diff -up openssh/auth-pam.c.openssl openssh/auth-pam.c

--- openssh/auth-pam.c.openssl	2017-09-26 13:19:31.662248869 +0200

+++ openssh/auth-pam.c	2017-09-26 13:19:31.793249672 +0200

@@ -128,6 +128,10 @@ extern u_int utmp_len;

 typedef pthread_t sp_pthread_t;

 #else

 typedef pid_t sp_pthread_t;

+# define pthread_create(a, b, c, d)	_ssh_compat_pthread_create(a, b, c, d)

+# define pthread_exit(a)		_ssh_compat_pthread_exit(a)

+# define pthread_cancel(a)		_ssh_compat_pthread_cancel(a)

+# define pthread_join(a, b)		_ssh_compat_pthread_join(a, b)

 #endif

 struct pam_ctxt {

diff -up openssh/cipher.c.openssl openssh/cipher.c

--- openssh/cipher.c.openssl	2017-09-26 13:19:31.782249605 +0200

+++ openssh/cipher.c	2017-09-26 13:27:37.424040367 +0200

@@ -283,7 +283,7 @@ cipher_init(struct sshcipher_ctx **ccp,

 		ret = SSH_ERR_ALLOC_FAIL;

 		goto out;

 	}

-	if (EVP_CipherInit(cc->evp, type, NULL, (u_char *)iv,

+	if (EVP_CipherInit(cc->evp, type, (u_char *)key, (u_char *)iv,

 	    (do_encrypt == CIPHER_ENCRYPT)) == 0) {

 		ret = SSH_ERR_LIBCRYPTO_ERROR;

 		goto out;

@@ -301,10 +301,6 @@ cipher_init(struct sshcipher_ctx **ccp,

 			goto out;

 		}

 	}

-	if (EVP_CipherInit(cc->evp, NULL, (u_char *)key, NULL, -1) == 0) {

-		ret = SSH_ERR_LIBCRYPTO_ERROR;

-		goto out;

-	}

 	ret = 0;

 #endif /* WITH_OPENSSL */

  out:

@@ -490,7 +486,7 @@ cipher_get_keyiv(struct sshcipher_ctx *c

 		   len, iv))

 		       return SSH_ERR_LIBCRYPTO_ERROR;

 	} else

-		memcpy(iv, cc->evp->iv, len);

+		memcpy(iv, EVP_CIPHER_CTX_iv(cc->evp), len);

 #endif

 	return 0;

 }

@@ -524,14 +520,14 @@ cipher_set_keyiv(struct sshcipher_ctx *c

 		    EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv))

 			return SSH_ERR_LIBCRYPTO_ERROR;

 	} else

-		memcpy(cc->evp->iv, iv, evplen);

+		memcpy(EVP_CIPHER_CTX_iv_noconst(cc->evp), iv, evplen);

 #endif

 	return 0;

 }

 #ifdef WITH_OPENSSL

-#define EVP_X_STATE(evp)	(evp)->cipher_data

-#define EVP_X_STATE_LEN(evp)	(evp)->cipher->ctx_size

+#define EVP_X_STATE(evp)	EVP_CIPHER_CTX_get_cipher_data(evp)

+#define EVP_X_STATE_LEN(evp)	EVP_CIPHER_impl_ctx_size(EVP_CIPHER_CTX_cipher(evp))

 #endif

 int

diff -up openssh/ctr-cavstest.c.openssl openssh/ctr-cavstest.c

--- openssh/ctr-cavstest.c.openssl	2017-09-26 13:19:31.707249145 +0200

+++ openssh/ctr-cavstest.c	2017-09-26 13:19:31.794249679 +0200

@@ -144,7 +144,7 @@ int main (int argc, char *argv[])

                 usage();

         }

-	SSLeay_add_all_algorithms();

+	OpenSSL_add_all_algorithms();

 	c = cipher_by_name(algo);

 	if (c == NULL) {

diff -up openssh/dh.c.openssl openssh/dh.c

--- openssh/dh.c.openssl	2017-09-19 06:26:43.000000000 +0200

+++ openssh/dh.c	2017-09-26 13:19:31.794249679 +0200

@@ -212,14 +212,15 @@ choose_dh(int min, int wantbits, int max

 /* diffie-hellman-groupN-sha1 */

 int

-dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

+dh_pub_is_valid(const DH *dh, const BIGNUM *dh_pub)

 {

 	int i;

 	int n = BN_num_bits(dh_pub);

 	int bits_set = 0;

 	BIGNUM *tmp;

+	const BIGNUM *p;

-	if (dh_pub->neg) {

+	if (BN_is_negative(dh_pub)) {

 		logit("invalid public DH value: negative");

 		return 0;

 	}

@@ -232,7 +233,8 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

 		error("%s: BN_new failed", __func__);

 		return 0;

 	}

-	if (!BN_sub(tmp, dh->p, BN_value_one()) ||

+	DH_get0_pqg(dh, &p, NULL, NULL);

+	if (!BN_sub(tmp, p, BN_value_one()) ||

 	    BN_cmp(dh_pub, tmp) != -1) {		/* pub_exp > p-2 */

 		BN_clear_free(tmp);

 		logit("invalid public DH value: >= p-1");

@@ -243,14 +245,14 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

 	for (i = 0; i <= n; i++)

 		if (BN_is_bit_set(dh_pub, i))

 			bits_set++;

-	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));

+	debug2("bits set: %d/%d", bits_set, BN_num_bits(p));

 	/*

 	 * if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial

 	 */

 	if (bits_set < 4) {

 		logit("invalid public DH value (%d/%d)",

-		   bits_set, BN_num_bits(dh->p));

+		   bits_set, BN_num_bits(p));

 		return 0;

 	}

 	return 1;

@@ -260,9 +262,11 @@ int

 dh_gen_key(DH *dh, int need)

 {

 	int pbits;

+	const BIGNUM *p, *pub_key;

-	if (need < 0 || dh->p == NULL ||

-	    (pbits = BN_num_bits(dh->p)) <= 0 ||

+	DH_get0_pqg(dh, &p, NULL, NULL);

+	if (need < 0 || p == NULL ||

+	    (pbits = BN_num_bits(p)) <= 0 ||

 	    need > INT_MAX / 2 || 2 * need > pbits)

 		return SSH_ERR_INVALID_ARGUMENT;

 	if (need < 256)

@@ -271,11 +275,11 @@ dh_gen_key(DH *dh, int need)

 	 * Pollard Rho, Big step/Little Step attacks are O(sqrt(n)),

 	 * so double requested need here.

 	 */

-	dh->length = MINIMUM(need * 2, pbits - 1);

-	if (DH_generate_key(dh) == 0 ||

-	    !dh_pub_is_valid(dh, dh->pub_key)) {

-		BN_clear_free(dh->priv_key);

-		dh->priv_key = NULL;

+	DH_set_length(dh, MINIMUM(need * 2, pbits - 1));

+	if (DH_generate_key(dh) == 0)

+		return SSH_ERR_LIBCRYPTO_ERROR;

+	DH_get0_key(dh, &pub_key, NULL);

+	if (!dh_pub_is_valid(dh, pub_key)) {

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	}

 	return 0;

@@ -284,15 +289,22 @@ DH *

 dh_new_group_asc(const char *gen, const char *modulus)

 {

 	DH *dh;

+	BIGNUM *p = NULL, *g = NULL;

-	if ((dh = DH_new()) == NULL)

-		return NULL;

-	if (BN_hex2bn(&dh->p, modulus) == 0 ||

-	    BN_hex2bn(&dh->g, gen) == 0) {

-		DH_free(dh);

-		return NULL;

-	}

+	if ((dh = DH_new()) == NULL ||

+	    (p = BN_new()) == NULL ||

+	    (g = BN_new()) == NULL)

+		goto err;

+	if (BN_hex2bn(&p, modulus) == 0 ||

+	    BN_hex2bn(&g, gen) == 0 ||

+	    DH_set0_pqg(dh, p, NULL, g) == 0)

+		goto err;

 	return (dh);

+err:

+	DH_free(dh);

+	BN_free(p);

+	BN_free(g);

+	return NULL;

 }

 /*

@@ -307,8 +319,7 @@ dh_new_group(BIGNUM *gen, BIGNUM *modulu

 	if ((dh = DH_new()) == NULL)

 		return NULL;

-	dh->p = modulus;

-	dh->g = gen;

+	DH_set0_pqg(dh, modulus, NULL, gen);

 	return (dh);

 }

diff -up openssh/dh.h.openssl openssh/dh.h

--- openssh/dh.h.openssl	2017-09-26 13:19:31.783249611 +0200

+++ openssh/dh.h	2017-09-26 13:19:31.794249679 +0200

@@ -42,7 +42,7 @@ DH	*dh_new_group18(void);

 DH	*dh_new_group_fallback(int);

 int	 dh_gen_key(DH *, int);

-int	 dh_pub_is_valid(DH *, BIGNUM *);

+int	 dh_pub_is_valid(const DH *, const BIGNUM *);

 u_int	 dh_estimate(int);

diff -up openssh/digest-openssl.c.openssl openssh/digest-openssl.c

--- openssh/digest-openssl.c.openssl	2017-09-19 06:26:43.000000000 +0200

+++ openssh/digest-openssl.c	2017-09-26 13:19:31.795249685 +0200

@@ -43,7 +43,7 @@

 struct ssh_digest_ctx {

 	int alg;

-	EVP_MD_CTX mdctx;

+	EVP_MD_CTX *mdctx;

 };

 struct ssh_digest {

@@ -106,7 +106,7 @@ ssh_digest_bytes(int alg)

 size_t

 ssh_digest_blocksize(struct ssh_digest_ctx *ctx)

 {

-	return EVP_MD_CTX_block_size(&ctx->mdctx);

+	return EVP_MD_CTX_block_size(ctx->mdctx);

 }

 struct ssh_digest_ctx *

@@ -118,8 +118,10 @@ ssh_digest_start(int alg)

 	if (digest == NULL || ((ret = calloc(1, sizeof(*ret))) == NULL))

 		return NULL;

 	ret->alg = alg;

-	EVP_MD_CTX_init(&ret->mdctx);

-	if (EVP_DigestInit_ex(&ret->mdctx, digest->mdfunc(), NULL) != 1) {

+	ret->mdctx = EVP_MD_CTX_new();

+	if (ret->mdctx == NULL ||

+	    EVP_DigestInit_ex(ret->mdctx, digest->mdfunc(), NULL) != 1) {

+		EVP_MD_CTX_free(ret->mdctx);

 		free(ret);

 		return NULL;

 	}

@@ -132,7 +133,7 @@ ssh_digest_copy_state(struct ssh_digest_

 	if (from->alg != to->alg)

 		return SSH_ERR_INVALID_ARGUMENT;

 	/* we have bcopy-style order while openssl has memcpy-style */

-	if (!EVP_MD_CTX_copy_ex(&to->mdctx, &from->mdctx))

+	if (!EVP_MD_CTX_copy_ex(to->mdctx, from->mdctx))

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	return 0;

 }

@@ -140,7 +141,7 @@ ssh_digest_copy_state(struct ssh_digest_

 int

 ssh_digest_update(struct ssh_digest_ctx *ctx, const void *m, size_t mlen)

 {

-	if (EVP_DigestUpdate(&ctx->mdctx, m, mlen) != 1)

+	if (EVP_DigestUpdate(ctx->mdctx, m, mlen) != 1)

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	return 0;

 }

@@ -161,7 +162,7 @@ ssh_digest_final(struct ssh_digest_ctx *

 		return SSH_ERR_INVALID_ARGUMENT;

 	if (dlen < digest->digest_len) /* No truncation allowed */

 		return SSH_ERR_INVALID_ARGUMENT;

-	if (EVP_DigestFinal_ex(&ctx->mdctx, d, &l) != 1)

+	if (EVP_DigestFinal_ex(ctx->mdctx, d, &l) != 1)

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	if (l != digest->digest_len) /* sanity */

 		return SSH_ERR_INTERNAL_ERROR;

@@ -172,7 +173,7 @@ void

 ssh_digest_free(struct ssh_digest_ctx *ctx)

 {

 	if (ctx != NULL) {

-		EVP_MD_CTX_cleanup(&ctx->mdctx);

+		EVP_MD_CTX_free(ctx->mdctx);

 		explicit_bzero(ctx, sizeof(*ctx));

 		free(ctx);

 	}

diff -up openssh/entropy.c.openssl openssh/entropy.c

--- openssh/entropy.c.openssl	2017-09-26 13:19:31.783249611 +0200

+++ openssh/entropy.c	2017-09-26 13:19:31.795249685 +0200

@@ -218,7 +218,9 @@ seed_rng(void)

 		    "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());

 	/* clean the PRNG status when exiting the program */

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	atexit(RAND_cleanup);

+#endif

 #ifndef OPENSSL_PRNG_ONLY

 	if (RAND_status() == 1) {

diff -up openssh/gss-genr.c.openssl openssh/gss-genr.c

--- openssh/gss-genr.c.openssl	2017-09-26 13:19:31.773249550 +0200

+++ openssh/gss-genr.c	2017-09-26 13:19:31.796249691 +0200

@@ -99,7 +99,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 	u_char digest[EVP_MAX_MD_SIZE];

 	char deroid[2];

 	const EVP_MD *evp_md = EVP_md5();

-	EVP_MD_CTX md;

+	EVP_MD_CTX *md;

 	char *s, *cp, *p;

 	if (gss_enc2oid != NULL) {

@@ -113,6 +113,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 	if ((buf = sshbuf_new()) == NULL)

 		fatal("%s: sshbuf_new failed", __func__);

+	md = EVP_MD_CTX_new();

 	oidpos = 0;

 	s = cp = xstrdup(kex);

 	for (i = 0; i < gss_supported->count; i++) {

@@ -122,12 +123,13 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 			deroid[0] = SSH_GSS_OIDTYPE;

 			deroid[1] = gss_supported->elements[i].length;

-			EVP_DigestInit(&md, evp_md);

-			EVP_DigestUpdate(&md, deroid, 2);

-			EVP_DigestUpdate(&md,

+			EVP_MD_CTX_reset(md);

+			EVP_DigestInit(md, evp_md);

+			EVP_DigestUpdate(md, deroid, 2);

+			EVP_DigestUpdate(md,

 			    gss_supported->elements[i].elements,

 			    gss_supported->elements[i].length);

-			EVP_DigestFinal(&md, digest, NULL);

+			EVP_DigestFinal(md, digest, NULL);

 			encoded = xmalloc(EVP_MD_size(evp_md) * 2);

 			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),

@@ -149,6 +151,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 		}

 	}

 	free(s);

+	EVP_MD_CTX_free(md);

 	gss_enc2oid[oidpos].oid = NULL;

 	gss_enc2oid[oidpos].encoded = NULL;

diff -up openssh/includes.h.openssl openssh/includes.h

--- openssh/includes.h.openssl	2017-09-19 06:26:43.000000000 +0200

+++ openssh/includes.h	2017-09-26 13:19:31.796249691 +0200

@@ -166,6 +166,7 @@

 #ifdef WITH_OPENSSL

 #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */

+#include "libcrypto-compat.h"

 #endif

 #include "defines.h"

diff -up openssh/kexdhc.c.openssl openssh/kexdhc.c

--- openssh/kexdhc.c.openssl	2017-09-19 06:26:43.000000000 +0200

+++ openssh/kexdhc.c	2017-09-26 13:19:31.797249697 +0200

@@ -56,6 +56,7 @@ kexdh_client(struct ssh *ssh)

 {

 	struct kex *kex = ssh->kex;

 	int r;

+	const BIGNUM *pub_key;

 	/* generate and send 'e', client DH public key */

 	switch (kex->kex_type) {

@@ -81,21 +82,27 @@ kexdh_client(struct ssh *ssh)

 		goto out;

 	}

 	debug("sending SSH2_MSG_KEXDH_INIT");

-	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||

-	    (r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||

+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)

+		goto out;

+	DH_get0_key(kex->dh, &pub_key, NULL);

+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

 #ifdef DEBUG_KEXDH

 	DHparams_print_fp(stderr, kex->dh);

 	fprintf(stderr, "pub= ");

-	BN_print_fp(stderr, kex->dh->pub_key);

+	BN_print_fp(stderr, pub_key);

 	fprintf(stderr, "\n");

 #endif

 	debug("expecting SSH2_MSG_KEXDH_REPLY");

 	ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_REPLY, &input_kex_dh);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -109,6 +116,7 @@ input_kex_dh(int type, u_int32_t seq, st

 	u_char hash[SSH_DIGEST_MAX_LENGTH];

 	size_t klen = 0, slen, sbloblen, hashlen;

 	int kout, r;

+	const BIGNUM *pub_key;

 	if (kex->verify_host_key == NULL) {

 		r = SSH_ERR_INVALID_ARGUMENT;

@@ -168,6 +176,7 @@ input_kex_dh(int type, u_int32_t seq, st

 #endif

 	/* calc and verify H */

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	hashlen = sizeof(hash);

 	if ((r = kex_dh_hash(

 	    kex->hash_alg,

@@ -176,7 +185,7 @@ input_kex_dh(int type, u_int32_t seq, st

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),

 	    server_host_key_blob, sbloblen,

-	    kex->dh->pub_key,

+	    pub_key,

 	    dh_server_pub,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

diff -up openssh/kexdhs.c.openssl openssh/kexdhs.c

--- openssh/kexdhs.c.openssl	2017-09-19 06:26:43.000000000 +0200

+++ openssh/kexdhs.c	2017-09-26 13:19:31.797249697 +0200

@@ -87,6 +87,10 @@ kexdh_server(struct ssh *ssh)

 	ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_INIT, &input_kex_dh_init);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -101,6 +105,7 @@ input_kex_dh_init(int type, u_int32_t se

 	size_t sbloblen, slen;

 	size_t klen = 0, hashlen;

 	int kout, r;

+	const BIGNUM *pub_key;

 	if (kex->load_host_public_key == NULL ||

 	    kex->load_host_private_key == NULL) {

@@ -163,6 +168,7 @@ input_kex_dh_init(int type, u_int32_t se

 		goto out;

 	/* calc H */

 	hashlen = sizeof(hash);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	if ((r = kex_dh_hash(

 	    kex->hash_alg,

 	    kex->client_version_string,

@@ -171,7 +177,7 @@ input_kex_dh_init(int type, u_int32_t se

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    server_host_key_blob, sbloblen,

 	    dh_client_pub,

-	    kex->dh->pub_key,

+	    pub_key,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

 		goto out;

@@ -197,7 +203,7 @@ input_kex_dh_init(int type, u_int32_t se

 	/* send server hostkey, DH pubkey 'f' and signed H */

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||

 	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||	/* f */

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||	/* f */

 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

diff -up openssh/kexgexc.c.openssl openssh/kexgexc.c

--- openssh/kexgexc.c.openssl	2017-09-26 13:19:31.783249611 +0200

+++ openssh/kexgexc.c	2017-09-26 13:19:31.797249697 +0200

@@ -95,6 +95,7 @@ input_kex_dh_gex_group(int type, u_int32

 	struct kex *kex = ssh->kex;

 	BIGNUM *p = NULL, *g = NULL;

 	int r, bits;

+	const BIGNUM *pub_key;

 	debug("got SSH2_MSG_KEX_DH_GEX_GROUP");

@@ -119,24 +120,30 @@ input_kex_dh_gex_group(int type, u_int32

 	p = g = NULL; /* belong to kex->dh now */

 	/* generate and send 'e', client DH public key */

-	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||

-	    (r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||

+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)

+		goto out;

+	DH_get0_key(kex->dh, &pub_key, NULL);

+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

 	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");

 #ifdef DEBUG_KEXDH

 	DHparams_print_fp(stderr, kex->dh);

 	fprintf(stderr, "pub= ");

-	BN_print_fp(stderr, kex->dh->pub_key);

+	BN_print_fp(stderr, pub_key);

 	fprintf(stderr, "\n");

 #endif

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP, NULL);

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &input_kex_dh_gex_reply);

 	r = 0;

 out:

 	BN_clear_free(p);

 	BN_clear_free(g);

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -152,6 +157,7 @@ input_kex_dh_gex_reply(int type, u_int32

 	u_char hash[SSH_DIGEST_MAX_LENGTH];

 	size_t klen = 0, slen, sbloblen, hashlen;

 	int kout, r;

+	const BIGNUM *p, *g, *pub_key;

 	debug("got SSH2_MSG_KEX_DH_GEX_REPLY");

 	if (kex->verify_host_key == NULL) {

@@ -214,6 +220,8 @@ input_kex_dh_gex_reply(int type, u_int32

 		kex->min = kex->max = -1;

 	/* calc and verify H */

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	hashlen = sizeof(hash);

 	if ((r = kexgex_hash(

 	    kex->hash_alg,

@@ -223,8 +231,8 @@ input_kex_dh_gex_reply(int type, u_int32

 	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),

 	    server_host_key_blob, sbloblen,

 	    kex->min, kex->nbits, kex->max,

-	    kex->dh->p, kex->dh->g,

-	    kex->dh->pub_key,

+	    p, g,

+	    pub_key,

 	    dh_server_pub,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

diff -up openssh/kexgexs.c.openssl openssh/kexgexs.c

--- openssh/kexgexs.c.openssl	2017-09-26 13:19:31.783249611 +0200

+++ openssh/kexgexs.c	2017-09-26 13:19:31.797249697 +0200

@@ -72,6 +72,7 @@ input_kex_dh_gex_request(int type, u_int

 	struct kex *kex = ssh->kex;

 	int r;

 	u_int min = 0, max = 0, nbits = 0;

+	const BIGNUM *p, *g;

 	debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");

 	if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||

@@ -101,9 +102,10 @@ input_kex_dh_gex_request(int type, u_int

 		goto out;

 	}

 	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->p)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->g)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, p)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, g)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

@@ -115,6 +117,10 @@ input_kex_dh_gex_request(int type, u_int

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -129,6 +135,7 @@ input_kex_dh_gex_init(int type, u_int32_

 	size_t sbloblen, slen;

 	size_t klen = 0, hashlen;

 	int kout, r;

+	const BIGNUM *p, *g, *pub_key;

 	if (kex->load_host_public_key == NULL ||

 	    kex->load_host_private_key == NULL) {

@@ -191,6 +198,8 @@ input_kex_dh_gex_init(int type, u_int32_

 		goto out;

 	/* calc H */

 	hashlen = sizeof(hash);

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	if ((r = kexgex_hash(

 	    kex->hash_alg,

 	    kex->client_version_string,

@@ -199,9 +208,9 @@ input_kex_dh_gex_init(int type, u_int32_

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    server_host_key_blob, sbloblen,

 	    kex->min, kex->nbits, kex->max,

-	    kex->dh->p, kex->dh->g,

+	    p, g,

 	    dh_client_pub,

-	    kex->dh->pub_key,

+	    pub_key,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

 		goto out;

@@ -227,7 +236,7 @@ input_kex_dh_gex_init(int type, u_int32_

 	/* send server hostkey, DH pubkey 'f' and signed H */

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||

 	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||     /* f */

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||     /* f */

 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

diff -up openssh/kexgssc.c.openssl openssh/kexgssc.c

--- openssh/kexgssc.c.openssl	2017-09-26 13:19:31.771249537 +0200

+++ openssh/kexgssc.c	2017-09-26 13:19:31.797249697 +0200

@@ -59,6 +59,7 @@ kexgss_client(struct ssh *ssh) {

 	BIGNUM *shared_secret = NULL;

 	BIGNUM *p = NULL;

 	BIGNUM *g = NULL;	

+	const BIGNUM *pub_key, *p1, *g1;

 	u_char *kbuf;

 	u_char *serverhostkey = NULL;

 	u_char *empty = "";

@@ -126,6 +127,7 @@ kexgss_client(struct ssh *ssh) {

 	/* Step 1 - e is dh->pub_key */

 	dh_gen_key(dh, ssh->kex->we_need * 8);

+	DH_get0_key(dh, &pub_key, NULL);

 	/* This is f, we initialise it now to make life easier */

 	dh_server_pub = BN_new();

@@ -173,7 +175,7 @@ kexgss_client(struct ssh *ssh) {

 				packet_start(SSH2_MSG_KEXGSS_INIT);

 				packet_put_string(send_tok.value,

 				    send_tok.length);

-				packet_put_bignum2(dh->pub_key);

+				packet_put_bignum2((BIGNUM *)pub_key);

 				first = 0;

 			} else {

 				packet_start(SSH2_MSG_KEXGSS_CONTINUE);

@@ -282,13 +284,14 @@ kexgss_client(struct ssh *ssh) {

 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),

 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),

 		    (serverhostkey ? serverhostkey : empty), slen,

-		    dh->pub_key,	/* e */

+		    pub_key,		/* e */

 		    dh_server_pub,	/* f */

 		    shared_secret,	/* K */

 		    hash, &hashlen

 		);

 		break;

 	case KEX_GSS_GEX_SHA1:

+		DH_get0_pqg(dh, &p1, NULL, &g1;;

 		kexgex_hash(

 		    ssh->kex->hash_alg,

 		    ssh->kex->client_version_string,

@@ -297,8 +300,8 @@ kexgss_client(struct ssh *ssh) {

 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),

 		    (serverhostkey ? serverhostkey : empty), slen,

  		    min, nbits, max,

-		    dh->p, dh->g,

-		    dh->pub_key,

+		    p1, g1,

+		    pub_key,

 		    dh_server_pub,

 		    shared_secret,

 		    hash, &hashlen

diff -up openssh/kexgsss.c.openssl openssh/kexgsss.c

--- openssh/kexgsss.c.openssl	2017-09-26 13:19:31.771249537 +0200

+++ openssh/kexgsss.c	2017-09-26 13:19:31.798249703 +0200

@@ -78,6 +78,7 @@ kexgss_server(struct ssh *ssh)

 	char *mechs;

 	u_char hash[SSH_DIGEST_MAX_LENGTH];

 	size_t hashlen;

+	const BIGNUM *p, *g, *pub_key;

 	/* Initialise GSSAPI */

@@ -127,9 +128,10 @@ kexgss_server(struct ssh *ssh)

 		if (dh == NULL)

 			packet_disconnect("Protocol error: no matching group found");

+		DH_get0_pqg(dh, &p, NULL, &g);

 		packet_start(SSH2_MSG_KEXGSS_GROUP);

-		packet_put_bignum2(dh->p);

-		packet_put_bignum2(dh->g);

+		packet_put_bignum2((BIGNUM *)p);

+		packet_put_bignum2((BIGNUM *)g);

 		packet_send();

 		packet_write_wait();

@@ -221,6 +223,7 @@ kexgss_server(struct ssh *ssh)

 	memset(kbuf, 0, klen);

 	free(kbuf);

+	DH_get0_key(dh, &pub_key, NULL);

 	hashlen = sizeof(hash);

 	switch (ssh->kex->kex_type) {

 	case KEX_GSS_GRP1_SHA1:

@@ -232,7 +235,7 @@ kexgss_server(struct ssh *ssh)

 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),

 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),

 		    NULL, 0, /* Change this if we start sending host keys */

-		    dh_client_pub, dh->pub_key, shared_secret,

+		    dh_client_pub, pub_key, shared_secret,

 		    hash, &hashlen

 		);

 		break;

@@ -244,9 +247,9 @@ kexgss_server(struct ssh *ssh)

 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),

 		    NULL, 0,

 		    cmin, nbits, cmax,

-		    dh->p, dh->g,

+		    p, g,

 		    dh_client_pub,

-		    dh->pub_key,

+		    pub_key,

 		    shared_secret,

 		    hash, &hashlen

 		);

@@ -270,7 +273,7 @@ kexgss_server(struct ssh *ssh)