Tree - rpms/bind - CentOS Git server

rpms / bind

Blame bind-9.11-rt31459.patch

Blob History Raw

		ad7b3b	`From 45209f5153693339c4582795714b6859693673fc Mon Sep 17 00:00:00 2001`
		6e9104	`From: Evan Hunt <each@isc.org>`
		6e9104	`Date: Tue, 12 Sep 2017 19:05:46 -0700`
		6e9104	`Subject: [PATCH] rebased rt31459c`
		6e9104
		6e9104	`[rt31459d] update the newer tools`
		6e9104
		6e9104	`[rt31459d] setup entropy in dns_lib_init()`
		6e9104
		6e9104	`[rt31459d] silence compiler warning`
		6e9104
		6e9104	`DNS_OPENSSL_LIBS -> DST_OPENSSL_LIBS`
		6e9104
		6e9104	`Include new unit test`
		6e9104	`---`
		6e9104	`bin/confgen/keygen.c \| 7 +`
		6e9104	`bin/dnssec/dnssec-dsfromkey.c \| 8 +-`
		6e9104	`bin/dnssec/dnssec-importkey.c \| 8 +-`
		6e9104	`bin/dnssec/dnssec-revoke.c \| 8 +-`
		6e9104	`bin/dnssec/dnssec-settime.c \| 8 +-`
		6e9104	`bin/dnssec/dnssec-signzone.c \| 11 +-`
		6e9104	`bin/dnssec/dnssec-verify.c \| 8 +-`
		6e9104	`bin/dnssec/dnssectool.c \| 11 +-`
		6e9104	`bin/named/server.c \| 6 +`
		6e9104	`bin/nsupdate/nsupdate.c \| 18 ++-`
		6e9104	`bin/tests/makejournal.c \| 6 +-`
		ad7b3b	`bin/tests/system/pipelined/pipequeries.c \| 21 ++-`
		6e9104	`bin/tests/system/pipelined/tests.sh \| 4 +-`
		6e9104	`bin/tests/system/rsabigexponent/bigkey.c \| 4 +`
		6e9104	`bin/tests/system/tkey/keycreate.c \| 26 +++-`
		6e9104	`bin/tests/system/tkey/keydelete.c \| 26 +++-`
		6e9104	`bin/tests/system/tkey/tests.sh \| 8 +-`
		6e9104	`bin/tools/mdig.c \| 3 +-`
		6e9104	`configure \| 250 ++++++++++++++++++-------------`
		6e9104	`configure.in \| 77 +++++++++-`
		6e9104	`lib/dns/dst_api.c \| 21 ++-`
		6e9104	`lib/dns/include/dst/dst.h \| 8 +`
		ad7b3b	`lib/dns/lib.c \| 15 +-`
		6e9104	`lib/dns/openssl_link.c \| 72 ++++++++-`
		6e9104	`lib/dns/pkcs11.c \| 29 +++-`
		6e9104	`lib/dns/tests/Atffile \| 1 +`
		6e9104	`lib/dns/tests/Kyuafile \| 1 +`
		6e9104	`lib/dns/tests/Makefile.in \| 7 +`
		6e9104	`lib/dns/tests/dnstest.c \| 14 +-`
		ad7b3b	`lib/dns/tests/dstrandom_test.c \| 99 ++++++++++++`
		6e9104	`lib/dns/win32/libdns.def.in \| 7 +`
		6e9104	`lib/isc/entropy.c \| 24 +++`
		6e9104	`lib/isc/include/isc/entropy.h \| 12 ++`
		6e9104	`lib/isc/include/isc/platform.h.in \| 5 +`
		6e9104	`lib/isc/include/isc/types.h \| 2 +`
		6e9104	`lib/isc/pk11.c \| 12 +-`
		6e9104	`lib/isc/win32/include/isc/platform.h.in \| 5 +`
		6e9104	`win32utils/Configure \| 29 +++-`
		ad7b3b	`38 files changed, 699 insertions(+), 182 deletions(-)`
		6e9104	`create mode 100644 lib/dns/tests/dstrandom_test.c`
		6e9104
		6e9104	`diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c`
		ad7b3b	`index 5015abb..295e16f 100644`
		6e9104	`--- a/bin/confgen/keygen.c`
		6e9104	`+++ b/bin/confgen/keygen.c`
		6e9104	`@@ -165,6 +165,13 @@ generate_key(isc_mem_t mctx, const char randomfile, dns_secalg_t alg,`
		6e9104	`randomfile = NULL;`
		6e9104	`open_keyboard = ISC_ENTROPY_KEYBOARDYES;`
		6e9104	`}`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`DO("start entropy source", isc_entropy_usebestsource(ectx,`
		6e9104	`&entropy_source,`
		6e9104	`randomfile,`
		6e9104	`diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c`
		ad7b3b	`index 65fdaaa..6612189 100644`
		6e9104	`--- a/bin/dnssec/dnssec-dsfromkey.c`
		6e9104	`+++ b/bin/dnssec/dnssec-dsfromkey.c`
		ad7b3b	`@@ -497,14 +497,14 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`if (ectx == NULL)`
		6e9104	`setup_entropy(mctx, NULL, &ectx);`
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not initialize hash");`
		6e9104	`result = dst_lib_init(mctx, ectx,`
		6e9104	`ISC_ENTROPY_BLOCKING \| ISC_ENTROPY_GOODONLY);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("could not initialize hash");`
		6e9104	`isc_entropy_stopcallbacksources(ectx);`
		6e9104
		6e9104	`setup_logging(mctx, &log;;`
		ad7b3b	`@@ -566,8 +566,8 @@ main(int argc, char **argv) {`
		6e9104	`if (dns_rdataset_isassociated(&rdataset))`
		6e9104	`dns_rdataset_disassociate(&rdataset);`
		6e9104	`cleanup_logging(&log;;`
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`cleanup_entropy(&ectx);`
		6e9104	`dns_name_destroy();`
		6e9104	`if (verbose > 10)`
		6e9104	`diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c`
		ad7b3b	`index 0d1e7f8..79c4d74 100644`
		6e9104	`--- a/bin/dnssec/dnssec-importkey.c`
		6e9104	`+++ b/bin/dnssec/dnssec-importkey.c`
		ad7b3b	`@@ -407,14 +407,14 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`if (ectx == NULL)`
		6e9104	`setup_entropy(mctx, NULL, &ectx);`
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not initialize hash");`
		6e9104	`result = dst_lib_init(mctx, ectx,`
		6e9104	`ISC_ENTROPY_BLOCKING \| ISC_ENTROPY_GOODONLY);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("could not initialize hash");`
		6e9104	`isc_entropy_stopcallbacksources(ectx);`
		6e9104
		6e9104	`setup_logging(mctx, &log;;`
		ad7b3b	`@@ -458,8 +458,8 @@ main(int argc, char **argv) {`
		6e9104	`if (dns_rdataset_isassociated(&rdataset))`
		6e9104	`dns_rdataset_disassociate(&rdataset);`
		6e9104	`cleanup_logging(&log;;`
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`cleanup_entropy(&ectx);`
		6e9104	`dns_name_destroy();`
		6e9104	`if (verbose > 10)`
		6e9104	`diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c`
		ad7b3b	`index 1a2b545..e33cb8b 100644`
		6e9104	`--- a/bin/dnssec/dnssec-revoke.c`
		6e9104	`+++ b/bin/dnssec/dnssec-revoke.c`
		ad7b3b	`@@ -184,14 +184,14 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`if (ectx == NULL)`
		6e9104	`setup_entropy(mctx, NULL, &ectx);`
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("Could not initialize hash");`
		6e9104	`result = dst_lib_init2(mctx, ectx, engine,`
		6e9104	`ISC_ENTROPY_BLOCKING \| ISC_ENTROPY_GOODONLY);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("Could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("Could not initialize hash");`
		6e9104	`isc_entropy_stopcallbacksources(ectx);`
		6e9104
		6e9104	`result = dst_key_fromnamedfile(filename, dir,`
		ad7b3b	`@@ -273,8 +273,8 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`cleanup:`
		6e9104	`dst_key_free(&key);`
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`cleanup_entropy(&ectx);`
		6e9104	`if (verbose > 10)`
		6e9104	`isc_mem_stats(mctx, stdout);`
		6e9104	`diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c`
		ad7b3b	`index f355903..6a2ca59 100644`
		6e9104	`--- a/bin/dnssec/dnssec-settime.c`
		6e9104	`+++ b/bin/dnssec/dnssec-settime.c`
		ad7b3b	`@@ -382,14 +382,14 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`if (ectx == NULL)`
		6e9104	`setup_entropy(mctx, NULL, &ectx);`
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("Could not initialize hash");`
		6e9104	`result = dst_lib_init2(mctx, ectx, engine,`
		6e9104	`ISC_ENTROPY_BLOCKING \| ISC_ENTROPY_GOODONLY);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("Could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("Could not initialize hash");`
		6e9104	`isc_entropy_stopcallbacksources(ectx);`
		6e9104
		6e9104	`if (predecessor != NULL) {`
		ad7b3b	`@@ -674,8 +674,8 @@ main(int argc, char **argv) {`
		6e9104	`if (prevkey != NULL)`
		6e9104	`dst_key_free(&prevkey);`
		6e9104	`dst_key_free(&key);`
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`cleanup_entropy(&ectx);`
		6e9104	`if (verbose > 10)`
		6e9104	`isc_mem_stats(mctx, stdout);`
		6e9104	`diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c`
		ad7b3b	`index c6a0313..6ddaebe 100644`
		6e9104	`--- a/bin/dnssec/dnssec-signzone.c`
		6e9104	`+++ b/bin/dnssec/dnssec-signzone.c`
		ad7b3b	`@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {`
		6e9104	`if (!pseudorandom)`
		6e9104	`eflags \|= ISC_ENTROPY_GOODONLY;`
		6e9104
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not create hash context");`
		6e9104	`-`
		6e9104	`result = dst_lib_init2(mctx, ectx, engine, eflags);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104	`+`
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("could not create hash context");`
		6e9104	`+`
		6e9104	`isc_stdtime_get(&now;;`
		6e9104
		6e9104	`if (startstr != NULL) {`
		ad7b3b	`@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {`
		6e9104	`dns_master_styledestroy(&dsstyle, mctx);`
		6e9104
		6e9104	`cleanup_logging(&log;;`
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`cleanup_entropy(&ectx);`
		6e9104	`dns_name_destroy();`
		6e9104	`if (verbose > 10)`
		6e9104	`diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c`
		ad7b3b	`index 4c293bf..3263cbc 100644`
		6e9104	`--- a/bin/dnssec/dnssec-verify.c`
		6e9104	`+++ b/bin/dnssec/dnssec-verify.c`
		ad7b3b	`@@ -281,15 +281,15 @@ main(int argc, char *argv[]) {`
		6e9104	`if (ectx == NULL)`
		6e9104	`setup_entropy(mctx, NULL, &ectx);`
		6e9104
		6e9104	`- result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`- if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not create hash context");`
		6e9104	`-`
		6e9104	`result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`fatal("could not initialize dst: %s",`
		6e9104	`isc_result_totext(result));`
		6e9104
		6e9104	`+ result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ fatal("could not create hash context");`
		6e9104	`+`
		6e9104	`isc_stdtime_get(&now;;`
		6e9104
		6e9104	`rdclass = strtoclass(classname);`
		6e9104	`diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c`
		ad7b3b	`index fbc7ece..31a99e7 100644`
		6e9104	`--- a/bin/dnssec/dnssectool.c`
		6e9104	`+++ b/bin/dnssec/dnssectool.c`
		ad7b3b	`@@ -34,6 +34,7 @@`
		6e9104	`#include <isc/heap.h>`
		6e9104	`#include <isc/list.h>`
		6e9104	`#include <isc/mem.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`#include <isc/print.h>`
		6e9104	`#include <isc/string.h>`
		6e9104	`#include <isc/time.h>`
		ad7b3b	`@@ -235,7 +236,8 @@ setup_entropy(isc_mem_t mctx, const char randomfile, isc_entropy_t **ectx) {`
		6e9104	`if (*ectx == NULL) {`
		6e9104	`result = isc_entropy_create(mctx, ectx);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not create entropy object");`
		6e9104	`+ fatal("could not create entropy object: %s",`
		6e9104	`+ isc_result_totext(result));`
		6e9104	`ISC_LIST_INIT(sources);`
		6e9104	`}`
		6e9104
		ad7b3b	`@@ -244,6 +246,13 @@ setup_entropy(isc_mem_t mctx, const char randomfile, isc_entropy_t **ectx) {`
		6e9104	`randomfile = NULL;`
		6e9104	`}`
		6e9104
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(*ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`result = isc_entropy_usebestsource(*ectx, &source, randomfile,`
		6e9104	`usekeyboard);`
		6e9104
		6e9104	`diff --git a/bin/named/server.c b/bin/named/server.c`
		ad7b3b	`index 7f87ccf..9258e7f 100644`
		6e9104	`--- a/bin/named/server.c`
		6e9104	`+++ b/bin/named/server.c`
		ad7b3b	`@@ -36,6 +36,7 @@`
		6e9104	`#include <isc/lex.h>`
		6e9104	`#include <isc/meminfo.h>`
		6e9104	`#include <isc/parseint.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`#include <isc/portset.h>`
		6e9104	`#include <isc/print.h>`
		6e9104	`#include <isc/random.h>`
		ad7b3b	`@@ -8171,6 +8172,10 @@ load_configuration(const char filename, ns_server_t server,`
		6e9104	`"no source of entropy found");`
		6e9104	`} else {`
		6e9104	`const char *randomdev = cfg_obj_asstring(obj);`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (strcmp(randomdev, ISC_PLATFORM_CRYPTORANDOM) == 0)`
		ad7b3b	`+ isc_entropy_usehook(ns_g_entropy, true);`
		6e9104	`+#else`
		6e9104	`int level = ISC_LOG_ERROR;`
		6e9104	`result = isc_entropy_createfilesource(ns_g_entropy,`
		6e9104	`randomdev);`
		ad7b3b	`@@ -8205,6 +8210,7 @@ load_configuration(const char filename, ns_server_t server,`
		6e9104	`}`
		6e9104	`isc_entropy_detach(&ns_g_fallbackentropy);`
		6e9104	`}`
		6e9104	`+#endif`
		6e9104	`#endif`
		6e9104	`}`
		6e9104	`}`
		6e9104	`diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c`
		ad7b3b	`index 5eefc57..1559a33 100644`
		6e9104	`--- a/bin/nsupdate/nsupdate.c`
		6e9104	`+++ b/bin/nsupdate/nsupdate.c`
		ad7b3b	`@@ -35,6 +35,7 @@`
		6e9104	`#include <isc/mem.h>`
		6e9104	`#include <isc/parseint.h>`
		6e9104	`#include <isc/print.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`#include <isc/random.h>`
		6e9104	`#include <isc/region.h>`
		6e9104	`#include <isc/sockaddr.h>`
		ad7b3b	`@@ -271,7 +272,8 @@ setup_entropy(isc_mem_t mctx, const char randomfile, isc_entropy_t **ectx) {`
		6e9104	`if (*ectx == NULL) {`
		6e9104	`result = isc_entropy_create(mctx, ectx);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`- fatal("could not create entropy object");`
		6e9104	`+ fatal("could not create entropy object: %s",`
		6e9104	`+ isc_result_totext(result));`
		6e9104	`ISC_LIST_INIT(sources);`
		6e9104	`}`
		6e9104
		ad7b3b	`@@ -280,6 +282,13 @@ setup_entropy(isc_mem_t mctx, const char randomfile, isc_entropy_t **ectx) {`
		6e9104	`randomfile = NULL;`
		6e9104	`}`
		6e9104
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(*ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`result = isc_entropy_usebestsource(*ectx, &source, randomfile,`
		6e9104	`usekeyboard);`
		6e9104
		ad7b3b	`@@ -950,11 +959,11 @@ setup_system(void) {`
		6e9104	`}`
		6e9104	`}`
		6e9104
		6e9104	`- setup_entropy(gmctx, NULL, &entropy);`
		6e9104	`+ if (entropy == NULL)`
		6e9104	`+ setup_entropy(gmctx, NULL, &entropy);`
		6e9104
		6e9104	`result = isc_hash_create(gmctx, entropy, DNS_NAME_MAXWIRE);`
		6e9104	`check_result(result, "isc_hash_create");`
		6e9104	`- isc_hash_init();`
		6e9104
		6e9104	`result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);`
		6e9104	`check_result(result, "dns_dispatchmgr_create");`
		ad7b3b	`@@ -978,6 +987,9 @@ setup_system(void) {`
		6e9104	`check_result(result, "dst_lib_init");`
		ad7b3b	`is_dst_up = true;`
		6e9104
		6e9104	`+ /* moved after dst_lib_init() */`
		6e9104	`+ isc_hash_init();`
		6e9104	`+`
		6e9104	`attrmask = DNS_DISPATCHATTR_UDP \| DNS_DISPATCHATTR_TCP;`
		6e9104	`attrmask \|= DNS_DISPATCHATTR_IPV4 \| DNS_DISPATCHATTR_IPV6;`
		6e9104
		6e9104	`diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c`
		ad7b3b	`index 61a41b0..acc71a1 100644`
		6e9104	`--- a/bin/tests/makejournal.c`
		6e9104	`+++ b/bin/tests/makejournal.c`
		ad7b3b	`@@ -102,12 +102,12 @@ main(int argc, char **argv) {`
		6e9104	`CHECK(isc_mem_create(0, 0, &mctx));`
		6e9104	`CHECK(isc_entropy_create(mctx, &ectx));`
		6e9104
		6e9104	`- CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		ad7b3b	`- hash_active = true;`
		6e9104	`-`
		6e9104	`CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));`
		ad7b3b	`dst_active = true;`
		6e9104
		6e9104	`+ CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		ad7b3b	`+ hash_active = true;`
		6e9104	`+`
		6e9104	`CHECK(isc_log_create(mctx, &lctx, &logconfig));`
		6e9104	`isc_log_registercategories(lctx, categories);`
		6e9104	`isc_log_setcontext(lctx);`
		6e9104	`diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c`
		ad7b3b	`index 2fcc064..7b4f617 100644`
		6e9104	`--- a/bin/tests/system/pipelined/pipequeries.c`
		6e9104	`+++ b/bin/tests/system/pipelined/pipequeries.c`
		ad7b3b	`@@ -204,6 +204,7 @@ sendqueries(isc_task_t task, isc_event_t event) {`
		6e9104
		6e9104	`int`
		6e9104	`main(int argc, char *argv[]) {`
		6e9104	`+ char *randomfile = NULL;`
		6e9104	`isc_sockaddr_t bind_any;`
		6e9104	`struct in_addr inaddr;`
		6e9104	`isc_result_t result;`
		ad7b3b	`@@ -224,7 +225,8 @@ main(int argc, char *argv[]) {`
		6e9104	`UNUSED(argv);`
		6e9104
		ad7b3b	`isc_commandline_errprint = false;`
		6e9104	`- while ((c = isc_commandline_parse(argc, argv, "p:")) != -1) {`
		ad7b3b	`+ while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1)`
		ad7b3b	`+ {`
		6e9104	`switch (c) {`
		6e9104	`case 'p':`
		6e9104	`result = isc_parse_uint16(&port,`
		ad7b3b	`@@ -235,6 +237,9 @@ main(int argc, char *argv[]) {`
		6e9104	`exit(1);`
		6e9104	`}`
		6e9104	`break;`
		6e9104	`+ case 'r':`
		6e9104	`+ randomfile = isc_commandline_argument;`
		6e9104	`+ break;`
		6e9104	`case '?':`
		6e9104	`fprintf(stderr, "%s: invalid argument '%c'",`
		6e9104	`argv[0], c);`
		ad7b3b	`@@ -276,10 +281,18 @@ main(int argc, char *argv[]) {`
		6e9104
		6e9104	`ectx = NULL;`
		6e9104	`RUNCHECK(isc_entropy_create(mctx, &ectx));`
		6e9104	`- RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));`
		6e9104	`- RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`+ if (randomfile != NULL)`
		6e9104	`+ RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));`
		6e9104
		6e9104	`RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));`
		6e9104	`+ RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104
		6e9104	`taskmgr = NULL;`
		6e9104	`RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));`
		ad7b3b	`@@ -332,8 +345,8 @@ main(int argc, char *argv[]) {`
		6e9104	`isc_task_detach(&task);`
		6e9104	`isc_taskmgr_destroy(&taskmgr);`
		6e9104
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`isc_entropy_detach(&ectx);`
		6e9104
		6e9104	`isc_log_destroy(&lctx);`
		6e9104	`diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh`
		6e9104	`index a6720ce..9063b1f 100644`
		6e9104	`--- a/bin/tests/system/pipelined/tests.sh`
		6e9104	`+++ b/bin/tests/system/pipelined/tests.sh`
		6e9104	`@@ -19,7 +19,7 @@ status=0`
		6e9104
		6e9104	`echo_i "check pipelined TCP queries"`
		6e9104	`ret=0`
		6e9104	`-$PIPEQUERIES -p ${PORT} < input > raw \|\| ret=1`
		6e9104	`+$PIPEQUERIES -p ${PORT} -r $RANDFILE < input > raw \|\| ret=1`
		6e9104	`awk '{ print $1 " " $5 }' < raw > output`
		6e9104	`sort < output > output-sorted`
		6e9104	`diff ref output-sorted \|\| { ret=1 ; echo_i "diff sorted failed"; }`
		6e9104	@@ -43,7 +43,7 @@ status=`expr $status + $ret`
		6e9104
		6e9104	`echo_i "check keep-response-order"`
		6e9104	`ret=0`
		6e9104	`-$PIPEQUERIES -p ${PORT} ++ < inputb > rawb \|\| ret=1`
		6e9104	`+$PIPEQUERIES -p ${PORT} -r $RANDFILE ++ < inputb > rawb \|\| ret=1`
		6e9104	`awk '{ print $1 " " $5 }' < rawb > outputb`
		6e9104	`diff refb outputb \|\| ret=1`
		6e9104	`if [ $ret != 0 ]; then echo_i "failed"; fi`
		6e9104	`diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c`
		ad7b3b	`index 4462f2e..f06268d 100644`
		6e9104	`--- a/bin/tests/system/rsabigexponent/bigkey.c`
		6e9104	`+++ b/bin/tests/system/rsabigexponent/bigkey.c`
		6e9104	`@@ -20,6 +20,7 @@`
		6e9104	`#include <isc/buffer.h>`
		6e9104	`#include <isc/entropy.h>`
		6e9104	`#include <isc/mem.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`#include <isc/print.h>`
		6e9104	`#include <isc/region.h>`
		6e9104	`#include <isc/stdio.h>`
		6e9104	`@@ -183,6 +184,9 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`CHECK(isc_mem_create(0, 0, &mctx), "isc_mem_create()");`
		6e9104	`CHECK(isc_entropy_create(mctx, &ectx), "isc_entropy_create()");`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+#endif`
		6e9104	`CHECK(isc_entropy_usebestsource(ectx, &source,`
		6e9104	`"../random.data",`
		6e9104	`ISC_ENTROPY_KEYBOARDNO),`
		6e9104	`diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c`
		ad7b3b	`index 653c951..fe8698e 100644`
		6e9104	`--- a/bin/tests/system/tkey/keycreate.c`
		6e9104	`+++ b/bin/tests/system/tkey/keycreate.c`
		6e9104	`@@ -206,6 +206,7 @@ sendquery(isc_task_t task, isc_event_t event) {`
		6e9104	`int`
		6e9104	`main(int argc, char *argv[]) {`
		6e9104	`char *ourkeyname;`
		6e9104	`+ char *randomfile;`
		6e9104	`isc_taskmgr_t *taskmgr;`
		6e9104	`isc_timermgr_t *timermgr;`
		6e9104	`isc_socketmgr_t *socketmgr;`
		6e9104	`@@ -225,10 +226,21 @@ main(int argc, char *argv[]) {`
		6e9104
		6e9104	`RUNCHECK(isc_app_start());`
		6e9104
		6e9104	`+ randomfile = NULL;`
		6e9104	`+`
		6e9104	`if (argc < 2) {`
		6e9104	`fprintf(stderr, "I:no DH key provided\n");`
		6e9104	`exit(-1);`
		6e9104	`}`
		6e9104	`+ if (strcmp(argv[1], "-r") == 0) {`
		6e9104	`+ if (argc < 4) {`
		6e9104	`+ fprintf(stderr, "I:no DH key provided\n");`
		6e9104	`+ exit(-1);`
		6e9104	`+ }`
		6e9104	`+ randomfile = argv[2];`
		6e9104	`+ argv += 2;`
		6e9104	`+ argc -= 2;`
		6e9104	`+ }`
		6e9104	`ourkeyname = argv[1];`
		6e9104
		6e9104	`if (argc >= 3)`
		6e9104	`@@ -242,14 +254,22 @@ main(int argc, char *argv[]) {`
		6e9104
		6e9104	`ectx = NULL;`
		6e9104	`RUNCHECK(isc_entropy_create(mctx, &ectx));`
		6e9104	`- RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));`
		6e9104	`- RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`+ if (randomfile != NULL)`
		6e9104	`+ RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));`
		6e9104
		6e9104	`log = NULL;`
		6e9104	`logconfig = NULL;`
		6e9104	`RUNCHECK(isc_log_create(mctx, &log, &logconfig));`
		6e9104
		6e9104	`RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));`
		6e9104	`+ RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104
		6e9104	`taskmgr = NULL;`
		6e9104	`RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));`
		6e9104	`@@ -328,8 +348,8 @@ main(int argc, char *argv[]) {`
		6e9104
		6e9104	`isc_log_destroy(&log;;`
		6e9104
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`isc_entropy_detach(&ectx);`
		6e9104
		6e9104	`isc_mem_destroy(&mctx);`
		6e9104	`diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c`
		ad7b3b	`index 70a40c3..2146f9b 100644`
		6e9104	`--- a/bin/tests/system/tkey/keydelete.c`
		6e9104	`+++ b/bin/tests/system/tkey/keydelete.c`
		6e9104	`@@ -136,6 +136,7 @@ sendquery(isc_task_t task, isc_event_t event) {`
		6e9104	`int`
		6e9104	`main(int argc, char **argv) {`
		6e9104	`char *keyname;`
		6e9104	`+ char *randomfile;`
		6e9104	`isc_taskmgr_t *taskmgr;`
		6e9104	`isc_timermgr_t *timermgr;`
		6e9104	`isc_socketmgr_t *socketmgr;`
		6e9104	`@@ -156,10 +157,21 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`RUNCHECK(isc_app_start());`
		6e9104
		6e9104	`+ randomfile = NULL;`
		6e9104	`+`
		6e9104	`if (argc < 2) {`
		6e9104	`fprintf(stderr, "I:no key to delete\n");`
		6e9104	`exit(-1);`
		6e9104	`}`
		6e9104	`+ if (strcmp(argv[1], "-r") == 0) {`
		6e9104	`+ if (argc < 4) {`
		6e9104	`+ fprintf(stderr, "I:no DH key provided\n");`
		6e9104	`+ exit(-1);`
		6e9104	`+ }`
		6e9104	`+ randomfile = argv[2];`
		6e9104	`+ argv += 2;`
		6e9104	`+ argc -= 2;`
		6e9104	`+ }`
		6e9104	`keyname = argv[1];`
		6e9104
		6e9104	`dns_result_register();`
		6e9104	`@@ -169,14 +181,22 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`ectx = NULL;`
		6e9104	`RUNCHECK(isc_entropy_create(mctx, &ectx));`
		6e9104	`- RUNCHECK(isc_entropy_createfilesource(ectx, "../random.data"));`
		6e9104	`- RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (randomfile != NULL &&`
		6e9104	`+ strcmp(randomfile, ISC_PLATFORM_CRYPTORANDOM) == 0) {`
		6e9104	`+ randomfile = NULL;`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`+ if (randomfile != NULL)`
		6e9104	`+ RUNCHECK(isc_entropy_createfilesource(ectx, randomfile));`
		6e9104
		6e9104	`log = NULL;`
		6e9104	`logconfig = NULL;`
		6e9104	`RUNCHECK(isc_log_create(mctx, &log, &logconfig));`
		6e9104
		6e9104	`RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));`
		6e9104	`+ RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104
		6e9104	`taskmgr = NULL;`
		6e9104	`RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));`
		ad7b3b	`@@ -264,8 +284,8 @@ main(int argc, char **argv) {`
		6e9104
		6e9104	`isc_log_destroy(&log;;`
		6e9104
		6e9104	`- dst_lib_destroy();`
		6e9104	`isc_hash_destroy();`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`isc_entropy_detach(&ectx);`
		6e9104
		6e9104	`isc_mem_destroy(&mctx);`
		6e9104	`diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh`
		6e9104	`index 9f90dd7..fad6c83 100644`
		6e9104	`--- a/bin/tests/system/tkey/tests.sh`
		6e9104	`+++ b/bin/tests/system/tkey/tests.sh`
		6e9104	`@@ -33,7 +33,7 @@ for owner in . foo.example.`
		6e9104	`do`
		6e9104	`echo "I:creating new key using owner name \"$owner\""`
		6e9104	`ret=0`
		6e9104	- keyname=`$KEYCREATE $dhkeyname $owner` \|\| ret=1
		6e9104	+ keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` \|\| ret=1
		6e9104	`if [ $ret != 0 ]; then`
		6e9104	`echo "I:failed"`
		6e9104	status=`expr $status + $ret`
		6e9104	`@@ -55,7 +55,7 @@ do`
		6e9104
		6e9104	`echo "I:deleting new key"`
		6e9104	`ret=0`
		6e9104	`- $KEYDELETE $keyname \|\| ret=1`
		6e9104	`+ $KEYDELETE -r $RANDFILE $keyname \|\| ret=1`
		6e9104	`if [ $ret != 0 ]; then`
		6e9104	`echo "I:failed"`
		6e9104	`fi`
		6e9104	`@@ -75,7 +75,7 @@ done`
		6e9104
		6e9104	`echo "I:creating new key using owner name bar.example."`
		6e9104	`ret=0`
		6e9104	-keyname=`$KEYCREATE $dhkeyname bar.example.` \|\| ret=1
		6e9104	+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` \|\| ret=1
		6e9104	`if [ $ret != 0 ]; then`
		6e9104	`echo "I:failed"`
		6e9104	status=`expr $status + $ret`
		6e9104	@@ -116,7 +116,7 @@ status=`expr $status + $ret`
		6e9104
		6e9104	`echo "I:recreating the bar.example. key"`
		6e9104	`ret=0`
		6e9104	-keyname=`$KEYCREATE $dhkeyname bar.example.` \|\| ret=1
		6e9104	+keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` \|\| ret=1
		6e9104	`if [ $ret != 0 ]; then`
		6e9104	`echo "I:failed"`
		6e9104	status=`expr $status + $ret`
		6e9104	`diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c`
		ad7b3b	`index 4876875..e46653a 100644`
		6e9104	`--- a/bin/tools/mdig.c`
		6e9104	`+++ b/bin/tools/mdig.c`
		ad7b3b	`@@ -1955,12 +1955,11 @@ main(int argc, char *argv[]) {`
		6e9104
		6e9104	`ectx = NULL;`
		6e9104	`RUNCHECK(isc_entropy_create(mctx, &ectx));`
		6e9104	`+ RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));`
		6e9104	`RUNCHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		6e9104	`RUNCHECK(isc_entropy_getdata(ectx, cookie_secret,`
		6e9104	`sizeof(cookie_secret), NULL, 0));`
		6e9104
		6e9104	`- RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));`
		6e9104	`-`
		6e9104	`ISC_LIST_INIT(queries);`
		ad7b3b	`parse_args(false, argc, argv);`
		6e9104	`if (server == NULL)`
		6e9104	`diff --git a/configure b/configure`
		ad7b3b	`index 4394755..2e0af33 100755`
		6e9104	`--- a/configure`
		6e9104	`+++ b/configure`
		6e9104	`@@ -640,6 +640,7 @@ ac_includes_default="\`
		6e9104
		6e9104	`ac_subst_vars='LTLIBOBJS`
		6e9104	`LIBOBJS`
		6e9104	`+LIBDIR_SUFFIX`
		6e9104	`BUILD_LIBS`
		6e9104	`BUILD_LDFLAGS`
		6e9104	`BUILD_CPPFLAGS`
		ad7b3b	`@@ -823,6 +824,7 @@ XMLSTATS`
		6e9104	`NZDTARGETS`
		6e9104	`NZDSRCS`
		6e9104	`NZD_TOOLS`
		6e9104	`+ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`PKCS11_TEST`
		6e9104	`PKCS11_ED25519`
		6e9104	`PKCS11_GOST`
		ad7b3b	`@@ -1035,6 +1037,7 @@ with_eddsa`
		6e9104	`with_aes`
		6e9104	`enable_openssl_hash`
		6e9104	`with_cc_alg`
		6e9104	`+enable_crypto_rand`
		6e9104	`with_lmdb`
		6e9104	`with_libxml2`
		6e9104	`with_libjson`
		ad7b3b	`@@ -1728,6 +1731,7 @@ Optional Features:`
		6e9104	`--enable-threads enable multithreading`
		6e9104	`--enable-native-pkcs11 use native PKCS11 for all crypto [default=no]`
		6e9104	`--enable-openssl-hash use OpenSSL for hash functions [default=no]`
		6e9104	`+ --enable-crypto-rand use the crypto provider for random [default=yes]`
		6e9104	`--enable-largefile 64-bit file support`
		6e9104	`--enable-backtrace log stack backtrace on abort [default=yes]`
		6e9104	`--enable-symtable use internal symbol table for backtrace`
		ad7b3b	`@@ -16631,6 +16635,7 @@ case "$use_openssl" in`
		6e9104	`$as_echo "disabled because of native PKCS11" >&6; }`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO="-DPKCS11CRYPTO"`
		6e9104	`+ CRYPTOLIB="pkcs11"`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -16645,6 +16650,7 @@ $as_echo "disabled because of native PKCS11" >&6; }`
		6e9104	`$as_echo "no" >&6; }`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO=""`
		6e9104	`+ CRYPTOLIB=""`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -16657,6 +16663,7 @@ $as_echo "no" >&6; }`
		6e9104	`auto)`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO=""`
		6e9104	`+ CRYPTOLIB=""`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -16666,7 +16673,7 @@ $as_echo "no" >&6; }`
		6e9104	`OPENSSLLINKOBJS=""`
		6e9104	`OPENSSLLINKSRCS=""`
		6e9104	`as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path`
		6e9104	`-If you don't want OpenSSL, use --without-openssl" "$LINENO" 5`
		6e9104	`+If you do not want OpenSSL, use --without-openssl" "$LINENO" 5`
		6e9104	`;;`
		6e9104	`*)`
		6e9104	`if test "yes" = "$want_native_pkcs11"`
		ad7b3b	`@@ -16697,6 +16704,7 @@ $as_echo "not found" >&6; }`
		6e9104	`as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5`
		6e9104	`fi`
		6e9104	`CRYPTO='-DOPENSSL'`
		6e9104	`+ CRYPTOLIB="openssl"`
		6e9104	`if test "/usr" = "$use_openssl"`
		6e9104	`then`
		6e9104	`DST_OPENSSL_INC=""`
		ad7b3b	`@@ -17358,8 +17366,6 @@ fi`
		6e9104	`# Use OpenSSL for hash functions`
		6e9104	`#`
		6e9104
		6e9104	`-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using OpenSSL for hash functions" >&5`
		6e9104	`-$as_echo_n "checking for using OpenSSL for hash functions... " >&6; }`
		6e9104	`ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"`
		6e9104	`case $want_openssl_hash in`
		6e9104	`yes)`
		ad7b3b	`@@ -17728,6 +17734,86 @@ if test "rt" = "$have_clock_gt"; then`
		6e9104	`LIBS="-lrt $LIBS"`
		6e9104	`fi`
		6e9104
		6e9104	`+#`
		6e9104	`+# Use the crypto provider (OpenSSL/PKCS#11) for random functions`
		6e9104	`+#`
		6e9104	`+`
		6e9104	`+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for using the crypto library (vs. builtin) for random functions" >&5`
		6e9104	`+$as_echo_n "checking for using the crypto library (vs. builtin) for random functions... " >&6; }`
		6e9104	`+# Check whether --enable-crypto-rand was given.`
		6e9104	`+if test "${enable_crypto_rand+set}" = set; then :`
		6e9104	`+ enableval=$enable_crypto_rand; want_crypto_rand="$enableval"`
		6e9104	`+else`
		6e9104	`+ want_crypto_rand="auto"`
		6e9104	`+fi`
		6e9104	`+`
		6e9104	`+if test "$want_crypto_rand" = "auto"`
		6e9104	`+then`
		6e9104	`+ case "$CRYPTOLIB" in`
		6e9104	`+ "")`
		6e9104	`+ want_crypto_rand="no"`
		6e9104	`+ ;;`
		6e9104	`+ pkcs11)`
		6e9104	`+ want_crypto_rand="yes"`
		6e9104	`+ ;;`
		6e9104	`+ openssl)`
		6e9104	`+ saved_cflags="$CFLAGS"`
		6e9104	`+ saved_libs="$LIBS"`
		6e9104	`+ CFLAGS="$CFLAGS $DST_OPENSSL_INC"`
		6e9104	`+ LIBS="$LIBS $DST_OPENSSL_LIBS"`
		6e9104	`+ if test "$cross_compiling" = yes; then :`
		6e9104	`+ want_crypto_rand="yes"`
		6e9104	`+else`
		6e9104	`+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext`
		6e9104	`+/* end confdefs.h. */`
		6e9104	`+`
		6e9104	`+#include <openssl/rand.h>`
		6e9104	`+`
		6e9104	`+unsigned char buf[128];`
		6e9104	`+`
		6e9104	`+int main()`
		6e9104	`+{`
		6e9104	`+ if (RAND_bytes(buf, 128) != 1)`
		6e9104	`+ return (1);`
		6e9104	`+ return (0);`
		6e9104	`+}`
		6e9104	`+`
		6e9104	`+_ACEOF`
		6e9104	`+if ac_fn_c_try_run "$LINENO"; then :`
		6e9104	`+ want_crypto_rand="yes"`
		6e9104	`+else`
		6e9104	`+ want_crypto_rand="no"`
		6e9104	`+fi`
		6e9104	`+rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \`
		6e9104	`+ conftest.$ac_objext conftest.beam conftest.$ac_ext`
		6e9104	`+fi`
		6e9104	`+`
		6e9104	`+ CFLAGS="$saved_cflags"`
		6e9104	`+ LIBS="$saved_libs"`
		6e9104	`+ ;;`
		6e9104	`+ *)`
		6e9104	`+ as_fn_error $? "Unknown crypto library define $CRYPTOLIB" "$LINENO" 5`
		6e9104	`+ ;;`
		6e9104	`+ esac`
		6e9104	`+fi`
		6e9104	`+case $want_crypto_rand in`
		6e9104	`+ yes)`
		6e9104	`+ if test "$CRYPTOLIB" = ""`
		6e9104	`+ then`
		6e9104	`+ as_fn_error $? "No crypto library for random functions" "$LINENO" 5`
		6e9104	`+ fi`
		6e9104	`+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$CRYPTOLIB\"" >&5`
		6e9104	`+$as_echo "\"$CRYPTOLIB\"" >&6; }`
		6e9104	`+ ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""`
		6e9104	`+ ;;`
		6e9104	`+ no)`
		6e9104	`+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5`
		6e9104	`+$as_echo "no" >&6; }`
		6e9104	`+ ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"`
		6e9104	`+ ;;`
		6e9104	`+esac`
		6e9104	`+`
		6e9104	`+`
		6e9104	`#`
		6e9104	`# was --with-lmdb specified?`
		6e9104	`#`
		ad7b3b	`@@ -19810,9 +19896,12 @@ _ACEOF`
		6e9104	`if ac_fn_c_try_compile "$LINENO"; then :`
		6e9104	`{ $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5`
		6e9104	`$as_echo "size_t for buflen; int for flags" >&6; }`
		6e9104	`- $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T size_t" >>confdefs.h`
		6e9104	`+ # Changed to solve multilib conflict on Fedora`
		6e9104	`+ # AC_DEFINE(IRS_GETNAMEINFO_SOCKLEN_T, size_t)`
		6e9104	`+ # AC_DEFINE(IRS_GETNAMEINFO_BUFLEN_T, size_t)`
		6e9104	`+ $as_echo "#define IRS_GETNAMEINFO_SOCKLEN_T socklen_t" >>confdefs.h`
		6e9104
		6e9104	`- $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T size_t" >>confdefs.h`
		6e9104	`+ $as_echo "#define IRS_GETNAMEINFO_BUFLEN_T socklen_t" >>confdefs.h`
		6e9104
		6e9104	`$as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h`
		6e9104
		ad7b3b	`@@ -21123,12 +21212,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"`
		6e9104	`ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"`
		6e9104	`ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"`
		6e9104	`if test "yes" = "$use_atomic"; then`
		6e9104	`- have_atomic=yes # set default`
		6e9104	`- case "$host" in`
		6e9104	`- i[3456]86-*)`
		6e9104	`- # XXX: some old x86 architectures actually do not support`
		6e9104	`- # (some of) these operations. Do we need stricter checks?`
		6e9104	`- # The cast to long int works around a bug in the HP C Compiler`
		6e9104	`+ # The cast to long int works around a bug in the HP C Compiler`
		6e9104	`# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects`
		6e9104	# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
		6e9104	`# This bug is HP SR number 8606223364.`
		ad7b3b	`@@ -21161,6 +21245,11 @@ cat >>confdefs.h <<_ACEOF`
		6e9104	`_ACEOF`
		6e9104
		6e9104
		6e9104	`+ have_atomic=yes # set default`
		6e9104	`+ case "$host" in`
		6e9104	`+ i[3456]86-*)`
		6e9104	`+ # XXX: some old x86 architectures actually do not support`
		6e9104	`+ # (some of) these operations. Do we need stricter checks?`
		6e9104	`if test $ac_cv_sizeof_void_p = 8; then`
		6e9104	`arch=x86_64`
		6e9104	`have_xaddq=yes`
		ad7b3b	`@@ -21169,39 +21258,6 @@ _ACEOF`
		6e9104	`fi`
		6e9104	`;;`
		6e9104	`x86_64-\|amd64-)`
		6e9104	`- # The cast to long int works around a bug in the HP C Compiler`
		6e9104	`-# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects`
		6e9104	-# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
		6e9104	`-# This bug is HP SR number 8606223364.`
		6e9104	`-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of void *" >&5`
		6e9104	`-$as_echo_n "checking size of void *... " >&6; }`
		6e9104	`-if ${ac_cv_sizeof_void_p+:} false; then :`
		6e9104	`- $as_echo_n "(cached) " >&6`
		6e9104	`-else`
		6e9104	`- if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (void *))" "ac_cv_sizeof_void_p" "$ac_includes_default"; then :`
		6e9104	`-`
		6e9104	`-else`
		6e9104	`- if test "$ac_cv_type_void_p" = yes; then`
		6e9104	- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
		6e9104	-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
		6e9104	`-as_fn_error 77 "cannot compute sizeof (void *)`
		6e9104	-See \`config.log' for more details" "$LINENO" 5; }
		6e9104	`- else`
		6e9104	`- ac_cv_sizeof_void_p=0`
		6e9104	`- fi`
		6e9104	`-fi`
		6e9104	`-`
		6e9104	`-fi`
		6e9104	`-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_void_p" >&5`
		6e9104	`-$as_echo "$ac_cv_sizeof_void_p" >&6; }`
		6e9104	`-`
		6e9104	`-`
		6e9104	`-`
		6e9104	`-cat >>confdefs.h <<_ACEOF`
		6e9104	`-#define SIZEOF_VOID_P $ac_cv_sizeof_void_p`
		6e9104	`-_ACEOF`
		6e9104	`-`
		6e9104	`-`
		6e9104	`if test $ac_cv_sizeof_void_p = 8; then`
		6e9104	`arch=x86_64`
		6e9104	`have_xaddq=yes`
		ad7b3b	`@@ -21232,6 +21288,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }`
		6e9104	`$as_echo "$arch" >&6; }`
		6e9104	`fi`
		6e9104
		6e9104	`+if test ! "$arch" = "x86_64" -a "$have_xaddq" = "yes"; then`
		6e9104	`+ as_fn_error $? "XADDQ present but disabled by Fedora patch!" "$LINENO" 5`
		6e9104	`+fi`
		6e9104	`+`
		6e9104	`if test "yes" = "$have_atomic"; then`
		6e9104	`{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5`
		6e9104	`$as_echo_n "checking compiler support for inline assembly code... " >&6; }`
		ad7b3b	`@@ -23519,6 +23579,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"`
		6e9104	`#`
		6e9104	`dlzdir='${DLZ_DRIVER_DIR}'`
		6e9104
		6e9104	`+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for target libdir" >&5`
		6e9104	`+$as_echo_n "checking for target libdir... " >&6; }`
		6e9104	`+if test "$cross_compiling" = yes; then :`
		6e9104	+ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
		6e9104	+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
		6e9104	`+as_fn_error $? "cannot run test program while cross compiling`
		6e9104	+See \`config.log' for more details" "$LINENO" 5; }
		6e9104	`+else`
		6e9104	`+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext`
		6e9104	`+/* end confdefs.h. */`
		6e9104	`+int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}`
		6e9104	`+_ACEOF`
		6e9104	`+if ac_fn_c_try_run "$LINENO"; then :`
		6e9104	`+ target_lib=lib64`
		6e9104	`+else`
		6e9104	`+ target_lib=lib`
		6e9104	`+fi`
		6e9104	`+rm -f core .core core.conftest. gmon.out bb.out conftest$ac_exeext \`
		6e9104	`+ conftest.$ac_objext conftest.beam conftest.$ac_ext`
		6e9104	`+fi`
		6e9104	`+`
		6e9104	`+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$target_lib\"" >&5`
		6e9104	`+$as_echo "\"$target_lib\"" >&6; }`
		6e9104	`+`
		6e9104	`#`
		6e9104	`# Private autoconf macro to simplify configuring drivers:`
		6e9104	`#`
		ad7b3b	`@@ -23849,11 +23933,11 @@ $as_echo "no" >&6; }`
		6e9104	`$as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }`
		6e9104	`;;`
		6e9104	`*)`
		6e9104	`- if test -d "$use_dlz_mysql/lib/mysql"`
		6e9104	`+ if test -d $use_dlz_mysql/${target_lib}/mysql`
		6e9104	`then`
		6e9104	`- mysql_lib="$use_dlz_mysql/lib/mysql"`
		6e9104	`+ mysql_lib=$use_dlz_mysql/${target_lib}/mysql`
		6e9104	`else`
		6e9104	`- mysql_lib="$use_dlz_mysql/lib"`
		6e9104	`+ mysql_lib=$use_dlz_mysql/${target_lib}`
		6e9104	`fi`
		6e9104
		6e9104	`CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"`
		ad7b3b	`@@ -23938,7 +24022,7 @@ $as_echo "" >&6; }`
		6e9104	`# Check other locations for includes.`
		6e9104	`# Order is important (sigh).`
		6e9104
		6e9104	`- bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"`
		6e9104	`+ bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"`
		6e9104	`# include a blank element first`
		6e9104	`for d in "" $bdb_incdirs`
		6e9104	`do`
		ad7b3b	`@@ -23963,57 +24047,9 @@ $as_echo "" >&6; }`
		6e9104	`bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"`
		6e9104	`for d in $bdb_libnames`
		6e9104	`do`
		6e9104	`- if test "$dd" = "/usr"`
		ad7b3b	`- then`
		6e9104	- as_ac_Lib=`$as_echo "ac_cv_lib_$d''_db_create" \| $as_tr_sh`
		6e9104	`-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for db_create in -l$d" >&5`
		6e9104	`-$as_echo_n "checking for db_create in -l$d... " >&6; }`
		6e9104	`-if eval \${$as_ac_Lib+:} false; then :`
		6e9104	`- $as_echo_n "(cached) " >&6`
		6e9104	`-else`
		6e9104	`- ac_check_lib_save_LIBS=$LIBS`
		6e9104	`-LIBS="-l$d $LIBS"`
		6e9104	`-cat confdefs.h - <<_ACEOF >conftest.$ac_ext`
		6e9104	`-/* end confdefs.h. */`
		6e9104	`-`
		6e9104	`-/* Override any GCC internal prototype to avoid an error.`
		6e9104	`- Use char because int might match the return type of a GCC`
		6e9104	`- builtin and then its argument prototype would still apply. */`
		6e9104	`-#ifdef __cplusplus`
		6e9104	`-extern "C"`
		6e9104	`-#endif`
		6e9104	`-char db_create ();`
		6e9104	`-int`
		6e9104	`-main ()`
		6e9104	`-{`
		6e9104	`-return db_create ();`
		6e9104	`- ;`
		6e9104	`- return 0;`
		6e9104	`-}`
		6e9104	`-_ACEOF`
		6e9104	`-if ac_fn_c_try_link "$LINENO"; then :`
		6e9104	`- eval "$as_ac_Lib=yes"`
		6e9104	`-else`
		6e9104	`- eval "$as_ac_Lib=no"`
		6e9104	`-fi`
		6e9104	`-rm -f core conftest.err conftest.$ac_objext \`
		6e9104	`- conftest$ac_exeext conftest.$ac_ext`
		6e9104	`-LIBS=$ac_check_lib_save_LIBS`
		6e9104	`-fi`
		6e9104	`-eval ac_res=\$$as_ac_Lib`
		6e9104	`- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5`
		6e9104	`-$as_echo "$ac_res" >&6; }`
		6e9104	`-if eval test \"x\$"$as_ac_Lib"\" = x"yes"; then :`
		6e9104	`- dlz_bdb_libs="-l${d}"`
		6e9104	`-fi`
		6e9104	`-`
		6e9104	`- if test $dlz_bdb_libs != "yes"`
		6e9104	`- then`
		6e9104	`- break`
		6e9104	`- fi`
		6e9104	`- elif test -f "$dd/lib/lib${d}.so"`
		ad7b3b	`+ if test -f "$dd/${target_lib}/lib${d}.so"`
		ad7b3b	`then`
		6e9104	`- dlz_bdb_libs="-L${dd}/lib -l${d}"`
		6e9104	`+ dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"`
		6e9104	`break`
		6e9104	`fi`
		6e9104	`done`
		ad7b3b	`@@ -24172,10 +24208,10 @@ $as_echo "no" >&6; }`
		6e9104	`DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"`
		6e9104	`DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"`
		6e9104	`fi`
		6e9104	`- if test -n "-L$use_dlz_ldap/lib -lldap -llber"`
		6e9104	`+ if test -n "-L$use_dlz_ldap/${target_lib} -lldap -llber"`
		6e9104	`then`
		6e9104	`- DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/lib -lldap -llber"`
		6e9104	`- DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/lib -lldap -llber"`
		6e9104	`+ DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_ldap/${target_lib} -lldap -llber"`
		6e9104	`+ DLZ_DRIVER_LDAP_LIBS="-L$use_dlz_ldap/${target_lib} -lldap -llber"`
		6e9104	`fi`
		6e9104
		6e9104
		ad7b3b	`@@ -24261,11 +24297,11 @@ fi`
		6e9104	`odbcdirs="/usr /usr/local /usr/pkg"`
		6e9104	`for d in $odbcdirs`
		6e9104	`do`
		6e9104	`- if test -f $d/include/sql.h -a -f $d/lib/libodbc.a`
		6e9104	`+ if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a`
		6e9104	`then`
		6e9104	`use_dlz_odbc=$d`
		6e9104	`dlz_odbc_include="-I$use_dlz_odbc/include"`
		6e9104	`- dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"`
		6e9104	`+ dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"`
		6e9104	`break`
		6e9104	`fi`
		6e9104	`done`
		ad7b3b	`@@ -24540,6 +24576,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"`
		6e9104
		6e9104
		6e9104
		6e9104	`+`
		6e9104	`+`
		6e9104	`#`
		6e9104	`# Commands to run at the end of config.status.`
		6e9104	`# Don't just put these into configure, it won't work right if somebody`
		ad7b3b	`@@ -26930,6 +26968,8 @@ report() {`
		6e9104	`echo " IPv6 support (--enable-ipv6)"`
		6e9104	`test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" \|\| \`
		6e9104	`echo " OpenSSL cryptography/DNSSEC (--with-openssl)"`
		6e9104	`+ test "no" = "$want_crypto_rand" \|\| \`
		6e9104	`+ echo " Crypto provider entropy source (--enable-crypto-rand)"`
		6e9104	`test "X$PYTHON" = "X" \|\| echo " Python tools (--with-python)"`
		6e9104	`test "X$XMLSTATS" = "X" \|\| echo " XML statistics (--with-libxml2)"`
		6e9104	`test "X$JSONSTATS" = "X" \|\| echo " JSON statistics (--with-libjson)"`
		ad7b3b	`@@ -26970,6 +27010,8 @@ report() {`
		6e9104	`echo " Very verbose query trace logging (--enable-querytrace)"`
		6e9104	`test "no" = "$atf" \|\| echo " Automated Testing Framework (--with-atf)"`
		6e9104
		6e9104	`+ echo " Cryptographic library for DNSSEC: $CRYPTOLIB"`
		6e9104	`+`
		6e9104	`echo " Dynamically loadable zone (DLZ) drivers:"`
		6e9104	`test "no" = "$use_dlz_bdb" \|\| \`
		6e9104	`echo " Berkeley DB (--with-dlz-bdb)"`
		ad7b3b	`@@ -27017,6 +27059,8 @@ report() {`
		6e9104	`echo " ECDSA algorithm support (--with-ecdsa)"`
		6e9104	`test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" \|\| \`
		6e9104	`echo " EDDSA algorithm support (--with-eddsa)"`
		6e9104	`+ test "yes" = "$want_crypto_rand" \|\| \`
		6e9104	`+ echo " Crypto provider entropy source (--enable-crypto-rand)"`
		6e9104
		6e9104	`test "yes" = "$enable_seccomp" \|\| \`
		6e9104	`echo " Use libseccomp system call filtering (--enable-seccomp)"`
		6e9104	`diff --git a/configure.in b/configure.in`
		ad7b3b	`index b07895f..898b4ac 100644`
		6e9104	`--- a/configure.in`
		6e9104	`+++ b/configure.in`
		ad7b3b	`@@ -1542,6 +1542,7 @@ case "$use_openssl" in`
		6e9104	`AC_MSG_RESULT(disabled because of native PKCS11)`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO="-DPKCS11CRYPTO"`
		6e9104	`+ CRYPTOLIB="pkcs11"`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -1555,6 +1556,7 @@ case "$use_openssl" in`
		6e9104	`AC_MSG_RESULT(no)`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO=""`
		6e9104	`+ CRYPTOLIB=""`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -1567,6 +1569,7 @@ case "$use_openssl" in`
		6e9104	`auto)`
		6e9104	`DST_OPENSSL_INC=""`
		6e9104	`CRYPTO=""`
		6e9104	`+ CRYPTOLIB=""`
		6e9104	`OPENSSLECDSALINKOBJS=""`
		6e9104	`OPENSSLECDSALINKSRCS=""`
		6e9104	`OPENSSLEDDSALINKOBJS=""`
		ad7b3b	`@@ -1577,7 +1580,7 @@ case "$use_openssl" in`
		6e9104	`OPENSSLLINKSRCS=""`
		6e9104	`AC_MSG_ERROR(`
		6e9104	`[OpenSSL was not found in any of $openssldirs; use --with-openssl=/path`
		6e9104	`-If you don't want OpenSSL, use --without-openssl])`
		6e9104	`+If you do not want OpenSSL, use --without-openssl])`
		6e9104	`;;`
		6e9104	`*)`
		6e9104	`if test "yes" = "$want_native_pkcs11"`
		ad7b3b	`@@ -1607,6 +1610,7 @@ If you don't want OpenSSL, use --without-openssl])`
		6e9104	`AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])`
		6e9104	`fi`
		6e9104	`CRYPTO='-DOPENSSL'`
		6e9104	`+ CRYPTOLIB="openssl"`
		6e9104	`if test "/usr" = "$use_openssl"`
		6e9104	`then`
		6e9104	`DST_OPENSSL_INC=""`
		ad7b3b	`@@ -2080,7 +2084,6 @@ fi`
		6e9104	`# Use OpenSSL for hash functions`
		6e9104	`#`
		6e9104
		6e9104	`-AC_MSG_CHECKING(for using OpenSSL for hash functions)`
		6e9104	`ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"`
		6e9104	`case $want_openssl_hash in`
		6e9104	`yes)`
		ad7b3b	`@@ -2347,6 +2350,67 @@ if test "rt" = "$have_clock_gt"; then`
		6e9104	`LIBS="-lrt $LIBS"`
		6e9104	`fi`
		6e9104
		6e9104	`+#`
		6e9104	`+# Use the crypto provider (OpenSSL/PKCS#11) for random functions`
		6e9104	`+#`
		6e9104	`+`
		6e9104	`+AC_MSG_CHECKING(for using the crypto library (vs. builtin) for random functions)`
		6e9104	`+AC_ARG_ENABLE(crypto-rand,`
		6e9104	`+ [ --enable-crypto-rand use the crypto provider for random [[default=yes]]],`
		6e9104	`+ want_crypto_rand="$enableval", want_crypto_rand="auto")`
		6e9104	`+if test "$want_crypto_rand" = "auto"`
		6e9104	`+then`
		6e9104	`+ case "$CRYPTOLIB" in`
		6e9104	`+ "")`
		6e9104	`+ want_crypto_rand="no"`
		6e9104	`+ ;;`
		6e9104	`+ pkcs11)`
		6e9104	`+ want_crypto_rand="yes"`
		6e9104	`+ ;;`
		6e9104	`+ openssl)`
		6e9104	`+ saved_cflags="$CFLAGS"`
		6e9104	`+ saved_libs="$LIBS"`
		6e9104	`+ CFLAGS="$CFLAGS $DST_OPENSSL_INC"`
		6e9104	`+ LIBS="$LIBS $DST_OPENSSL_LIBS"`
		6e9104	`+ AC_TRY_RUN([`
		6e9104	`+#include <openssl/rand.h>`
		6e9104	`+`
		6e9104	`+unsigned char buf[128];`
		6e9104	`+`
		6e9104	`+int main()`
		6e9104	`+{`
		6e9104	`+ if (RAND_bytes(buf, 128) != 1)`
		6e9104	`+ return (1);`
		6e9104	`+ return (0);`
		6e9104	`+}`
		6e9104	`+],`
		6e9104	`+ [want_crypto_rand="yes"],`
		6e9104	`+ [want_crypto_rand="no"],`
		6e9104	`+ [want_crypto_rand="yes"])`
		6e9104	`+ CFLAGS="$saved_cflags"`
		6e9104	`+ LIBS="$saved_libs"`
		6e9104	`+ ;;`
		6e9104	`+ *)`
		6e9104	`+ AC_MSG_ERROR([Unknown crypto library define $CRYPTOLIB])`
		6e9104	`+ ;;`
		6e9104	`+ esac`
		6e9104	`+fi`
		6e9104	`+case $want_crypto_rand in`
		6e9104	`+ yes)`
		6e9104	`+ if test "$CRYPTOLIB" = ""`
		6e9104	`+ then`
		6e9104	`+ AC_MSG_ERROR([No crypto library for random functions])`
		6e9104	`+ fi`
		6e9104	`+ AC_MSG_RESULT(["$CRYPTOLIB"])`
		6e9104	`+ ISC_PLATFORM_CRYPTORANDOM="#define ISC_PLATFORM_CRYPTORANDOM \"$CRYPTOLIB\""`
		6e9104	`+ ;;`
		6e9104	`+ no)`
		6e9104	`+ AC_MSG_RESULT(no)`
		6e9104	`+ ISC_PLATFORM_CRYPTORANDOM="#undef ISC_PLATFORM_CRYPTORANDOM"`
		6e9104	`+ ;;`
		6e9104	`+esac`
		6e9104	`+AC_SUBST(ISC_PLATFORM_CRYPTORANDOM)`
		6e9104	`+`
		6e9104	`#`
		6e9104	`# was --with-lmdb specified?`
		6e9104	`#`
		ad7b3b	`@@ -4139,12 +4203,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"`
		6e9104	`ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"`
		6e9104	`ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"`
		6e9104	`if test "yes" = "$use_atomic"; then`
		6e9104	`+ AC_CHECK_SIZEOF([void *])`
		6e9104	`have_atomic=yes # set default`
		6e9104	`case "$host" in`
		6e9104	`[i[3456]86-*])`
		6e9104	`# XXX: some old x86 architectures actually do not support`
		6e9104	`# (some of) these operations. Do we need stricter checks?`
		6e9104	`- AC_CHECK_SIZEOF([void *])`
		6e9104	`if test $ac_cv_sizeof_void_p = 8; then`
		6e9104	`arch=x86_64`
		6e9104	`have_xaddq=yes`
		ad7b3b	`@@ -4153,7 +4217,6 @@ if test "yes" = "$use_atomic"; then`
		6e9104	`fi`
		6e9104	`;;`
		6e9104	`x86_64-\|amd64-)`
		6e9104	`- AC_CHECK_SIZEOF([void *])`
		6e9104	`if test $ac_cv_sizeof_void_p = 8; then`
		6e9104	`arch=x86_64`
		6e9104	`have_xaddq=yes`
		ad7b3b	`@@ -5517,6 +5580,8 @@ report() {`
		6e9104	`echo " IPv6 support (--enable-ipv6)"`
		6e9104	`test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" \|\| \`
		6e9104	`echo " OpenSSL cryptography/DNSSEC (--with-openssl)"`
		6e9104	`+ test "no" = "$want_crypto_rand" \|\| \`
		6e9104	`+ echo " Crypto provider entropy source (--enable-crypto-rand)"`
		6e9104	`test "X$PYTHON" = "X" \|\| echo " Python tools (--with-python)"`
		6e9104	`test "X$XMLSTATS" = "X" \|\| echo " XML statistics (--with-libxml2)"`
		6e9104	`test "X$JSONSTATS" = "X" \|\| echo " JSON statistics (--with-libjson)"`
		ad7b3b	`@@ -5557,6 +5622,8 @@ report() {`
		6e9104	`echo " Very verbose query trace logging (--enable-querytrace)"`
		6e9104	`test "no" = "$atf" \|\| echo " Automated Testing Framework (--with-atf)"`
		6e9104
		6e9104	`+ echo " Cryptographic library for DNSSEC: $CRYPTOLIB"`
		6e9104	`+`
		6e9104	`echo " Dynamically loadable zone (DLZ) drivers:"`
		6e9104	`test "no" = "$use_dlz_bdb" \|\| \`
		6e9104	`echo " Berkeley DB (--with-dlz-bdb)"`
		ad7b3b	`@@ -5604,6 +5671,8 @@ report() {`
		6e9104	`echo " ECDSA algorithm support (--with-ecdsa)"`
		6e9104	`test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" \|\| \`
		6e9104	`echo " EDDSA algorithm support (--with-eddsa)"`
		6e9104	`+ test "yes" = "$want_crypto_rand" \|\| \`
		6e9104	`+ echo " Crypto provider entropy source (--enable-crypto-rand)"`
		6e9104
		6e9104	`test "yes" = "$enable_seccomp" \|\| \`
		6e9104	`echo " Use libseccomp system call filtering (--enable-seccomp)"`
		6e9104	`diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c`
		ad7b3b	`index 5703f9c..afb4d80 100644`
		6e9104	`--- a/lib/dns/dst_api.c`
		6e9104	`+++ b/lib/dns/dst_api.c`
		ad7b3b	`@@ -276,6 +276,12 @@ dst_lib_init2(isc_mem_t mctx, isc_entropy_t ectx,`
		6e9104	`#ifdef GSSAPI`
		6e9104	`RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));`
		6e9104	`#endif`
		6e9104	`+#if defined(OPENSSL) \|\| defined(PKCS11CRYPTO)`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (dst_entropy_pool != NULL)`
		6e9104	`+ isc_entropy_sethook(dst_random_getdata);`
		6e9104	`+#endif`
		6e9104	`+#endif /* defined(OPENSSL) \|\| defined(PKCS11CRYPTO) */`
		ad7b3b	`dst_initialized = true;`
		6e9104	`return (ISC_R_SUCCESS);`
		6e9104
		ad7b3b	`@@ -295,11 +301,19 @@ dst_lib_destroy(void) {`
		6e9104	`for (i = 0; i < DST_MAX_ALGS; i++)`
		6e9104	`if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)`
		6e9104	`dst_t_func[i]->cleanup();`
		6e9104	`+#if defined(OPENSSL) \|\| defined(PKCS11CRYPTO)`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ if (dst_entropy_pool != NULL) {`
		ad7b3b	`+ isc_entropy_usehook(dst_entropy_pool, false);`
		6e9104	`+ isc_entropy_sethook(NULL);`
		6e9104	`+ }`
		6e9104	`+#endif`
		6e9104	`#ifdef OPENSSL`
		6e9104	`dst__openssl_destroy();`
		6e9104	`#elif PKCS11CRYPTO`
		6e9104	`(void) dst__pkcs11_destroy();`
		6e9104	`#endif /* if OPENSSL, elif PKCS11CRYPTO */`
		6e9104	`+#endif /* defined(OPENSSL) \|\| defined(PKCS11CRYPTO) */`
		6e9104	`if (dst__memory_pool != NULL)`
		6e9104	`isc_mem_detach(&dst__memory_pool);`
		6e9104	`if (dst_entropy_pool != NULL)`
		ad7b3b	`@@ -1998,13 +2012,17 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {`
		6e9104	`flags &= ~ISC_ENTROPY_GOODONLY;`
		6e9104	`else`
		6e9104	`flags \|= ISC_ENTROPY_BLOCKING;`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ return (dst_random_getdata(buf, len, NULL, flags));`
		6e9104	`+#else`
		6e9104	`return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));`
		6e9104	`+#endif`
		6e9104	`#endif /* PKCS11CRYPTO */`
		6e9104	`}`
		6e9104
		6e9104	`unsigned int`
		6e9104	`dst__entropy_status(void) {`
		6e9104	`-#ifndef PKCS11CRYPTO`
		6e9104	`+#if !defined(PKCS11CRYPTO) && !defined(ISC_PLATFORM_CRYPTORANDOM)`
		6e9104	`#ifdef GSSAPI`
		6e9104	`unsigned int flags = dst_entropy_flags;`
		6e9104	`isc_result_t ret;`
		ad7b3b	`@@ -2027,6 +2045,7 @@ dst__entropy_status(void) {`
		6e9104	`#endif`
		6e9104	`return (isc_entropy_status(dst_entropy_pool));`
		6e9104	`#else`
		6e9104	`+ /* Doesn't matter as it is not used in this case. */`
		6e9104	`return (0);`
		6e9104	`#endif`
		6e9104	`}`
		6e9104	`diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h`
		ad7b3b	`index 32b0742..78e1277 100644`
		6e9104	`--- a/lib/dns/include/dst/dst.h`
		6e9104	`+++ b/lib/dns/include/dst/dst.h`
		ad7b3b	`@@ -160,6 +160,14 @@ dst_lib_destroy(void);`
		6e9104	`* Releases all resources allocated by DST.`
		6e9104	`*/`
		6e9104
		6e9104	`+isc_result_t`
		6e9104	`+dst_random_getdata(void *data, unsigned int length,`
		6e9104	`+ unsigned int *returned, unsigned int flags);`
		6e9104	`+/*%<`
		6e9104	`+ * \brief Return data from the crypto random generator.`
		6e9104	`+ * Specialization of isc_entropy_getdata().`
		6e9104	`+ */`
		6e9104	`+`
		ad7b3b	`bool`
		6e9104	`dst_algorithm_supported(unsigned int alg);`
		6e9104	`/*%<`
		6e9104	`diff --git a/lib/dns/lib.c b/lib/dns/lib.c`
		ad7b3b	`index 304814b..60543c4 100644`
		6e9104	`--- a/lib/dns/lib.c`
		6e9104	`+++ b/lib/dns/lib.c`
		ad7b3b	`@@ -18,6 +18,7 @@`
		ad7b3b	`#include <stdbool.h>`
		6e9104	`#include <stddef.h>`
		6e9104
		6e9104	`+#include <isc/entropy.h>`
		6e9104	`#include <isc/hash.h>`
		6e9104	`#include <isc/mem.h>`
		6e9104	`#include <isc/msgcat.h>`
		ad7b3b	`@@ -78,6 +79,7 @@ static unsigned int references = 0;`
		6e9104	`static void`
		6e9104	`initialize(void) {`
		6e9104	`isc_result_t result;`
		6e9104	`+ isc_entropy_t *ectx = NULL;`
		6e9104
		ad7b3b	`REQUIRE(initialize_done == false);`
		6e9104
		ad7b3b	`@@ -88,11 +90,14 @@ initialize(void) {`
		6e9104	`result = dns_ecdb_register(dns_g_mctx, &dbimp);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`goto cleanup_mctx;`
		6e9104	`- result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);`
		6e9104	`+ result = isc_entropy_create(dns_g_mctx, &ectx);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`goto cleanup_db;`
		6e9104	`+ result = isc_hash_create(dns_g_mctx, NULL, DNS_NAME_MAXWIRE);`
		6e9104	`+ if (result != ISC_R_SUCCESS)`
		6e9104	`+ goto cleanup_ectx;`
		6e9104
		6e9104	`- result = dst_lib_init(dns_g_mctx, NULL, 0);`
		6e9104	`+ result = dst_lib_init(dns_g_mctx, ectx, 0);`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`goto cleanup_hash;`
		6e9104
		ad7b3b	`@@ -100,11 +105,17 @@ initialize(void) {`
		6e9104	`if (result != ISC_R_SUCCESS)`
		6e9104	`goto cleanup_dst;`
		6e9104
		6e9104	`+ isc_hash_init();`
		6e9104	`+ isc_entropy_detach(&ectx);`
		6e9104	`+`
		ad7b3b	`initialize_done = true;`
		6e9104	`return;`
		6e9104
		6e9104	`cleanup_dst:`
		6e9104	`dst_lib_destroy();`
		6e9104	`+ cleanup_ectx:`
		6e9104	`+ if (ectx != NULL)`
		6e9104	`+ isc_entropy_detach(&ectx);`
		6e9104	`cleanup_hash:`
		6e9104	`isc_hash_destroy();`
		6e9104	`cleanup_db:`
		6e9104	`diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c`
		ad7b3b	`index a30a2ab..d88d643 100644`
		6e9104	`--- a/lib/dns/openssl_link.c`
		6e9104	`+++ b/lib/dns/openssl_link.c`
		6e9104	`@@ -31,6 +31,7 @@`
		6e9104	`#include <isc/mem.h>`
		6e9104	`#include <isc/mutex.h>`
		6e9104	`#include <isc/mutexblock.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`#include <isc/string.h>`
		6e9104	`#include <isc/thread.h>`
		6e9104	`#include <isc/util.h>`
		6e9104	`@@ -46,8 +47,6 @@`
		6e9104	`#include <openssl/engine.h>`
		6e9104	`#endif`
		6e9104
		6e9104	`-static RAND_METHOD *rm = NULL;`
		6e9104	`-`
		6e9104	`#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)`
		6e9104	`static isc_mutex_t *locks = NULL;`
		6e9104	`static int nlocks;`
		6e9104	`@@ -57,6 +56,9 @@ static int nlocks;`
		6e9104	`static ENGINE *e = NULL;`
		6e9104	`#endif`
		6e9104
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+static RAND_METHOD *rm = NULL;`
		6e9104	`+`
		6e9104	`static int`
		6e9104	`entropy_get(unsigned char *buf, int num) {`
		6e9104	`isc_result_t result;`
		6e9104	`@@ -102,6 +104,7 @@ entropy_add(const void *buf, int num, double entropy) {`
		6e9104	`return (1);`
		6e9104	`}`
		6e9104	`#endif`
		6e9104	`+#endif /* !ISC_PLATFORM_CRYPTORANDOM */`
		6e9104
		6e9104	`#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)`
		6e9104	`static void`
		6e9104	`@@ -190,7 +193,7 @@ _set_thread_id(CRYPTO_THREADID *id)`
		6e9104	`isc_result_t`
		6e9104	`dst__openssl_init(const char *engine) {`
		6e9104	`isc_result_t result;`
		6e9104	`-#if !defined(OPENSSL_NO_ENGINE)`
		6e9104	`+#if !defined(OPENSSL_NO_ENGINE) && !defined(ISC_PLATFORM_CRYPTORANDOM)`
		6e9104	`ENGINE *re;`
		6e9104	`#else`
		6e9104	`UNUSED(engine);`
		6e9104	`@@ -220,6 +223,7 @@ dst__openssl_init(const char *engine) {`
		6e9104	`ERR_load_crypto_strings();`
		6e9104	`#endif`
		6e9104
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`rm = mem_alloc(sizeof(RAND_METHOD) FILELINE);`
		6e9104	`if (rm == NULL) {`
		6e9104	`result = ISC_R_NOMEMORY;`
		6e9104	`@@ -231,6 +235,7 @@ dst__openssl_init(const char *engine) {`
		6e9104	`rm->add = entropy_add;`
		6e9104	`rm->pseudorand = entropy_getpseudo;`
		6e9104	`rm->status = entropy_status;`
		6e9104	`+#endif`
		6e9104
		6e9104	`#if !defined(OPENSSL_NO_ENGINE)`
		6e9104	`#if !defined(CONF_MFLAGS_DEFAULT_SECTION)`
		6e9104	`@@ -264,6 +269,7 @@ dst__openssl_init(const char *engine) {`
		6e9104	`}`
		6e9104	`}`
		6e9104
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`re = ENGINE_get_default_RAND();`
		6e9104	`if (re == NULL) {`
		6e9104	`re = ENGINE_new();`
		6e9104	`@@ -276,9 +282,21 @@ dst__openssl_init(const char *engine) {`
		6e9104	`ENGINE_free(re);`
		6e9104	`} else`
		6e9104	`ENGINE_finish(re);`
		6e9104	`+#endif`
		6e9104	`#else`
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`RAND_set_rand_method(rm);`
		6e9104	`+#endif`
		6e9104	`#endif /* !defined(OPENSSL_NO_ENGINE) */`
		6e9104	`+`
		6e9104	`+ /* Protect ourselves against unseeded PRNG */`
		6e9104	`+ if (RAND_status() != 1) {`
		6e9104	`+ FATAL_ERROR(__FILE__, __LINE__,`
		6e9104	`+ "OpenSSL pseudorandom number generator "`
		6e9104	+ "cannot be initialized (see the `PRNG not "
		6e9104	`+ "seeded' message in the OpenSSL FAQ)");`
		6e9104	`+ }`
		6e9104	`+`
		6e9104	`return (ISC_R_SUCCESS);`
		6e9104
		6e9104	`#if !defined(OPENSSL_NO_ENGINE)`
		6e9104	`@@ -286,10 +304,14 @@ dst__openssl_init(const char *engine) {`
		6e9104	`if (e != NULL)`
		6e9104	`ENGINE_free(e);`
		6e9104	`e = NULL;`
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`mem_free(rm FILELINE);`
		6e9104	`rm = NULL;`
		6e9104	`#endif`
		6e9104	`+#endif`
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`cleanup_mutexinit:`
		6e9104	`+#endif`
		6e9104	`#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)`
		6e9104	`CRYPTO_set_locking_callback(NULL);`
		6e9104	`DESTROYMUTEXBLOCK(locks, nlocks);`
		6e9104	`@@ -304,14 +326,17 @@ void`
		6e9104	`dst__openssl_destroy(void) {`
		6e9104	`#if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x10100000L)`
		6e9104	`OPENSSL_cleanup();`
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`if (rm != NULL) {`
		6e9104	`mem_free(rm FILELINE);`
		6e9104	`rm = NULL;`
		6e9104	`}`
		6e9104	`+#endif`
		6e9104	`#else`
		6e9104	`/*`
		6e9104	`* Sequence taken from apps_shutdown() in <apps/apps.h>.`
		6e9104	`*/`
		6e9104	`+#ifndef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`if (rm != NULL) {`
		6e9104	`#if OPENSSL_VERSION_NUMBER >= 0x00907000L`
		6e9104	`RAND_cleanup();`
		6e9104	`@@ -319,6 +344,7 @@ dst__openssl_destroy(void) {`
		6e9104	`mem_free(rm FILELINE);`
		6e9104	`rm = NULL;`
		6e9104	`}`
		6e9104	`+#endif`
		6e9104	`#if (OPENSSL_VERSION_NUMBER >= 0x00907000L)`
		6e9104	`CONF_modules_free();`
		6e9104	`#endif`
		6e9104	`@@ -454,11 +480,45 @@ dst__openssl_getengine(const char *engine) {`
		6e9104	`}`
		6e9104	`#endif`
		6e9104
		6e9104	`-#else /* OPENSSL */`
		6e9104	`+isc_result_t`
		6e9104	`+dst_random_getdata(void *data, unsigned int length,`
		6e9104	`+ unsigned int *returned, unsigned int flags) {`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+#ifndef DONT_REQUIRE_DST_LIB_INIT`
		6e9104	`+ INSIST(dst__memory_pool != NULL);`
		6e9104	`+#endif`
		6e9104	`+ REQUIRE(data != NULL);`
		6e9104	`+ REQUIRE(length > 0);`
		6e9104
		6e9104	`-#include <isc/util.h>`
		6e9104	`+#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)`
		6e9104	`+ if ((flags & ISC_ENTROPY_GOODONLY) == 0) {`
		6e9104	`+ if (RAND_pseudo_bytes((unsigned char *)data, (int)length) < 0)`
		6e9104	`+ return (dst__openssl_toresult2("RAND_pseudo_bytes",`
		6e9104	`+ DST_R_OPENSSLFAILURE));`
		6e9104	`+ } else {`
		6e9104	`+ if (RAND_bytes((unsigned char *)data, (int)length) != 1)`
		6e9104	`+ return (dst__openssl_toresult2("RAND_bytes",`
		6e9104	`+ DST_R_OPENSSLFAILURE));`
		6e9104	`+ }`
		6e9104	`+#else`
		6e9104	`+ UNUSED(flags);`
		6e9104
		6e9104	`-EMPTY_TRANSLATION_UNIT`
		6e9104	`+ if (RAND_bytes((unsigned char *)data, (int)length) != 1)`
		6e9104	`+ return (dst__openssl_toresult2("RAND_bytes",`
		6e9104	`+ DST_R_OPENSSLFAILURE));`
		6e9104	`+#endif`
		6e9104	`+ if (returned != NULL)`
		6e9104	`+ *returned = length;`
		6e9104	`+ return (ISC_R_SUCCESS);`
		6e9104	`+#else`
		6e9104	`+ UNUSED(data);`
		6e9104	`+ UNUSED(length);`
		6e9104	`+ UNUSED(returned);`
		6e9104	`+ UNUSED(flags);`
		6e9104	`+`
		6e9104	`+ return (ISC_R_NOTIMPLEMENTED);`
		6e9104	`+#endif`
		6e9104	`+}`
		6e9104
		6e9104	`#endif /* OPENSSL */`
		6e9104	`/! \file /`
		6e9104	`diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c`
		6e9104	`index 5a2c502..8eaef53 100644`
		6e9104	`--- a/lib/dns/pkcs11.c`
		6e9104	`+++ b/lib/dns/pkcs11.c`
		6e9104	`@@ -13,12 +13,15 @@`
		6e9104
		6e9104	`#include <config.h>`
		6e9104
		6e9104	`+#include <isc/util.h>`
		6e9104	`+`
		6e9104	`#include <dns/log.h>`
		6e9104	`#include <dns/result.h>`
		6e9104
		6e9104	`#include <pk11/pk11.h>`
		6e9104	`#include <pk11/internal.h>`
		6e9104
		6e9104	`+#include "dst_internal.h"`
		6e9104	`#include "dst_pkcs11.h"`
		6e9104
		6e9104	`isc_result_t`
		6e9104	`@@ -34,12 +37,32 @@ dst__pkcs11_toresult(const char funcname, const char file, int line,`
		6e9104	`return (fallback);`
		6e9104	`}`
		6e9104
		6e9104	`+isc_result_t`
		6e9104	`+dst_random_getdata(void *data, unsigned int length,`
		6e9104	`+ unsigned int *returned, unsigned int flags) {`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		6e9104	`+ isc_result_t ret;`
		6e9104
		6e9104	`-#else /* PKCS11CRYPTO */`
		6e9104	`+#ifndef DONT_REQUIRE_DST_LIB_INIT`
		6e9104	`+ INSIST(dst__memory_pool != NULL);`
		6e9104	`+#endif`
		6e9104	`+ REQUIRE(data != NULL);`
		6e9104	`+ REQUIRE(length > 0);`
		6e9104	`+ UNUSED(flags);`
		6e9104
		6e9104	`-#include <isc/util.h>`
		6e9104	`+ ret = pk11_rand_bytes(data, (int) length);`
		6e9104	`+ if ((ret == ISC_R_SUCCESS) && (returned != NULL))`
		6e9104	`+ *returned = length;`
		6e9104	`+ return (ret);`
		6e9104	`+#else`
		6e9104	`+ UNUSED(data);`
		6e9104	`+ UNUSED(length);`
		6e9104	`+ UNUSED(returned);`
		6e9104	`+ UNUSED(flags);`
		6e9104
		6e9104	`-EMPTY_TRANSLATION_UNIT`
		6e9104	`+ return (ISC_R_NOTIMPLEMENTED);`
		6e9104	`+#endif`
		6e9104	`+}`
		6e9104
		6e9104	`#endif /* PKCS11CRYPTO */`
		6e9104	`/! \file /`
		6e9104	`diff --git a/lib/dns/tests/Atffile b/lib/dns/tests/Atffile`
		6e9104	`index 953082d..603c4b5 100644`
		6e9104	`--- a/lib/dns/tests/Atffile`
		6e9104	`+++ b/lib/dns/tests/Atffile`
		6e9104	`@@ -10,6 +10,7 @@ tp: dbversion_test`
		6e9104	`tp: dh_test`
		6e9104	`tp: dispatch_test`
		6e9104	`tp: dnstap_test`
		6e9104	`+tp: dstrandom_test`
		6e9104	`tp: dst_test`
		6e9104	`tp: geoip_test`
		6e9104	`tp: gost_test`
		6e9104	`diff --git a/lib/dns/tests/Kyuafile b/lib/dns/tests/Kyuafile`
		6e9104	`index 0353a73..cb2324d 100644`
		6e9104	`--- a/lib/dns/tests/Kyuafile`
		6e9104	`+++ b/lib/dns/tests/Kyuafile`
		6e9104	`@@ -10,6 +10,7 @@ atf_test_program{name='dh_test'}`
		6e9104	`atf_test_program{name='dispatch_test'}`
		6e9104	`atf_test_program{name='dnstap_test'}`
		6e9104	`atf_test_program{name='dst_test'}`
		6e9104	`+atf_test_program{name='dstrandom_test'}`
		6e9104	`atf_test_program{name='geoip_test'}`
		6e9104	`atf_test_program{name='gost_test'}`
		6e9104	`atf_test_program{name='keytable_test'}`
		6e9104	`diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in`
		6e9104	`index 58fa872..625e809 100644`
		6e9104	`--- a/lib/dns/tests/Makefile.in`
		6e9104	`+++ b/lib/dns/tests/Makefile.in`
		6e9104	`@@ -40,6 +40,7 @@ SRCS = acl_test.c \`
		6e9104	`dnstap_test.c \`
		6e9104	`dst_test.c \`
		6e9104	`dnstest.c \`
		6e9104	`+ dstrandom_test.c \`
		6e9104	`geoip_test.c \`
		6e9104	`gost_test.c \`
		6e9104	`keytable_test.c \`
		6e9104	`@@ -71,6 +72,7 @@ TARGETS = acl_test@EXEEXT@ \`
		6e9104	`dh_test@EXEEXT@ \`
		6e9104	`dispatch_test@EXEEXT@ \`
		6e9104	`dnstap_test@EXEEXT@ \`
		6e9104	`+ dstrandom_test@EXEEXT@ \`
		6e9104	`dst_test@EXEEXT@ \`
		6e9104	`geoip_test@EXEEXT@ \`
		6e9104	`gost_test@EXEEXT@ \`
		6e9104	`@@ -255,6 +257,11 @@ tsig_test@EXEEXT@: tsig_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}`
		6e9104	`tsig_test.@O@ dnstest.@O@ ${DNSLIBS} \`
		6e9104	`${ISCLIBS} ${LIBS}`
		6e9104
		6e9104	`+dstrandom_test@EXEEXT@: dstrandom_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}`
		6e9104	`+ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \`
		6e9104	`+ dstrandom_test.@O@ ${DNSLIBS} \`
		6e9104	`+ ${ISCLIBS} ${ISCPK11LIBS} ${LIBS}`
		6e9104	`+`
		6e9104	`unit::`
		6e9104	`sh ${top_builddir}/unit/unittest.sh`
		6e9104
		6e9104	`diff --git a/lib/dns/tests/dnstest.c b/lib/dns/tests/dnstest.c`
		ad7b3b	`index 51bb90b..1b25b90 100644`
		6e9104	`--- a/lib/dns/tests/dnstest.c`
		6e9104	`+++ b/lib/dns/tests/dnstest.c`
		ad7b3b	`@@ -122,12 +122,12 @@ dns_test_begin(FILE *logfile, bool start_managers) {`
		6e9104	`CHECK(isc_mem_create(0, 0, &mctx));`
		6e9104	`CHECK(isc_entropy_create(mctx, &ectx));`
		6e9104
		6e9104	`- CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		ad7b3b	`- hash_active = true;`
		6e9104	`-`
		6e9104	`CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));`
		ad7b3b	`dst_active = true;`
		6e9104
		6e9104	`+ CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));`
		ad7b3b	`+ hash_active = true;`
		6e9104	`+`
		6e9104	`if (logfile != NULL) {`
		6e9104	`isc_logdestination_t destination;`
		6e9104	`isc_logconfig_t *logconfig = NULL;`
		ad7b3b	`@@ -171,14 +171,14 @@ dns_test_begin(FILE *logfile, bool start_managers) {`
		6e9104
		6e9104	`void`
		6e9104	`dns_test_end(void) {`
		6e9104	`- if (dst_active) {`
		6e9104	`- dst_lib_destroy();`
		ad7b3b	`- dst_active = false;`
		6e9104	`- }`
		6e9104	`if (hash_active) {`
		6e9104	`isc_hash_destroy();`
		ad7b3b	`hash_active = false;`
		6e9104	`}`
		6e9104	`+ if (dst_active) {`
		6e9104	`+ dst_lib_destroy();`
		ad7b3b	`+ dst_active = false;`
		6e9104	`+ }`
		6e9104	`if (ectx != NULL)`
		6e9104	`isc_entropy_detach(&ectx);`
		6e9104
		6e9104	`diff --git a/lib/dns/tests/dstrandom_test.c b/lib/dns/tests/dstrandom_test.c`
		6e9104	`new file mode 100644`
		ad7b3b	`index 0000000..b980d8a`
		6e9104	`--- /dev/null`
		6e9104	`+++ b/lib/dns/tests/dstrandom_test.c`
		ad7b3b	`@@ -0,0 +1,99 @@`
		6e9104	`+/*`
		ad7b3b	`+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")`
		6e9104	`+ *`
		ad7b3b	`+ * This Source Code Form is subject to the terms of the Mozilla Public`
		ad7b3b	`+ * License, v. 2.0. If a copy of the MPL was not distributed with this`
		ad7b3b	`+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.`
		6e9104	`+ *`
		ad7b3b	`+ * See the COPYRIGHT file distributed with this work for additional`
		ad7b3b	`+ * information regarding copyright ownership.`
		6e9104	`+ */`
		6e9104	`+`
		6e9104	`+/! \file /`
		6e9104	`+`
		6e9104	`+#include <config.h>`
		6e9104	`+`
		6e9104	`+#include <atf-c.h>`
		6e9104	`+`
		6e9104	`+#include <stdio.h>`
		6e9104	`+#include <string.h>`
		ad7b3b	`+#include <unistd.h>`
		6e9104	`+`
		6e9104	`+#include <isc/entropy.h>`
		6e9104	`+#include <isc/mem.h>`
		6e9104	`+#include <isc/platform.h>`
		6e9104	`+#include <isc/util.h>`
		6e9104	`+`
		6e9104	`+#include <dst/dst.h>`
		6e9104	`+`
		6e9104	`+isc_mem_t *mctx = NULL;`
		6e9104	`+isc_entropy_t *ectx = NULL;`
		6e9104	`+unsigned char buffer[128];`
		6e9104	`+`
		6e9104	`+ATF_TC(isc_entropy_getdata);`
		6e9104	`+ATF_TC_HEAD(isc_entropy_getdata, tc) {`
		6e9104	`+ atf_tc_set_md_var(tc, "descr",`
		6e9104	`+ "isc_entropy_getdata() examples");`
		6e9104	`+ atf_tc_set_md_var(tc, "X-randomfile",`
		6e9104	`+ "testdata/dstrandom/random.data");`
		6e9104	`+}`
		6e9104	`+ATF_TC_BODY(isc_entropy_getdata, tc) {`
		6e9104	`+ isc_result_t result;`
		6e9104	`+ unsigned int returned, status;`
		6e9104	`+ int ret;`
		6e9104	`+ const char *randomfile = atf_tc_get_md_var(tc, "X-randomfile");`
		6e9104	`+`
		6e9104	`+ isc_mem_debugging \|= ISC_MEM_DEBUGRECORD;`
		6e9104	`+ result = isc_mem_create(0, 0, &mctx);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+ result = isc_entropy_create(mctx, &ectx);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+ result = dst_lib_init(mctx, ectx, 0);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+`
		6e9104	`+#ifdef ISC_PLATFORM_CRYPTORANDOM`
		ad7b3b	`+ isc_entropy_usehook(ectx, true);`
		6e9104	`+`
		6e9104	`+ returned = 0;`
		6e9104	`+ result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),`
		6e9104	`+ &returned, 0);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+ ATF_REQUIRE(returned == sizeof(buffer));`
		6e9104	`+`
		6e9104	`+ status = isc_entropy_status(ectx);`
		6e9104	`+ ATF_REQUIRE_EQ(status, 0);`
		6e9104	`+`
		ad7b3b	`+ isc_entropy_usehook(ectx, false);`
		6e9104	`+#endif`
		6e9104	`+`
		6e9104	`+ ret = chdir(TESTS);`
		6e9104	`+ ATF_REQUIRE_EQ(ret, 0);`
		6e9104	`+`
		6e9104	`+ result = isc_entropy_createfilesource(ectx, randomfile);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+`
		6e9104	`+ returned = 0;`
		6e9104	`+ result = isc_entropy_getdata(ectx, buffer, sizeof(buffer),`
		6e9104	`+ &returned, 0);`
		6e9104	`+ ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);`
		6e9104	`+ ATF_REQUIRE(returned == sizeof(buffer));`
		6e9104	`+`
		6e9104	`+ status = isc_entropy_status(ectx);`
		6e9104	`+ ATF_REQUIRE(status > 0);`
		6e9104	`+`
		6e9104	`+ dst_lib_destroy();`
		6e9104	`+ isc_entropy_detach(&ectx);`
		6e9104	`+ ATF_REQUIRE(ectx == NULL);`
		6e9104	`+ isc_mem_destroy(&mctx);`
		6e9104	`+ ATF_REQUIRE(mctx == NULL);`
		6e9104	`+}`
		6e9104	`+`
		6e9104	`+/*`
		6e9104	`+ * Main`
		6e9104	`+ */`
		6e9104	`+ATF_TP_ADD_TCS(tp) {`
		6e9104	`+ ATF_TP_ADD_TC(tp, isc_entropy_getdata);`
		6e9104	`+`
		6e9104	`+ return (atf_no_error());`
		6e9104	`+}`
		6e9104	`+`
		6e9104	`diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in`
		ad7b3b	`index 62a156c..bf83fe5 100644`
		6e9104	`--- a/lib/dns/win32/libdns.def.in`
		6e9104	`+++ b/lib/dns/win32/libdns.def.in`
		ad7b3b	`@@ -1483,6 +1483,13 @@ dst_lib_destroy`
		6e9104	`dst_lib_init`
		6e9104	`dst_lib_init2`
		6e9104	`dst_lib_initmsgcat`
		6e9104	`+@IF PKCS11`
		6e9104	`+dst_random_getdata`
		6e9104	`+@ELSE PKCS11`
		6e9104	`+@IF OPENSSL`
		6e9104	`+dst_random_getdata`
		6e9104	`+@END OPENSSL`
		6e9104	`+@END PKCS11`
		6e9104	`dst_region_computeid`
		6e9104	`dst_region_computerid`
		6e9104	`dst_result_register`
		6e9104	`diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c`
		ad7b3b	`index ab2f617..ed05ed6 100644`
		6e9104	`--- a/lib/isc/entropy.c`
		6e9104	`+++ b/lib/isc/entropy.c`
		ad7b3b	`@@ -104,11 +104,15 @@ struct isc_entropy {`
		ad7b3b	`uint32_t initialized;`
		ad7b3b	`uint32_t initcount;`
		6e9104	`isc_entropypool_t pool;`
		ad7b3b	`+ bool usehook;`
		6e9104	`unsigned int nsources;`
		6e9104	`isc_entropysource_t *nextsource;`
		6e9104	`ISC_LIST(isc_entropysource_t) sources;`
		6e9104	`};`
		6e9104
		6e9104	`+/% Global Hook /`
		6e9104	`+static isc_entropy_getdata_t hook;`
		6e9104	`+`
		6e9104	`/% Sample Queue /`
		6e9104	`typedef struct {`
		ad7b3b	`uint32_t last_time; /%< last time recorded /`
		ad7b3b	`@@ -557,6 +561,11 @@ isc_entropy_getdata(isc_entropy_t ent, void data, unsigned int length,`
		6e9104
		6e9104	`LOCK(&ent->lock);`
		6e9104
		6e9104	`+ if (ent->usehook && (hook != NULL)) {`
		6e9104	`+ UNLOCK(&ent->lock);`
		6e9104	`+ return (hook(data, length, returned, flags));`
		6e9104	`+ }`
		6e9104	`+`
		6e9104	`remain = length;`
		6e9104	`buf = data;`
		6e9104	`total = 0;`
		ad7b3b	`@@ -708,6 +717,7 @@ isc_entropy_create(isc_mem_t mctx, isc_entropy_t *entp) {`
		6e9104	`ent->refcnt = 1;`
		6e9104	`ent->initialized = 0;`
		6e9104	`ent->initcount = 0;`
		ad7b3b	`+ ent->usehook = false;`
		6e9104	`ent->magic = ENTROPY_MAGIC;`
		6e9104
		6e9104	`isc_entropypool_init(&ent->pool);`
		6e9104	`@@ -1286,3 +1296,17 @@ isc_entropy_usebestsource(isc_entropy_t ectx, isc_entropysource_t *source,`
		6e9104	`*/`
		6e9104	`return (final_result);`
		6e9104	`}`
		6e9104	`+`
		6e9104	`+void`
		ad7b3b	`+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff) {`
		6e9104	`+ REQUIRE(VALID_ENTROPY(ectx));`
		6e9104	`+`
		6e9104	`+ LOCK(&ectx->lock);`
		6e9104	`+ ectx->usehook = onoff;`
		6e9104	`+ UNLOCK(&ectx->lock);`
		6e9104	`+}`
		6e9104	`+`
		6e9104	`+void`
		6e9104	`+isc_entropy_sethook(isc_entropy_getdata_t myhook) {`
		6e9104	`+ hook = myhook;`
		6e9104	`+}`
		6e9104	`diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h`
		ad7b3b	`index 4bba8e1..632166a 100644`
		6e9104	`--- a/lib/isc/include/isc/entropy.h`
		6e9104	`+++ b/lib/isc/include/isc/entropy.h`
		ad7b3b	`@@ -304,6 +304,18 @@ isc_entropy_usebestsource(isc_entropy_t ectx, isc_entropysource_t *source,`
		6e9104	`* isc_entropy_createcallbacksource().`
		6e9104	`*/`
		6e9104
		6e9104	`+void`
		ad7b3b	`+isc_entropy_usehook(isc_entropy_t *ectx, bool onoff);`
		6e9104	`+/*!<`
		6e9104	`+ * \brief Mark/unmark the given entropy structure as being hooked.`
		6e9104	`+ */`
		6e9104	`+`
		6e9104	`+void`
		6e9104	`+isc_entropy_sethook(isc_entropy_getdata_t myhook);`
		6e9104	`+/*!<`
		6e9104	`+ * \brief Set the getdata hook (e.g., for a crypto random generator).`
		6e9104	`+ */`
		6e9104	`+`
		6e9104	`ISC_LANG_ENDDECLS`
		6e9104
		6e9104	`#endif /* ISC_ENTROPY_H */`
		6e9104	`diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in`
		ad7b3b	`index 9c7c342..ee8dc3e 100644`
		6e9104	`--- a/lib/isc/include/isc/platform.h.in`
		6e9104	`+++ b/lib/isc/include/isc/platform.h.in`
		ad7b3b	`@@ -341,6 +341,11 @@`
		6e9104	`*/`
		6e9104	`@ISC_PLATFORM_HAVESTRINGSH@`
		6e9104
		6e9104	`+/*`
		6e9104	`+ * Define if the random functions are provided by crypto.`
		6e9104	`+ */`
		6e9104	`+@ISC_PLATFORM_CRYPTORANDOM@`
		6e9104	`+`
		6e9104	`/*`
		6e9104	`* Define if the hash functions must be provided by OpenSSL.`
		6e9104	`*/`
		6e9104	`diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h`
		ad7b3b	`index 42ff7e0..8d87c44 100644`
		6e9104	`--- a/lib/isc/include/isc/types.h`
		6e9104	`+++ b/lib/isc/include/isc/types.h`
		6e9104	`@@ -93,6 +93,8 @@ typedef struct isc_time isc_time_t; /%< Time /`
		6e9104	`typedef struct isc_timer isc_timer_t; /%< Timer /`
		6e9104	`typedef struct isc_timermgr isc_timermgr_t; /%< Timer Manager /`
		6e9104
		6e9104	`+typedef isc_result_t (isc_entropy_getdata_t)(void , unsigned int,`
		6e9104	`+ unsigned int *, unsigned int);`
		6e9104	`typedef void (isc_taskaction_t)(isc_task_t , isc_event_t *);`
		6e9104	`typedef int (isc_sockfdwatch_t)(isc_task_t , isc_socket_t , void , int);`
		6e9104
		6e9104	`diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c`
		ad7b3b	`index a01e698..875c232 100644`
		6e9104	`--- a/lib/isc/pk11.c`
		6e9104	`+++ b/lib/isc/pk11.c`
		ad7b3b	`@@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {`
		6e9104	`ret = isc_stdio_open(randomfile, "r", &stream);`
		6e9104	`if (ret != ISC_R_SUCCESS)`
		6e9104	`goto cleanup;`
		6e9104	`- ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);`
		6e9104	`- if (ret!= ISC_R_SUCCESS)`
		6e9104	`- goto cleanup;`
		6e9104	`+ while (ret == ISC_R_SUCCESS) {`
		6e9104	`+ ret = isc_stdio_read(seed, 1, SEEDSIZE, stream, &cc);`
		6e9104	`+ if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF))`
		6e9104	`+ goto cleanup;`
		6e9104	`+ (void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);`
		6e9104	`+ }`
		6e9104	`ret = isc_stdio_close(stream);`
		6e9104	`stream = NULL;`
		6e9104	`- if (ret!= ISC_R_SUCCESS)`
		6e9104	`+ if (ret != ISC_R_SUCCESS)`
		6e9104	`goto cleanup;`
		6e9104	`- (void) pkcs_C_SeedRandom(ctx.session, seed, (CK_ULONG) cc);`
		6e9104
		6e9104	`cleanup:`
		6e9104	`if (stream != NULL)`
		6e9104	`diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in`
		ad7b3b	`index 5b8a2c9..913a2ce 100644`
		6e9104	`--- a/lib/isc/win32/include/isc/platform.h.in`
		6e9104	`+++ b/lib/isc/win32/include/isc/platform.h.in`
		ad7b3b	`@@ -69,6 +69,11 @@`
		6e9104	`#define ISC_PLATFORM_NORETURN_PRE __declspec(noreturn)`
		6e9104	`#define ISC_PLATFORM_NORETURN_POST`
		6e9104
		6e9104	`+/*`
		6e9104	`+ * Define if the random functions are provided by crypto.`
		6e9104	`+ */`
		6e9104	`+@ISC_PLATFORM_CRYPTORANDOM@`
		6e9104	`+`
		6e9104	`/*`
		6e9104	`* Define if the hash functions must be provided by OpenSSL.`
		6e9104	`*/`
		6e9104	`diff --git a/win32utils/Configure b/win32utils/Configure`
		ad7b3b	`index ff596b7..09b476f 100644`
		6e9104	`--- a/win32utils/Configure`
		6e9104	`+++ b/win32utils/Configure`
		6e9104	`@@ -381,6 +381,7 @@ my @substdefh = ("AES_CC",`
		6e9104	`my %configdefp;`
		6e9104
		6e9104	`my @substdefp = ("ISC_PLATFORM_BUSYWAITNOP",`
		6e9104	`+ "ISC_PLATFORM_CRYPTORANDOM",`
		6e9104	`"ISC_PLATFORM_HAVEATOMICSTORE",`
		6e9104	`"ISC_PLATFORM_HAVEATOMICSTOREQ",`
		6e9104	`"ISC_PLATFORM_HAVECMPXCHG",`
		6e9104	`@@ -509,7 +510,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");`
		6e9104
		6e9104	`# enable-xxx/disable-xxx`
		6e9104
		6e9104	`-my @enablelist = ("developer",`
		6e9104	`+my @enablelist = ("crypto-rand",`
		6e9104	`+ "developer",`
		6e9104	`"fixed-rrset",`
		6e9104	`"intrinsics",`
		6e9104	`"isc-spnego",`
		6e9104	`@@ -571,6 +573,7 @@ my @help = (`
		6e9104	`"\nOptional Features:\n",`
		6e9104	`" enable-intrinsics enable instrinsic/atomic functions [default=yes]\n",`
		6e9104	`" enable-native-pkcs11 use native PKCS#11 for all crypto [default=no]\n",`
		6e9104	`+" enable-crypto-rand use crypto provider for random [default=yes]\n",`
		6e9104	`" enable-openssl-hash use OpenSSL for hash functions [default=yes]\n",`
		6e9104	`" enable-isc-spnego use SPNEGO from lib/dns [default=yes]\n",`
		6e9104	`" enable-filter-aaaa enable filtering of AAAA records [default=yes]\n",`
		6e9104	`@@ -614,7 +617,9 @@ my $want_clean = "no";`
		6e9104	`my $want_unknown = "no";`
		6e9104	`my $unknown_value;`
		6e9104	`my $enable_intrinsics = "yes";`
		6e9104	`+my $cryptolib = "";`
		6e9104	`my $enable_native_pkcs11 = "no";`
		6e9104	`+my $enable_crypto_rand = "yes";`
		6e9104	`my $enable_openssl_hash = "auto";`
		6e9104	`my $enable_filter_aaaa = "yes";`
		6e9104	`my $enable_isc_spnego = "yes";`
		6e9104	`@@ -823,6 +828,10 @@ sub myenable {`
		6e9104	`if ($val =~ /^yes$/i) {`
		6e9104	`$enable_native_pkcs11 = "yes";`
		6e9104	`}`
		6e9104	`+ } elsif ($key =~ /^crypto-rand$/i) {`
		6e9104	`+ if ($val =~ /^no$/i) {`
		6e9104	`+ $enable_crypto_rand = "no";`
		6e9104	`+ }`
		6e9104	`} elsif ($key =~ /^openssl-hash$/i) {`
		6e9104	`if ($val =~ /^yes$/i) {`
		6e9104	`$enable_openssl_hash = "yes";`
		6e9104	`@@ -1106,6 +1115,11 @@ if ($verbose) {`
		6e9104	`} else {`
		6e9104	`print "native-pkcs11: disabled\n";`
		6e9104	`}`
		6e9104	`+ if ($enable_crypto_rand eq "yes") {`
		6e9104	`+ print "crypto-rand: enabled\n";`
		6e9104	`+ } else {`
		6e9104	`+ print "crypto-rand: disabled\n";`
		6e9104	`+ }`
		6e9104	`if ($enable_openssl_hash eq "yes") {`
		6e9104	`print "openssl-hash: enabled\n";`
		6e9104	`} else {`
		ad7b3b	`@@ -1454,6 +1468,7 @@ if ($enable_intrinsics eq "yes") {`
		6e9104
		6e9104	`# enable-native-pkcs11`
		6e9104	`if ($enable_native_pkcs11 eq "yes") {`
		6e9104	`+ $cryptolib = "pkcs11";`
		6e9104	`if ($use_openssl eq "auto") {`
		6e9104	`$use_openssl = "no";`
		6e9104	`}`
		ad7b3b	`@@ -1663,6 +1678,7 @@ if ($use_openssl eq "yes") {`
		6e9104	`$openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");`
		6e9104	`}`
		6e9104
		6e9104	`+ $cryptolib = "openssl";`
		6e9104	`$configcond{"OPENSSL"} = 1;`
		6e9104	`$configdefd{"CRYPTO"} = "OPENSSL";`
		6e9104	`$configvar{"OPENSSL_PATH"} = "$openssl_path";`
		ad7b3b	`@@ -2214,6 +2230,15 @@ if ($cookie_algorithm eq "sha1") {`
		6e9104	`die "Unrecognized cookie algorithm: $cookie_algorithm\n";`
		6e9104	`}`
		6e9104
		6e9104	`+# enable-crypto-rand`
		6e9104	`+if ($enable_crypto_rand eq "yes") {`
		6e9104	`+ if (($use_openssl eq "no") && ($enable_native_pkcs11 eq "no")) {`
		6e9104	`+ die "No crypto provider for random functions\n";`
		6e9104	`+ }`
		6e9104	`+ $configdefp{"ISC_PLATFORM_CRYPTORANDOM"} = "\"$cryptolib\"";`
		6e9104	`+}`
		6e9104	`+print "Cryptographic library for DNSSEC: $cryptolib";`
		6e9104	`+`
		6e9104	`# enable-openssl-hash`
		6e9104	`if ($enable_openssl_hash eq "yes") {`
		6e9104	`if ($use_openssl eq "no") {`
		ad7b3b	`@@ -3536,6 +3561,7 @@ exit 0;`
		6e9104	`# --enable-developer partially supported`
		6e9104	`# --enable-newstats (9.9/9.9sub only)`
		6e9104	`# --enable-native-pkcs11 supported`
		6e9104	`+# --enable-crypto-rand supported`
		6e9104	`# --enable-openssl-version-check included without a way to disable it`
		6e9104	`# --enable-openssl-hash supported`
		6e9104	`# --enable-threads included without a way to disable it`
		ad7b3b	`@@ -3561,6 +3587,7 @@ exit 0;`
		6e9104	`# --with-gost supported`
		6e9104	`# --with-aes supported`
		6e9104	`# --with-cc-alg supported`
		6e9104	`+# --with-randomdev not supported on WIN32 (makes no sense)`
		6e9104	`# --with-geoip supported`
		6e9104	`# --with-gssapi supported with MIT (K)erberos (f)or (W)indows`
		6e9104	`# --with-lmdb no supported on WIN32 (port is not reliable)`
		6e9104	`--`
		6e9104	`2.14.4`
		6e9104

rpms / bind

Source Code

Blame bind-9.11-rt31459.patch