--- bind-9.10.4-P3/configure.in	2016-11-07 17:57:34.328237767 +0100

+++ bind-9.10.4-P3/configure.in	2016-11-07 17:57:34.336237955 +0100

@@ -1562,28 +1562,6 @@ Please check the argument to --with-open

 shared library configuration (e.g., LD_LIBRARY_PATH).)],

 		[AC_MSG_RESULT(assuming it does work on target platform)])

-		AC_MSG_CHECKING(whether linking with OpenSSL requires -ldl)

-		AC_TRY_LINK([

-#include <openssl/err.h>

-#include <openssl/dso.h>

-],

-[ DSO_METHOD_dlfcn(); ],

-		[AC_MSG_RESULT(no)],

-		[LIBS="$LIBS -ldl"

-		AC_TRY_LINK([

-#include <openssl/err.h>

-#include <openssl/dso.h>

-],[ DSO_METHOD_dlfcn(); ],

-		[AC_MSG_RESULT(yes)

-		DST_OPENSSL_LIBS="$DST_OPENSSL_LIBS -ldl"

-		],

-		 [AC_MSG_RESULT(unknown)

-		 AC_MSG_ERROR(OpenSSL has unsupported dynamic loading)],

-		[AC_MSG_RESULT(assuming it does work on target platform)])

-		],

-		[AC_MSG_RESULT(assuming it does work on target platform)]

-		)

-		 

 AC_ARG_ENABLE(openssl-version-check,

 [AC_HELP_STRING([--enable-openssl-version-check],

 	[check OpenSSL version @<:@default=yes@:>@])])

--- bind-9.10.4-P3/lib/dns/dst_openssl.h	2016-09-14 03:23:44.000000000 +0200

+++ bind-9.10.4-P3/lib/dns/dst_openssl.h	2016-11-07 17:57:34.336237955 +0100

@@ -30,8 +30,10 @@ 

 #include <openssl/conf.h>

 #include <openssl/crypto.h>

 #include <openssl/bn.h>

+#include <openssl/ec.h>

-#if !defined(OPENSSL_NO_ENGINE) && defined(CRYPTO_LOCK_ENGINE) && \

+#if !defined(OPENSSL_NO_ENGINE) && (defined(CRYPTO_LOCK_ENGINE) || \

+    defined(CRYPTO_EX_INDEX_ENGINE)) && \

     (OPENSSL_VERSION_NUMBER >= 0x0090707f)

 #define USE_ENGINE 1

 #endif

--- bind-9.10.4-P3/lib/dns/openssldh_link.c	2016-09-14 03:23:44.000000000 +0200

+++ bind-9.10.4-P3/lib/dns/openssldh_link.c	2016-11-07 17:57:34.336237955 +0100

@@ -81,6 +81,7 @@ openssldh_computesecret(const dst_key_t

 	int ret;

 	isc_region_t r;

 	unsigned int len;

+	const BIGNUM *pub_key;

 	REQUIRE(pub->keydata.dh != NULL);

 	REQUIRE(priv->keydata.dh != NULL);

@@ -92,7 +93,12 @@ openssldh_computesecret(const dst_key_t

 	isc_buffer_availableregion(secret, &r);

 	if (r.length < len)

 		return (ISC_R_NOSPACE);

-	ret = DH_compute_key(r.base, dhpub->pub_key, dhpriv);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	pub_key = dhpub->pub_key;

+#else

+	DH_get0_key(dhpub, &pub_key, NULL);

+#endif

+	ret = DH_compute_key(r.base, pub_key, dhpriv);

 	if (ret <= 0)

 		return (dst__openssl_toresult2("DH_compute_key",

 					       DST_R_COMPUTESECRETFAILURE));

@@ -104,6 +110,8 @@ static isc_boolean_t

 openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {

 	int status;

 	DH *dh1, *dh2;

+	const BIGNUM *p1, *g1, *pub_key1, *priv_key1;

+	const BIGNUM *p2, *g2, *pub_key2, *priv_key2;

 	dh1 = key1->keydata.dh;

 	dh2 = key2->keydata.dh;

@@ -113,17 +121,33 @@ openssldh_compare(const dst_key_t *key1,

 	else if (dh1 == NULL || dh2 == NULL)

 		return (ISC_FALSE);

-	status = BN_cmp(dh1->p, dh2->p) ||

-		 BN_cmp(dh1->g, dh2->g) ||

-		 BN_cmp(dh1->pub_key, dh2->pub_key);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	p1 = dh1->p;

+	g1 = dh1->g;

+	pub_key1 = dh1->pub_key;

+	priv_key1 = dh1->priv_key;

+	p2 = dh2->p;

+	g2 = dh2->g;

+	pub_key2 = dh2->pub_key;

+	priv_key2 = dh2->priv_key;

+#else

+	DH_get0_pqg(dh1, &p1, NULL, &g1;;

+	DH_get0_key(dh1, &pub_key1, &priv_key1);

+	DH_get0_pqg(dh2, &p2, NULL, &g2;;

+	DH_get0_key(dh2, &pub_key2, &priv_key2);

+#endif

+

+	status = BN_cmp(p1, p2) ||

+		 BN_cmp(g1, g2) ||

+		 BN_cmp(pub_key1, pub_key2);

 	if (status != 0)

 		return (ISC_FALSE);

-	if (dh1->priv_key != NULL || dh2->priv_key != NULL) {

-		if (dh1->priv_key == NULL || dh2->priv_key == NULL)

+	if (priv_key1 != NULL || priv_key2 != NULL) {

+		if (priv_key1 == NULL || priv_key2 == NULL)

 			return (ISC_FALSE);

-		if (BN_cmp(dh1->priv_key, dh2->priv_key) != 0)

+		if (BN_cmp(priv_key1, priv_key2) != 0)

 			return (ISC_FALSE);

 	}

 	return (ISC_TRUE);

@@ -133,6 +157,8 @@ static isc_boolean_t

 openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {

 	int status;

 	DH *dh1, *dh2;

+	const BIGNUM *p1, *g1;

+	const BIGNUM *p2, *g2;

 	dh1 = key1->keydata.dh;

 	dh2 = key2->keydata.dh;

@@ -142,8 +168,18 @@ openssldh_paramcompare(const dst_key_t *

 	else if (dh1 == NULL || dh2 == NULL)

 		return (ISC_FALSE);

-	status = BN_cmp(dh1->p, dh2->p) ||

-		 BN_cmp(dh1->g, dh2->g);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	p1 = dh1->p;

+	g1 = dh1->g;

+	p2 = dh2->p;

+	g2 = dh2->g;

+#else

+	DH_get0_pqg(dh1, &p1, NULL, &g1;;

+	DH_get0_pqg(dh2, &p2, NULL, &g2;;

+#endif

+

+	status = BN_cmp(p1, p2) ||

+		 BN_cmp(g1, g2);

 	if (status != 0)

 		return (ISC_FALSE);

@@ -190,16 +226,29 @@ openssldh_generate(dst_key_t *key, int g

 		    key->key_size == 1024 ||

 		    key->key_size == 1536)

 		{

+			BIGNUM *p, *g;

 			dh = DH_new();

 			if (dh == NULL)

 				return (dst__openssl_toresult(ISC_R_NOMEMORY));

 			if (key->key_size == 768)

-				dh->p = bn768;

+				p = bn768;

 			else if (key->key_size == 1024)

-				dh->p = bn1024;

+				p = bn1024;

 			else

-				dh->p = bn1536;

+				p = bn1536;

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+			dh->p = p;

 			dh->g = bn2;

+#else

+			p = BN_dup(p);

+			g = BN_dup(bn2);

+			if (p == NULL || g == NULL) {

+				BN_free(p);

+				BN_free(g);

+				return (dst__openssl_toresult(ISC_R_NOMEMORY));

+			}

+			DH_set0_pqg(dh, p, NULL, g);

+#endif

 		} else

 			generator = 2;

 	}

@@ -247,7 +296,11 @@ openssldh_generate(dst_key_t *key, int g

 		return (dst__openssl_toresult2("DH_generate_key",

 					       DST_R_OPENSSLFAILURE));

 	}

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	dh->flags &= ~DH_FLAG_CACHE_MONT_P;

+#else

+	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);

+#endif

 	key->keydata.dh = dh;

@@ -257,7 +310,17 @@ openssldh_generate(dst_key_t *key, int g

 static isc_boolean_t

 openssldh_isprivate(const dst_key_t *key) {

 	DH *dh = key->keydata.dh;

-	return (ISC_TF(dh != NULL && dh->priv_key != NULL));

+	const BIGNUM *priv_key;

+

+	if (dh == NULL)

+		return (ISC_TF(0));

+

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	priv_key = dh->priv_key;

+#else

+	DH_get0_key(dh, NULL, &priv_key);

+#endif

+	return (ISC_TF(priv_key != NULL));

 }

 static void

@@ -267,10 +330,12 @@ openssldh_destroy(dst_key_t *key) {

 	if (dh == NULL)

 		return;

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	if (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536)

 		dh->p = NULL;

 	if (dh->g == bn2)

 		dh->g = NULL;

+#endif

 	DH_free(dh);

 	key->keydata.dh = NULL;

 }

@@ -299,6 +364,7 @@ uint16_fromregion(isc_region_t *region)

 static isc_result_t

 openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {

 	DH *dh;

+	const BIGNUM *p, *g, *pub_key;

 	isc_region_t r;

 	isc_uint16_t dnslen, plen, glen, publen;

@@ -306,42 +372,51 @@ openssldh_todns(const dst_key_t *key, is

 	dh = key->keydata.dh;

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	p = dh->p;

+	g = dh->g;

+	pub_key = dh->pub_key;

+#else

+	DH_get0_pqg(dh, &p, NULL, &g);

+	DH_get0_key(dh, &pub_key, NULL);

+#endif

+

 	isc_buffer_availableregion(data, &r);

-	if (dh->g == bn2 &&

-	    (dh->p == bn768 || dh->p == bn1024 || dh->p == bn1536)) {

+	if (BN_cmp(g, bn2) == 0 &&

+	    (BN_cmp(p, bn768) == 0 || BN_cmp(p, bn1024) == 0 || BN_cmp(p, bn1536) == 0)) {

 		plen = 1;

 		glen = 0;

 	}

 	else {

-		plen = BN_num_bytes(dh->p);

-		glen = BN_num_bytes(dh->g);

+		plen = BN_num_bytes(p);

+		glen = BN_num_bytes(g);

 	}

-	publen = BN_num_bytes(dh->pub_key);

+	publen = BN_num_bytes(pub_key);

 	dnslen = plen + glen + publen + 6;

 	if (r.length < (unsigned int) dnslen)

 		return (ISC_R_NOSPACE);

 	uint16_toregion(plen, &r);

 	if (plen == 1) {

-		if (dh->p == bn768)

+		if (BN_cmp(p, bn768) == 0)

 			*r.base = 1;

-		else if (dh->p == bn1024)

+		else if (BN_cmp(p, bn1024) == 0)

 			*r.base = 2;

 		else

 			*r.base = 3;

 	}

 	else

-		BN_bn2bin(dh->p, r.base);

+		BN_bn2bin(p, r.base);

 	isc_region_consume(&r, plen);

 	uint16_toregion(glen, &r);

 	if (glen > 0)

-		BN_bn2bin(dh->g, r.base);

+		BN_bn2bin(g, r.base);

 	isc_region_consume(&r, glen);

 	uint16_toregion(publen, &r);

-	BN_bn2bin(dh->pub_key, r.base);

+	BN_bn2bin(pub_key, r.base);

 	isc_region_consume(&r, publen);

 	isc_buffer_add(data, dnslen);

@@ -355,6 +430,8 @@ openssldh_fromdns(dst_key_t *key, isc_bu

 	isc_region_t r;

 	isc_uint16_t plen, glen, publen;

 	int special = 0;

+	BIGNUM *p = NULL, *g = NULL, *pub_key = NULL;

+	isc_result_t ret = ISC_R_NOMEMORY;

 	isc_buffer_remainingregion(data, &r);

 	if (r.length == 0)

@@ -363,24 +440,28 @@ openssldh_fromdns(dst_key_t *key, isc_bu

 	dh = DH_new();

 	if (dh == NULL)

 		return (dst__openssl_toresult(ISC_R_NOMEMORY));

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	dh->flags &= ~DH_FLAG_CACHE_MONT_P;

+#else

+	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);

+#endif

 	/*

 	 * Read the prime length.  1 & 2 are table entries, > 16 means a

 	 * prime follows, otherwise an error.

 	 */

 	if (r.length < 2) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	plen = uint16_fromregion(&r);

 	if (plen < 16 && plen != 1 && plen != 2) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	if (r.length < plen) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	if (plen == 1 || plen == 2) {

 		if (plen == 1) {

@@ -391,85 +472,119 @@ openssldh_fromdns(dst_key_t *key, isc_bu

 		}

 		switch (special) {

 			case 1:

-				dh->p = bn768;

+				p = bn768;

 				break;

 			case 2:

-				dh->p = bn1024;

+				p = bn1024;

 				break;

 			case 3:

-				dh->p = bn1536;

+				p = bn1536;

 				break;

 			default:

-				DH_free(dh);

-				return (DST_R_INVALIDPUBLICKEY);

+				ret = DST_R_INVALIDPUBLICKEY;

+				goto fail;

 		}

+#if OPENSSL_VERSION_NUMBER >= 0x10100000L

+		p = BN_dup(p);

+#endif

 	} else {

-		dh->p = BN_bin2bn(r.base, plen, NULL);

+		p = BN_bin2bn(r.base, plen, NULL);

 		isc_region_consume(&r, plen);

 	}

+	if (p == NULL) {

+		ret = dst__openssl_toresult(ISC_R_NOMEMORY);

+		goto fail;

+	}

+

 	/*

 	 * Read the generator length.  This should be 0 if the prime was

 	 * special, but it might not be.  If it's 0 and the prime is not

 	 * special, we have a problem.

 	 */

 	if (r.length < 2) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	glen = uint16_fromregion(&r);

 	if (r.length < glen) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	if (special != 0) {

-		if (glen == 0)

-			dh->g = bn2;

-		else {

-			dh->g = BN_bin2bn(r.base, glen, NULL);

-			if (BN_cmp(dh->g, bn2) == 0) {

-				BN_free(dh->g);

-				dh->g = bn2;

-			}

-			else {

-				DH_free(dh);

-				return (DST_R_INVALIDPUBLICKEY);

+		if (glen == 0) {

+			g = bn2;

+#if OPENSSL_VERSION_NUMBER >= 0x10100000L

+			g = BN_dup(g);

+#endif

+		} else {

+			g = BN_bin2bn(r.base, glen, NULL);

+			if (BN_cmp(g, bn2) != 0) {

+				ret = DST_R_INVALIDPUBLICKEY;

+				goto fail;

 			}

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+			BN_free(g);

+			g = bn2;

+#endif

 		}

 	} else {

 		if (glen == 0) {

-			DH_free(dh);

-			return (DST_R_INVALIDPUBLICKEY);

+			ret = DST_R_INVALIDPUBLICKEY;

+			goto fail;

 		}

-		dh->g = BN_bin2bn(r.base, glen, NULL);

+		g = BN_bin2bn(r.base, glen, NULL);

 	}

 	isc_region_consume(&r, glen);

 	if (r.length < 2) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

 	publen = uint16_fromregion(&r);

 	if (r.length < publen) {

-		DH_free(dh);

-		return (DST_R_INVALIDPUBLICKEY);

+		ret = DST_R_INVALIDPUBLICKEY;

+		goto fail;

 	}

-	dh->pub_key = BN_bin2bn(r.base, publen, NULL);

+	pub_key = BN_bin2bn(r.base, publen, NULL);

 	isc_region_consume(&r, publen);

-	key->key_size = BN_num_bits(dh->p);

+	if (p == NULL || g == NULL ||

+		pub_key == NULL) {

+		ret = dst__openssl_toresult(ISC_R_NOMEMORY);

+		goto fail;

+	}

+

+	key->key_size = BN_num_bits(p);

 	isc_buffer_forward(data, plen + glen + publen + 6);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	dh->p = p;

+	dh->g = g;

+	dh->pub_key = pub_key;

+#else

+	DH_set0_pqg(dh, p, NULL, g);

+	DH_set0_key(dh, pub_key, NULL);

+#endif

+

 	key->keydata.dh = dh;

 	return (ISC_R_SUCCESS);

+fail:

+	if (p != bn768 && p != bn1024 && p != bn1536)

+		BN_free(p);

+	if (g != bn2)

+		BN_free(g);

+	DH_free(dh);

+	return ret;

 }

 static isc_result_t

 openssldh_tofile(const dst_key_t *key, const char *directory) {

 	int i;

 	DH *dh;

+	const BIGNUM *p, *g, *pub_key, *priv_key;

 	dst_private_t priv;

 	unsigned char *bufs[4];

 	isc_result_t result;

@@ -482,9 +597,19 @@ openssldh_tofile(const dst_key_t *key, c

 	dh = key->keydata.dh;

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	p = dh->p;

+	g = dh->g;

+	pub_key = dh->pub_key;

+	priv_key = dh->priv_key;

+#else

+	DH_get0_pqg(dh, &p, NULL, &g);

+	DH_get0_key(dh, &pub_key, &priv_key);

+#endif

+

 	memset(bufs, 0, sizeof(bufs));

 	for (i = 0; i < 4; i++) {

-		bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(dh->p));

+		bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(p));

 		if (bufs[i] == NULL) {

 			result = ISC_R_NOMEMORY;

 			goto fail;

@@ -494,26 +619,26 @@ openssldh_tofile(const dst_key_t *key, c

 	i = 0;

 	priv.elements[i].tag = TAG_DH_PRIME;

-	priv.elements[i].length = BN_num_bytes(dh->p);

-	BN_bn2bin(dh->p, bufs[i]);

+	priv.elements[i].length = BN_num_bytes(p);

+	BN_bn2bin(p, bufs[i]);

 	priv.elements[i].data = bufs[i];

 	i++;

 	priv.elements[i].tag = TAG_DH_GENERATOR;

-	priv.elements[i].length = BN_num_bytes(dh->g);

-	BN_bn2bin(dh->g, bufs[i]);

+	priv.elements[i].length = BN_num_bytes(g);

+	BN_bn2bin(g, bufs[i]);

 	priv.elements[i].data = bufs[i];

 	i++;

 	priv.elements[i].tag = TAG_DH_PRIVATE;

-	priv.elements[i].length = BN_num_bytes(dh->priv_key);

-	BN_bn2bin(dh->priv_key, bufs[i]);

+	priv.elements[i].length = BN_num_bytes(priv_key);

+	BN_bn2bin(priv_key, bufs[i]);

 	priv.elements[i].data = bufs[i];

 	i++;

 	priv.elements[i].tag = TAG_DH_PUBLIC;

-	priv.elements[i].length = BN_num_bytes(dh->pub_key);

-	BN_bn2bin(dh->pub_key, bufs[i]);

+	priv.elements[i].length = BN_num_bytes(pub_key);

+	BN_bn2bin(pub_key, bufs[i]);

 	priv.elements[i].data = bufs[i];

 	i++;

@@ -523,7 +648,7 @@ openssldh_tofile(const dst_key_t *key, c

 	for (i = 0; i < 4; i++) {

 		if (bufs[i] == NULL)

 			break;

-		isc_mem_put(key->mctx, bufs[i], BN_num_bytes(dh->p));

+		isc_mem_put(key->mctx, bufs[i], BN_num_bytes(p));

 	}

 	return (result);

 }

@@ -534,6 +659,7 @@ openssldh_parse(dst_key_t *key, isc_lex_

 	isc_result_t ret;

 	int i;

 	DH *dh = NULL;

+	BIGNUM *p = NULL, *g = NULL, *pub_key = NULL, *priv_key = NULL;

 	isc_mem_t *mctx;

 #define DST_RET(a) {ret = a; goto err;}

@@ -551,7 +677,11 @@ openssldh_parse(dst_key_t *key, isc_lex_

 	dh = DH_new();

 	if (dh == NULL)

 		DST_RET(ISC_R_NOMEMORY);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	dh->flags &= ~DH_FLAG_CACHE_MONT_P;

+#else

+	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);

+#endif

 	key->keydata.dh = dh;

 	for (i = 0; i < priv.nelements; i++) {

@@ -563,51 +693,63 @@ openssldh_parse(dst_key_t *key, isc_lex_

 		switch (priv.elements[i].tag) {

 			case TAG_DH_PRIME:

-				dh->p = bn;

+				p = bn;

 				break;

 			case TAG_DH_GENERATOR:

-				dh->g = bn;

+				g = bn;

 				break;

 			case TAG_DH_PRIVATE:

-				dh->priv_key = bn;

+				priv_key = bn;

 				break;

 			case TAG_DH_PUBLIC:

-				dh->pub_key = bn;

+				pub_key = bn;

 				break;

 		}

 	}

 	dst__privstruct_free(&priv, mctx);

-	key->key_size = BN_num_bits(dh->p);

+	key->key_size = BN_num_bits(p);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	if ((key->key_size == 768 ||

 	     key->key_size == 1024 ||

 	     key->key_size == 1536) &&

-	    BN_cmp(dh->g, bn2) == 0)

+	    BN_cmp(g, bn2) == 0)

 	{

-		if (key->key_size == 768 && BN_cmp(dh->p, bn768) == 0) {

-			BN_free(dh->p);

-			BN_free(dh->g);

+		if (key->key_size == 768 && BN_cmp(p, bn768) == 0) {

 			dh->p = bn768;

 			dh->g = bn2;

 		} else if (key->key_size == 1024 &&

-			   BN_cmp(dh->p, bn1024) == 0) {

-			BN_free(dh->p);

-			BN_free(dh->g);

+			   BN_cmp(p, bn1024) == 0) {

 			dh->p = bn1024;

 			dh->g = bn2;

 		} else if (key->key_size == 1536 &&

-			   BN_cmp(dh->p, bn1536) == 0) {

-			BN_free(dh->p);

-			BN_free(dh->g);

+			   BN_cmp(p, bn1536) == 0) {

 			dh->p = bn1536;

 			dh->g = bn2;

+		} else {

+			dh->p = p;

+			dh->g = g;

 		}

+	} else {

+		dh->p = p;

+		dh->g = g;

 	}

-

+	dh->pub_key = pub_key;

+	dh->priv_key = priv_key;

+#else

+	if (p == NULL || g == NULL || pub_key == NULL)

+		DST_RET(ISC_R_NOMEMORY);

+	DH_set0_pqg(dh, p, NULL, g);

+	DH_set0_key(dh, pub_key, priv_key);

+#endif

 	return (ISC_R_SUCCESS);

  err:

+	BN_free(p);

+	BN_free(g);

+	BN_free(pub_key);

+	BN_free(priv_key);

 	openssldh_destroy(key);

 	dst__privstruct_free(&priv, mctx);

 	memset(&priv, 0, sizeof(priv));

--- bind-9.10.4-P3/lib/dns/openssldsa_link.c	2016-09-14 03:23:44.000000000 +0200

+++ bind-9.10.4-P3/lib/dns/openssldsa_link.c	2016-11-07 17:57:34.337237978 +0100

@@ -64,7 +64,7 @@ openssldsa_createctx(dst_key_t *key, dst

 	if (evp_md_ctx == NULL)

 		return (ISC_R_NOMEMORY);

-	if (!EVP_DigestInit_ex(evp_md_ctx, EVP_dss1(), NULL)) {

+	if (!EVP_DigestInit_ex(evp_md_ctx, EVP_sha1(), NULL)) {

 		EVP_MD_CTX_destroy(evp_md_ctx);

 			return (ISC_R_FAILURE);

 	}

@@ -123,7 +123,7 @@ openssldsa_adddata(dst_context_t *dctx,

 }

 static int

-BN_bn2bin_fixed(BIGNUM *bn, unsigned char *buf, int size) {

+BN_bn2bin_fixed(const BIGNUM *bn, unsigned char *buf, int size) {

 	int bytes = size - BN_num_bytes(bn);

 	while (bytes-- > 0)

 		*buf++ = 0;

@@ -137,6 +137,7 @@ openssldsa_sign(dst_context_t *dctx, isc

 	DSA *dsa = key->keydata.dsa;

 	isc_region_t r;

 	DSA_SIG *dsasig;

+	const BIGNUM *dr, *ds;

 	unsigned int klen;

 #if USE_EVP

 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;

@@ -218,9 +219,16 @@ openssldsa_sign(dst_context_t *dctx, isc

 	*r.base = klen;

 	isc_region_consume(&r, 1);

-	BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH);

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

+	dr = dsasig->r;

+	ds = dsasig->s;

+#else

+	DSA_SIG_get0(dsasig, &dr, &ds);

+#endif

+

+	BN_bn2bin_fixed(dr, r.base, ISC_SHA1_DIGESTLENGTH);

 	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);

-	BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH);

+	BN_bn2bin_fixed(ds, r.base, ISC_SHA1_DIGESTLENGTH);

 	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);

 	DSA_SIG_free(dsasig);

 	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);

@@ -235,6 +243,7 @@ openssldsa_verify(dst_context_t *dctx, c

 	int status = 0;

 	unsigned char *cp = sig->base;

 	DSA_SIG *dsasig;

+	BIGNUM *dr = NULL, *ds = NULL;

 #if USE_EVP

 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;

 #if 0

@@ -267,9 +276,21 @@ openssldsa_verify(dst_context_t *dctx, c

 	dsasig = DSA_SIG_new();

 	if (dsasig == NULL)

 		return (ISC_R_NOMEMORY);

-	dsasig->r = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);

+	dr = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);

 	cp += ISC_SHA1_DIGESTLENGTH;

-	dsasig->s = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);

+	ds = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);

+	if (dr == NULL || ds == NULL) {