
89a891
 $as_echo_n "checking compiler support for inline assembly code... " >&6; }
1bd7b4
@@ -24547,6 +24607,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
89a891
 #
89a891
 dlzdir='${DLZ_DRIVER_DIR}'
89a891
 
89a891
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for target libdir" >&5
89a891
+$as_echo_n "checking for target libdir... " >&6; }
89a891
+if test "$cross_compiling" = yes; then :
89a891
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
89a891
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
89a891
+as_fn_error $? "cannot run test program while cross compiling
89a891
+See \`config.log' for more details" "$LINENO" 5; }
89a891
+else
89a891
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
89a891
+/* end confdefs.h.  */
89a891
+int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}
89a891
+_ACEOF
89a891
+if ac_fn_c_try_run "$LINENO"; then :
89a891
+  target_lib=lib64
89a891
+else
89a891
+  target_lib=lib
89a891
+fi
89a891
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
89a891
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
89a891
+fi
89a891
+
89a891
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$target_lib\"" >&5
89a891
+$as_echo "\"$target_lib\"" >&6; }
89a891
+
89a891
 #
89a891
 # Private autoconf macro to simplify configuring drivers:
89a891
 #
1bd7b4
@@ -24877,11 +24961,11 @@ $as_echo "no" >&6; }
89a891
 $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
89a891
 		;;
89a891
 	*)
89a891
-		if test -d "$use_dlz_mysql/lib/mysql"
89a891
+		if test -d $use_dlz_mysql/${target_lib}/mysql
89a891
 		then
89a891
-			mysql_lib="$use_dlz_mysql/lib/mysql"
89a891
+			mysql_lib=$use_dlz_mysql/${target_lib}/mysql
89a891
 		else
89a891
-			mysql_lib="$use_dlz_mysql/lib"
89a891
+			mysql_lib=$use_dlz_mysql/${target_lib}
89a891
 		fi
89a891
 
89a891
 	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
1bd7b4
@@ -24966,7 +25050,7 @@ $as_echo "" >&6; }
89a891
 			# Check other locations for includes.
89a891
 			# Order is important (sigh).
89a891
 
89a891
-			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
89a891
+			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"
89a891
 			# include a blank element first
89a891
 			for d in "" $bdb_incdirs
89a891
 			do
1bd7b4
@@ -24991,57 +25075,9 @@ $as_echo "" >&6; }
89a891
 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
89a891
 			for d in $bdb_libnames
89a891
 			do
89a891
-				if test "$dd" = "/usr"
10d019
-				then
89a891
-					as_ac_Lib=`$as_echo "ac_cv_lib_$d''_db_create" | $as_tr_sh`
89a891
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for db_create in -l$d" >&5
89a891
-$as_echo_n "checking for db_create in -l$d... " >&6; }
89a891
-if eval \${$as_ac_Lib+:} false; then :
89a891
-  $as_echo_n "(cached) " >&6
89a891
-else
89a891
-  ac_check_lib_save_LIBS=$LIBS
89a891
-LIBS="-l$d  $LIBS"
89a891
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
89a891
-/* end confdefs.h.  */
89a891
-
89a891
-/* Override any GCC internal prototype to avoid an error.
89a891
-   Use char because int might match the return type of a GCC
89a891
-   builtin and then its argument prototype would still apply.  */
89a891
-#ifdef __cplusplus
89a891
-extern "C"
89a891
-#endif
89a891
-char db_create ();
89a891
-int
89a891
-main ()
89a891
-{
89a891
-return db_create ();
89a891
-  ;
89a891
-  return 0;
89a891
-}
89a891
-_ACEOF
89a891
-if ac_fn_c_try_link "$LINENO"; then :
89a891
-  eval "$as_ac_Lib=yes"
89a891
-else
89a891
-  eval "$as_ac_Lib=no"
89a891
-fi
89a891
-rm -f core conftest.err conftest.$ac_objext \
89a891
-    conftest$ac_exeext conftest.$ac_ext
89a891
-LIBS=$ac_check_lib_save_LIBS
89a891
-fi
89a891
-eval ac_res=\$$as_ac_Lib
89a891
-	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
89a891
-$as_echo "$ac_res" >&6; }
89a891
-if eval test \"x\$"$as_ac_Lib"\" = x"yes"; then :
89a891
-  dlz_bdb_libs="-l${d}"
89a891
-fi
89a891
-
89a891
-					if test $dlz_bdb_libs != "yes"
89a891
-					then
89a891
-						break
89a891
-					fi
89a891
-				elif test -f "$dd/lib/lib${d}.so"
10d019
+				if test -f "$dd/${target_lib}/lib${d}.so"
10d019
 				then
89a891
-					dlz_bdb_libs="-L${dd}/lib -l${d}"
89a891
+					dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
89a891
 					break
89a891
 				fi
89a891
 			done
1bd7b4
@@ -25200,10 +25236,10 @@ $as_echo "no" >&6; }
89a891
 		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
89a891
 		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
89a891
 	fi
89a891
-	if test -n "-L$use_dlz_ldap/lib -lldap -llber"
89a891
+	if test -n "-L$use_dlz_ldap/${target_lib} -lldap -llber"
89a891
 	then
89a891
-		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/lib -lldap -llber"
89a891
-		DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/lib -lldap -llber"
89a891
+		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/${target_lib} -lldap -llber"
89a891
+		DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/${target_lib} -lldap -llber"
89a891
 	fi
89a891
 
89a891
 
1bd7b4
@@ -25289,11 +25325,11 @@ fi
89a891
 		odbcdirs="/usr /usr/local /usr/pkg"
89a891
 		for d in $odbcdirs
89a891
 		do
89a891
-			if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
89a891
+			if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a
89a891
 			then
89a891
 				use_dlz_odbc=$d
89a891
 				dlz_odbc_include="-I$use_dlz_odbc/include"
89a891
-				dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
89a891
+				dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"
89a891
 				break
89a891
 			fi
89a891
 		done
1bd7b4
@@ -25568,6 +25604,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
89a891
 
89a891
 
89a891
 
89a891
+
89a891
+
89a891
 #
89a891
 # Commands to run at the end of config.status.
89a891
 # Don't just put these into configure, it won't work right if somebody
1bd7b4
@@ -27946,6 +27984,8 @@ report() {
89a891
 	    echo "    IPv6 support (--enable-ipv6)"
89a891
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
89a891
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
89a891
+        test "no" = "$want_crypto_rand" || \
89a891
+                echo "    Crypto provider entropy source (--enable-crypto-rand)"
89a891
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
89a891
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
89a891
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
1bd7b4
@@ -27986,6 +28026,8 @@ report() {
89a891
 	echo "    Very verbose query trace logging (--enable-querytrace)"
10d019
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
89a891
 
89a891
+    echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"
89a891
+
89a891
     echo "    Dynamically loadable zone (DLZ) drivers:"
89a891
     test "no" = "$use_dlz_bdb" || \
89a891
 	echo "        Berkeley DB (--with-dlz-bdb)"
1bd7b4
@@ -28033,6 +28075,8 @@ report() {
89a891
 	echo "    ECDSA algorithm support (--with-ecdsa)"
89a891
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
89a891
 	echo "    EDDSA algorithm support (--with-eddsa)"
89a891
+    test "yes" = "$want_crypto_rand" || \
89a891
+        echo "    Crypto provider entropy source (--enable-crypto-rand)"
89a891
 
89a891
     test "yes" = "$enable_seccomp" || \
89a891
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
10d019
diff --git a/configure.ac b/configure.ac
1bd7b4
index 11f41e8..fdcfc62 100644
10d019
--- a/configure.ac
10d019
+++ b/configure.ac
1bd7b4
@@ -1600,6 +1600,7 @@ case "$use_openssl" in
89a891
 		AC_MSG_RESULT(disabled because of native PKCS11)
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO="-DPKCS11CRYPTO"
89a891
+		CRYPTOLIB="pkcs11"
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -1613,6 +1614,7 @@ case "$use_openssl" in
89a891
 		AC_MSG_RESULT(no)
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO=""
89a891
+		CRYPTOLIB=""
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -1625,6 +1627,7 @@ case "$use_openssl" in
89a891
 	auto)
89a891
 		DST_OPENSSL_INC=""
89a891
 		CRYPTO=""
89a891
+		CRYPTOLIB=""
89a891
 		OPENSSLECDSALINKOBJS=""
89a891
 		OPENSSLECDSALINKSRCS=""
89a891
 		OPENSSLEDDSALINKOBJS=""
1bd7b4
@@ -1635,7 +1638,7 @@ case "$use_openssl" in
89a891
 		OPENSSLLINKSRCS=""
89a891
 		AC_MSG_ERROR(
89a891
 [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
89a891
-If you don't want OpenSSL, use --without-openssl])
89a891
+If you do not want OpenSSL, use --without-openssl])
89a891
 		;;
89a891
 	*)
89a891
 		if test "yes" = "$want_native_pkcs11"
1bd7b4
@@ -1665,6 +1668,7 @@ If you don't want OpenSSL, use --without-openssl])
89a891
 			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
89a891
 		fi
89a891
 		CRYPTO='-DOPENSSL'
89a891
+		CRYPTOLIB="openssl"
89a891
 		if test "/usr" = "$use_openssl"
89a891
 		then
89a891
 			DST_OPENSSL_INC=""
1bd7b4
@@ -2109,7 +2113,6 @@ fi
89a891
 # Use OpenSSL for hash functions
89a891
 #
89a891
 
89a891
-AC_MSG_CHECKING(for using OpenSSL for hash functions)
89a891
 ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
89a891
 case $want_openssl_hash in
89a891
 	yes)
1bd7b4
@@ -2381,6 +2384,67 @@ if test "rt" = "$have_clock_gt"; then
89a891
 	LIBS="-lrt $LIBS"
89a891
 fi
89a891
 
89a891
+#
89a891
+# Use the crypto provider (OpenSSL/PKCS#11) for random functions
89a891
+#
89a891
+
89a891
+AC_MSG_CHECKING(for using the crypto library (vs. builtin) for random functions)
89a891
+AC_ARG_ENABLE(crypto-rand,
89a891
+	[  --enable-crypto-rand    use the crypto provider for random [[default=yes]]],
89a891
+	want_crypto_rand="$enableval", want_crypto_rand="auto")
89a891
+if test "$want_crypto_rand" = "auto"
89a891
+then
89a891
+	case "$CRYPTOLIB" in
89a891
+	"")
89a891
+		want_crypto_rand="no"
89a891
+		;;
89a891
+	pkcs11)
89a891
+		want_crypto_rand="yes"
89a891
+		;;
89a891
+	openssl)
89a891
+		saved_cflags="$CFLAGS"
89a891
+		saved_libs="$LIBS"
89a891
+		CFLAGS="$CFLAGS $DST_OPENSSL_INC"
89a891
+		LIBS="$LIBS $DST_OPENSSL_LIBS"
89a891
+		AC_TRY_RUN([
89a891
+#include <openssl/rand.h>
89a891
+
89a891
+unsigned char buf[128];
89a891
+
89a891
+int main()
89a891
+{
89a891
+	if (RAND_bytes(buf, 128) != 1)
89a891
+		return (1);
89a891
+	return (0);
89a891
+}
89a891
+],
89a891
+		[want_crypto_rand="yes"],
89a891
+		[want_crypto_rand="no"],
89a891
+		[want_crypto_rand="yes"])
89a891
+		CFLAGS="$saved_cflags"
89a891
+		LIBS="$saved_libs"
89a891
+		;;
89a891
+	*)
89a891
+		AC_MSG_ERROR([Unknown crypto library define $CRYPTOLIB])
89a891
+		;;
89a891
+	esac
89a891
+fi
89a891
+case $want_crypto_rand in
89a891
+	yes)
89a891
+		if test "$CRYPTOLIB" = ""
89a891
+		then
89a891
+			AC_MSG_ERROR([No crypto library for random functions])
89a891
+		fi
89a891
+		AC_MSG_RESULT(["$CRYPTOLIB"])
89a891
+		ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""
89a891
+		;;
89a891
+	no)
89a891
+		AC_MSG_RESULT(no)
89a891
+		ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"
89a891
+		;;
89a891
+esac
89a891
+AC_SUBST(ISC_PLATFORM_CRYPTORANDOM)
89a891
+
89a891
 #
89a891
 # was --with-lmdb specified?
89a891
 #
1bd7b4
@@ -4174,12 +4238,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
89a891
 ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
89a891
 ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
89a891
 if test "yes" = "$use_atomic"; then
89a891
+	AC_CHECK_SIZEOF([void *])
89a891
 	have_atomic=yes		# set default
89a891
 	case "$host" in
89a891
 	[i[3456]86-*])
89a891
 		# XXX: some old x86 architectures actually do not support
89a891
 		#      (some of) these operations.  Do we need stricter checks?
89a891
-		AC_CHECK_SIZEOF([void *])
89a891
 		if test $ac_cv_sizeof_void_p = 8; then
89a891
 			arch=x86_64
89a891
 			have_xaddq=yes
1bd7b4
@@ -4188,7 +4252,6 @@ if test "yes" = "$use_atomic"; then
89a891
 		fi
89a891
 	;;
89a891
 	x86_64-*|amd64-*)
89a891
-		AC_CHECK_SIZEOF([void *])
89a891
 		if test $ac_cv_sizeof_void_p = 8; then
89a891
 			arch=x86_64
89a891
 			have_xaddq=yes
1bd7b4
@@ -5622,6 +5685,8 @@ report() {
89a891
 	    echo "    IPv6 support (--enable-ipv6)"
89a891
 	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
89a891
 		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
89a891
+        test "no" = "$want_crypto_rand" || \
89a891
+                echo "    Crypto provider entropy source (--enable-crypto-rand)"
89a891
 	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
89a891
 	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
89a891
 	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
1bd7b4
@@ -5662,6 +5727,8 @@ report() {
89a891
 	echo "    Very verbose query trace logging (--enable-querytrace)"
10d019
     test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
89a891
 
89a891
+    echo "    Cryptographic library for DNSSEC: $CRYPTOLIB"
89a891
+
89a891
     echo "    Dynamically loadable zone (DLZ) drivers:"
89a891
     test "no" = "$use_dlz_bdb" || \
89a891
 	echo "        Berkeley DB (--with-dlz-bdb)"
1bd7b4
@@ -5709,6 +5776,8 @@ report() {
89a891
 	echo "    ECDSA algorithm support (--with-ecdsa)"
89a891
     test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
89a891
 	echo "    EDDSA algorithm support (--with-eddsa)"
89a891
+    test "yes" = "$want_crypto_rand" || \
89a891
+        echo "    Crypto provider entropy source (--enable-crypto-rand)"
89a891
 
89a891
     test "yes" = "$enable_seccomp" || \
89a891
 	echo "    Use libseccomp system call filtering (--enable-seccomp)"
89a891
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
943bc6
index 7a86506..aa54afc 100644
89a891
--- a/lib/dns/dst_api.c
89a891
+++ b/lib/dns/dst_api.c
10d019
@@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
89a891
 #ifdef GSSAPI
89a891
 	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
89a891
 #endif
89a891
+#if defined(OPENSSL) || defined(PKCS11CRYPTO)
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (dst_entropy_pool != NULL)
89a891
+		isc_entropy_sethook(dst_random_getdata);
89a891
+#endif
89a891
+#endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
10d019
 	dst_initialized = true;
89a891
 	return (ISC_R_SUCCESS);
89a891
 
10d019
@@ -296,11 +302,19 @@ dst_lib_destroy(void) {
89a891
 	for (i = 0; i < DST_MAX_ALGS; i++)
89a891
 		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
89a891
 			dst_t_func[i]->cleanup();
89a891
+#if defined(OPENSSL) || defined(PKCS11CRYPTO)
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	if (dst_entropy_pool != NULL) {
10d019
+		isc_entropy_usehook(dst_entropy_pool, false);
89a891
+		isc_entropy_sethook(NULL);
89a891
+	}
89a891
+#endif
89a891
 #ifdef OPENSSL
89a891
 	dst__openssl_destroy();
89a891
 #elif PKCS11CRYPTO
89a891
 	(void) dst__pkcs11_destroy();
89a891
 #endif /* if OPENSSL, elif PKCS11CRYPTO */
89a891
+#endif /* defined(OPENSSL) || defined(PKCS11CRYPTO) */
89a891
 	if (dst__memory_pool != NULL)
89a891
 		isc_mem_detach(&dst__memory_pool);
89a891
 	if (dst_entropy_pool != NULL)
10d019
@@ -2002,13 +2016,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
89a891
 		flags &= ~ISC_ENTROPY_GOODONLY;
89a891
 	else
89a891
 		flags |= ISC_ENTROPY_BLOCKING;
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	return (dst_random_getdata(buf, len, NULL, flags));
89a891
+#else
89a891
 	return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
89a891
+#endif
89a891
 #endif /* PKCS11CRYPTO */
89a891
 }
89a891
 
89a891
 unsigned int
89a891
 dst__entropy_status(void) {
89a891
-#ifndef PKCS11CRYPTO
89a891
+#if !defined(PKCS11CRYPTO) && !defined(ISC_PLATFORM_CRYPTORANDOM)
89a891
 #ifdef GSSAPI
89a891
 	unsigned int flags = dst_entropy_flags;
89a891
 	isc_result_t ret;
10d019
@@ -2031,6 +2049,7 @@ dst__entropy_status(void) {
89a891
 #endif
89a891
 	return (isc_entropy_status(dst_entropy_pool));
89a891
 #else
89a891
+	/* Doesn't matter as it is not used in this case. */
89a891
 	return (0);
89a891
 #endif
89a891
 }
89a891
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
943bc6
index 5b42ab4..3aba028 100644
89a891
--- a/lib/dns/include/dst/dst.h
89a891
+++ b/lib/dns/include/dst/dst.h
10d019
@@ -159,6 +159,14 @@ dst_lib_destroy(void);
89a891
  * Releases all resources allocated by DST.
89a891
  */
89a891
 
89a891
+isc_result_t
89a891
+dst_random_getdata(void *data, unsigned int length,
89a891
+		   unsigned int *returned, unsigned int flags);
89a891
+/*%<
89a891
+ * \brief Return data from the crypto random generator.
89a891
+ * Specialization of isc_entropy_getdata().
89a891
+ */
89a891
+
10d019
 bool
89a891
 dst_algorithm_supported(unsigned int alg);
89a891
 /*%<
89a891
diff --git a/lib/dns/lib.c b/lib/dns/lib.c
943bc6
index d9417de..0dc935d 100644
89a891
--- a/lib/dns/lib.c
89a891
+++ b/lib/dns/lib.c
943bc6
@@ -16,6 +16,7 @@
10d019
 #include <stdbool.h>
89a891
 #include <stddef.h>
89a891
 
89a891
+#include <isc/entropy.h>
89a891
 #include <isc/hash.h>
89a891
 #include <isc/mem.h>
89a891
 #include <isc/msgcat.h>
943bc6
@@ -76,6 +77,7 @@ static unsigned int references = 0;
89a891
 static void
89a891
 initialize(void) {
89a891
 	isc_result_t result;
89a891
+	isc_entropy_t *ectx = NULL;
89a891
 
10d019
 	REQUIRE(initialize_done == false);
89a891
 
943bc6
@@ -86,11 +88,14 @@ initialize(void) {
89a891
 	result = dns_ecdb_register(dns_g_mctx, &dbimp);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		goto cleanup_mctx;
89a891
-	result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);
89a891
+	result = isc_entropy_create(dns_g_mctx, &ectx);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		goto cleanup_db;
89a891
+	result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);
89a891
+	if (result != ISC_R_SUCCESS)
89a891
+		goto cleanup_ectx;
89a891
 
89a891
-	result = dst_lib_init(dns_g_mctx, NULL, 0);
89a891
+	result = dst_lib_init(dns_g_mctx, ectx, 0);
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		goto cleanup_hash;
89a891
 
943bc6
@@ -98,11 +103,17 @@ initialize(void) {
89a891
 	if (result != ISC_R_SUCCESS)
89a891
 		goto cleanup_dst;
89a891
 
89a891
+	isc_hash_init();
89a891
+	isc_entropy_detach(&ectx);
89a891
+
10d019
 	initialize_done = true;
89a891
 	return;
89a891
 
89a891
   cleanup_dst:
89a891
 	dst_lib_destroy();
89a891
+  cleanup_ectx:
89a891
+	if (ectx != NULL)
89a891
+		isc_entropy_detach(&ectx);
89a891
   cleanup_hash:
89a891
 	isc_hash_destroy();
89a891
   cleanup_db:
89a891
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
943bc6
index 1e57c71..3f4f822 100644
89a891
--- a/lib/dns/openssl_link.c
89a891
+++ b/lib/dns/openssl_link.c
89a891
@@ -31,6 +31,7 @@
89a891
 #include <isc/mem.h>
89a891
 #include <isc/mutex.h>
89a891
 #include <isc/mutexblock.h>
89a891
+#include <isc/platform.h>
89a891
 #include <isc/string.h>
89a891
 #include <isc/thread.h>
89a891
 #include <isc/util.h>
89a891
@@ -46,8 +47,6 @@
89a891
 #include <openssl/engine.h>
89a891
 #endif
89a891
 
89a891
-static RAND_METHOD *rm = NULL;
89a891
-
89a891
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
89a891
 static isc_mutex_t *locks = NULL;
89a891
 static int nlocks;
89a891
@@ -57,6 +56,9 @@ static int nlocks;
89a891
 static ENGINE *e = NULL;
89a891
 #endif
89a891
 
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
+static RAND_METHOD *rm = NULL;
89a891
+
89a891
 static int
89a891
 entropy_get(unsigned char *buf, int num) {
89a891
 	isc_result_t result;
89a891
@@ -102,6 +104,7 @@ entropy_add(const void *buf, int num, double entropy) {
89a891
 	return (1);
89a891
 }
89a891
 #endif
89a891
+#endif /* !ISC_PLATFORM_CRYPTORANDOM */
89a891
 
230545
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
89a891
 static void
10d019
@@ -192,7 +195,7 @@ _set_thread_id(CRYPTO_THREADID *id)
89a891
 isc_result_t
89a891
 dst__openssl_init(const char *engine) {
89a891
 	isc_result_t result;
89a891
-#if !defined(OPENSSL_NO_ENGINE)
89a891
+#if !defined(OPENSSL_NO_ENGINE) && !defined(ISC_PLATFORM_CRYPTORANDOM)
89a891
 	ENGINE *re;
89a891
 #else
89a891
 	UNUSED(engine);
10d019
@@ -222,6 +225,7 @@ dst__openssl_init(const char *engine) {
89a891
 	ERR_load_crypto_strings();
89a891
 #endif
89a891
 
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	rm = mem_alloc(sizeof(RAND_METHOD) FILELINE);
89a891
 	if (rm == NULL) {
89a891
 		result = ISC_R_NOMEMORY;
10d019
@@ -233,6 +237,7 @@ dst__openssl_init(const char *engine) {
89a891
 	rm->add = entropy_add;
89a891
 	rm->pseudorand = entropy_getpseudo;
89a891
 	rm->status = entropy_status;
89a891
+#endif
89a891
 
89a891
 #if !defined(OPENSSL_NO_ENGINE)
89a891
 #if !defined(CONF_MFLAGS_DEFAULT_SECTION)
10d019
@@ -266,6 +271,7 @@ dst__openssl_init(const char *engine) {
89a891
 		}
89a891
 	}
89a891
 
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	re = ENGINE_get_default_RAND();
89a891
 	if (re == NULL) {
89a891
 		re = ENGINE_new();
10d019
@@ -278,9 +284,21 @@ dst__openssl_init(const char *engine) {
89a891
 		ENGINE_free(re);
89a891
 	} else
89a891
 		ENGINE_finish(re);
89a891
+#endif
89a891
 #else
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	RAND_set_rand_method(rm);
89a891
+#endif
89a891
 #endif /* !defined(OPENSSL_NO_ENGINE) */
89a891
+
89a891
+	/* Protect ourselves against unseeded PRNG */
89a891
+	if (RAND_status() != 1) {
89a891
+		FATAL_ERROR(__FILE__, __LINE__,
89a891
+			    "OpenSSL pseudorandom number generator "
89a891
+			    "cannot be initialized (see the `PRNG not "
89a891
+			    "seeded' message in the OpenSSL FAQ)");
89a891
+	}
89a891
+
89a891
 	return (ISC_R_SUCCESS);
89a891
 
89a891
 #if !defined(OPENSSL_NO_ENGINE)
10d019
@@ -288,10 +306,14 @@ dst__openssl_init(const char *engine) {
89a891
 	if (e != NULL)
89a891
 		ENGINE_free(e);
89a891
 	e = NULL;
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	mem_free(rm FILELINE);
89a891
 	rm = NULL;
89a891
 #endif
89a891
+#endif
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
  cleanup_mutexinit:
89a891
+#endif
89a891
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
89a891
 	CRYPTO_set_locking_callback(NULL);
89a891
 	DESTROYMUTEXBLOCK(locks, nlocks);
10d019
@@ -306,14 +328,17 @@ void
89a891
 dst__openssl_destroy(void) {
89a891
 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x10100000L)
89a891
 	OPENSSL_cleanup();
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	if (rm != NULL) {
89a891
 		mem_free(rm FILELINE);
89a891
 		rm = NULL;
89a891
 	}
89a891
+#endif
89a891
 #else
89a891
 	/*
89a891
 	 * Sequence taken from apps_shutdown() in <apps/apps.h>.
89a891
 	 */
89a891
+#ifndef ISC_PLATFORM_CRYPTORANDOM
89a891
 	if (rm != NULL) {
89a891
 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
89a891
 		RAND_cleanup();
10d019
@@ -321,6 +346,7 @@ dst__openssl_destroy(void) {
89a891
 		mem_free(rm FILELINE);
89a891
 		rm = NULL;
89a891
 	}
89a891
+#endif
89a891
 #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
89a891
 	CONF_modules_free();
89a891
 #endif
10d019
@@ -456,11 +482,45 @@ dst__openssl_getengine(const char *engine) {
89a891
 }
89a891
 #endif
89a891
 
89a891
-#else /* OPENSSL */
89a891
+isc_result_t
89a891
+dst_random_getdata(void *data, unsigned int length,
89a891
+		   unsigned int *returned, unsigned int flags) {
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+#ifndef DONT_REQUIRE_DST_LIB_INIT
89a891
+	INSIST(dst__memory_pool != NULL);
89a891
+#endif
89a891
+	REQUIRE(data != NULL);
89a891
+	REQUIRE(length > 0);
89a891
 
89a891
-#include <isc/util.h>
89a891
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
89a891
+	if ((flags & ISC_ENTROPY_GOODONLY) == 0) {
89a891
+		if (RAND_pseudo_bytes((unsigned char *)data, (int)length) < 0)
89a891
+			return (dst__openssl_toresult2("RAND_pseudo_bytes",
89a891
+						       DST_R_OPENSSLFAILURE));
89a891
+	} else {
89a891
+		if (RAND_bytes((unsigned char *)data, (int)length) != 1)
89a891
+			return (dst__openssl_toresult2("RAND_bytes",
89a891
+						       DST_R_OPENSSLFAILURE));
89a891
+	}
89a891
+#else
89a891
+	UNUSED(flags);
89a891
 
89a891
-EMPTY_TRANSLATION_UNIT
89a891
+	if (RAND_bytes((unsigned char *)data, (int)length) != 1)
89a891
+		return (dst__openssl_toresult2("RAND_bytes",
89a891
+					       DST_R_OPENSSLFAILURE));
89a891
+#endif
89a891
+	if (returned != NULL)
89a891
+		*returned = length;
89a891
+	return (ISC_R_SUCCESS);
89a891
+#else
89a891
+	UNUSED(data);
89a891
+	UNUSED(length);
89a891
+	UNUSED(returned);
89a891
+	UNUSED(flags);
89a891
+
89a891
+	return (ISC_R_NOTIMPLEMENTED);
89a891
+#endif
89a891
+}
89a891
 
89a891
 #endif /* OPENSSL */
89a891
 /*! \file */
89a891
diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
943bc6
index 6b30309..20552fa 100644
89a891
--- a/lib/dns/pkcs11.c
89a891
+++ b/lib/dns/pkcs11.c
89a891
@@ -13,12 +13,15 @@
89a891
 
89a891
 #include <config.h>
89a891
 
89a891
+#include <isc/util.h>
89a891
+
89a891
 #include <dns/log.h>
89a891
 #include <dns/result.h>
89a891
 
89a891
 #include <pk11/pk11.h>
89a891
 #include <pk11/internal.h>
89a891
 
89a891
+#include "dst_internal.h"
89a891
 #include "dst_pkcs11.h"
89a891
 
89a891
 isc_result_t
89a891
@@ -34,12 +37,32 @@ dst__pkcs11_toresult(const char *funcname, const char *file, int line,
89a891
 	return (fallback);
89a891
 }
89a891
 
89a891
+isc_result_t
89a891
+dst_random_getdata(void *data, unsigned int length,
89a891
+		   unsigned int *returned, unsigned int flags) {
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
89a891
+	isc_result_t ret;
89a891
 
89a891
-#else /* PKCS11CRYPTO */
89a891
+#ifndef DONT_REQUIRE_DST_LIB_INIT
89a891
+	INSIST(dst__memory_pool != NULL);
89a891
+#endif
89a891
+	REQUIRE(data != NULL);
89a891
+	REQUIRE(length > 0);
89a891
+	UNUSED(flags);
89a891
 
89a891
-#include <isc/util.h>
89a891
+	ret = pk11_rand_bytes(data, (int) length);
89a891
+	if ((ret == ISC_R_SUCCESS) && (returned != NULL))
89a891
+		*returned = length;
89a891
+	return (ret);
89a891
+#else
89a891
+	UNUSED(data);
89a891
+	UNUSED(length);
89a891
+	UNUSED(returned);
89a891
+	UNUSED(flags);
89a891
 
89a891
-EMPTY_TRANSLATION_UNIT
89a891
+	return (ISC_R_NOTIMPLEMENTED);
89a891
+#endif
89a891
+}
89a891
 
89a891
 #endif /* PKCS11CRYPTO */
89a891
 /*! \file */
89a891
diff --git a/lib/dns/tests/Kyuafile b/lib/dns/tests/Kyuafile
10d019
index 937b548..f3c0e38 100644
89a891
--- a/lib/dns/tests/Kyuafile
89a891
+++ b/lib/dns/tests/Kyuafile
10d019
@@ -10,6 +10,7 @@ tap_test_program{name='dh_test'}
10d019
 tap_test_program{name='dispatch_test'}
10d019
 tap_test_program{name='dnstap_test'}
10d019
 tap_test_program{name='dst_test'}
10d019
+tap_test_program{name='dstrandom_test'}
10d019
 tap_test_program{name='geoip_test'}
10d019
 tap_test_program{name='gost_test'}
10d019
 tap_test_program{name='keytable_test'}
89a891
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
943bc6
index 4126372..30cab17 100644
89a891
--- a/lib/dns/tests/Makefile.in
89a891
+++ b/lib/dns/tests/Makefile.in
10d019
@@ -37,6 +37,7 @@ SRCS =		acl_test.c \
89a891
 		dnstap_test.c \
89a891
 		dst_test.c \
89a891
 		dnstest.c \
89a891
+		dstrandom_test.c \
89a891
 		geoip_test.c \
89a891
 		gost_test.c \
89a891
 		keytable_test.c \
10d019
@@ -69,6 +70,7 @@ TARGETS =	acl_test@EXEEXT@ \
89a891
 		dh_test@EXEEXT@ \
89a891
 		dispatch_test@EXEEXT@ \
89a891
 		dnstap_test@EXEEXT@ \
89a891
+		dstrandom_test@EXEEXT@ \
89a891
 		dst_test@EXEEXT@ \
89a891
 		geoip_test@EXEEXT@ \
89a891
 		gost_test@EXEEXT@ \
10d019
@@ -258,6 +260,11 @@ zt_test@EXEEXT@: zt_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
10d019
 		${LDFLAGS} -o $@ zt_test.@O@ dnstest.@O@ \
10d019
 		${DNSLIBS} ${ISCLIBS} ${LIBS}
89a891
 
89a891
+dstrandom_test@EXEEXT@: dstrandom_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
89a891
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
89a891
+			dstrandom_test.@O@ ${DNSLIBS} \
89a891
+			${ISCLIBS} ${ISCPK11LIBS} ${LIBS}
89a891
+
89a891
 unit::
89a891
 	sh ${top_builddir}/unit/unittest.sh
89a891
 
89a891
diff --git a/lib/dns/tests/dstrandom_test.c b/lib/dns/tests/dstrandom_test.c
89a891
new file mode 100644
10d019
index 0000000..bd3d164
89a891
--- /dev/null
89a891
+++ b/lib/dns/tests/dstrandom_test.c
10d019
@@ -0,0 +1,115 @@
89a891
+/*
10d019
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
89a891
+ *
10d019
+ * This Source Code Form is subject to the terms of the Mozilla Public
10d019
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
10d019
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
89a891
+ *
10d019
+ * See the COPYRIGHT file distributed with this work for additional
10d019
+ * information regarding copyright ownership.
89a891
+ */
89a891
+
89a891
+#include <config.h>
89a891
+
10d019
+#if HAVE_CMOCKA
10d019
+
10d019
+#include <stdarg.h>
10d019
+#include <stddef.h>
10d019
+#include <setjmp.h>
89a891
+
10d019
+#include <stdlib.h>
89a891
+#include <stdio.h>
89a891
+#include <string.h>
10d019
+#include <unistd.h>
10d019
+
10d019
+#define UNIT_TESTING
10d019
+#include <cmocka.h>
89a891
+
89a891
+#include <isc/entropy.h>
89a891
+#include <isc/mem.h>
10d019
+#include <isc/print.h>
89a891
+#include <isc/platform.h>
89a891
+#include <isc/util.h>
89a891
+
89a891
+#include <dst/dst.h>
89a891
+
89a891
+isc_mem_t *mctx = NULL;
89a891
+isc_entropy_t *ectx = NULL;
89a891
+unsigned char buffer[128];
89a891
+
10d019
+/* isc_entropy_getdata() examples */
10d019
+static void
10d019
+isc_entropy_getdata_test(void **state) {
89a891
+	isc_result_t result;
89a891
+	unsigned int returned, status;
10d019
+	const char *randomfile = "testdata/dstrandom/random.data";
89a891
+	int ret;
10d019
+
10d019
+	UNUSED(state);
89a891
+
89a891
+	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
89a891
+	result = isc_mem_create(0, 0, &mctx);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
89a891
+	result = isc_entropy_create(mctx, &ectx);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
89a891
+	result = dst_lib_init(mctx, ectx, 0);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
89a891
+
89a891
+#ifdef ISC_PLATFORM_CRYPTORANDOM
10d019
+	isc_entropy_usehook(ectx, true);
89a891
+
89a891
+	returned = 0;
89a891
+	result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),
89a891
+				     &returned, 0);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
10d019
+	assert_int_equal(returned, sizeof(buffer));
89a891
+
89a891
+	status = isc_entropy_status(ectx);
10d019
+	assert_int_equal(status, 0);
89a891
+
10d019
+	isc_entropy_usehook(ectx, false);
89a891
+#endif
89a891
+
89a891
+	ret = chdir(TESTS);
10d019
+	assert_int_equal(ret, 0);
89a891
+
89a891
+	result = isc_entropy_createfilesource(ectx, randomfile);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
89a891
+
89a891
+	returned = 0;
89a891
+	result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),
89a891
+				     &returned, 0);
10d019
+	assert_int_equal(result, ISC_R_SUCCESS);
10d019
+	assert_int_equal(returned, sizeof(buffer));
89a891
+
89a891
+	status = isc_entropy_status(ectx);
10d019
+	assert_true(status > 0);
89a891
+
89a891
+	dst_lib_destroy();
89a891
+	isc_entropy_detach(&ectx);
10d019
+	assert_null(ectx);
10d019
+
89a891
+	isc_mem_destroy(&mctx);
10d019
+	assert_null(mctx);
89a891
+}
89a891
+
10d019
+int
10d019
+main(void) {
10d019
+	const struct CMUnitTest tests[] = {
10d019
+		cmocka_unit_test(isc_entropy_getdata_test),
10d019
+	};
89a891
+
10d019
+	return (cmocka_run_group_tests(tests, NULL, NULL));
89a891
+}
89a891
+
10d019
+#else /* HAVE_CMOCKA */
10d019
+
10d019
+#include <stdio.h>
10d019
+
10d019
+int
10d019
+main(void) {
10d019
+	printf("1..0 # Skipped: cmocka not available\n");
10d019
+	return (0);
10d019
+}
10d019
+
10d019
+#endif
89a891
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
943bc6
index 9c2ef79..f597049 100644
89a891
--- a/lib/dns/win32/libdns.def.in
89a891
+++ b/lib/dns/win32/libdns.def.in
943bc6
@@ -1487,6 +1487,13 @@ dst_lib_destroy
89a891
 dst_lib_init
89a891
 dst_lib_init2
89a891
 dst_lib_initmsgcat
89a891
+@IF PKCS11
89a891
+dst_random_getdata
89a891
+@ELSE PKCS11
89a891
+@IF OPENSSL
89a891
+dst_random_getdata
89a891
+@END OPENSSL
89a891
+@END PKCS11
89a891
 dst_region_computeid
89a891
 dst_region_computerid
89a891
 dst_result_register
89a891
diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
943bc6
index 0c1f3ed..fdd17d7 100644
89a891
--- a/lib/isc/entropy.c
89a891
+++ b/lib/isc/entropy.c
10d019
@@ -104,11 +104,15 @@ struct isc_entropy {
10d019
 	uint32_t			initialized;
10d019
 	uint32_t			initcount;
89a891
 	isc_entropypool_t		pool;
10d019
+	bool				usehook;
89a891
 	unsigned int			nsources;
89a891
 	isc_entropysource_t	       *nextsource;
89a891
 	ISC_LIST(isc_entropysource_t)	sources;
89a891
 };
89a891
 
89a891
+/*% Global Hook */
89a891
+static isc_entropy_getdata_t hook;
89a891
+
89a891
 /*% Sample Queue */
89a891
 typedef struct {
10d019
 	uint32_t	last_time;	/*%< last time recorded */
10d019
@@ -557,6 +561,11 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
89a891
 
89a891
 	LOCK(&ent->lock);
89a891
 
89a891
+	if (ent->usehook && (hook != NULL)) {
89a891
+		UNLOCK(&ent->lock);
89a891
+		return (hook(data, length, returned, flags));
89a891
+	}
89a891
+
89a891
 	remain = length;
89a891
 	buf = data;
89a891
 	total = 0;
10d019
@@ -708,6 +717,7 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
89a891
 	ent->refcnt = 1;
89a891
 	ent->initialized = 0;
89a891
 	ent->initcount = 0;
10d019
+	ent->usehook = false;
89a891
 	ent->magic = ENTROPY_MAGIC;
89a891
 
89a891
 	isc_entropypool_init(&ent->pool);
89a891
@@ -1286,3 +1296,17 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
89a891
 	 */
89a891
 	return (final_result);
89a891
 }
89a891
+
89a891
+void
10d019
+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff) {
89a891
+	REQUIRE(VALID_ENTROPY(ectx));
89a891
+
89a891
+	LOCK(&ectx->lock);
89a891
+	ectx->usehook = onoff;
89a891
+	UNLOCK(&ectx->lock);
89a891
+}
89a891
+
89a891
+void
89a891
+isc_entropy_sethook(isc_entropy_getdata_t myhook) {
89a891
+	hook = myhook;
89a891
+}
89a891
diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
943bc6
index b5bc956..f32c9dc 100644
89a891
--- a/lib/isc/include/isc/entropy.h
89a891
+++ b/lib/isc/include/isc/entropy.h
230545
@@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
89a891
  *	isc_entropy_createcallbacksource().
89a891
  */
89a891
 
89a891
+void
10d019
+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);
89a891
+/*!<
89a891
+ * \brief Mark/unmark the given entropy structure as being hooked.
89a891
+ */
89a891
+
89a891
+void
89a891
+isc_entropy_sethook(isc_entropy_getdata_t myhook);
89a891
+/*!<
89a891
+ * \brief Set the getdata hook (e.g., for a crypto random generator).
89a891
+ */
89a891
+
89a891
 ISC_LANG_ENDDECLS
89a891
 
89a891
 #endif /* ISC_ENTROPY_H */
89a891
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
943bc6
index 2bf8758..f4c684e 100644
89a891
--- a/lib/isc/include/isc/platform.h.in
89a891
+++ b/lib/isc/include/isc/platform.h.in
230545
@@ -359,6 +359,11 @@
89a891
  */
89a891
 @ISC_PLATFORM_HAVESTRINGSH@
89a891
 
89a891
+/*
89a891
+ * Define if the random functions are provided by crypto.
89a891
+ */
89a891
+@ISC_PLATFORM_CRYPTORANDOM@
89a891
+
89a891
 /*
89a891
  * Define if the hash functions must be provided by OpenSSL.
89a891
  */
89a891
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
943bc6
index 3bdd54f..d5acd39 100644
89a891
--- a/lib/isc/include/isc/types.h
89a891
+++ b/lib/isc/include/isc/types.h
943bc6
@@ -95,6 +95,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
89a891
 typedef struct isc_timer		isc_timer_t;		/*%< Timer */
89a891
 typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
89a891
 
89a891
+typedef isc_result_t (*isc_entropy_getdata_t)(void *, unsigned int,
89a891
+					      unsigned int *, unsigned int);
89a891
 typedef void (*isc_taskaction_t)(isc_task_t *, isc_event_t *);
89a891
 typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
89a891
 
89a891
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
943bc6
index 227f807..4a63fdf 100644
89a891
--- a/lib/isc/pk11.c
89a891
+++ b/lib/isc/pk11.c
10d019
@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
89a891
 	ret = isc_stdio_open(randomfile, "r", &stream);
89a891
 	if (ret != ISC_R_SUCCESS)
89a891
 		goto cleanup;
89a891
-	ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);
89a891
-	if (ret!= ISC_R_SUCCESS)
89a891
-		goto cleanup;
89a891
+	while (ret == ISC_R_SUCCESS) {
89a891
+		ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);
89a891
+		if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF))
89a891
+			goto cleanup;
89a891
+		(void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);
89a891
+	} 
89a891
 	ret = isc_stdio_close(stream);
89a891
 	stream = NULL;
89a891
-	if (ret!= ISC_R_SUCCESS)
89a891
+	if (ret != ISC_R_SUCCESS)
89a891
 		goto cleanup;
89a891
-	(void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);
89a891
 
89a891
     cleanup:
89a891
 	if (stream != NULL)
89a891
diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
943bc6
index 1f785e0..f9051c3 100644
89a891
--- a/lib/isc/win32/include/isc/platform.h.in
89a891
+++ b/lib/isc/win32/include/isc/platform.h.in
230545
@@ -73,6 +73,11 @@
89a891
 #define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)
89a891
 #define ISC_PLATFORM_NORETURN_POST
89a891
 
89a891
+/*
89a891
+ * Define if the random functions are provided by crypto.
89a891
+ */
89a891
+@ISC_PLATFORM_CRYPTORANDOM@
89a891
+
89a891
 /*
89a891
  * Define if the hash functions must be provided by OpenSSL.
89a891
  */
89a891
diff --git a/win32utils/Configure b/win32utils/Configure
1bd7b4
index 7ac30fb..55b6c23 100644
89a891
--- a/win32utils/Configure
89a891
+++ b/win32utils/Configure
10d019
@@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
89a891
 my %configdefp;
89a891
 
89a891
 my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",
89a891
+                 "ISC_PLATFORM_CRYPTORANDOM",
89a891
                  "ISC_PLATFORM_HAVEATOMICSTORE",
89a891
                  "ISC_PLATFORM_HAVEATOMICSTOREQ",
89a891
                  "ISC_PLATFORM_HAVECMPXCHG",
1bd7b4
@@ -516,7 +517,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
89a891
 
89a891
 # enable-xxx/disable-xxx
89a891
 
89a891
-my @enablelist = ("developer",
89a891
+my @enablelist = ("crypto-rand",
89a891
+                  "developer",
89a891
                   "fixed-rrset",
89a891
                   "intrinsics",
1bd7b4
                   "native-pkcs11",
1bd7b4
@@ -578,6 +580,7 @@ my @help = (
89a891
 "\nOptional Features:\n",
230545
 "  enable-intrinsics     enable intrinsic/atomic functions [default=yes]\n",
89a891
 "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
89a891
+"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
89a891
 "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
89a891
 "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
1bd7b4
 "  enable-fixed-rrset    enable fixed rrset ordering [default=no]\n",
1bd7b4
@@ -625,7 +628,9 @@ my $want_clean = "no";
89a891
 my $want_unknown = "no";
89a891
 my $unknown_value;
89a891
 my $enable_intrinsics = "yes";
89a891
+my $cryptolib = "";
89a891
 my $enable_native_pkcs11 = "no";
89a891
+my $enable_crypto_rand = "yes";
89a891
 my $enable_openssl_hash = "auto";
89a891
 my $enable_filter_aaaa = "yes";
1bd7b4
 my $enable_fixed_rrset = "no";
1bd7b4
@@ -844,6 +849,10 @@ sub myenable {
89a891
         if ($val =~ /^yes$/i) {
89a891
             $enable_native_pkcs11 = "yes";
89a891
         }
89a891
+    } elsif ($key =~ /^crypto-rand$/i) {
89a891
+        if ($val =~ /^no$/i) {
89a891
+            $enable_crypto_rand = "no";
89a891
+        }
89a891
     } elsif ($key =~ /^openssl-hash$/i) {
89a891
         if ($val =~ /^yes$/i) {
89a891
             $enable_openssl_hash = "yes";
1bd7b4
@@ -1146,6 +1155,11 @@ if ($verbose) {
89a891
     } else {
89a891
         print "native-pkcs11: disabled\n";
89a891
     }
89a891
+    if ($enable_crypto_rand eq "yes") {
89a891
+        print "crypto-rand: enabled\n";
89a891
+    } else {
89a891
+        print "crypto-rand: disabled\n";
89a891
+    }
89a891
     if ($enable_openssl_hash eq "yes") {
89a891
         print "openssl-hash: enabled\n";
89a891
     } else {
1bd7b4
@@ -1498,6 +1512,7 @@ if ($enable_intrinsics eq "yes") {
89a891
 
89a891
 # enable-native-pkcs11
89a891
 if ($enable_native_pkcs11 eq "yes") {
89a891
+    $cryptolib = "pkcs11";
89a891
     if ($use_openssl eq "auto") {
89a891
         $use_openssl = "no";
89a891
     }
1bd7b4
@@ -1707,6 +1722,7 @@ if ($use_openssl eq "yes") {
89a891
         $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
1bd7b4
     }
89a891
 
89a891
+    $cryptolib = "openssl";
89a891
     $configcond{"OPENSSL"} = 1;
89a891
     $configdefd{"CRYPTO"} = "OPENSSL";
89a891
     $configvar{"OPENSSL_PATH"} = "$openssl_path";
1bd7b4
@@ -2278,6 +2294,15 @@ if ($use_aes eq "yes") {
89a891
 }
89a891
 
10d019
 
89a891
+# enable-crypto-rand
89a891
+if ($enable_crypto_rand eq "yes") {
89a891
+    if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {
89a891
+        die "No crypto provider for random functions\n";
89a891
+    }
89a891
+    $configdefp{"ISC_PLATFORM_CRYPTORANDOM"} = "\"$cryptolib\"";
89a891
+}
89a891
+print "Cryptographic library for DNSSEC: $cryptolib";
89a891
+
89a891
 # enable-openssl-hash
89a891
 if ($enable_openssl_hash eq "yes") {
89a891
     if ($use_openssl eq "no") {
1bd7b4
@@ -3650,6 +3675,7 @@ exit 0;
89a891
 #  --enable-developer partially supported
89a891
 #  --enable-newstats (9.9/9.9sub only)
89a891
 #  --enable-native-pkcs11 supported
89a891
+#  --enable-crypto-rand supported
89a891
 #  --enable-openssl-version-check included without a way to disable it
89a891
 #  --enable-openssl-hash supported
89a891
 #  --enable-threads included without a way to disable it
89a891
-- 
1bd7b4
2.31.1
89a891