diff -up openssh-7.4p1/authfd.c.openssl openssh-7.4p1/authfd.c

--- openssh-7.4p1/authfd.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/authfd.c	2016-12-23 17:47:36.429817751 +0100

@@ -207,15 +207,22 @@ deserialise_identity1(struct sshbuf *ids

 	int r, keybits;

 	u_int32_t bits;

 	char *comment = NULL;

+	BIGNUM *e = NULL, *n = NULL;

 	if ((key = sshkey_new(KEY_RSA1)) == NULL)

 		return SSH_ERR_ALLOC_FAIL;

-	if ((r = sshbuf_get_u32(ids, &bits)) != 0 ||

-	    (r = sshbuf_get_bignum1(ids, key->rsa->e)) != 0 ||

-	    (r = sshbuf_get_bignum1(ids, key->rsa->n)) != 0 ||

-	    (r = sshbuf_get_cstring(ids, &comment, NULL)) != 0)

+	if ((e = BN_new()) == NULL ||

+	    (n = BN_new()) == NULL ||

+	    (r = sshbuf_get_u32(ids, &bits)) != 0 ||

+	    (r = sshbuf_get_bignum1(ids, e)) != 0 ||

+	    (r = sshbuf_get_bignum1(ids, n)) != 0 ||

+	    (RSA_set0_key(key->rsa, n, e, NULL) == 0) ||

+	    (r = sshbuf_get_cstring(ids, &comment, NULL)) != 0) {

+		BN_free(n);

+		BN_free(e);

 		goto out;

-	keybits = BN_num_bits(key->rsa->n);

+	}

+	keybits = BN_num_bits(n);

 	/* XXX previously we just warned here. I think we should be strict */

 	if (keybits < 0 || bits != (u_int)keybits) {

 		r = SSH_ERR_KEY_BITS_MISMATCH;

@@ -393,15 +400,17 @@ ssh_decrypt_challenge(int sock, struct s

 	struct sshbuf *msg;

 	int r;

 	u_char type;

+	const BIGNUM *e, *n;

 	if (key->type != KEY_RSA1)

 		return SSH_ERR_INVALID_ARGUMENT;

 	if ((msg = sshbuf_new()) == NULL)

 		return SSH_ERR_ALLOC_FAIL;

+	RSA_get0_key(key->rsa, &n, &e, NULL);

 	if ((r = sshbuf_put_u8(msg, SSH_AGENTC_RSA_CHALLENGE)) != 0 ||

-	    (r = sshbuf_put_u32(msg, BN_num_bits(key->rsa->n))) != 0 ||

-	    (r = sshbuf_put_bignum1(msg, key->rsa->e)) != 0 ||

-	    (r = sshbuf_put_bignum1(msg, key->rsa->n)) != 0 ||

+	    (r = sshbuf_put_u32(msg, BN_num_bits(n))) != 0 ||

+	    (r = sshbuf_put_bignum1(msg, e)) != 0 ||

+	    (r = sshbuf_put_bignum1(msg, n)) != 0 ||

 	    (r = sshbuf_put_bignum1(msg, challenge)) != 0 ||

 	    (r = sshbuf_put(msg, session_id, 16)) != 0 ||

 	    (r = sshbuf_put_u32(msg, 1)) != 0) /* Response type for proto 1.1 */

@@ -499,15 +508,19 @@ static int

 ssh_encode_identity_rsa1(struct sshbuf *b, RSA *key, const char *comment)

 {

 	int r;

+	const BIGNUM *n, *e, *d, *q, *p, *iqmp;

+	RSA_get0_key(key, &n, &e, &d);

+	RSA_get0_factors(key, &p, &q);

+	RSA_get0_crt_params(key, NULL, NULL, &iqmp);

 	/* To keep within the protocol: p < q for ssh. in SSL p > q */

-	if ((r = sshbuf_put_u32(b, BN_num_bits(key->n))) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->n)) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->e)) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->d)) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->iqmp)) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->q)) != 0 ||

-	    (r = sshbuf_put_bignum1(b, key->p)) != 0 ||

+	if ((r = sshbuf_put_u32(b, BN_num_bits(n))) != 0 ||

+	    (r = sshbuf_put_bignum1(b, n)) != 0 ||

+	    (r = sshbuf_put_bignum1(b, e)) != 0 ||

+	    (r = sshbuf_put_bignum1(b, d)) != 0 ||

+	    (r = sshbuf_put_bignum1(b, iqmp)) != 0 ||

+	    (r = sshbuf_put_bignum1(b, q)) != 0 ||

+	    (r = sshbuf_put_bignum1(b, p)) != 0 ||

 	    (r = sshbuf_put_cstring(b, comment)) != 0)

 		return r;

 	return 0;

@@ -622,11 +635,13 @@ ssh_remove_identity(int sock, struct ssh

 #ifdef WITH_SSH1

 	if (key->type == KEY_RSA1) {

+		const BIGNUM *e, *n;

+		RSA_get0_key(key->rsa, &n, &e, NULL);

 		if ((r = sshbuf_put_u8(msg,

 		    SSH_AGENTC_REMOVE_RSA_IDENTITY)) != 0 ||

-		    (r = sshbuf_put_u32(msg, BN_num_bits(key->rsa->n))) != 0 ||

-		    (r = sshbuf_put_bignum1(msg, key->rsa->e)) != 0 ||

-		    (r = sshbuf_put_bignum1(msg, key->rsa->n)) != 0)

+		    (r = sshbuf_put_u32(msg, BN_num_bits(n))) != 0 ||

+		    (r = sshbuf_put_bignum1(msg, e)) != 0 ||

+		    (r = sshbuf_put_bignum1(msg, n)) != 0)

 			goto out;

 	} else

 #endif

diff -up openssh-7.4p1/auth-pam.c.openssl openssh-7.4p1/auth-pam.c

--- openssh-7.4p1/auth-pam.c.openssl	2016-12-23 17:47:36.400817739 +0100

+++ openssh-7.4p1/auth-pam.c	2016-12-23 17:47:36.430817752 +0100

@@ -129,6 +129,10 @@ extern u_int utmp_len;

 typedef pthread_t sp_pthread_t;

 #else

 typedef pid_t sp_pthread_t;

+# define pthread_create(a, b, c, d)	_ssh_compat_pthread_create(a, b, c, d)

+# define pthread_exit(a)		_ssh_compat_pthread_exit(a)

+# define pthread_cancel(a)		_ssh_compat_pthread_cancel(a)

+# define pthread_join(a, b)		_ssh_compat_pthread_join(a, b)

 #endif

 struct pam_ctxt {

diff -up openssh-7.4p1/cipher-3des1.c.openssl openssh-7.4p1/cipher-3des1.c

--- openssh-7.4p1/cipher-3des1.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/cipher-3des1.c	2016-12-23 17:47:36.430817752 +0100

@@ -44,7 +44,7 @@

  */

 struct ssh1_3des_ctx

 {

-	EVP_CIPHER_CTX	k1, k2, k3;

+	EVP_CIPHER_CTX	*k1, *k2, *k3;

 };

 const EVP_CIPHER * evp_ssh1_3des(void);

@@ -65,7 +65,7 @@ ssh1_3des_init(EVP_CIPHER_CTX *ctx, cons

 	if (key == NULL)

 		return 1;

 	if (enc == -1)

-		enc = ctx->encrypt;

+		enc = EVP_CIPHER_CTX_encrypting(ctx);

 	k1 = k2 = k3 = (u_char *) key;

 	k2 += 8;

 	if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) {

@@ -74,12 +74,19 @@ ssh1_3des_init(EVP_CIPHER_CTX *ctx, cons

 		else

 			k1 += 16;

 	}

-	EVP_CIPHER_CTX_init(&c->k1);

-	EVP_CIPHER_CTX_init(&c->k2);

-	EVP_CIPHER_CTX_init(&c->k3);

-	if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||

-	    EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||

-	    EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {

+	c->k1 = EVP_CIPHER_CTX_new();

+	c->k2 = EVP_CIPHER_CTX_new();

+	c->k3 = EVP_CIPHER_CTX_new();

+	if (c->k1 == NULL || c->k2 == NULL || c->k3 == NULL) {

+		EVP_CIPHER_CTX_free(c->k1);

+		EVP_CIPHER_CTX_free(c->k2);

+		EVP_CIPHER_CTX_free(c->k3);

+		free(c);

+		return 0;

+	}

+	if (EVP_CipherInit(c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||

+	    EVP_CipherInit(c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||

+	    EVP_CipherInit(c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {

 		explicit_bzero(c, sizeof(*c));

 		free(c);

 		EVP_CIPHER_CTX_set_app_data(ctx, NULL);

@@ -95,9 +102,9 @@ ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_cha

 	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL)

 		return 0;

-	if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 ||

-	    EVP_Cipher(&c->k2, dest, dest, len) == 0 ||

-	    EVP_Cipher(&c->k3, dest, dest, len) == 0)

+	if (EVP_Cipher(c->k1, dest, (u_char *)src, len) == 0 ||

+	    EVP_Cipher(c->k2, dest, dest, len) == 0 ||

+	    EVP_Cipher(c->k3, dest, dest, len) == 0)

 		return 0;

 	return 1;

 }

@@ -108,9 +115,9 @@ ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx)

 	struct ssh1_3des_ctx *c;

 	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {

-		EVP_CIPHER_CTX_cleanup(&c->k1);

-		EVP_CIPHER_CTX_cleanup(&c->k2);

-		EVP_CIPHER_CTX_cleanup(&c->k3);

+		EVP_CIPHER_CTX_free(c->k1);

+		EVP_CIPHER_CTX_free(c->k2);

+		EVP_CIPHER_CTX_free(c->k3);

 		explicit_bzero(c, sizeof(*c));

 		free(c);

 		EVP_CIPHER_CTX_set_app_data(ctx, NULL);

@@ -128,13 +135,13 @@ ssh1_3des_iv(EVP_CIPHER_CTX *evp, int do

 	if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)

 		return SSH_ERR_INTERNAL_ERROR;

 	if (doset) {

-		memcpy(c->k1.iv, iv, 8);

-		memcpy(c->k2.iv, iv + 8, 8);

-		memcpy(c->k3.iv, iv + 16, 8);

+		memcpy(EVP_CIPHER_CTX_iv_noconst(c->k1), iv, 8);

+		memcpy(EVP_CIPHER_CTX_iv_noconst(c->k2), iv + 8, 8);

+		memcpy(EVP_CIPHER_CTX_iv_noconst(c->k3), iv + 16, 8);

 	} else {

-		memcpy(iv, c->k1.iv, 8);

-		memcpy(iv + 8, c->k2.iv, 8);

-		memcpy(iv + 16, c->k3.iv, 8);

+		memcpy(iv, EVP_CIPHER_CTX_iv(c->k1), 8);

+		memcpy(iv + 8, EVP_CIPHER_CTX_iv(c->k2), 8);

+		memcpy(iv + 16, EVP_CIPHER_CTX_iv(c->k3), 8);

 	}

 	return 0;

 }

@@ -142,17 +149,14 @@ ssh1_3des_iv(EVP_CIPHER_CTX *evp, int do

 const EVP_CIPHER *

 evp_ssh1_3des(void)

 {

-	static EVP_CIPHER ssh1_3des;

+	EVP_CIPHER *ssh1_3des;

-	memset(&ssh1_3des, 0, sizeof(ssh1_3des));

-	ssh1_3des.nid = NID_undef;

-	ssh1_3des.block_size = 8;

-	ssh1_3des.iv_len = 0;

-	ssh1_3des.key_len = 16;

-	ssh1_3des.init = ssh1_3des_init;

-	ssh1_3des.cleanup = ssh1_3des_cleanup;

-	ssh1_3des.do_cipher = ssh1_3des_cbc;

-	ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH;

-	return &ssh1_3des;

+	ssh1_3des = EVP_CIPHER_meth_new(NID_undef, 8, 16);

+	EVP_CIPHER_meth_set_iv_length(ssh1_3des, 0);

+	EVP_CIPHER_meth_set_init(ssh1_3des, ssh1_3des_init);

+	EVP_CIPHER_meth_set_cleanup(ssh1_3des, ssh1_3des_cleanup);

+	EVP_CIPHER_meth_set_do_cipher(ssh1_3des, ssh1_3des_cbc);

+	EVP_CIPHER_meth_set_flags(ssh1_3des, EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH);

+	return ssh1_3des;

 }

 #endif /* WITH_SSH1 */

diff -up openssh-7.4p1/cipher-bf1.c.openssl openssh-7.4p1/cipher-bf1.c

--- openssh-7.4p1/cipher-bf1.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/cipher-bf1.c	2016-12-23 17:47:36.430817752 +0100

@@ -89,17 +89,28 @@ bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_ch

 const EVP_CIPHER *

 evp_ssh1_bf(void)

 {

-	static EVP_CIPHER ssh1_bf;

+	EVP_CIPHER *ssh1_bf;

-	memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER));

-	orig_bf = ssh1_bf.do_cipher;

-	ssh1_bf.nid = NID_undef;

+	orig_bf = EVP_CIPHER_meth_get_do_cipher(EVP_bf_cbc());

+	/* block_size, length, flags from openssl/crypto/engine/eng_cryptodev.c:638 */

+	ssh1_bf = EVP_CIPHER_meth_new(NID_undef, 8, 32);

+	EVP_CIPHER_meth_set_iv_length(ssh1_bf, 8);

+	EVP_CIPHER_meth_set_flags(ssh1_bf, EVP_CIPH_CBC_MODE);

 #ifdef SSH_OLD_EVP

-	ssh1_bf.init = bf_ssh1_init;

+	EVP_CIPHER_meth_set_init(ssh1_bf, ssh1_bf_init);

+#else

+	EVP_CIPHER_meth_set_init(ssh1_bf,

+	    EVP_CIPHER_meth_get_init(EVP_bf_cbc()));

 #endif

-	ssh1_bf.do_cipher = bf_ssh1_cipher;

-	ssh1_bf.key_len = 32;

-	return (&ssh1_bf);

+	/* copy methods and parameters from old EVP_BF_cbc()

+	 * meth_dup does not allow to change type and key_len */

+	EVP_CIPHER_meth_set_cleanup(ssh1_bf,

+	    EVP_CIPHER_meth_get_cleanup(EVP_bf_cbc()));

+	EVP_CIPHER_meth_set_ctrl(ssh1_bf,

+	    EVP_CIPHER_meth_get_ctrl(EVP_bf_cbc()));

+	/* ASN1 params??? */

+	EVP_CIPHER_meth_set_do_cipher(ssh1_bf, bf_ssh1_cipher);

+	return ssh1_bf;

 }

 #endif /* defined(WITH_OPENSSL) && !defined(OPENSSL_NO_BF) */

diff -up openssh-7.4p1/cipher.c.openssl openssh-7.4p1/cipher.c

--- openssh-7.4p1/cipher.c.openssl	2016-12-23 17:47:36.418817747 +0100

+++ openssh-7.4p1/cipher.c	2016-12-23 17:47:36.430817752 +0100

@@ -368,7 +368,7 @@ cipher_init(struct sshcipher_ctx **ccp,

 		ret = SSH_ERR_ALLOC_FAIL;

 		goto out;

 	}

-	if (EVP_CipherInit(cc->evp, type, NULL, (u_char *)iv,

+	if (EVP_CipherInit(cc->evp, type, (u_char *)key, (u_char *)iv,

 	    (do_encrypt == CIPHER_ENCRYPT)) == 0) {

 		ret = SSH_ERR_LIBCRYPTO_ERROR;

 		goto out;

@@ -386,10 +386,6 @@ cipher_init(struct sshcipher_ctx **ccp,

 			goto out;

 		}

 	}

-	if (EVP_CipherInit(cc->evp, NULL, (u_char *)key, NULL, -1) == 0) {

-		ret = SSH_ERR_LIBCRYPTO_ERROR;

-		goto out;

-	}

 	if (cipher->discard_len > 0) {

 		if ((junk = malloc(cipher->discard_len)) == NULL ||

@@ -621,7 +617,7 @@ cipher_get_keyiv(struct sshcipher_ctx *c

 			   len, iv))

 			       return SSH_ERR_LIBCRYPTO_ERROR;

 		} else

-			memcpy(iv, cc->evp->iv, len);

+			memcpy(iv, EVP_CIPHER_CTX_iv(cc->evp), len);

 		break;

 #endif

 #ifdef WITH_SSH1

@@ -667,7 +663,7 @@ cipher_set_keyiv(struct sshcipher_ctx *c

 			    EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv))

 				return SSH_ERR_LIBCRYPTO_ERROR;

 		} else

-			memcpy(cc->evp->iv, iv, evplen);

+			memcpy(EVP_CIPHER_CTX_iv_noconst(cc->evp), iv, evplen);

 		break;

 #endif

 #ifdef WITH_SSH1

@@ -681,8 +677,8 @@ cipher_set_keyiv(struct sshcipher_ctx *c

 }

 #ifdef WITH_OPENSSL

-#define EVP_X_STATE(evp)	(evp)->cipher_data

-#define EVP_X_STATE_LEN(evp)	(evp)->cipher->ctx_size

+#define EVP_X_STATE(evp)	EVP_CIPHER_CTX_get_cipher_data(evp)

+#define EVP_X_STATE_LEN(evp)	EVP_CIPHER_impl_ctx_size(EVP_CIPHER_CTX_cipher(evp))

 #endif

 int

diff -up openssh-7.4p1/ctr-cavstest.c.openssl openssh-7.4p1/ctr-cavstest.c

--- openssh-7.4p1/ctr-cavstest.c.openssl	2016-12-23 17:47:36.344817716 +0100

+++ openssh-7.4p1/ctr-cavstest.c	2016-12-23 17:47:36.430817752 +0100

@@ -144,7 +144,7 @@ int main (int argc, char *argv[])

                 usage();

         }

-	SSLeay_add_all_algorithms();

+	OpenSSL_add_all_algorithms();

 	c = cipher_by_name(algo);

 	if (c == NULL) {

diff -up openssh-7.4p1/dh.c.openssl openssh-7.4p1/dh.c

--- openssh-7.4p1/dh.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/dh.c	2016-12-23 17:47:36.430817752 +0100

@@ -212,14 +212,15 @@ choose_dh(int min, int wantbits, int max

 /* diffie-hellman-groupN-sha1 */

 int

-dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

+dh_pub_is_valid(const DH *dh, const BIGNUM *dh_pub)

 {

 	int i;

 	int n = BN_num_bits(dh_pub);

 	int bits_set = 0;

 	BIGNUM *tmp;

+	const BIGNUM *p;

-	if (dh_pub->neg) {

+	if (BN_is_negative(dh_pub)) {

 		logit("invalid public DH value: negative");

 		return 0;

 	}

@@ -232,7 +233,8 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

 		error("%s: BN_new failed", __func__);

 		return 0;

 	}

-	if (!BN_sub(tmp, dh->p, BN_value_one()) ||

+	DH_get0_pqg(dh, &p, NULL, NULL);

+	if (!BN_sub(tmp, p, BN_value_one()) ||

 	    BN_cmp(dh_pub, tmp) != -1) {		/* pub_exp > p-2 */

 		BN_clear_free(tmp);

 		logit("invalid public DH value: >= p-1");

@@ -243,14 +245,14 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)

 	for (i = 0; i <= n; i++)

 		if (BN_is_bit_set(dh_pub, i))

 			bits_set++;

-	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));

+	debug2("bits set: %d/%d", bits_set, BN_num_bits(p));

 	/*

 	 * if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial

 	 */

 	if (bits_set < 4) {

 		logit("invalid public DH value (%d/%d)",

-		   bits_set, BN_num_bits(dh->p));

+		   bits_set, BN_num_bits(p));

 		return 0;

 	}

 	return 1;

@@ -260,9 +262,11 @@ int

 dh_gen_key(DH *dh, int need)

 {

 	int pbits;

+	const BIGNUM *p, *pub_key;

-	if (need < 0 || dh->p == NULL ||

-	    (pbits = BN_num_bits(dh->p)) <= 0 ||

+	DH_get0_pqg(dh, &p, NULL, NULL);

+	if (need < 0 || p == NULL ||

+	    (pbits = BN_num_bits(p)) <= 0 ||

 	    need > INT_MAX / 2 || 2 * need > pbits)

 		return SSH_ERR_INVALID_ARGUMENT;

 	if (need < 256)

@@ -271,10 +275,11 @@ dh_gen_key(DH *dh, int need)

 	 * Pollard Rho, Big step/Little Step attacks are O(sqrt(n)),

 	 * so double requested need here.

 	 */

-	dh->length = MINIMUM(need * 2, pbits - 1);

-	if (DH_generate_key(dh) == 0 ||

-	    !dh_pub_is_valid(dh, dh->pub_key)) {

-		BN_clear_free(dh->priv_key);

+	DH_set_length(dh, MINIMUM(need * 2, pbits - 1));

+	if (DH_generate_key(dh) == 0)

+		return SSH_ERR_LIBCRYPTO_ERROR;

+	DH_get0_key(dh, &pub_key, NULL);

+	if (!dh_pub_is_valid(dh, pub_key)) {

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	}

 	return 0;

@@ -284,15 +290,22 @@ DH *

 dh_new_group_asc(const char *gen, const char *modulus)

 {

 	DH *dh;

+	BIGNUM *p, *g;

-	if ((dh = DH_new()) == NULL)

-		return NULL;

-	if (BN_hex2bn(&dh->p, modulus) == 0 ||

-	    BN_hex2bn(&dh->g, gen) == 0) {

-		DH_free(dh);

-		return NULL;

-	}

+	if ((dh = DH_new()) == NULL ||

+	    (p = BN_new()) == NULL ||

+	    (g = BN_new()) == NULL)

+		goto err;

+	if (BN_hex2bn(&p, modulus) == 0 ||

+	    BN_hex2bn(&g, gen) == 0 ||

+	    DH_set0_pqg(dh, p, NULL, g) == 0)

+		goto err;

 	return (dh);

+err:

+	DH_free(dh);

+	BN_free(p);

+	BN_free(g);

+	return NULL;

 }

 /*

@@ -307,8 +320,7 @@ dh_new_group(BIGNUM *gen, BIGNUM *modulu

 	if ((dh = DH_new()) == NULL)

 		return NULL;

-	dh->p = modulus;

-	dh->g = gen;

+	DH_set0_pqg(dh, modulus, NULL, gen);

 	return (dh);

 }

diff -up openssh-7.4p1/dh.h.openssl openssh-7.4p1/dh.h

--- openssh-7.4p1/dh.h.openssl	2016-12-23 17:47:36.418817747 +0100

+++ openssh-7.4p1/dh.h	2016-12-23 17:47:36.431817752 +0100

@@ -42,7 +42,7 @@ DH	*dh_new_group18(void);

 DH	*dh_new_group_fallback(int);

 int	 dh_gen_key(DH *, int);

-int	 dh_pub_is_valid(DH *, BIGNUM *);

+int	 dh_pub_is_valid(const DH *, const BIGNUM *);

 u_int	 dh_estimate(int);

diff -up openssh-7.4p1/digest-openssl.c.openssl openssh-7.4p1/digest-openssl.c

--- openssh-7.4p1/digest-openssl.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/digest-openssl.c	2016-12-23 17:47:36.431817752 +0100

@@ -43,7 +43,7 @@

 struct ssh_digest_ctx {

 	int alg;

-	EVP_MD_CTX mdctx;

+	EVP_MD_CTX *mdctx;

 };

 struct ssh_digest {

@@ -107,7 +107,7 @@ ssh_digest_bytes(int alg)

 size_t

 ssh_digest_blocksize(struct ssh_digest_ctx *ctx)

 {

-	return EVP_MD_CTX_block_size(&ctx->mdctx);

+	return EVP_MD_CTX_block_size(ctx->mdctx);

 }

 struct ssh_digest_ctx *

@@ -119,8 +119,9 @@ ssh_digest_start(int alg)

 	if (digest == NULL || ((ret = calloc(1, sizeof(*ret))) == NULL))

 		return NULL;

 	ret->alg = alg;

-	EVP_MD_CTX_init(&ret->mdctx);

-	if (EVP_DigestInit_ex(&ret->mdctx, digest->mdfunc(), NULL) != 1) {

+	ret->mdctx = EVP_MD_CTX_new();

+	if (ret->mdctx == NULL ||

+	    EVP_DigestInit_ex(ret->mdctx, digest->mdfunc(), NULL) != 1) {

 		free(ret);

 		return NULL;

 	}

@@ -133,7 +134,7 @@ ssh_digest_copy_state(struct ssh_digest_

 	if (from->alg != to->alg)

 		return SSH_ERR_INVALID_ARGUMENT;

 	/* we have bcopy-style order while openssl has memcpy-style */

-	if (!EVP_MD_CTX_copy_ex(&to->mdctx, &from->mdctx))

+	if (!EVP_MD_CTX_copy_ex(to->mdctx, from->mdctx))

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	return 0;

 }

@@ -141,7 +142,7 @@ ssh_digest_copy_state(struct ssh_digest_

 int

 ssh_digest_update(struct ssh_digest_ctx *ctx, const void *m, size_t mlen)

 {

-	if (EVP_DigestUpdate(&ctx->mdctx, m, mlen) != 1)

+	if (EVP_DigestUpdate(ctx->mdctx, m, mlen) != 1)

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	return 0;

 }

@@ -162,7 +163,7 @@ ssh_digest_final(struct ssh_digest_ctx *

 		return SSH_ERR_INVALID_ARGUMENT;

 	if (dlen < digest->digest_len) /* No truncation allowed */

 		return SSH_ERR_INVALID_ARGUMENT;

-	if (EVP_DigestFinal_ex(&ctx->mdctx, d, &l) != 1)

+	if (EVP_DigestFinal_ex(ctx->mdctx, d, &l) != 1)

 		return SSH_ERR_LIBCRYPTO_ERROR;

 	if (l != digest->digest_len) /* sanity */

 		return SSH_ERR_INTERNAL_ERROR;

@@ -173,7 +174,7 @@ void

 ssh_digest_free(struct ssh_digest_ctx *ctx)

 {

 	if (ctx != NULL) {

-		EVP_MD_CTX_cleanup(&ctx->mdctx);

+		EVP_MD_CTX_free(ctx->mdctx);

 		explicit_bzero(ctx, sizeof(*ctx));

 		free(ctx);

 	}

diff -up openssh-7.4p1/entropy.c.openssl openssh-7.4p1/entropy.c

--- openssh-7.4p1/entropy.c.openssl	2016-12-23 17:47:36.419817747 +0100

+++ openssh-7.4p1/entropy.c	2016-12-23 17:47:36.431817752 +0100

@@ -218,7 +218,9 @@ seed_rng(void)

 		    "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());

 	/* clean the PRNG status when exiting the program */

+#if OPENSSL_VERSION_NUMBER < 0x10100000L

 	atexit(RAND_cleanup);

+#endif

 #ifndef OPENSSL_PRNG_ONLY

 	if (RAND_status() == 1) {

diff -up openssh-7.4p1/gss-genr.c.openssl openssh-7.4p1/gss-genr.c

--- openssh-7.4p1/gss-genr.c.openssl	2016-12-23 17:47:36.392817736 +0100

+++ openssh-7.4p1/gss-genr.c	2016-12-23 17:47:36.431817752 +0100

@@ -99,7 +99,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 	u_char digest[EVP_MAX_MD_SIZE];

 	char deroid[2];

 	const EVP_MD *evp_md = EVP_md5();

-	EVP_MD_CTX md;

+	EVP_MD_CTX *md;

 	char *s, *cp, *p;

 	if (gss_enc2oid != NULL) {

@@ -113,6 +113,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 	buffer_init(&buf;;

+	md = EVP_MD_CTX_new();

 	oidpos = 0;

 	s = cp = xstrdup(kex);

 	for (i = 0; i < gss_supported->count; i++) {

@@ -122,12 +123,13 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 			deroid[0] = SSH_GSS_OIDTYPE;

 			deroid[1] = gss_supported->elements[i].length;

-			EVP_DigestInit(&md, evp_md);

-			EVP_DigestUpdate(&md, deroid, 2);

-			EVP_DigestUpdate(&md,

+			EVP_MD_CTX_reset(md);

+			EVP_DigestInit(md, evp_md);

+			EVP_DigestUpdate(md, deroid, 2);

+			EVP_DigestUpdate(md,

 			    gss_supported->elements[i].elements,

 			    gss_supported->elements[i].length);

-			EVP_DigestFinal(&md, digest, NULL);

+			EVP_DigestFinal(md, digest, NULL);

 			encoded = xmalloc(EVP_MD_size(evp_md) * 2);

 			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),

@@ -149,6 +151,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup

 		}

 	}

 	free(s);

+	EVP_MD_CTX_free(md);

 	gss_enc2oid[oidpos].oid = NULL;

 	gss_enc2oid[oidpos].encoded = NULL;

diff -up openssh-7.4p1/includes.h.openssl openssh-7.4p1/includes.h

--- openssh-7.4p1/includes.h.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/includes.h	2016-12-23 17:47:36.431817752 +0100

@@ -163,6 +163,7 @@

 #ifdef WITH_OPENSSL

 #include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */

+#include "libcrypto-compat.h"

 #endif

 #include "defines.h"

diff -up openssh-7.4p1/kexdhc.c.openssl openssh-7.4p1/kexdhc.c

--- openssh-7.4p1/kexdhc.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/kexdhc.c	2016-12-23 17:47:36.431817752 +0100

@@ -56,6 +56,7 @@ kexdh_client(struct ssh *ssh)

 {

 	struct kex *kex = ssh->kex;

 	int r;

+	const BIGNUM *pub_key;

 	/* generate and send 'e', client DH public key */

 	switch (kex->kex_type) {

@@ -81,21 +82,27 @@ kexdh_client(struct ssh *ssh)

 		goto out;

 	}

 	debug("sending SSH2_MSG_KEXDH_INIT");

-	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||

-	    (r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||

+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)

+		goto out;

+	DH_get0_key(kex->dh, &pub_key, NULL);

+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

 #ifdef DEBUG_KEXDH

 	DHparams_print_fp(stderr, kex->dh);

 	fprintf(stderr, "pub= ");

-	BN_print_fp(stderr, kex->dh->pub_key);

+	BN_print_fp(stderr, pub_key);

 	fprintf(stderr, "\n");

 #endif

 	debug("expecting SSH2_MSG_KEXDH_REPLY");

 	ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_REPLY, &input_kex_dh);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -110,6 +117,7 @@ input_kex_dh(int type, u_int32_t seq, vo

 	u_char hash[SSH_DIGEST_MAX_LENGTH];

 	size_t klen = 0, slen, sbloblen, hashlen;

 	int kout, r;

+	const BIGNUM *pub_key;

 	if (kex->verify_host_key == NULL) {

 		r = SSH_ERR_INVALID_ARGUMENT;

@@ -169,6 +177,7 @@ input_kex_dh(int type, u_int32_t seq, vo

 #endif

 	/* calc and verify H */

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	hashlen = sizeof(hash);

 	if ((r = kex_dh_hash(

 	    kex->hash_alg,

@@ -177,7 +186,7 @@ input_kex_dh(int type, u_int32_t seq, vo

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),

 	    server_host_key_blob, sbloblen,

-	    kex->dh->pub_key,

+	    pub_key,

 	    dh_server_pub,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

diff -up openssh-7.4p1/kexdhs.c.openssl openssh-7.4p1/kexdhs.c

--- openssh-7.4p1/kexdhs.c.openssl	2016-12-19 05:59:41.000000000 +0100

+++ openssh-7.4p1/kexdhs.c	2016-12-23 17:47:36.431817752 +0100

@@ -87,6 +87,10 @@ kexdh_server(struct ssh *ssh)

 	ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_INIT, &input_kex_dh_init);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -102,6 +106,7 @@ input_kex_dh_init(int type, u_int32_t se

 	size_t sbloblen, slen;

 	size_t klen = 0, hashlen;

 	int kout, r;

+	const BIGNUM *pub_key;

 	if (kex->load_host_public_key == NULL ||

 	    kex->load_host_private_key == NULL) {

@@ -164,6 +169,7 @@ input_kex_dh_init(int type, u_int32_t se

 		goto out;

 	/* calc H */

 	hashlen = sizeof(hash);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	if ((r = kex_dh_hash(

 	    kex->hash_alg,

 	    kex->client_version_string,

@@ -172,7 +178,7 @@ input_kex_dh_init(int type, u_int32_t se

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    server_host_key_blob, sbloblen,

 	    dh_client_pub,

-	    kex->dh->pub_key,

+	    pub_key,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

 		goto out;

@@ -198,7 +204,7 @@ input_kex_dh_init(int type, u_int32_t se

 	/* send server hostkey, DH pubkey 'f' and singed H */

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||

 	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||	/* f */

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||	/* f */

 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

diff -up openssh-7.4p1/kexgexc.c.openssl openssh-7.4p1/kexgexc.c

--- openssh-7.4p1/kexgexc.c.openssl	2016-12-23 17:47:36.419817747 +0100

+++ openssh-7.4p1/kexgexc.c	2016-12-23 17:47:36.431817752 +0100

@@ -96,6 +96,7 @@ input_kex_dh_gex_group(int type, u_int32

 	struct kex *kex = ssh->kex;

 	BIGNUM *p = NULL, *g = NULL;

 	int r, bits;

+	const BIGNUM *pub_key;

 	debug("got SSH2_MSG_KEX_DH_GEX_GROUP");

@@ -120,26 +121,30 @@ input_kex_dh_gex_group(int type, u_int32

 	p = g = NULL; /* belong to kex->dh now */

 	/* generate and send 'e', client DH public key */

-	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||

-	    (r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||

+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)

+		goto out;

+	DH_get0_key(kex->dh, &pub_key, NULL);

+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

 	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");

 #ifdef DEBUG_KEXDH

 	DHparams_print_fp(stderr, kex->dh);

 	fprintf(stderr, "pub= ");

-	BN_print_fp(stderr, kex->dh->pub_key);

+	BN_print_fp(stderr, pub_key);

 	fprintf(stderr, "\n");

 #endif

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP, NULL);

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &input_kex_dh_gex_reply);

 	r = 0;

 out:

-	if (p)

-		BN_clear_free(p);

-	if (g)

-		BN_clear_free(g);

+	BN_clear_free(p);

+	BN_clear_free(g);

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -154,6 +159,7 @@ input_kex_dh_gex_reply(int type, u_int32

 	u_char hash[SSH_DIGEST_MAX_LENGTH];

 	size_t klen = 0, slen, sbloblen, hashlen;

 	int kout, r;

+	const BIGNUM *p, *g, *pub_key;

 	debug("got SSH2_MSG_KEX_DH_GEX_REPLY");

 	if (kex->verify_host_key == NULL) {

@@ -220,6 +226,8 @@ input_kex_dh_gex_reply(int type, u_int32

 		kex->min = kex->max = -1;

 	/* calc and verify H */

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	hashlen = sizeof(hash);

 	if ((r = kexgex_hash(

 	    kex->hash_alg,

@@ -229,8 +237,8 @@ input_kex_dh_gex_reply(int type, u_int32

 	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),

 	    server_host_key_blob, sbloblen,

 	    kex->min, kex->nbits, kex->max,

-	    kex->dh->p, kex->dh->g,

-	    kex->dh->pub_key,

+	    p, g,

+	    pub_key,

 	    dh_server_pub,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

diff -up openssh-7.4p1/kexgexs.c.openssl openssh-7.4p1/kexgexs.c

--- openssh-7.4p1/kexgexs.c.openssl	2016-12-23 17:47:36.419817747 +0100

+++ openssh-7.4p1/kexgexs.c	2016-12-23 17:47:36.432817753 +0100

@@ -73,6 +73,7 @@ input_kex_dh_gex_request(int type, u_int

 	struct kex *kex = ssh->kex;

 	int r;

 	u_int min = 0, max = 0, nbits = 0;

+	const BIGNUM *p, *g;

 	debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");

 	if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||

@@ -102,9 +103,10 @@ input_kex_dh_gex_request(int type, u_int

 		goto out;

 	}

 	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->p)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->g)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, p)) != 0 ||

+	    (r = sshpkt_put_bignum2(ssh, g)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

@@ -116,6 +118,10 @@ input_kex_dh_gex_request(int type, u_int

 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);

 	r = 0;

  out:

+	if (r != 0) {

+		DH_free(kex->dh);

+		kex->dh = NULL;

+	}

 	return r;

 }

@@ -131,6 +137,7 @@ input_kex_dh_gex_init(int type, u_int32_

 	size_t sbloblen, slen;

 	size_t klen = 0, hashlen;

 	int kout, r;

+	const BIGNUM *p, *g, *pub_key;

 	if (kex->load_host_public_key == NULL ||

 	    kex->load_host_private_key == NULL) {

@@ -193,6 +200,8 @@ input_kex_dh_gex_init(int type, u_int32_

 		goto out;

 	/* calc H */

 	hashlen = sizeof(hash);

+	DH_get0_pqg(kex->dh, &p, NULL, &g);

+	DH_get0_key(kex->dh, &pub_key, NULL);

 	if ((r = kexgex_hash(

 	    kex->hash_alg,

 	    kex->client_version_string,

@@ -201,9 +210,9 @@ input_kex_dh_gex_init(int type, u_int32_

 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),

 	    server_host_key_blob, sbloblen,

 	    kex->min, kex->nbits, kex->max,

-	    kex->dh->p, kex->dh->g,

+	    p, g,

 	    dh_client_pub,

-	    kex->dh->pub_key,

+	    pub_key,

 	    shared_secret,

 	    hash, &hashlen)) != 0)

 		goto out;

@@ -229,7 +238,7 @@ input_kex_dh_gex_init(int type, u_int32_

 	/* send server hostkey, DH pubkey 'f' and singed H */

 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||

 	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||

-	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||     /* f */

+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||     /* f */

 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||

 	    (r = sshpkt_send(ssh)) != 0)

 		goto out;

diff -up openssh-7.4p1/kexgssc.c.openssl openssh-7.4p1/kexgssc.c

--- openssh-7.4p1/kexgssc.c.openssl	2016-12-23 17:47:36.349817718 +0100

+++ openssh-7.4p1/kexgssc.c	2016-12-23 17:47:36.432817753 +0100

@@ -58,6 +58,7 @@ kexgss_client(struct ssh *ssh) {

 	BIGNUM *shared_secret = NULL;

 	BIGNUM *p = NULL;

 	BIGNUM *g = NULL;	

+	const BIGNUM *pub_key, *p1, *g1;

 	u_char *kbuf;

 	u_char *serverhostkey = NULL;