From 41152499cddf14cb5f4d7e6fc85b343352dd1ca8 Mon Sep 17 00:00:00 2001
From: Sascha Wildner <saw@online.de>
Date: Wed, 20 Oct 2021 16:04:23 +0200
Subject: [PATCH 2/2] openssl3: base work

---
 Makefile.inc1                              |    6 +-
 Makefile_upgrade.inc                       |   37 +-
 bin/cpdup/Makefile                         |    1 +
 bin/ed/Makefile                            |    3 +-
 contrib/cryptsetup/lib/backends.c          |   10 +-
 contrib/cryptsetup/luks/af.c               |   12 +-
 contrib/cryptsetup/luks/pbkdf.c            |   12 +-
 etc/mtree/BSD.usr.dist                     |    4 +
 games/factor/Makefile                      |    2 +-
 gnu/lib/libcryptsetup/Makefile             |    2 +-
 gnu/lib/libluks/Makefile                   |    3 +-
 gnu/sbin/cryptsetup/Makefile               |    8 +-
 initrd/mkinitrd.sh                         |    2 +-
 lib/Makefile                               |    4 +-
 lib/libarchive/Makefile                    |    3 +-
 lib/libcrypt/Makefile                      |    2 +-
 lib/libcrypto/Makefile                     | 1253 ++++++++++++++++++
 lib/libcrypto/Makefile.inc                 |   52 +
 lib/libcrypto/engines/Makefile             |    8 +
 lib/libcrypto/engines/Makefile.inc         |   14 +
 lib/libcrypto/engines/capi/Makefile        |    7 +
 lib/libcrypto/engines/padlock/Makefile     |   10 +
 lib/libdmsg/Makefile                       |    3 +-
 lib/libdmsg/crypto.c                       |   38 +-
 lib/libdmsg/dmsg.h                         |    2 +-
 lib/libfetch/Makefile                      |    2 +-
 lib/libldns/Makefile                       |    3 +-
 lib/libldns/ldns/config.h                  |   14 +-
 lib/librecrypto/Makefile                   |  303 -----
 lib/librecrypto/Makefile.inc               |   12 -
 lib/librecrypto/dfly_config.txt            |  110 --
 lib/libressl/Makefile                      |   41 -
 lib/libssh/Makefile                        |    3 +-
 lib/libssh/config.h                        |   18 +-
 lib/libssh/openbsd-compat/openssl-compat.c |   58 +
 lib/libssh/openbsd-compat/openssl-compat.h |   10 +
 lib/libssl/Makefile                        |   45 +
 lib/libtcplay/Makefile                     |    2 +-
 lib/libtelnet/Makefile                     |    3 +-
 lib/libtelnet/pk.c                         |    1 -
 libexec/dma/dma-mbox-create/Makefile       |    2 +-
 libexec/dma/dma/Makefile                   |    3 +-
 libexec/ftpd/Makefile                      |    1 +
 libexec/sftp-server/Makefile               |    2 +-
 libexec/ssh-keysign/Makefile               |    2 +-
 libexec/ssh-pkcs11-helper/Makefile         |    2 +-
 libexec/telnetd/Makefile                   |    2 +-
 sbin/cryptdisks/Makefile                   |    6 +-
 sbin/dhcpcd/Makefile                       |    1 +
 sbin/fsck_hammer2/Makefile                 |    2 +
 sbin/hammer/Makefile                       |    1 +
 sbin/hammer2/Makefile                      |    1 +
 sbin/iscontrol/Makefile                    |    1 +
 sbin/md5/Makefile                          |    1 +
 sbin/mount_hammer2/Makefile                |    2 +-
 sbin/ping6/Makefile                        |    1 +
 sbin/routed/Makefile                       |    1 +
 sbin/routed/rtquery/Makefile               |    1 +
 sbin/tcplay/Makefile                       |    2 +-
 share/examples/etc/README.examples         |    1 -
 share/examples/ssl/Makefile                |    2 +-
 tools/tools/net80211/w00t/Makefile.inc     |    2 +-
 usr.bin/bdes/Makefile                      |    3 +-
 usr.bin/chkey/Makefile                     |    2 +-
 usr.bin/dc/Makefile                        |    3 +-
 usr.bin/dc/bcode.c                         |    6 +-
 usr.bin/dc/bcode.h                         |    1 +
 usr.bin/dc/inout.c                         |   22 +-
 usr.bin/drill/Makefile                     |    2 +-
 usr.bin/dsynth/Makefile                    |    1 +
 usr.bin/nc/Makefile                        |   24 +-
 usr.bin/nc/atomicio.c                      |   67 +
 usr.bin/nc/atomicio.h                      |   39 +
 usr.bin/nc/nc.1                            |  532 ++++++++
 usr.bin/nc/netcat.c                        | 1370 ++++++++++++++++++++
 usr.bin/nc/socks.c                         |  340 +++++
 usr.bin/newkey/Makefile                    |    2 +-
 usr.bin/newkey/generic.c                   |    1 -
 usr.bin/openssl/Makefile                   |   28 +-
 usr.bin/openssl/Makefile.etc               |    9 +-
 usr.bin/openssl/Makefile.inc               |    3 +
 usr.bin/openssl/libapps/Makefile           |   14 +
 usr.bin/openssl/openssl/Makefile           |   27 +
 usr.bin/scp/Makefile                       |    2 +-
 usr.bin/sort/Makefile                      |    1 +
 usr.bin/ssh-add/Makefile                   |    2 +-
 usr.bin/ssh-agent/Makefile                 |    2 +-
 usr.bin/ssh-keygen/Makefile                |    3 +-
 usr.bin/ssh-keyscan/Makefile               |    2 +-
 usr.bin/ssh/Makefile                       |    2 +-
 usr.bin/telnet/Makefile                    |    2 +-
 usr.sbin/802_11/Makefile.crypto            |    3 +-
 usr.sbin/ckdist/Makefile                   |    2 +-
 usr.sbin/keyserv/Makefile                  |    2 +-
 usr.sbin/mtree/Makefile                    |    1 +
 usr.sbin/pfctl/Makefile                    |    1 +
 usr.sbin/ppp/Makefile                      |    1 +
 usr.sbin/sshd/Makefile                     |    3 +-
 usr.sbin/tcpdump/Makefile                  |    3 +-
 usr.sbin/uefisign/Makefile                 |    2 +-
 100 files changed, 4055 insertions(+), 637 deletions(-)
 create mode 100644 lib/libcrypto/Makefile
 create mode 100644 lib/libcrypto/Makefile.inc
 create mode 100644 lib/libcrypto/engines/Makefile
 create mode 100644 lib/libcrypto/engines/Makefile.inc
 create mode 100644 lib/libcrypto/engines/capi/Makefile
 create mode 100644 lib/libcrypto/engines/padlock/Makefile
 delete mode 100644 lib/librecrypto/Makefile
 delete mode 100644 lib/librecrypto/Makefile.inc
 delete mode 100644 lib/librecrypto/dfly_config.txt
 delete mode 100644 lib/libressl/Makefile
 create mode 100644 lib/libssl/Makefile
 create mode 100644 usr.bin/nc/atomicio.c
 create mode 100644 usr.bin/nc/atomicio.h
 create mode 100644 usr.bin/nc/nc.1
 create mode 100644 usr.bin/nc/netcat.c
 create mode 100644 usr.bin/nc/socks.c
 create mode 100644 usr.bin/openssl/Makefile.inc
 create mode 100644 usr.bin/openssl/libapps/Makefile
 create mode 100644 usr.bin/openssl/openssl/Makefile

diff --git a/Makefile.inc1 b/Makefile.inc1
index 79cfa9bc62..aecb46dcf0 100644
--- a/Makefile.inc1
+++ b/Makefile.inc1
@@ -1051,11 +1051,11 @@ _prebuild_libs+= lib/libcrypt lib/libncurses/libncurses
 
 _generic_libs+=	lib
 
-_prebuild_libs+=	lib/librecrypto lib/libressl
-lib/libressl__L: lib/librecrypto__L
+_prebuild_libs+=	lib/libcrypto lib/libssl
+lib/libssl__L: lib/libcrypto__L
 
 _prebuild_libs+=       lib/libldns
-lib/libldns__L: lib/librecrypto__L
+lib/libldns__L: lib/libcrypto__L
 
 _prebuild_libs+= lib/libsbuf lib/libm \
 		lib/libpam/libpam lib/libypclnt lib/lib${THREAD_LIB} \
diff --git a/Makefile_upgrade.inc b/Makefile_upgrade.inc
index cc2203e905..1a2fa8673e 100644
--- a/Makefile_upgrade.inc
+++ b/Makefile_upgrade.inc
@@ -3919,6 +3919,40 @@ TO_REMOVE+=/usr/include/sys/vmm.h
 TO_REMOVE+=/usr/share/man/man2/vmm.2.gz
 TO_REMOVE+=/usr/share/man/man2/vmm_guest_ctl.2.gz
 TO_REMOVE+=/usr/share/man/man2/vmm_guest_sync_addr.2.gz
+TO_REMOVE+=/usr/include/priv/openssl/aes.h
+TO_REMOVE+=/usr/include/priv/openssl/asn1t.h
+TO_REMOVE+=/usr/include/priv/openssl/blowfish.h
+TO_REMOVE+=/usr/include/priv/openssl/camellia.h
+TO_REMOVE+=/usr/include/priv/openssl/cast.h
+TO_REMOVE+=/usr/include/priv/openssl/chacha.h
+TO_REMOVE+=/usr/include/priv/openssl/cmac.h
+TO_REMOVE+=/usr/include/priv/openssl/cms.h
+TO_REMOVE+=/usr/include/priv/openssl/conf_api.h
+TO_REMOVE+=/usr/include/priv/openssl/curve25519.h
+TO_REMOVE+=/usr/include/priv/openssl/dso.h
+TO_REMOVE+=/usr/include/priv/openssl/ecdh.h
+TO_REMOVE+=/usr/include/priv/openssl/ecdsa.h
+TO_REMOVE+=/usr/include/priv/openssl/gost.h
+TO_REMOVE+=/usr/include/priv/openssl/hkdf.h
+TO_REMOVE+=/usr/include/priv/openssl/idea.h
+TO_REMOVE+=/usr/include/priv/openssl/modes.h
+TO_REMOVE+=/usr/include/priv/openssl/opensslfeatures.h
+TO_REMOVE+=/usr/include/priv/openssl/pem2.h
+TO_REMOVE+=/usr/include/priv/openssl/pkcs12.h
+TO_REMOVE+=/usr/include/priv/openssl/poly1305.h
+TO_REMOVE+=/usr/include/priv/openssl/rand.h
+TO_REMOVE+=/usr/include/priv/openssl/rc2.h
+TO_REMOVE+=/usr/include/priv/openssl/sm3.h
+TO_REMOVE+=/usr/include/priv/openssl/sm4.h
+TO_REMOVE+=/usr/include/priv/openssl/ssl23.h
+TO_REMOVE+=/usr/include/priv/openssl/ts.h
+TO_REMOVE+=/usr/include/priv/openssl/txt_db.h
+TO_REMOVE+=/usr/include/priv/openssl/ui.h
+TO_REMOVE+=/usr/include/priv/openssl/whrlpool.h
+TO_REMOVE+=/usr/include/priv/openssl/x509_verify.h
+# XXX
+TO_REMOVE+=/usr/share/man/man1/openssl.1.gz
+TO_REMOVE+=/usr/share/man/man5/openssl.cnf.5.gz
 
 .if !defined(WANT_INSTALLER)
 TO_REMOVE+=/usr/sbin/dfuibe_installer
@@ -3941,7 +3975,6 @@ TO_REMOVE_LATE+=/lib/libcrypto.so.5
 TO_REMOVE_LATE+=/usr/lib/libssl.a
 TO_REMOVE_LATE+=/usr/lib/libssl.so
 TO_REMOVE_LATE+=/usr/lib/libssl.so.5
-TO_REMOVE_LATE+=/usr/lib/engines
 TO_REMOVE_LATE+=/usr/lib/libcrypto.so
 TO_REMOVE_LATE+=/usr/lib/libcrypto.a
 TO_REMOVE_LATE+=/usr/lib/profile/libssl.a
@@ -3954,6 +3987,8 @@ TO_REMOVE_LATE+=/lib/priv/libprivate_crypto.so.38
 TO_REMOVE_LATE+=/lib/priv/libprivate_ssl.so.39
 TO_REMOVE_LATE+=/lib/libprivate_crypto.so.45
 TO_REMOVE_LATE+=/lib/libprivate_ssl.so.47
+TO_REMOVE_LATE+=/lib/libprivate_crypto.so.46
+TO_REMOVE_LATE+=/lib/libprivate_ssl.so.48
 
 # XXX Remove when pfsync(4) has been fixed
 TO_REMOVE+=/usr/share/man/man4/pfsync.4.gz
diff --git a/bin/cpdup/Makefile b/bin/cpdup/Makefile
index c95639efdb..8f09b260fa 100644
--- a/bin/cpdup/Makefile
+++ b/bin/cpdup/Makefile
@@ -7,6 +7,7 @@ CFLAGS+=	-DNOMD5
 .else
 .if !defined(NOMD5)
 SRCS+=		md5.c
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
diff --git a/bin/ed/Makefile b/bin/ed/Makefile
index e2f157e480..20e6579f8e 100644
--- a/bin/ed/Makefile
+++ b/bin/ed/Makefile
@@ -6,7 +6,8 @@ SRCS=	buf.c cbc.c glbl.c io.c main.c re.c sub.c undo.c
 LINKS=	${BINDIR}/ed ${BINDIR}/red
 MLINKS=	ed.1 red.1
 
-CFLAGS+=	-DDES -I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-DDES -DOPENSSL_SUPPRESS_DEPRECATED
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
diff --git a/contrib/cryptsetup/lib/backends.c b/contrib/cryptsetup/lib/backends.c
index 488ccef09c..2359349fcf 100644
--- a/contrib/cryptsetup/lib/backends.c
+++ b/contrib/cryptsetup/lib/backends.c
@@ -16,7 +16,7 @@ int hash(const char *backend_name, const char *hash_name,
          char *result, size_t size,
          const char *passphrase, size_t sizep)
 {
-	EVP_MD_CTX mdctx;
+	EVP_MD_CTX *mdctx;
 	const EVP_MD *md;
 	size_t pad = 0;
 	int r = -ENOENT;
@@ -35,9 +35,11 @@ int hash(const char *backend_name, const char *hash_name,
 
 	pad = size - EVP_MD_size(md);
 
-	EVP_DigestInit(&mdctx, md);
-	EVP_DigestUpdate(&mdctx, passphrase, sizep);
-	r = !EVP_DigestFinal(&mdctx, result, NULL);
+	mdctx = EVP_MD_CTX_new();
+	EVP_DigestInit(mdctx, md);
+	EVP_DigestUpdate(mdctx, passphrase, sizep);
+	r = !EVP_DigestFinal(mdctx, result, NULL);
+	EVP_MD_CTX_free(mdctx);
 
 	if (pad) {
 		memset(result+size, 0, pad);
diff --git a/contrib/cryptsetup/luks/af.c b/contrib/cryptsetup/luks/af.c
index 2d3acc0b60..ec1c999072 100644
--- a/contrib/cryptsetup/luks/af.c
+++ b/contrib/cryptsetup/luks/af.c
@@ -38,15 +38,17 @@ static void XORblock(char const *src1, char const *src2, char *dst, size_t n)
 
 static int hash_buf(char *src, char *dst, uint32_t iv, int len, const EVP_MD *hash_id)
 {
-	EVP_MD_CTX mdctx;
+	EVP_MD_CTX *mdctx;
 	unsigned char digest[128];
 
 	iv = htonl(iv);
 
-	EVP_DigestInit(&mdctx, hash_id);
-	EVP_DigestUpdate(&mdctx, (unsigned char *)&iv, sizeof(iv));
-	EVP_DigestUpdate(&mdctx, src, len);
-	EVP_DigestFinal(&mdctx, digest, NULL);
+	mdctx = EVP_MD_CTX_new();
+	EVP_DigestInit(mdctx, hash_id);
+	EVP_DigestUpdate(mdctx, (unsigned char *)&iv, sizeof(iv));
+	EVP_DigestUpdate(mdctx, src, len);
+	EVP_DigestFinal(mdctx, digest, NULL);
+	EVP_MD_CTX_free(mdctx);
 	memcpy(dst, digest, len);
 
 	return 0;
diff --git a/contrib/cryptsetup/luks/pbkdf.c b/contrib/cryptsetup/luks/pbkdf.c
index 31e5da4d51..6b52de848e 100644
--- a/contrib/cryptsetup/luks/pbkdf.c
+++ b/contrib/cryptsetup/luks/pbkdf.c
@@ -72,7 +72,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	char U[MAX_PRF_BLOCK_LEN];
 	char T[MAX_PRF_BLOCK_LEN];
 	const EVP_MD *PRF;
-	HMAC_CTX ctx;
+	HMAC_CTX *ctx;
 	int i, k, rc = -EINVAL;
 	unsigned int u, hLen, l, r;
 	unsigned char *p;
@@ -169,7 +169,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	 *  into a small set of values.
 	 *
 	 */
-	HMAC_CTX_init(&ctx);
+	ctx = HMAC_CTX_new();
 
 	for (i = 1; (uint) i <= l; i++) {
 		memset(T, 0, hLen);
@@ -181,9 +181,9 @@ static int pkcs5_pbkdf2(const char *hash,
 				tmp[Slen + 1] = (i & 0x00ff0000) >> 16;
 				tmp[Slen + 2] = (i & 0x0000ff00) >> 8;
 				tmp[Slen + 3] = (i & 0x000000ff) >> 0;
-				HMAC_Init_ex(&ctx, P, Plen, PRF, NULL);
-				HMAC_Update(&ctx, tmp, tmplen);				
-				HMAC_Final(&ctx, U, NULL);
+				HMAC_Init_ex(ctx, P, Plen, PRF, NULL);
+				HMAC_Update(ctx, tmp, tmplen);				
+				HMAC_Final(ctx, U, NULL);
 			} else {
 				HMAC(PRF, P, Plen, U, hLen, U, NULL);
 			}
@@ -204,7 +204,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	}
 	rc = 0;
 out:
-	HMAC_CTX_cleanup(&ctx);
+	HMAC_CTX_free(ctx);
 	return rc;
 }
 
diff --git a/etc/mtree/BSD.usr.dist b/etc/mtree/BSD.usr.dist
index 74f5d30b9a..f41f77bf41 100644
--- a/etc/mtree/BSD.usr.dist
+++ b/etc/mtree/BSD.usr.dist
@@ -14,6 +14,8 @@
     lib
         debug
         ..
+        engines
+        ..
         gcc47
             plugin
                 include
@@ -56,6 +58,8 @@
         ..
         i18n
         ..
+        ossl-modules
+        ..
         priv
             profile
             ..
diff --git a/games/factor/Makefile b/games/factor/Makefile
index d87d2003ab..91d8012a1a 100644
--- a/games/factor/Makefile
+++ b/games/factor/Makefile
@@ -8,7 +8,7 @@ MLINKS+=factor.6 primes.6
 GAMESCRYPTO=
 
 CFLAGS+=	-I${.CURDIR}/../primes
-CFLAGS+=	-DHAVE_OPENSSL
+CFLAGS+=	-DHAVE_OPENSSL -DOPENSSL_SUPPRESS_DEPRECATED
 
 .PATH:	${.CURDIR}/../primes
 
diff --git a/gnu/lib/libcryptsetup/Makefile b/gnu/lib/libcryptsetup/Makefile
index 7940faa1d8..4959972596 100644
--- a/gnu/lib/libcryptsetup/Makefile
+++ b/gnu/lib/libcryptsetup/Makefile
@@ -8,7 +8,7 @@ SRCS+=		backends.c libdevmapper.c setup.c utils.c \
 INCS+=		libcryptsetup.h
 
 CFLAGS+=	-I${CRYPTSETUP_DIR}/lib
-CFLAGS+=	-I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../../crypto/openssl/include
 
 .PATH: ${CRYPTSETUP_DIR}/lib
 
diff --git a/gnu/lib/libluks/Makefile b/gnu/lib/libluks/Makefile
index 4dcac6b202..769285fcdb 100644
--- a/gnu/lib/libluks/Makefile
+++ b/gnu/lib/libluks/Makefile
@@ -7,7 +7,8 @@ SRCS+=		af.c hexprint.c keyencryption.c keymanage.c pbkdf.c random.c
 INCS+=		luks.h
 
 CFLAGS+=	-I${CRYPTSETUP_DIR}/luks
-CFLAGS+=	-I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .PATH: ${CRYPTSETUP_DIR}/luks
 
diff --git a/gnu/sbin/cryptsetup/Makefile b/gnu/sbin/cryptsetup/Makefile
index c90f35b0b4..d11c5747ea 100644
--- a/gnu/sbin/cryptsetup/Makefile
+++ b/gnu/sbin/cryptsetup/Makefile
@@ -1,7 +1,6 @@
 CRYPTSETUP_DIR=		${.CURDIR}/../../../contrib/cryptsetup
 
 PROG=		cryptsetup
-
 .PATH:		${CRYPTSETUP_DIR}/src
 CFLAGS+=	-I${CRYPTSETUP_DIR}/src
 SRCS=		cryptsetup.c
@@ -24,9 +23,10 @@ CFLAGS+=	-I. -I${CRYPTSETUP_DIR} -D_BSD_SOURCE
 DPADD+=		${LIBDM} ${LIBPROP}
 LDADD+=		-ldm -lprop
 
-DPADD+=		${LIBCRYPTO}
-LDADD+=		-lprivate_crypto
+DPADD+=		${LIBCRYPTO} ${LIBPTHREAD}
+LDADD+=		-lprivate_crypto -lpthread
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .include <bsd.prog.mk>
diff --git a/initrd/mkinitrd.sh b/initrd/mkinitrd.sh
index c33b86000d..954a9876fd 100755
--- a/initrd/mkinitrd.sh
+++ b/initrd/mkinitrd.sh
@@ -63,7 +63,7 @@ RESCUE_DIR="/rescue"
 BOOT_DIR="/boot"
 
 # Maximum size (number of MB) allowed for the initrd image
-INITRD_SIZE_MAX="15"  # MB
+INITRD_SIZE_MAX="19"  # MB
 
 # When run from the buildworld/installworld environment do not require that
 # things like uniq, kldload, mount, newfs, etc be in the cross-tools.
diff --git a/lib/Makefile b/lib/Makefile
index 4e24ed1cc1..8ba2d27044 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -23,8 +23,8 @@
 # Otherwise, the SUBDIR list should be in alphabetical order.
 
 SUBDIR_ORDERED= \
-	librecrypto \
-	libressl \
+	libcrypto \
+	libssl \
 	libcrypt \
 	libbz2 \
 	libzstd \
diff --git a/lib/libarchive/Makefile b/lib/libarchive/Makefile
index 038439c1ca..cfca77b56f 100644
--- a/lib/libarchive/Makefile
+++ b/lib/libarchive/Makefile
@@ -9,6 +9,7 @@ SHLIB_MAJOR=	5
 CFLAGS+=	-DHAVE_CONFIG_H
 CFLAGS+=	-I${.OBJDIR} -I${.CURDIR} -I${CONTRIBDIR}
 CFLAGS+=	-I${.CURDIR}/../../contrib/zstd/lib
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 # This can be changed back to CFLAGS once iconv works correctly with
 # statically linked libraries (iconv uses dynamic-only dlopen(3))
@@ -18,7 +19,7 @@ WARNS?=	2
 DPADD=	${LIBBZ2} ${LIBLZMA} ${LIBCRYPTO} ${LIBZ} ${LIBZSTD}
 LDADD=	-lbz2 -llzma -lprivate_crypto -lz -lprivate_zstd
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 INCS=	archive.h archive_entry.h
 
diff --git a/lib/libcrypt/Makefile b/lib/libcrypt/Makefile
index 59f5df71b9..5676fbc045 100644
--- a/lib/libcrypt/Makefile
+++ b/lib/libcrypt/Makefile
@@ -17,7 +17,7 @@ MAN=		crypt.3
 MLINKS=		crypt.3 crypt_get_format.3 crypt.3 crypt_set_format.3
 MLINKS+=	crypt.3 encrypt.3 crypt.3 setkey.3
 CFLAGS+=	-I${.CURDIR}/../omd -I${.CURDIR}/../libutil
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 CFLAGS+=	-I${.CURDIR} -DHAS_DES -DHAS_BLOWFISH
 # And the auth_getval() code and support.
 .PATH:		${.CURDIR}/../libutil
diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile
new file mode 100644
index 0000000000..0f2ab4bc96
--- /dev/null
+++ b/lib/libcrypto/Makefile
@@ -0,0 +1,1253 @@
+LIB=		private_crypto
+SHLIB_MAJOR=	47
+PRIVATELIB=	shpub
+SHLIBDIR?=	/lib
+INCSDIR=	${INCLUDEDIR}/priv/openssl
+
+WARNS?=		1
+
+OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
+
+# crypto
+.PATH:	${OPENSSL_SRC}/crypto
+SRCS=	\
+	asn1_dsa.c \
+	bsearch.c \
+	context.c \
+	core_algorithm.c \
+	core_fetch.c \
+	core_namemap.c \
+	cpt_err.c \
+	cpuid.c \
+	cryptlib.c \
+	ctype.c \
+	cversion.c \
+	der_writer.c \
+	ebcdic.c \
+	ex_data.c \
+	getenv.c \
+	info.c \
+	init.c \
+	initthread.c \
+	mem.c \
+	mem_sec.c \
+	o_dir.c \
+	o_fopen.c \
+	o_init.c \
+	o_str.c \
+	o_time.c \
+	packet.c \
+	param_build.c \
+	param_build_set.c \
+	params.c \
+	params_dup.c \
+	params_from_text.c \
+	passphrase.c \
+	provider.c \
+	provider_child.c \
+	provider_conf.c \
+	provider_core.c \
+	provider_predefined.c \
+	punycode.c \
+	self_test_core.c \
+	sparse_array.c \
+	threads_lib.c \
+	threads_pthread.c \
+	trace.c \
+	uid.c \
+	x86_64cpuid.s
+
+# crypto/aes
+.PATH:	${OPENSSL_SRC}/crypto/aes
+SRCS+=	\
+	aes_cfb.c \
+	aes_ecb.c \
+	aes_ige.c \
+	aes_misc.c \
+	aesni-mb-x86_64.s \
+	aesni-sha1-x86_64.s \
+	aesni-sha256-x86_64.s \
+	aesni-x86_64.s \
+	aes_ofb.c \
+	aes_wrap.c \
+	aes-x86_64.s \
+	bsaes-x86_64.s \
+	vpaes-x86_64.s
+
+# crypto/aria
+.PATH:	${OPENSSL_SRC}/crypto/aria
+SRCS+=	\
+	aria.c
+
+# crypto/asn1
+.PATH:	${OPENSSL_SRC}/crypto/asn1
+SRCS+=	\
+	a_bitstr.c \
+	a_d2i_fp.c \
+	a_digest.c \
+	a_dup.c \
+	a_gentm.c \
+	a_i2d_fp.c \
+	a_int.c \
+	a_mbstr.c \
+	ameth_lib.c \
+	a_object.c \
+	a_octet.c \
+	a_print.c \
+	a_sign.c \
+	asn1_err.c \
+	asn1_gen.c \
+	asn1_item_list.c \
+	asn1_lib.c \
+	asn1_parse.c \
+	asn_mime.c \
+	asn_moid.c \
+	asn_mstbl.c \
+	asn_pack.c \
+	a_strex.c \
+	a_strnid.c \
+	a_time.c \
+	a_type.c \
+	a_utctm.c \
+	a_utf8.c \
+	a_verify.c \
+	bio_asn1.c \
+	bio_ndef.c \
+	d2i_param.c \
+	d2i_pr.c \
+	d2i_pu.c \
+	evp_asn1.c \
+	f_int.c \
+	f_string.c \
+	i2d_evp.c \
+	n_pkey.c \
+	nsseq.c \
+	p5_pbe.c \
+	p5_pbev2.c \
+	p5_scrypt.c \
+	p8_pkey.c \
+	tasn_dec.c \
+	tasn_enc.c \
+	tasn_fre.c \
+	tasn_new.c \
+	tasn_prn.c \
+	tasn_scn.c \
+	tasn_typ.c \
+	tasn_utl.c \
+	t_bitst.c \
+	t_pkey.c \
+	t_spki.c \
+	x_algor.c \
+	x_bignum.c \
+	x_info.c \
+	x_int64.c \
+	x_long.c \
+	x_pkey.c \
+	x_sig.c \
+	x_spki.c \
+	x_val.c
+
+# crypto/async
+.PATH:	${OPENSSL_SRC}/crypto/async
+.PATH:	${OPENSSL_SRC}/crypto/async/arch
+SRCS+=	\
+	async.c \
+	async_err.c \
+	async_null.c \
+	async_posix.c \
+	async_wait.c \
+	async_win.c
+
+# crypto/bf
+.PATH:	${OPENSSL_SRC}/crypto/bf
+SRCS+=	\
+	bf_cfb64.c \
+	bf_ecb.c \
+	bf_enc.c \
+	bf_ofb64.c \
+	bf_skey.c
+
+# crypto/bio
+.PATH:	${OPENSSL_SRC}/crypto/bio
+SRCS+=	\
+	bf_buff.c \
+	bf_lbuf.c \
+	bf_nbio.c \
+	bf_null.c \
+	bf_prefix.c \
+	bf_readbuff.c \
+	bio_addr.c \
+	bio_cb.c \
+	bio_dump.c \
+	bio_err.c \
+	bio_lib.c \
+	bio_meth.c \
+	bio_print.c \
+	bio_sock2.c \
+	bio_sock.c \
+	bss_acpt.c \
+	bss_bio.c \
+	bss_conn.c \
+	bss_core.c \
+	bss_dgram.c \
+	bss_fd.c \
+	bss_file.c \
+	bss_log.c \
+	bss_mem.c \
+	bss_null.c \
+	bss_sock.c \
+	ossl_core_bio.c
+
+# crypto/bn
+.PATH:	${OPENSSL_SRC}/crypto/bn
+.PATH:	${OPENSSL_SRC}/crypto/bn/asm
+SRCS+=	\
+	bn_add.c \
+	bn_blind.c \
+	bn_const.c \
+	bn_conv.c \
+	bn_ctx.c \
+	bn_depr.c \
+	bn_dh.c \
+	bn_div.c \
+	bn_err.c \
+	bn_exp2.c \
+	bn_exp.c \
+	bn_gcd.c \
+	bn_gf2m.c \
+	bn_intern.c \
+	bn_kron.c \
+	bn_lib.c \
+	bn_mod.c \
+	bn_mont.c \
+	bn_mpi.c \
+	bn_mul.c \
+	bn_nist.c \
+	bn_prime.c \
+	bn_print.c \
+	bn_rand.c \
+	bn_recp.c \
+	bn_rsa_fips186_4.c \
+	bn_shift.c \
+	bn_sqr.c \
+	bn_sqrt.c \
+	bn_srp.c \
+	bn_word.c \
+	bn_x931p.c \
+	rsaz-avx2.s \
+	rsaz-avx512.s \
+	rsaz_exp.c \
+	rsaz_exp_x2.c \
+	rsaz-x86_64.s \
+	x86_64-gcc.c \
+	x86_64-gf2m.s \
+	x86_64-mont5.s \
+	x86_64-mont.s
+
+# crypto/buffer
+.PATH:	${OPENSSL_SRC}/crypto/buffer
+SRCS+=	\
+	buf_err.c \
+	buffer.c
+
+# crypto/camellia
+.PATH:	${OPENSSL_SRC}/crypto/camellia
+SRCS+=	\
+	cmll_cfb.c \
+	cmll_ctr.c \
+	cmll_ecb.c \
+	cmll_misc.c \
+	cmll_ofb.c \
+	cmll-x86_64.s
+
+# crypto/cast
+.PATH:	${OPENSSL_SRC}/crypto/cast
+SRCS+=	\
+	c_cfb64.c \
+	c_ecb.c \
+	c_enc.c \
+	c_ofb64.c \
+	c_skey.c
+
+# crypto/chacha
+.PATH:	${OPENSSL_SRC}/crypto/chacha
+SRCS+=	\
+	chacha-x86_64.s
+
+# crypto/cmac
+.PATH:	${OPENSSL_SRC}/crypto/cmac
+SRCS+=	\
+	cmac.c
+
+# crypto/cmp
+.PATH:	${OPENSSL_SRC}/crypto/cmp
+SRCS+=	\
+	cmp_asn.c \
+	cmp_client.c \
+	cmp_ctx.c \
+	cmp_err.c \
+	cmp_hdr.c \
+	cmp_http.c \
+	cmp_msg.c \
+	cmp_protect.c \
+	cmp_server.c \
+	cmp_status.c \
+	cmp_util.c \
+	cmp_vfy.c
+
+# crypto/cms
+.PATH:	${OPENSSL_SRC}/crypto/cms
+SRCS+=	\
+	cms_asn1.c \
+	cms_att.c \
+	cms_cd.c \
+	cms_dd.c \
+	cms_dh.c \
+	cms_ec.c \
+	cms_enc.c \
+	cms_env.c \
+	cms_err.c \
+	cms_ess.c \
+	cms_io.c \
+	cms_kari.c \
+	cms_lib.c \
+	cms_pwri.c \
+	cms_rsa.c \
+	cms_sd.c \
+	cms_smime.c
+
+# crypto/comp
+.PATH:	${OPENSSL_SRC}/crypto/comp
+SRCS+=	\
+	comp_err.c \
+	comp_lib.c \
+	c_zlib.c
+
+# crypto/conf
+.PATH:	${OPENSSL_SRC}/crypto/conf
+SRCS+=	\
+	conf_api.c \
+	conf_def.c \
+	conf_err.c \
+	conf_lib.c \
+	conf_mall.c \
+	conf_mod.c \
+	conf_sap.c \
+	conf_ssl.c
+
+# crypto/crmf
+.PATH:	${OPENSSL_SRC}/crypto/crmf
+SRCS+=	\
+	crmf_asn.c \
+	crmf_err.c \
+	crmf_lib.c \
+	crmf_pbm.c
+
+# crypto/ct
+.PATH:	${OPENSSL_SRC}/crypto/ct
+SRCS+=	\
+	ct_b64.c \
+	ct_err.c \
+	ct_log.c \
+	ct_oct.c \
+	ct_policy.c \
+	ct_prn.c \
+	ct_sct.c \
+	ct_sct_ctx.c \
+	ct_vfy.c \
+	ct_x509v3.c
+
+# crypto/des
+.PATH:	${OPENSSL_SRC}/crypto/des
+SRCS+=	\
+	cbc_cksm.c \
+	cbc_enc.c \
+	cfb64ede.c \
+	cfb64enc.c \
+	cfb_enc.c \
+	des_enc.c \
+	ecb3_enc.c \
+	ecb_enc.c \
+	fcrypt_b.c \
+	fcrypt.c \
+	ofb64ede.c \
+	ofb64enc.c \
+	ofb_enc.c \
+	pcbc_enc.c \
+	qud_cksm.c \
+	rand_key.c \
+	set_key.c \
+	str2key.c \
+	xcbc_enc.c
+
+# crypto/dh
+.PATH:	${OPENSSL_SRC}/crypto/dh
+SRCS+=	\
+	dh_ameth.c \
+	dh_asn1.c \
+	dh_backend.c \
+	dh_check.c \
+	dh_depr.c \
+	dh_err.c \
+	dh_gen.c \
+	dh_group_params.c \
+	dh_kdf.c \
+	dh_key.c \
+	dh_lib.c \
+	dh_meth.c \
+	dh_pmeth.c \
+	dh_prn.c \
+	dh_rfc5114.c
+
+# crypto/dsa
+.PATH:	${OPENSSL_SRC}/crypto/dsa
+SRCS+=	\
+	dsa_ameth.c \
+	dsa_asn1.c \
+	dsa_backend.c \
+	dsa_check.c \
+	dsa_depr.c \
+	dsa_err.c \
+	dsa_gen.c \
+	dsa_key.c \
+	dsa_lib.c \
+	dsa_meth.c \
+	dsa_ossl.c \
+	dsa_pmeth.c \
+	dsa_prn.c \
+	dsa_sign.c \
+	dsa_vrf.c
+
+# crypto/dso
+.PATH:	${OPENSSL_SRC}/crypto/dso
+SRCS+=	\
+	dso_dl.c \
+	dso_dlfcn.c \
+	dso_err.c \
+	dso_lib.c \
+	dso_openssl.c \
+	dso_vms.c \
+	dso_win32.c
+
+# crypto/ec
+.PATH:	${OPENSSL_SRC}/crypto/ec
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448/arch_32
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448/arch_64
+SRCS+=	\
+	curve25519.c \
+	curve448.c \
+	curve448_tables.c \
+	ec2_oct.c \
+	ec2_smpl.c \
+	ec_ameth.c \
+	ec_asn1.c \
+	ec_backend.c \
+	ec_check.c \
+	ec_curve.c \
+	ec_cvt.c \
+	ec_deprecated.c \
+	ecdh_kdf.c \
+	ecdh_ossl.c \
+	ecdsa_ossl.c \
+	ecdsa_sign.c \
+	ecdsa_vrf.c \
+	ec_err.c \
+	ec_key.c \
+	ec_kmeth.c \
+	eck_prn.c \
+	ec_lib.c \
+	ec_mult.c \
+	ec_oct.c \
+	ec_pmeth.c \
+	ecp_mont.c \
+	ecp_nist.c \
+	ecp_nistz256.c \
+	ecp_nistz256-x86_64.s \
+	ecp_oct.c \
+	ec_print.c \
+	ecp_smpl.c \
+	ecx_backend.c \
+	ecx_key.c \
+	ecx_meth.c \
+	eddsa.c \
+	f_generic.c \
+	f_impl32.c \
+	f_impl64.c \
+	scalar.c \
+	x25519-x86_64.s
+
+# crypto/encode_decode
+.PATH:	${OPENSSL_SRC}/crypto/encode_decode
+SRCS+=	\
+	decoder_err.c \
+	decoder_lib.c \
+	decoder_meth.c \
+	decoder_pkey.c \
+	encoder_err.c \
+	encoder_lib.c \
+	encoder_meth.c \
+	encoder_pkey.c
+
+# crypto/engine
+.PATH:	${OPENSSL_SRC}/crypto/engine
+SRCS+=	\
+	eng_all.c \
+	eng_cnf.c \
+	eng_ctrl.c \
+	eng_dyn.c \
+	eng_err.c \
+	eng_fat.c \
+	eng_init.c \
+	eng_lib.c \
+	eng_list.c \
+	eng_openssl.c \
+	eng_pkey.c \
+	eng_rdrand.c \
+	eng_table.c \
+	tb_asnmth.c \
+	tb_cipher.c \
+	tb_dh.c \
+	tb_digest.c \
+	tb_dsa.c \
+	tb_eckey.c \
+	tb_pkmeth.c \
+	tb_rand.c \
+	tb_rsa.c
+
+# crypto/err
+.PATH:	${OPENSSL_SRC}/crypto/err
+SRCS+=	\
+	err_all.c \
+	err_all_legacy.c \
+	err_blocks.c \
+	err.c \
+	err_prn.c
+
+# crypto/ess
+.PATH:	${OPENSSL_SRC}/crypto/ess
+SRCS+=	\
+	ess_asn1.c \
+	ess_err.c \
+	ess_lib.c
+
+# crypto/evp
+.PATH:	${OPENSSL_SRC}/crypto/evp
+SRCS+=	\
+	asymcipher.c \
+	bio_b64.c \
+	bio_enc.c \
+	bio_md.c \
+	bio_ok.c \
+	c_allc.c \
+	c_alld.c \
+	cmeth_lib.c \
+	ctrl_params_translate.c \
+	dh_ctrl.c \
+	dh_support.c \
+	digest.c \
+	dsa_ctrl.c \
+	e_aes.c \
+	e_aes_cbc_hmac_sha1.c \
+	e_aes_cbc_hmac_sha256.c \
+	e_aria.c \
+	e_bf.c \
+	e_camellia.c \
+	e_cast.c \
+	ec_ctrl.c \
+	e_chacha20_poly1305.c \
+	ec_support.c \
+	e_des3.c \
+	e_des.c \
+	e_idea.c \
+	encode.c \
+	e_null.c \
+	e_old.c \
+	e_rc2.c \
+	e_rc4.c \
+	e_rc4_hmac_md5.c \
+	e_rc5.c \
+	e_seed.c \
+	e_sm4.c \
+	evp_cnf.c \
+	evp_enc.c \
+	evp_err.c \
+	evp_fetch.c \
+	evp_key.c \
+	evp_lib.c \
+	evp_pbe.c \
+	evp_pkey.c \
+	evp_rand.c \
+	evp_utils.c \
+	e_xcbc_d.c \
+	exchange.c \
+	kdf_lib.c \
+	kdf_meth.c \
+	kem.c \
+	keymgmt_lib.c \
+	keymgmt_meth.c \
+	legacy_blake2.c \
+	legacy_md4.c \
+	legacy_md5.c \
+	legacy_md5_sha1.c \
+	legacy_mdc2.c \
+	legacy_ripemd.c \
+	legacy_sha.c \
+	legacy_wp.c \
+	mac_lib.c \
+	mac_meth.c \
+	m_null.c \
+	m_sigver.c \
+	names.c \
+	p5_crpt2.c \
+	p5_crpt.c \
+	pbe_scrypt.c \
+	p_dec.c \
+	p_enc.c \
+	p_legacy.c \
+	p_lib.c \
+	pmeth_check.c \
+	pmeth_gn.c \
+	pmeth_lib.c \
+	p_open.c \
+	p_seal.c \
+	p_sign.c \
+	p_verify.c \
+	signature.c
+
+# crypto/ffc
+.PATH:	${OPENSSL_SRC}/crypto/ffc
+SRCS+=	\
+	ffc_backend.c \
+	ffc_dh.c \
+	ffc_key_generate.c \
+	ffc_key_validate.c \
+	ffc_params.c \
+	ffc_params_generate.c \
+	ffc_params_validate.c
+
+# crypto/hmac
+.PATH:	${OPENSSL_SRC}/crypto/hmac
+SRCS+=	\
+	hmac.c
+
+# crypto/http
+.PATH:	${OPENSSL_SRC}/crypto/http
+SRCS+=	\
+	http_client.c \
+	http_err.c \
+	http_lib.c
+
+# crypto/idea
+.PATH:	${OPENSSL_SRC}/crypto/idea
+SRCS+=	\
+	i_cbc.c \
+	i_cfb64.c \
+	i_ecb.c \
+	i_ofb64.c \
+	i_skey.c
+
+# crypto/kdf
+.PATH:	${OPENSSL_SRC}/crypto/kdf
+SRCS+=	\
+	kdf_err.c
+
+# crypto/lhash
+.PATH:	${OPENSSL_SRC}/crypto/lhash
+SRCS+=	\
+	lhash.c \
+	lh_stats.c
+
+# crypto/md4
+.PATH:	${OPENSSL_SRC}/crypto/md4
+SRCS+=	\
+	md4_dgst.c \
+	md4_one.c
+
+# crypto/md5
+.PATH:	${OPENSSL_SRC}/crypto/md5
+SRCS+=	\
+	md5_dgst.c \
+	md5_one.c \
+	md5_sha1.c \
+	md5-x86_64.s
+
+# crypto/mdc2
+.PATH:	${OPENSSL_SRC}/crypto/mdc2
+SRCS+=	\
+	mdc2dgst.c \
+	mdc2_one.c
+
+# crypto/modes
+.PATH:	${OPENSSL_SRC}/crypto/modes
+SRCS+=	\
+	aesni-gcm-x86_64.s \
+	cbc128.c \
+	ccm128.c \
+	cfb128.c \
+	ctr128.c \
+	cts128.c \
+	gcm128.c \
+	ghash-x86_64.s \
+	ocb128.c \
+	ofb128.c \
+	siv128.c \
+	wrap128.c \
+	xts128.c
+
+# crypto/objects
+.PATH:	${OPENSSL_SRC}/crypto/objects
+SRCS+=	\
+	obj_dat.c \
+	obj_err.c \
+	obj_lib.c \
+	obj_xref.c \
+	o_names.c
+
+# crypto/ocsp
+.PATH:	${OPENSSL_SRC}/crypto/ocsp
+SRCS+=	\
+	ocsp_asn.c \
+	ocsp_cl.c \
+	ocsp_err.c \
+	ocsp_ext.c \
+	ocsp_http.c \
+	ocsp_lib.c \
+	ocsp_prn.c \
+	ocsp_srv.c \
+	ocsp_vfy.c \
+	v3_ocsp.c
+
+# crypto/pem
+.PATH:	${OPENSSL_SRC}/crypto/pem
+SRCS+=	\
+	pem_all.c \
+	pem_err.c \
+	pem_info.c \
+	pem_lib.c \
+	pem_oth.c \
+	pem_pk8.c \
+	pem_pkey.c \
+	pem_sign.c \
+	pem_x509.c \
+	pem_xaux.c \
+	pvkfmt.c
+
+# crypto/pkcs12
+.PATH:	${OPENSSL_SRC}/crypto/pkcs12
+SRCS+=	\
+	p12_add.c \
+	p12_asn.c \
+	p12_attr.c \
+	p12_crpt.c \
+	p12_crt.c \
+	p12_decr.c \
+	p12_init.c \
+	p12_key.c \
+	p12_kiss.c \
+	p12_mutl.c \
+	p12_npas.c \
+	p12_p8d.c \
+	p12_p8e.c \
+	p12_sbag.c \
+	p12_utl.c \
+	pk12err.c
+
+# crypto/pkcs7
+.PATH:	${OPENSSL_SRC}/crypto/pkcs7
+SRCS+=	\
+	bio_pk7.c \
+	pk7_asn1.c \
+	pk7_attr.c \
+	pk7_doit.c \
+	pk7_lib.c \
+	pk7_mime.c \
+	pk7_smime.c \
+	pkcs7err.c
+
+# crypto/poly1305
+.PATH:	${OPENSSL_SRC}/crypto/poly1305
+SRCS+=	\
+	poly1305.c \
+	poly1305-x86_64.s
+
+# crypto/property
+.PATH:	${OPENSSL_SRC}/crypto/property
+SRCS+=	\
+	defn_cache.c \
+	property.c \
+	property_err.c \
+	property_parse.c \
+	property_query.c \
+	property_string.c
+
+# crypto/rand
+.PATH:	${OPENSSL_SRC}/crypto/rand
+SRCS+=	\
+	prov_seed.c \
+	rand_deprecated.c \
+	rand_err.c \
+	randfile.c \
+	rand_lib.c \
+	rand_meth.c \
+	rand_pool.c
+
+# crypto/rc2
+.PATH:	${OPENSSL_SRC}/crypto/rc2
+SRCS+=	\
+	rc2_cbc.c \
+	rc2cfb64.c \
+	rc2_ecb.c \
+	rc2ofb64.c \
+	rc2_skey.c
+
+# crypto/rc4
+.PATH:	${OPENSSL_SRC}/crypto/rc4
+SRCS+=	\
+	rc4-md5-x86_64.s \
+	rc4-x86_64.s
+
+# crypto/ripemd
+.PATH:	${OPENSSL_SRC}/crypto/ripemd
+SRCS+=	\
+	rmd_dgst.c \
+	rmd_one.c
+
+# crypto/rsa
+.PATH:	${OPENSSL_SRC}/crypto/rsa
+SRCS+=	\
+	rsa_ameth.c \
+	rsa_asn1.c \
+	rsa_backend.c \
+	rsa_chk.c \
+	rsa_crpt.c \
+	rsa_depr.c \
+	rsa_err.c \
+	rsa_gen.c \
+	rsa_lib.c \
+	rsa_meth.c \
+	rsa_mp.c \
+	rsa_mp_names.c \
+	rsa_none.c \
+	rsa_oaep.c \
+	rsa_ossl.c \
+	rsa_pk1.c \
+	rsa_pmeth.c \
+	rsa_prn.c \
+	rsa_pss.c \
+	rsa_saos.c \
+	rsa_schemes.c \
+	rsa_sign.c \
+	rsa_sp800_56b_check.c \
+	rsa_sp800_56b_gen.c \
+	rsa_x931.c \
+	rsa_x931g.c
+
+# crypto/seed
+.PATH:	${OPENSSL_SRC}/crypto/seed
+SRCS+=	\
+	seed.c \
+	seed_cbc.c \
+	seed_cfb.c \
+	seed_ecb.c \
+	seed_ofb.c
+
+# crypto/sha
+.PATH:	${OPENSSL_SRC}/crypto/sha
+SRCS+=	\
+	keccak1600-x86_64.s \
+	sha1dgst.c \
+	sha1-mb-x86_64.s \
+	sha1_one.c \
+	sha1-x86_64.s \
+	sha256.c \
+	sha256-mb-x86_64.s \
+	sha256-x86_64.s \
+	sha3.c \
+	sha512.c \
+	sha512-x86_64.s
+
+# crypto/siphash
+.PATH:	${OPENSSL_SRC}/crypto/siphash
+SRCS+=	\
+	siphash.c
+
+# crypto/sm2
+.PATH:	${OPENSSL_SRC}/crypto/sm2
+SRCS+=	\
+	sm2_crypt.c \
+	sm2_err.c \
+	sm2_key.c \
+	sm2_sign.c
+
+# crypto/sm3
+.PATH:	${OPENSSL_SRC}/crypto/sm3
+SRCS+=	\
+	legacy_sm3.c \
+	sm3.c
+
+# crypto/sm4
+.PATH:	${OPENSSL_SRC}/crypto/sm4
+SRCS+=	\
+	sm4.c
+
+# crypto/srp
+.PATH:	${OPENSSL_SRC}/crypto/srp
+SRCS+=	\
+	srp_lib.c \
+	srp_vfy.c
+
+# crypto/stack
+.PATH:	${OPENSSL_SRC}/crypto/stack
+SRCS+=	\
+	stack.c
+
+# crypto/store
+.PATH:	${OPENSSL_SRC}/crypto/store
+SRCS+=	\
+	store_err.c \
+	store_init.c \
+	store_lib.c \
+	store_meth.c \
+	store_register.c \
+	store_result.c \
+	store_strings.c
+
+# crypto/ts
+.PATH:	${OPENSSL_SRC}/crypto/ts
+SRCS+=	\
+	ts_asn1.c \
+	ts_conf.c \
+	ts_err.c \
+	ts_lib.c \
+	ts_req_print.c \
+	ts_req_utils.c \
+	ts_rsp_print.c \
+	ts_rsp_sign.c \
+	ts_rsp_utils.c \
+	ts_rsp_verify.c \
+	ts_verify_ctx.c
+
+# crypto/txt_db
+.PATH:	${OPENSSL_SRC}/crypto/txt_db
+SRCS+=	\
+	txt_db.c
+
+# crypto/ui
+.PATH:	${OPENSSL_SRC}/crypto/ui
+SRCS+=	\
+	ui_err.c \
+	ui_lib.c \
+	ui_null.c \
+	ui_openssl.c \
+	ui_util.c
+
+# crypto/whrlpool
+.PATH:	${OPENSSL_SRC}/crypto/whrlpool
+SRCS+=	\
+	wp_dgst.c \
+	wp-x86_64.s
+
+# crypto/x509
+.PATH:	${OPENSSL_SRC}/crypto/x509
+SRCS+=	\
+	by_dir.c \
+	by_file.c \
+	by_store.c \
+	pcy_cache.c \
+	pcy_data.c \
+	pcy_lib.c \
+	pcy_map.c \
+	pcy_node.c \
+	pcy_tree.c \
+	t_crl.c \
+	t_req.c \
+	t_x509.c \
+	v3_addr.c \
+	v3_admis.c \
+	v3_akeya.c \
+	v3_akid.c \
+	v3_asid.c \
+	v3_bcons.c \
+	v3_bitst.c \
+	v3_conf.c \
+	v3_cpols.c \
+	v3_crld.c \
+	v3_enum.c \
+	v3err.c \
+	v3_extku.c \
+	v3_genn.c \
+	v3_ia5.c \
+	v3_info.c \
+	v3_int.c \
+	v3_ist.c \
+	v3_lib.c \
+	v3_ncons.c \
+	v3_pcia.c \
+	v3_pci.c \
+	v3_pcons.c \
+	v3_pku.c \
+	v3_pmaps.c \
+	v3_prn.c \
+	v3_purp.c \
+	v3_san.c \
+	v3_skid.c \
+	v3_sxnet.c \
+	v3_tlsf.c \
+	v3_utf8.c \
+	v3_utl.c \
+	x509_att.c \
+	x509_cmp.c \
+	x509cset.c \
+	x509_d2.c \
+	x509_def.c \
+	x509_err.c \
+	x509_ext.c \
+	x509_lu.c \
+	x509_meth.c \
+	x509name.c \
+	x509_obj.c \
+	x509_r2x.c \
+	x509_req.c \
+	x509rset.c \
+	x509_set.c \
+	x509spki.c \
+	x509_trust.c \
+	x509_txt.c \
+	x509type.c \
+	x509_v3.c \
+	x509_vfy.c \
+	x509_vpm.c \
+	x_all.c \
+	x_attrib.c \
+	x_crl.c \
+	x_exten.c \
+	x_name.c \
+	x_pubkey.c \
+	x_req.c \
+	x_x509a.c \
+	x_x509.c
+
+# providers
+.PATH:	${OPENSSL_SRC}/providers
+SRCS+=	\
+	baseprov.c \
+	defltprov.c \
+	nullprov.c \
+	prov_running.c
+
+# providers/common
+.PATH:	${OPENSSL_SRC}/providers/common
+.PATH:	${OPENSSL_SRC}/providers/common/der
+SRCS+=	\
+	bio_prov.c \
+	capabilities.c \
+	der_digests_gen.c \
+	der_dsa_gen.c \
+	der_dsa_key.c \
+	der_dsa_sig.c \
+	der_ec_gen.c \
+	der_ec_key.c \
+	der_ec_sig.c \
+	der_ecx_gen.c \
+	der_ecx_key.c \
+	der_rsa_gen.c \
+	der_rsa_key.c \
+	der_rsa_sig.c \
+	der_sm2_gen.c \
+	der_sm2_key.c \
+	der_sm2_sig.c \
+	der_wrap_gen.c \
+	digest_to_nid.c \
+	provider_ctx.c \
+	provider_err.c \
+	provider_seeding.c \
+	provider_util.c \
+	securitycheck.c \
+	securitycheck_default.c
+
+# providers/implementations
+.PATH:	${OPENSSL_SRC}/providers/implementations/asymciphers
+.PATH:	${OPENSSL_SRC}/providers/implementations/ciphers
+.PATH:	${OPENSSL_SRC}/providers/implementations/digests
+.PATH:	${OPENSSL_SRC}/providers/implementations/encode_decode
+.PATH:	${OPENSSL_SRC}/providers/implementations/exchange
+.PATH:	${OPENSSL_SRC}/providers/implementations/kdfs
+.PATH:	${OPENSSL_SRC}/providers/implementations/kem
+.PATH:	${OPENSSL_SRC}/providers/implementations/keymgmt
+.PATH:	${OPENSSL_SRC}/providers/implementations/macs
+.PATH:	${OPENSSL_SRC}/providers/implementations/rands
+.PATH:	${OPENSSL_SRC}/providers/implementations/rands/seeding
+.PATH:	${OPENSSL_SRC}/providers/implementations/signature
+.PATH:	${OPENSSL_SRC}/providers/implementations/storemgmt
+SRCS+=	\
+	blake2b_mac.c \
+	blake2b_prov.c \
+	blake2_prov.c \
+	blake2s_mac.c \
+	blake2s_prov.c \
+	cipher_aes.c \
+	cipher_aes_cbc_hmac_sha1_hw.c \
+	cipher_aes_cbc_hmac_sha256_hw.c \
+	cipher_aes_cbc_hmac_sha.c \
+	cipher_aes_ccm.c \
+	cipher_aes_ccm_hw.c \
+	cipher_aes_gcm.c \
+	cipher_aes_gcm_hw.c \
+	cipher_aes_hw.c \
+	cipher_aes_ocb.c \
+	cipher_aes_ocb_hw.c \
+	cipher_aes_siv.c \
+	cipher_aes_siv_hw.c \
+	cipher_aes_wrp.c \
+	cipher_aes_xts.c \
+	cipher_aes_xts_fips.c \
+	cipher_aes_xts_hw.c \
+	cipher_aria.c \
+	cipher_aria_ccm.c \
+	cipher_aria_ccm_hw.c \
+	cipher_aria_gcm.c \
+	cipher_aria_gcm_hw.c \
+	cipher_aria_hw.c \
+	cipher_camellia.c \
+	cipher_camellia_hw.c \
+	cipher_chacha20.c \
+	cipher_chacha20_hw.c \
+	cipher_chacha20_poly1305.c \
+	cipher_chacha20_poly1305_hw.c \
+	ciphercommon_block.c \
+	ciphercommon.c \
+	ciphercommon_ccm.c \
+	ciphercommon_ccm_hw.c \
+	ciphercommon_gcm.c \
+	ciphercommon_gcm_hw.c \
+	ciphercommon_hw.c \
+	cipher_cts.c \
+	cipher_null.c \
+	cipher_sm4.c \
+	cipher_sm4_hw.c \
+	cipher_tdes.c \
+	cipher_tdes_common.c \
+	cipher_tdes_default.c \
+	cipher_tdes_default_hw.c \
+	cipher_tdes_hw.c \
+	cipher_tdes_wrap.c \
+	cipher_tdes_wrap_hw.c \
+	cmac_prov.c \
+	crngt.c \
+	decode_der2key.c \
+	decode_epki2pki.c \
+	decode_msblob2key.c \
+	decode_pem2der.c \
+	decode_pvk2key.c \
+	decode_spki2typespki.c \
+	dh_exch.c \
+	dh_kmgmt.c \
+	digestcommon.c \
+	drbg.c \
+	drbg_ctr.c \
+	drbg_hash.c \
+	drbg_hmac.c \
+	dsa_kmgmt.c \
+	dsa_sig.c \
+	ecdh_exch.c \
+	ecdsa_sig.c \
+	ec_kmgmt.c \
+	ecx_exch.c \
+	ecx_kmgmt.c \
+	eddsa_sig.c \
+	encode_key2any.c \
+	encode_key2blob.c \
+	encode_key2ms.c \
+	encode_key2text.c \
+	endecoder_common.c \
+	file_store_any2obj.c \
+	file_store.c \
+	gmac_prov.c \
+	hkdf.c \
+	hmac_prov.c \
+	kbkdf.c \
+	kdf_exch.c \
+	kdf_legacy_kmgmt.c \
+	kmac_prov.c \
+	krb5kdf.c \
+	mac_legacy_kmgmt.c \
+	mac_legacy_sig.c \
+	md5_prov.c \
+	md5_sha1_prov.c \
+	pbkdf2.c \
+	pbkdf2_fips.c \
+	pkcs12kdf.c \
+	poly1305_prov.c \
+	rand_cpu_x86.c \
+	rand_tsc.c \
+	rand_unix.c \
+	rand_win.c \
+	rsa_enc.c \
+	rsa_kem.c \
+	rsa_kmgmt.c \
+	rsa_sig.c \
+	scrypt.c \
+	seed_src.c \
+	sha2_prov.c \
+	sha3_prov.c \
+	siphash_prov.c \
+	sm2_enc.c \
+	sm2_sig.c \
+	sm3_prov.c \
+	sshkdf.c \
+	sskdf.c \
+	test_rng.c \
+	tls1_prf.c \
+	x942kdf.c
+
+# ssl
+.PATH:	${OPENSSL_SRC}/ssl
+SRCS+=	\
+	s3_cbc.c
+
+# ssl/record
+.PATH:	${OPENSSL_SRC}/ssl/record
+SRCS+=	\
+	tls_pad.c
+
+.PATH:	${OPENSSL_SRC}/include/openssl
+INCS=	asn1.h asn1err.h async.h asyncerr.h bio.h bioerr.h bn.h bnerr.h buffer.h buffererr.h comp.h comperr.h conf.h conferr.h configuration.h conftypes.h core.h core_dispatch.h crypto.h cryptoerr.h cryptoerr_legacy.h ct.h cterr.h des.h dh.h dherr.h dsa.h dsaerr.h ebcdic.h ec.h ecerr.h e_os2.h err.h evp.h evperr.h hmac.h http.h lhash.h macros.h md4.h md5.h \
+	objects.h objectserr.h obj_mac.h opensslconf.h opensslv.h ocsp.h ocsperr.h ossl_typ.h params.h pem.h pemerr.h pkcs7.h pkcs7err.h rc4.h ripemd.h rsa.h rsaerr.h safestack.h sha.h stack.h symhacks.h types.h x509.h x509err.h x509v3.h x509v3err.h x509_vfy.h
+
+CFLAGS+=-DAES_ASM \
+	-DBSAES_ASM \
+	-DCMLL_ASM \
+	-DECP_NISTZ256_ASM \
+	-DGHASH_ASM \
+	-DKECCAK1600_ASM \
+	-DMD5_ASM \
+	-DOPENSSL_BN_ASM_GF2m \
+	-DOPENSSL_BN_ASM_MONT \
+	-DOPENSSL_BN_ASM_MONT5 \
+	-DOPENSSL_CPUID_OBJ \
+	-DOPENSSL_IA32_SSE2 \
+	-DPOLY1305_ASM \
+	-DSHA1_ASM \
+	-DSHA256_ASM \
+	-DSHA512_ASM \
+	-DVPAES_ASM \
+	-DWHIRLPOOL_ASM \
+	-DX25519_ASM \
+	-Wa,--noexecstack \
+	-DL_ENDIAN \
+	${PRIVATELIB_CFLAGS} \
+	-I${OPENSSL_SRC} \
+	-I${OPENSSL_SRC}/include \
+	-I${OPENSSL_SRC}/providers/common/include \
+	-I${OPENSSL_SRC}/providers/implementations/include \
+	-DOPENSSLDIR="\"/etc/ssl\"" \
+	-DENGINESDIR="\"${LIBDIR}/engines\"" \
+	-DMODULESDIR="\"${LIBDIR}/ossl-modules\""
+
+DPADD=	${LIBPTHREAD}
+LDADD=	-lpthread
+
+SUBDIR=	engines
+
+.include <bsd.lib.mk>
diff --git a/lib/libcrypto/Makefile.inc b/lib/libcrypto/Makefile.inc
new file mode 100644
index 0000000000..6a20abed61
--- /dev/null
+++ b/lib/libcrypto/Makefile.inc
@@ -0,0 +1,52 @@
+OSSLVERSION=	3.0.0
+OSSLDATE=	2021-09-07
+LCRYPTO_SRC=	${.CURDIR}/../../crypto/openssl
+LCRYPTO_DOC=	${LCRYPTO_SRC}/doc
+
+CFLAGS+=	-DOPENSSL_THREADS
+CFLAGS+=	-DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN
+CFLAGS+=	-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT \
+		-DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM \
+		-DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM \
+		-DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
+CFLAGS+=	-I${LCRYPTO_SRC} -I${LCRYPTO_SRC}/include \
+		-I${LCRYPTO_SRC}/crypto \
+		-I${LCRYPTO_SRC}/crypto/asn1 -I${LCRYPTO_SRC}/crypto/evp \
+		-I${LCRYPTO_SRC}/crypto/modes \
+		-I${LCRYPTO_SRC}/crypto/engine -I${.OBJDIR}
+
+MANDIR=	${SHAREDIR}/openssl/man/man
+
+.if defined(LIB)
+_docs=	${LIB}
+_sec=	3
+.else
+_docs=	apps
+_sec=	1
+.endif
+
+man-update:
+.for manpage in ${MAN}
+	@(sec=${manpage:E}; \
+	pod=${manpage:R}.pod; \
+	cp ${LCRYPTO_DOC}/${_docs}/$$pod .; \
+	pod2man --section=$$sec --release="${OSSLVERSION}" \
+	  --date="${OSSLDATE}" --center="OpenSSL" \
+	  $$pod > ${.CURDIR}/man/${manpage}; \
+	rm $$pod; \
+	${ECHO} ${manpage})
+.endfor
+
+man-makefile-update:
+	rm -f ${.CURDIR}/Makefile.man
+	echo '# DO NOT EDIT: generated from man-makefile-update target' >> \
+	    ${.CURDIR}/Makefile.man
+	for i in ${LCRYPTO_DOC}/${_docs}/*.pod; do \
+		fn=`basename $$i .pod`; \
+		sec=`perl ${LCRYPTO_SRC}/util/extract-section.pl < $$i`; \
+		sec=$${sec:-${_sec}}; \
+		${ECHO} "MAN+= $$fn.$$sec" >> ${.CURDIR}/Makefile.man; \
+		perl ${LCRYPTO_SRC}/util/extract-names.pl < $$i | \
+		  sed -Ee "/^$$fn\$$/d;s/^(.*)/MLINKS+= $$fn.$$sec \1.$$sec/" >> \
+		    ${.CURDIR}/Makefile.man; \
+	done
diff --git a/lib/libcrypto/engines/Makefile b/lib/libcrypto/engines/Makefile
new file mode 100644
index 0000000000..fbb72af055
--- /dev/null
+++ b/lib/libcrypto/engines/Makefile
@@ -0,0 +1,8 @@
+# $FreeBSD$
+
+SUBDIR=		capi
+.if ${MACHINE_ARCH} == "x86_64"
+SUBDIR+=	padlock
+.endif
+
+.include <bsd.subdir.mk>
diff --git a/lib/libcrypto/engines/Makefile.inc b/lib/libcrypto/engines/Makefile.inc
new file mode 100644
index 0000000000..216c529b3f
--- /dev/null
+++ b/lib/libcrypto/engines/Makefile.inc
@@ -0,0 +1,14 @@
+# $FreeBSD$
+
+SHLIBDIR=	${LIBDIR}/engines
+
+OPENSSL_SRC=	${.CURDIR}/../../../../crypto/openssl
+
+CFLAGS+=	-I${OPENSSL_SRC}/engines
+CFLAGS+=	-I${OPENSSL_SRC}/include
+CFLAGS+=	-DL_ENDIAN
+CFLAGS+=	-DNDEBUG
+
+.PATH: ${OPENSSL_SRC}/engines
+
+WARNS?=		0
diff --git a/lib/libcrypto/engines/capi/Makefile b/lib/libcrypto/engines/capi/Makefile
new file mode 100644
index 0000000000..85b509e7b6
--- /dev/null
+++ b/lib/libcrypto/engines/capi/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+SHLIB_NAME?=	capi.so
+
+SRCS=	e_capi.c
+
+.include <bsd.lib.mk>
diff --git a/lib/libcrypto/engines/padlock/Makefile b/lib/libcrypto/engines/padlock/Makefile
new file mode 100644
index 0000000000..9d0462115b
--- /dev/null
+++ b/lib/libcrypto/engines/padlock/Makefile
@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+SHLIB_NAME?=	padlock.so
+
+SRCS=	e_padlock.c
+.if ${MACHINE_ARCH} == "x86_64"
+SRCS+=	e_padlock-x86_64.s
+.endif
+
+.include <bsd.lib.mk>
diff --git a/lib/libdmsg/Makefile b/lib/libdmsg/Makefile
index 6c2a2352d6..f61449d9eb 100644
--- a/lib/libdmsg/Makefile
+++ b/lib/libdmsg/Makefile
@@ -4,7 +4,8 @@ LIB=	dmsg
 SRCS+=	debug.c subs.c crypto.c msg.c msg_lnk.c service.c
 
 CFLAGS+=	-pthread
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 INCS=	dmsg.h
 
diff --git a/lib/libdmsg/crypto.c b/lib/libdmsg/crypto.c
index 15a1906e22..d5f9af93dc 100644
--- a/lib/libdmsg/crypto.c
+++ b/lib/libdmsg/crypto.c
@@ -62,6 +62,7 @@ static struct crypto_algo crypto_algos[] = {
 	{ NULL, 0, 0, NULL, NULL, NULL }
 };
 
+#if 0
 static
 unsigned long
 dmsg_crypto_id_callback(void)
@@ -81,14 +82,17 @@ dmsg_crypto_locking_callback(int mode, int type,
 		pthread_mutex_unlock(&crypto_locks[type]);
 	}
 }
+#endif
 
 void
 dmsg_crypto_setup(void)
 {
 	crypto_count = CRYPTO_num_locks();
 	crypto_locks = calloc(crypto_count, sizeof(crypto_locks[0]));
+#if 0
 	CRYPTO_set_id_callback(dmsg_crypto_id_callback);
 	CRYPTO_set_locking_callback(dmsg_crypto_locking_callback);
+#endif
 }
 
 static
@@ -114,13 +118,13 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 		dmx_printf(6, "%02x", (unsigned char)iv_fixed[i]);
 	dmx_printf(6, "%s\n", " (fixed part only)");
 
-	EVP_CIPHER_CTX_init(&ioq->ctx);
+	ioq->ctx = EVP_CIPHER_CTX_new();
 
 	if (enc)
-		ok = EVP_EncryptInit_ex(&ioq->ctx, EVP_aes_256_gcm(), NULL,
+		ok = EVP_EncryptInit_ex(ioq->ctx, EVP_aes_256_gcm(), NULL,
 					(unsigned char*)key, NULL);
 	else
-		ok = EVP_DecryptInit_ex(&ioq->ctx, EVP_aes_256_gcm(), NULL,
+		ok = EVP_DecryptInit_ex(ioq->ctx, EVP_aes_256_gcm(), NULL,
 					(unsigned char*)key, NULL);
 	if (!ok)
 		goto fail;
@@ -143,7 +147,7 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 	 * With a chunk size of 64 bytes, this adds up to 1 zettabyte of
 	 * traffic.
 	 */
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_SET_IVLEN,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_SET_IVLEN,
 				 DMSG_CRYPTO_GCM_IV_SIZE, NULL);
 	if (!ok)
 		goto fail;
@@ -159,7 +163,7 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 	 * as GCM, will cause an error in _finish if the pt/ct size is not
 	 * a multiple of the cipher block size.
 	 */
-	EVP_CIPHER_CTX_set_padding(&ioq->ctx, 0);
+	EVP_CIPHER_CTX_set_padding(ioq->ctx, 0);
 
 	return 0;
 
@@ -203,24 +207,24 @@ dmsg_crypto_gcm_encrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	*out_size = 0;
 
 	/* Re-initialize with new IV (but without redoing the key schedule) */
-	ok = EVP_EncryptInit_ex(&ioq->ctx, NULL, NULL, NULL,
+	ok = EVP_EncryptInit_ex(ioq->ctx, NULL, NULL, NULL,
 		(unsigned char*)ioq->iv);
 	if (!ok)
 		goto fail;
 
 	u_len = 0;	/* safety */
-	ok = EVP_EncryptUpdate(&ioq->ctx, (unsigned char*)ct, &u_len,
+	ok = EVP_EncryptUpdate(ioq->ctx, (unsigned char*)ct, &u_len,
 		(unsigned char*)pt, in_size);
 	if (!ok)
 		goto fail;
 
 	f_len = 0;	/* safety */
-	ok = EVP_EncryptFinal_ex(&ioq->ctx, (unsigned char*)ct + u_len, &f_len);
+	ok = EVP_EncryptFinal_ex(ioq->ctx, (unsigned char*)ct + u_len, &f_len);
 	if (!ok)
 		goto fail;
 
 	/* Retrieve auth tag */
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_GET_TAG,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_GET_TAG,
 				 DMSG_CRYPTO_GCM_TAG_SIZE,
 				 ct + u_len + f_len);
 	if (!ok)
@@ -233,14 +237,14 @@ dmsg_crypto_gcm_encrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	}
 
 	*out_size = u_len + f_len + DMSG_CRYPTO_GCM_TAG_SIZE;
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 
 	return 0;
 
 fail:
 	ioq->error = DMSG_IOQ_ERROR_ALGO;
 fail_out:
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 	dm_printf(1, "%s\n", "error during encrypt_chunk");
 	return -1;
 }
@@ -256,14 +260,14 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	*consume_size = 0;
 
 	/* Re-initialize with new IV (but without redoing the key schedule) */
-	ok = EVP_DecryptInit_ex(&ioq->ctx, NULL, NULL, NULL,
+	ok = EVP_DecryptInit_ex(ioq->ctx, NULL, NULL, NULL,
 		(unsigned char*)ioq->iv);
 	if (!ok) {
 		ioq->error = DMSG_IOQ_ERROR_ALGO;
 		goto fail_out;
 	}
 
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_SET_TAG,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_SET_TAG,
 				 DMSG_CRYPTO_GCM_TAG_SIZE,
 				 ct + out_size);
 	if (!ok) {
@@ -271,12 +275,12 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 		goto fail_out;
 	}
 
-	ok = EVP_DecryptUpdate(&ioq->ctx, (unsigned char*)pt, &u_len,
+	ok = EVP_DecryptUpdate(ioq->ctx, (unsigned char*)pt, &u_len,
 		(unsigned char*)ct, out_size);
 	if (!ok)
 		goto fail;
 
-	ok = EVP_DecryptFinal_ex(&ioq->ctx, (unsigned char*)pt + u_len, &f_len);
+	ok = EVP_DecryptFinal_ex(ioq->ctx, (unsigned char*)pt + u_len, &f_len);
 	if (!ok)
 		goto fail;
 
@@ -287,14 +291,14 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	}
 
 	*consume_size = u_len + f_len + DMSG_CRYPTO_GCM_TAG_SIZE;
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 
 	return 0;
 
 fail:
 	ioq->error = DMSG_IOQ_ERROR_MACFAIL;
 fail_out:
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 	dm_printf(1, "%s\n",
 		  "error during decrypt_chunk "
 		  "(likely authentication error)");
diff --git a/lib/libdmsg/dmsg.h b/lib/libdmsg/dmsg.h
index cc73a44fa0..7234c5e892 100644
--- a/lib/libdmsg/dmsg.h
+++ b/lib/libdmsg/dmsg.h
@@ -251,7 +251,7 @@ struct dmsg_ioq {
 	int		error;
 	int		seq;			/* salt sequencer */
 	int		msgcount;
-	EVP_CIPHER_CTX	ctx;
+	EVP_CIPHER_CTX	*ctx;
 	char		iv[DMSG_MAX_IV_SIZE]; /* encrypt or decrypt iv[] */
 	dmsg_msg_t	*msg;
 	dmsg_msg_queue_t msgq;
diff --git a/lib/libfetch/Makefile b/lib/libfetch/Makefile
index c236aceffb..6cae1cef13 100644
--- a/lib/libfetch/Makefile
+++ b/lib/libfetch/Makefile
@@ -9,7 +9,7 @@ INCS=		fetch.h
 MAN=		fetch.3
 CLEANFILES=	ftperr.h httperr.h
 
-CFLAGS+=	-DWITH_SSL
+CFLAGS+=	-DWITH_SSL -DOPENSSL_SUPPRESS_DEPRECATED
 DPADD=		${LIBSSL} ${LIBCRYPTO}
 LDADD=		-lprivate_ssl -lprivate_crypto
 CFLAGS+=	${PRIVATELIB_CFLAGS}
diff --git a/lib/libldns/Makefile b/lib/libldns/Makefile
index 5668e210db..ac9566c58c 100644
--- a/lib/libldns/Makefile
+++ b/lib/libldns/Makefile
@@ -56,7 +56,8 @@ CFLAGS+= 	-I${.CURDIR} -I${LDNS}
 
 LDADD=		-lprivate_crypto
 DPADD=		${LIBCRYPTO}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 LDFLAGS+=       -rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
 
 WARNS?=		2
diff --git a/lib/libldns/ldns/config.h b/lib/libldns/ldns/config.h
index 0993c32416..cb4b5a3ec5 100644
--- a/lib/libldns/ldns/config.h
+++ b/lib/libldns/ldns/config.h
@@ -42,11 +42,11 @@
 
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
    don't. */
-#define HAVE_DECL_NID_ED25519 0
+#define HAVE_DECL_NID_ED25519 1
 
 /* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
    don't. */
-#define HAVE_DECL_NID_ED448 0
+#define HAVE_DECL_NID_ED448 1
 
 /* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
@@ -84,10 +84,10 @@
 /* #undef HAVE_ENGINE_LOAD_CRYPTODEV */
 
 /* Define to 1 if you have the `ERR_load_crypto_strings' function. */
-#define HAVE_ERR_LOAD_CRYPTO_STRINGS 1
+/* #undef HAVE_ERR_LOAD_CRYPTO_STRINGS */
 
 /* Define to 1 if you have the `EVP_dss1' function. */
-#define HAVE_EVP_DSS1 1
+/* #undef HAVE_EVP_DSS1 */
 
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #define HAVE_EVP_MD_CTX_NEW 1
@@ -150,7 +150,7 @@
 /* #undef HAVE_LIBPCAP */
 
 /* Define if we have LibreSSL */
-#define HAVE_LIBRESSL 1
+/* #undef HAVE_LIBRESSL */
 
 /* Define to 1 if you have the `localtime_r' function. */
 #define HAVE_LOCALTIME_R 1
@@ -389,10 +389,10 @@
 #define USE_ECDSA 1
 
 /* Define this to enable ED25519 support. */
-/* #undef USE_ED25519 */
+#define USE_ED25519 1
 
 /* Define this to enable ED448 support. */
-/* #undef USE_ED448 */
+#define USE_ED448 1
 
 /* Define this to enable GOST support. */
 /* #undef USE_GOST */
diff --git a/lib/librecrypto/Makefile b/lib/librecrypto/Makefile
deleted file mode 100644
index 885d96243f..0000000000
--- a/lib/librecrypto/Makefile
+++ /dev/null
@@ -1,303 +0,0 @@
-# This version of librecrypto is from LibreSSL
-.include "Makefile.inc"
-
-LIB= 		private_crypto
-SHLIB_MAJOR=	46
-PRIVATELIB=	shpub
-
-SHLIBDIR?=	/lib
-WARNS?=		2
-NO_STRICT_ALIASING=
-
-INCS+=  	aes.h asn1.h asn1t.h bio.h blowfish.h bn.h
-INCS+=  	buffer.h camellia.h cast.h chacha.h cmac.h comp.h conf.h
-INCS+=  	conf_api.h crypto.h curve25519.h des.h dh.h dsa.h dso.h
-INCS+=  	ec.h ecdh.h ecdsa.h err.h evp.h gost.h
-INCS+=  	hkdf.h hmac.h idea.h lhash.h md4.h md5.h modes.h
-INCS+=		obj_mac.h objects.h ocsp.h
-INCS+=		opensslconf.h opensslfeatures.h opensslv.h ossl_typ.h
-INCS+=  	pem.h pem2.h pkcs12.h pkcs7.h poly1305.h rand.h rc2.h rc4.h
-INCS+=  	ripemd.h rsa.h safestack.h sha.h sm3.h sm4.h stack.h
-INCS+=  	ts.h txt_db.h ui.h whrlpool.h x509.h x509_verify.h x509_vfy.h
-INCS+=  	x509v3.h
-INCSDIR=	${INCLUDEDIR}/priv/openssl
-# explicitly disabled: engine.h
-# not needed: ui_compat.h
-
-CFLAGS+=	-I${LCRYPTO_SRC}/modes -I${LCRYPTO_SRC}/asn1
-CFLAGS+=	-I${LCRYPTO_SRC}/bn -I${LCRYPTO_SRC}/ec -I${LCRYPTO_SRC}/ecdsa
-CFLAGS+=	-I${LCRYPTO_SRC}/ecdh -I${LCRYPTO_SRC}/cms
-CFLAGS+=	-I${LCRYPTO_SRC}/evp -I${.OBJDIR}
-
-CFLAGS+=	-DLIBRESSL_INTERNAL
-CFLAGS+=	-D__STRICT_ALIGNMENT
-
-# Do not use ASM if -flto for now
-.if ${CFLAGS:M-flto}
-CFLAGS+=	-DOPENSSL_NO_ASM
-NOASM_AES=	aes_cbc.c aes_core.c
-NOASM_CAMELLIA=	camellia.c cmll_cbc.c
-NOASM_RC4=	rc4_enc.c rc4_skey.c
-NOASM_WHRLPOOL=	wp_block.c
-.else
-FLAGS_GROUPS=	asms asm
-
-asms_FLAGS=	-DHAVE_GNU_STACK
-asms_FLAGS_FILES=${ASM_X86_64_ELF}
-
-asm_FLAGS=	-DOPENSSL_CPUID_OBJ
-asm_FLAGS+=	-DAES_ASM -DBSAES_ASM -DVPAES_ASM
-asm_FLAGS+=	-DOPENSSL_IA32_SSE2
-asm_FLAGS+=	-DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m
-asm_FLAGS+=	-DGHASH_ASM
-asm_FLAGS+=	-DMD5_ASM
-asm_FLAGS+=	-DSHA1_ASM -DSHA256_ASM -DSHA512_ASM
-asm_FLAGS+=	-DWHIRLPOOL_ASM
-# unavailable: -DRSA_ASM
-asm_FLAGS_FILES=	cryptlib.c
-asm_FLAGS_FILES+=	aes_core.c e_aes.c e_aes_cbc_hmac_sha1.c
-asm_FLAGS_FILES+=	e_aes.c gcm128.c
-asm_FLAGS_FILES+=	bn_asm.c bn_exp.c bn_mont.c ec_cvt.c bn_gf2m.c
-asm_FLAGS_FILES+=	gcm128.c
-asm_FLAGS_FILES+=	md5_dgst.c
-asm_FLAGS_FILES+=	sha1dgst.c sha256.c sha512.c
-asm_FLAGS_FILES+=	wp_block.c
-
-ASM_X86_64_AES=		aes-elf-x86_64.S bsaes-elf-x86_64.S vpaes-elf-x86_64.S \
-			aesni-elf-x86_64.S aesni-sha1-elf-x86_64.S
-ASM_X86_64_BN=		modexp512-elf-x86_64.S mont-elf-x86_64.S \
-			mont5-elf-x86_64.S gf2m-elf-x86_64.S
-ASM_X86_64_CAMELLIA=	cmll-elf-x86_64.S
-ASM_X86_64_MD5=		md5-elf-x86_64.S
-ASM_X86_64_MODES=	ghash-elf-x86_64.S
-ASM_X86_64_RC4=		rc4-elf-x86_64.S rc4-md5-elf-x86_64.S
-ASM_X86_64_SHA=		sha1-elf-x86_64.S sha256-elf-x86_64.S sha512-elf-x86_64.S
-ASM_X86_64_WHRLPOOL=	wp-elf-x86_64.S
-ASM_X86_64_ELF=	${ASM_X86_64_AES} ${ASM_X86_64_BN} ${ASM_X86_64_CAMELLIA} \
-		${ASM_X86_64_MD5} ${ASM_X86_64_MODES} ${ASM_X86_64_RC4} \
-		${ASM_X86_64_SHA} ${ASM_X86_64_WHRLPOOL} cpuid-elf-x86_64.S
-NOASM_AES=
-NOASM_CAMELLIA=
-NOASM_RC4=
-NOASM_WHRLPOOL=
-.endif
-
-# Based on vendor libcrypto_la_SOURCES definitions with subdirectories stripped out
-
-SRC_TOP=	cpt_err.c cryptlib.c crypto_init.c crypto_lock.c cversion.c \
-		ex_data.c malloc-wrapper.c mem_dbg.c o_init.c o_time.c
-# not needed: mem_clr.c o_str.c
-SRC_AES=	aes_ige.c aes_misc.c aes_wrap.c ${NOASM_AES}
-# not needed: aes_cfb.c aes_ctr.c aes_ecb.c aes_ofb.c
-SRC_ASN1=	a_bitstr.c a_bool.c a_d2i_fp.c a_digest.c a_dup.c a_enum.c \
-		a_i2d_fp.c a_int.c a_mbstr.c a_object.c a_octet.c a_print.c \
-		a_sign.c a_strex.c a_strnid.c a_time.c \
-		a_time_tm.c a_type.c a_utf8.c a_verify.c ameth_lib.c \
-		asn1_err.c asn1_gen.c asn1_lib.c asn1_par.c asn_mime.c \
-		asn_moid.c asn_pack.c bio_asn1.c bio_ndef.c d2i_pr.c \
-		evp_asn1.c f_int.c f_string.c i2d_pr.c \
-		n_pkey.c nsseq.c p5_pbe.c p5_pbev2.c p8_pkey.c \
-		t_crl.c t_pkey.c t_req.c t_spki.c t_x509.c t_x509a.c \
-		tasn_dec.c tasn_enc.c tasn_fre.c tasn_new.c tasn_prn.c \
-		tasn_typ.c tasn_utl.c x_algor.c x_attrib.c x_bignum.c \
-		x_crl.c x_exten.c x_info.c x_long.c x_name.c x_nx509.c \
-		x_pkey.c x_pubkey.c x_req.c x_sig.c x_spki.c \
-		x_val.c x_x509.c x_x509a.c
-# not needed: d2i_pu.c f_enum.c i2d_pu.c t_bitst.c
-SRC_BF=		bf_cfb64.c bf_ecb.c bf_enc.c bf_ofb64.c bf_skey.c
-SRC_BIO=	b_dump.c b_posix.c b_print.c b_sock.c bf_buff.c bf_nbio.c \
-		bio_cb.c bio_err.c bio_lib.c bss_acpt.c \
-		bss_conn.c bss_dgram.c bss_fd.c bss_file.c \
-		bss_mem.c bss_null.c bss_sock.c
-# not needed: bf_null.c bio_meth.c bss_bio.c bss_log.c
-SRC_BN=		bn_add.c bn_asm.c bn_blind.c bn_const.c bn_ctx.c \
-		bn_div.c bn_err.c bn_exp.c bn_exp2.c bn_gcd.c bn_gf2m.c \
-		bn_kron.c bn_lib.c bn_mod.c bn_mont.c bn_mul.c \
-		bn_nist.c bn_prime.c bn_print.c bn_rand.c bn_recp.c \
-		bn_shift.c bn_sqr.c bn_sqrt.c bn_word.c
-# not needed: bn_depr.c bn_mpi.c bn_x931p.c
-SRC_BUFFER=	buf_err.c buffer.c
-# not needed: buf_str.c
-SRC_CAMELLIA=	cmll_cfb.c cmll_ctr.c cmll_ecb.c cmll_misc.c \
-		cmll_ofb.c ${NOASM_CAMELLIA}
-# not needed but included: cmll_ctr.c
-SRC_CAST=	c_cfb64.c c_ecb.c c_enc.c c_ofb64.c c_skey.c
-SRC_CHACHA=	chacha.c
-SRC_CMAC=	cm_ameth.c cm_pmeth.c cmac.c
-SRC_CMS=	cms_asn1.c cms_cd.c cms_enc.c cms_err.c cms_io.c cms_pwri.c \
-		cms_smime.c cms_att.c cms_dd.c cms_env.c cms_ess.c cms_kari.c \
-		cms_lib.c cms_sd.c
-SRC_COMP=
-# not needed: c_rle.c c_zlib.c comp_err.c comp_lib.c
-SRC_CONF=	conf_api.c conf_def.c conf_err.c conf_lib.c \
-		conf_mall.c conf_mod.c conf_sap.c
-SRC_CURVE25519= curve25519-generic.c curve25519.c
-SRC_DES=	cbc_enc.c cfb64ede.c cfb64enc.c cfb_enc.c \
-		des_enc.c ecb3_enc.c ecb_enc.c \
-		fcrypt.c fcrypt_b.c ofb64ede.c ofb64enc.c \
-		rand_key.c set_key.c xcbc_enc.c
-# not needed: cbc_cksm.c ede_cbcm_enc.c enc_read.c enc_writ.c
-# not needed: ofb_enc.c pcbc_enc.c qud_cksm.c str2key.c
-SRC_DH=		dh_ameth.c dh_asn1.c dh_check.c dh_err.c dh_gen.c \
-		dh_key.c dh_lib.c dh_pmeth.c dh_prn.c
-# deprecated: dh_depr.c
-# needed: dh_prn.c (for openssh/kexdhc.c)
-SRC_DSA=	dsa_ameth.c dsa_asn1.c dsa_err.c dsa_gen.c \
-		dsa_key.c dsa_lib.c dsa_ossl.c dsa_pmeth.c dsa_prn.c \
-		dsa_sign.c dsa_vrf.c dsa_depr.c dsa_meth.c
-# deprecated: dsa_depr.c (needed for contrib/ldns/keys.c)
-# not needed but included: dsa_meth.c
-SRC_DSO=	dso_err.c dso_lib.c dso_null.c dso_openssl.c
-# explictly disabled: dso_dlfcn.c
-SRC_EC=		ec2_mult.c ec2_oct.c ec2_smpl.c ec_ameth.c ec_asn1.c \
-		ec_check.c ec_curve.c ec_cvt.c ec_err.c ec_key.c ec_kmeth.c \
-		ec_lib.c ec_mult.c ec_oct.c ec_pmeth.c ec_print.c \
-		eck_prn.c ecp_mont.c ecp_nist.c ecp_oct.c ecp_smpl.c
-SRC_ECDH=	ecdh_kdf.c ech_err.c ech_key.c ech_lib.c
-SRC_ECDSA=	ecs_asn1.c ecs_err.c ecs_lib.c ecs_ossl.c ecs_sign.c ecs_vrf.c
-SRC_ENGINE=	# explicitly disabled
-#SRC_ENGINE=	eng_all.c eng_cnf.c eng_ctrl.c eng_dyn.c eng_err.c eng_fat.c \
-#		eng_init.c eng_lib.c eng_list.c eng_openssl.c eng_pkey.c \
-#		eng_table.c tb_asnmth.c tb_cipher.c tb_dh.c tb_digest.c \
-#		tb_dsa.c tb_ecdh.c tb_ecdsa.c tb_eckey.c tb_pkmeth.c \
-#		tb_rand.c tb_rsa.c tb_store.c
-SRC_ERR=	err.c err_all.c err_prn.c
-SRC_EVP=	bio_b64.c bio_enc.c bio_md.c c_all.c digest.c e_aes.c \
-		e_aes_cbc_hmac_sha1.c e_bf.c e_camellia.c e_cast.c e_chacha.c \
-		e_chacha20poly1305.c e_des.c e_des3.c e_gost2814789.c \
-		e_idea.c e_null.c e_rc2.c e_rc4.c e_rc4_hmac_md5.c e_sm4.c \
-		e_xcbc_d.c encode.c evp_aead.c evp_enc.c evp_err.c evp_key.c \
-		evp_lib.c evp_pbe.c evp_pkey.c m_dss.c m_dss1.c m_ecdsa.c \
-		m_gost2814789.c m_gostr341194.c m_md4.c m_md5.c m_md5_sha1.c \
-		m_ripemd.c m_sha1.c m_sigver.c m_sm3.c m_streebog.c m_wp.c \
-		names.c p5_crpt.c p5_crpt2.c p_lib.c p_sign.c p_verify.c \
-		pmeth_fn.c pmeth_gn.c pmeth_lib.c
-# not needed: e_old.c m_null.c p_dec.c p_enc.c p_open.c p_seal.c
-SRC_GOST=	gost2814789.c gost89_keywrap.c gost89_params.c gost89imit_ameth.c \
-		gost89imit_pmeth.c gost_asn1.c gost_err.c gostr341001.c \
-		gostr341001_ameth.c gostr341001_key.c gostr341001_params.c \
-		gostr341001_pmeth.c gostr341194.c streebog.c
-SRC_HKDF=	hkdf.c
-SRC_HMAC=	hm_ameth.c hm_pmeth.c hmac.c
-SRC_IDEA=	i_cbc.c i_cfb64.c i_ecb.c i_ofb64.c i_skey.c
-SRC_LHASH=	lh_stats.c lhash.c
-SRC_MD4=	md4_dgst.c md4_one.c
-SRC_MD5=	md5_dgst.c md5_one.c
-SRC_MODES=	cbc128.c ccm128.c cfb128.c ctr128.c gcm128.c \
-		ofb128.c xts128.c
-# not needed: cts128.c
-SRC_OBJECTS=	o_names.c obj_dat.c obj_err.c obj_lib.c obj_xref.c
-SRC_OCSP=	ocsp_asn.c ocsp_cl.c ocsp_err.c ocsp_ext.c ocsp_ht.c \
-		ocsp_lib.c ocsp_prn.c ocsp_srv.c ocsp_vfy.c
-SRC_PEM=	pem_all.c pem_err.c pem_info.c pem_lib.c pem_oth.c pem_pk8.c \
-		pem_pkey.c pem_x509.c pem_xaux.c pvkfmt.c
-# not needed: pem_seal.c pem_sign.c
-SRC_PKCS12=	p12_add.c p12_asn.c p12_attr.c p12_crpt.c p12_crt.c \
-		p12_decr.c p12_init.c p12_key.c p12_kiss.c p12_mutl.c \
-		p12_p8d.c p12_p8e.c p12_utl.c pk12err.c
-# not needed: p12_npas.c
-SRC_PKCS7=	pk7_asn1.c pk7_attr.c pk7_doit.c pk7_lib.c \
-		pk7_mime.c pk7_smime.c pkcs7err.c
-# not needed: bio_pk7.c
-SRC_POLY1305=	poly1305.c
-SRC_RAND=	rand_err.c rand_lib.c
-# not needed: randfile.c
-SRC_RC2=	rc2_cbc.c rc2_ecb.c rc2_skey.c rc2cfb64.c rc2ofb64.c
-SRC_RC4=	${NOASM_RC4}
-SRC_RIPEMD=	rmd_dgst.c rmd_one.c
-SRC_RSA=	rsa_ameth.c rsa_asn1.c rsa_chk.c rsa_crpt.c rsa_depr.c \
-		rsa_eay.c rsa_err.c rsa_gen.c rsa_lib.c rsa_meth.c rsa_none.c \
-		rsa_oaep.c rsa_pk1.c rsa_pmeth.c rsa_prn.c rsa_pss.c \
-		rsa_sign.c rsa_x931.c
-# deprecated but needed: rsa_depr.c (for openssh/sshkey.c)
-# not needed: rsa_saos.c
-SRC_SHA=	sha1_one.c sha1dgst.c sha256.c sha512.c
-SRC_SM3=	sm3.c
-SRC_SM4=	sm4.c
-SRC_STACK=	stack.c
-SRC_TS=		ts_asn1.c ts_conf.c ts_err.c ts_lib.c ts_req_print.c \
-		ts_req_utils.c ts_rsp_print.c ts_rsp_sign.c ts_rsp_utils.c \
-		ts_rsp_verify.c ts_verify_ctx.c
-SRC_TXT_DB=	txt_db.c
-SRC_UI=		ui_err.c ui_lib.c ui_openssl.c
-# not needed: ui_util.c
-SRC_WHRLPOOL=	wp_dgst.c ${NOASM_WHRLPOOL}
-SRC_X509=	by_dir.c by_file.c by_mem.c pcy_cache.c pcy_data.c pcy_lib.c \
-		pcy_map.c pcy_node.c pcy_tree.c x509_akey.c x509_akeya.c x509_alt.c \
-		x509_att.c x509_bcons.c x509_bitst.c x509_cmp.c x509_conf.c \
-		x509_constraints.c x509_cpols.c x509_crld.c x509_d2.c x509_def.c \
-		x509_enum.c x509_err.c x509_ext.c x509_extku.c x509_genn.c \
-		x509_ia5.c x509_info.c x509_int.c x509_issuer_cache.c x509_lib.c \
-		x509_lu.c x509_ncons.c x509_obj.c x509_ocsp.c x509_pci.c x509_pcia.c \
-		x509_pcons.c x509_pku.c x509_pmaps.c x509_prn.c x509_purp.c \
-		x509_skey.c x509_sxnet.c x509_r2x.c x509_req.c x509_set.c x509_trs.c \
-		x509_txt.c x509_utl.c x509_v3.c x509_verify.c x509_vfy.c x509_vpm.c \
-		x509cset.c x509name.c x509rset.c x509spki.c x509type.c x_all.c
-
-SRCS=		${ASM_X86_64_ELF} ${SRC_TOP} ${SRC_AES} ${SRC_ASN1} \
-		${SRC_BF} ${SRC_BIO} ${SRC_BN} ${SRC_BUFFER} ${SRC_CAMELLIA} \
-		${SRC_CAST} ${SRC_CHACHA} ${SRC_CMAC} ${SRC_CMS} ${SRC_COMP} \
-		${SRC_CONF} ${SRC_DES} ${SRC_DH} ${SRC_DSA} ${SRC_DSO} \
-		${SRC_EC} ${SRC_ECDH} ${SRC_ECDSA} ${SRC_ENGINE} ${SRC_ERR} \
-		${SRC_EVP} ${SRC_GOST} ${SRC_HMAC} ${SRC_HKDF} ${SRC_IDEA} \
-		${SRC_LHASH} ${SRC_MD4} ${SRC_MD5} ${SRC_MODES} \
-		${SRC_OBJECTS} ${SRC_OCSP} ${SRC_PEM} ${SRC_PKCS12} \
-		${SRC_PKCS7} ${SRC_POLY1305} ${SRC_RAND} ${SRC_RC2} \
-		${SRC_RIPEMD} ${SRC_RSA} ${SRC_SHA} ${SRC_STACK} ${SRC_TS} \
-		${SRC_TXT_DB} ${SRC_UI} ${SRC_WHRLPOOL} ${SRC_X509} \
-		${SRC_CURVE25519} ${SRC_RC4} ${SRC_SM3} ${SRC_SM4}
-
-.PATH:	${LCRYPTO_SRC} \
-	${LCRYPTO_SRC}/aes \
-	${LCRYPTO_SRC}/asn1 \
-	${LCRYPTO_SRC}/bf \
-	${LCRYPTO_SRC}/bio \
-	${LCRYPTO_SRC}/bn \
-	${LCRYPTO_SRC}/buffer \
-	${LCRYPTO_SRC}/camellia \
-	${LCRYPTO_SRC}/cast \
-	${LCRYPTO_SRC}/chacha \
-	${LCRYPTO_SRC}/cmac \
-	${LCRYPTO_SRC}/cms \
-	${LCRYPTO_SRC}/conf \
-	${LCRYPTO_SRC}/curve25519 \
-	${LCRYPTO_SRC}/des \
-	${LCRYPTO_SRC}/dh \
-	${LCRYPTO_SRC}/dsa \
-	${LCRYPTO_SRC}/dso \
-	${LCRYPTO_SRC}/ec \
-	${LCRYPTO_SRC}/ecdh \
-	${LCRYPTO_SRC}/ecdsa \
-	${LCRYPTO_SRC}/err \
-	${LCRYPTO_SRC}/evp \
-	${LCRYPTO_SRC}/gost \
-	${LCRYPTO_SRC}/hmac \
-	${LCRYPTO_SRC}/hkdf \
-	${LCRYPTO_SRC}/idea \
-	${LCRYPTO_SRC}/lhash \
-	${LCRYPTO_SRC}/md4 \
-	${LCRYPTO_SRC}/md5 \
-	${LCRYPTO_SRC}/modes \
-	${LCRYPTO_SRC}/objects \
-	${LCRYPTO_SRC}/ocsp \
-	${LCRYPTO_SRC}/pem \
-	${LCRYPTO_SRC}/pkcs12 \
-	${LCRYPTO_SRC}/pkcs7 \
-	${LCRYPTO_SRC}/poly1305 \
-	${LCRYPTO_SRC}/rand \
-	${LCRYPTO_SRC}/rc2 \
-	${LCRYPTO_SRC}/rc4 \
-	${LCRYPTO_SRC}/ripemd \
-	${LCRYPTO_SRC}/rsa \
-	${LCRYPTO_SRC}/sha \
-	${LCRYPTO_SRC}/sm3 \
-	${LCRYPTO_SRC}/sm4 \
-	${LCRYPTO_SRC}/stack \
-	${LCRYPTO_SRC}/ts \
-	${LCRYPTO_SRC}/txt_db \
-	${LCRYPTO_SRC}/ui \
-	${LCRYPTO_SRC}/whrlpool \
-	${LCRYPTO_SRC}/x509 \
-	${LIBRESSL_SRC}/include/openssl
-
-.include <bsd.lib.mk>
diff --git a/lib/librecrypto/Makefile.inc b/lib/librecrypto/Makefile.inc
deleted file mode 100644
index c482058456..0000000000
--- a/lib/librecrypto/Makefile.inc
+++ /dev/null
@@ -1,12 +0,0 @@
-.if exists (${.CURDIR}/../../Makefile.inc1)
-LIBRESSL_SRC=	${.CURDIR}/../../crypto/libressl
-.elif exists (${.CURDIR}/../../../Makefile.inc1)
-LIBRESSL_SRC=	${.CURDIR}/../../../crypto/libressl
-.else
-.error "Cannot find base directory"
-.endif
-LCRYPTO_SRC=	${LIBRESSL_SRC}/crypto
-LSSL_SRC=	${LIBRESSL_SRC}/ssl
-
-CFLAGS+=	-I${LCRYPTO_SRC} -I${LSSL_SRC} -I${.OBJDIR}
-CFLAGS+=	-I${LIBRESSL_SRC}/include
diff --git a/lib/librecrypto/dfly_config.txt b/lib/librecrypto/dfly_config.txt
deleted file mode 100644
index a2801ac239..0000000000
--- a/lib/librecrypto/dfly_config.txt
+++ /dev/null
@@ -1,110 +0,0 @@
-
-#if 0
-/* added to openssl/opensslfeatures.h */
-#define OPENSSL_NO_ENGINE
-#define OPENSSL_NO_HW_PADLOCK
-#endif
-
-#if 0
-/* use as default */
-#define OPENSSLDIR "/etc/ssl"
-#endif
-
-#if 0
-/* unused */
-#define PACKAGE_NAME "libressl"
-#define PACKAGE_TARNAME "libressl"
-#define PACKAGE_VERSION "3.1.3"
-#define PACKAGE_STRING "libressl 3.1.3"
-#define PACKAGE_BUGREPORT ""
-#define PACKAGE_URL ""
-#define PACKAGE "libressl"
-#define VERSION "3.1.3"
-#define LT_OBJDIR ".libs/"
-#endif
-
-#if 0
-/* only if using/compiling compat/ sources */
-#define STDC_HEADERS 1
-#define HAVE_SYS_TYPES_H 1
-#define HAVE_SYS_STAT_H 1
-#define HAVE_STDLIB_H 1
-#define HAVE_STRING_H 1
-#define HAVE_MEMORY_H 1
-#define HAVE_STRINGS_H 1
-#define HAVE_INTTYPES_H 1
-#define HAVE_STDINT_H 1
-#define HAVE_UNISTD_H 1
-#define HAVE_SYMLINK 1
-#define HAVE_ERR_H 1
-#define HAVE_READPASSPHRASE_H 1
-#define HAVE_ASPRINTF 1
-#define HAVE_FREEZERO 1
-#define HAVE_MEMMEM 1
-#define HAVE_READPASSPHRASE 1
-#define HAVE_REALLOCARRAY 1
-#define HAVE_RECALLOCARRAY 1
-#define HAVE_STRLCAT 1
-#define HAVE_STRLCPY 1
-#define HAVE_STRNDUP 1
-#define HAVE_STRNLEN 1
-#define HAVE_STRSEP 1
-#define HAVE_STRTONUM 1
-#define HAVE_TIMEGM 1
-#define HAVE_GETPROGNAME 1
-#define HAVE_SYSLOG 1
-#define HAVE_ACCEPT4 1
-#define HAVE_PIPE2 1
-#define HAVE_POLL 1
-#define HAVE_SOCKETPAIR 1
-#define HAVE_ARC4RANDOM 1
-#define HAVE_ARC4RANDOM_BUF 1
-#define HAVE_ARC4RANDOM_UNIFORM 1
-#define HAVE_EXPLICIT_BZERO 1
-#define HAVE_TIMINGSAFE_BCMP 1
-#define HAVE_TIMINGSAFE_MEMCMP 1
-#define HAVE_DL_ITERATE_PHDR 1
-#define HAVE_CLOCK_GETTIME 1
-#define HAVE_VA_COPY 1
-#define HAVE___VA_COPY 1
-#define HAS_GNU_WARNING_LONG 1
-#define SIZEOF_TIME_T 8
-#endif
-
-#if 0
-/* global for libressl */
-#define LIBRESSL_INTERNAL
-#define __BEGIN_HIDDEN_DECLS
-#define __END_HIDDEN_DECLS
-#endif
-
-#if 0
-/* only for crypto/ * / *.c */
-#define __STRICT_ALIGNMENT
-#endif
-#if 0
-/* only for crypto/ * / *.S */
-#define HAVE_GNU_STACK
-#endif
-
-#if 0
-/* only for crypto/chacha/chacha-merged.c */
-#define __bounded__(x, y, z)
-#endif
-#if 0
-/* only for apps/ */
-#define pledge(request, paths) 0
-#define unveil(path, permissions) 0
-#endif
-#if 0
-/* only for apps/openssl/apps_posix.c */
-#define timespecsub(tsp, usp, vsp)                                      \
-        do {                                                            \
-                (vsp)->tv_sec = (tsp)->tv_sec - (usp)->tv_sec;          \
-                (vsp)->tv_nsec = (tsp)->tv_nsec - (usp)->tv_nsec;       \
-                if ((vsp)->tv_nsec < 0) {                               \
-                        (vsp)->tv_sec--;                                \
-                        (vsp)->tv_nsec += 1000000000L;                  \
-                }                                                       \
-        } while (0)
-#endif
diff --git a/lib/libressl/Makefile b/lib/libressl/Makefile
deleted file mode 100644
index 77a958f1d1..0000000000
--- a/lib/libressl/Makefile
+++ /dev/null
@@ -1,41 +0,0 @@
-# This version of libressl is from LibreSSL
-.include "../librecrypto/Makefile.inc"
-
-LIB=		private_ssl
-SHLIB_MAJOR=	48
-PRIVATELIB=	shpub
-
-SHLIBDIR?=	/lib
-WARNS?=		2
-
-CFLAGS+=	-DLIBRESSL_INTERNAL
-
-# from vendor makefile
-SRCS=	bio_ssl.c bs_cbb.c bs_cbs.c \
-	d1_both.c d1_clnt.c d1_lib.c d1_pkt.c d1_srtp.c d1_srvr.c \
-	pqueue.c s3_cbc.c s3_lib.c \
-	ssl_algs.c ssl_asn1.c ssl_both.c ssl_cert.c ssl_ciph.c ssl_ciphers.c \
-	ssl_clnt.c ssl_err.c ssl_init.c \
-	ssl_lib.c ssl_kex.c ssl_methods.c ssl_packet.c ssl_pkt.c ssl_rsa.c \
-	ssl_sess.c ssl_sigalgs.c ssl_srvr.c ssl_stat.c \
-	ssl_tlsext.c ssl_transcript.c ssl_txt.c ssl_versions.c \
-	t1_enc.c t1_lib.c \
-	tls12_record_layer.c \
-	tls13_buffer.c tls13_client.c tls13_error.c \
-	tls13_handshake.c tls13_handshake_msg.c tls13_key_schedule.c \
-	tls13_key_share.c tls13_legacy.c tls13_lib.c tls13_record.c \
-	tls13_record_layer.c tls13_server.c
-
-# not referenced:
-# bs_ber.c
-
-INCS=	cms.h dtls1.h srtp.h ssl.h ssl2.h ssl23.h ssl3.h tls1.h
-INCSDIR=	${INCLUDEDIR}/priv/openssl
-
-LDADD=		-lprivate_crypto
-DPADD=		${LIBCRYPTO}
-LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-
-.PATH:	${LSSL_SRC} ${LIBRESSL_SRC}/include/openssl
-
-.include <bsd.lib.mk>
diff --git a/lib/libssh/Makefile b/lib/libssh/Makefile
index 37e439d16d..e3f39145ea 100644
--- a/lib/libssh/Makefile
+++ b/lib/libssh/Makefile
@@ -51,8 +51,9 @@ MAN=	moduli.5
 WARNS?=	2
 NO_STRICT_ALIASING=
 
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	-I${.CURDIR} -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 CFLAGS+=	-I${.CURDIR}/../../contrib/ldns
 DPADD=		${LIBCRYPTO} ${LIBLDNS} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_crypto -lprivate_ldns -lutil -lz
diff --git a/lib/libssh/config.h b/lib/libssh/config.h
index a1cc77beaa..529887a056 100644
--- a/lib/libssh/config.h
+++ b/lib/libssh/config.h
@@ -464,7 +464,7 @@
 #define HAVE_ECDSA_SIG_SET0 1
 
 /* Define to 1 if you have the `EC_KEY_METHOD_new' function. */
-#define HAVE_EC_KEY_METHOD_NEW 1
+/* #undef HAVE_EC_KEY_METHOD_NEW */
 
 /* Define to 1 if you have the <elf.h> header file. */
 #define HAVE_ELF_H 1
@@ -500,19 +500,19 @@
 #define HAVE_EVP_CIPHER_CTX_CTRL 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_get_iv' function. */
-#define HAVE_EVP_CIPHER_CTX_GET_IV 1
+/* #undef HAVE_EVP_CIPHER_CTX_GET_IV */
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_get_updated_iv' function. */
-/* #undef HAVE_EVP_CIPHER_CTX_GET_UPDATED_IV */
+#define HAVE_EVP_CIPHER_CTX_GET_UPDATED_IV 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_iv' function. */
-/* #undef HAVE_EVP_CIPHER_CTX_IV */
+#define HAVE_EVP_CIPHER_CTX_IV 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_iv_noconst' function. */
-/* #undef HAVE_EVP_CIPHER_CTX_IV_NOCONST */
+#define HAVE_EVP_CIPHER_CTX_IV_NOCONST 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_set_iv' function. */
-#define HAVE_EVP_CIPHER_CTX_SET_IV 1
+/* #undef HAVE_EVP_CIPHER_CTX_SET_IV */
 
 /* Define to 1 if you have the `EVP_DigestFinal_ex' function. */
 #define HAVE_EVP_DIGESTFINAL_EX 1
@@ -521,7 +521,7 @@
 #define HAVE_EVP_DIGESTINIT_EX 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_cleanup' function. */
-#define HAVE_EVP_MD_CTX_CLEANUP 1
+/* #undef HAVE_EVP_MD_CTX_CLEANUP */
 
 /* Define to 1 if you have the `EVP_MD_CTX_copy_ex' function. */
 #define HAVE_EVP_MD_CTX_COPY_EX 1
@@ -530,7 +530,7 @@
 #define HAVE_EVP_MD_CTX_FREE 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_init' function. */
-#define HAVE_EVP_MD_CTX_INIT 1
+/* #undef HAVE_EVP_MD_CTX_INIT */
 
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #define HAVE_EVP_MD_CTX_NEW 1
@@ -767,7 +767,7 @@
 #define HAVE_HEADER_AD 1
 
 /* Define to 1 if you have the `HMAC_CTX_init' function. */
-#define HAVE_HMAC_CTX_INIT 1
+/* #undef HAVE_HMAC_CTX_INIT */
 
 /* Define if you have ut_host in utmp.h */
 /* #undef HAVE_HOST_IN_UTMP */
diff --git a/lib/libssh/openbsd-compat/openssl-compat.c b/lib/libssh/openbsd-compat/openssl-compat.c
index a37ca61bf2..83b5747d95 100644
--- a/lib/libssh/openbsd-compat/openssl-compat.c
+++ b/lib/libssh/openbsd-compat/openssl-compat.c
@@ -93,4 +93,62 @@ ssh_libcrypto_init(void)
 #endif /* USE_OPENSSL_ENGINE */
 }
 
+#ifndef HAVE_EVP_CIPHER_CTX_GET_IV
+int
+EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx, unsigned char *iv, size_t len)
+{
+	if (ctx == NULL)
+		return 0;
+	if (EVP_CIPHER_CTX_iv_length(ctx) < 0)
+		return 0;
+	if (len != (size_t)EVP_CIPHER_CTX_iv_length(ctx))
+		return 0;
+	if (len > EVP_MAX_IV_LENGTH)
+		return 0; /* sanity check; shouldn't happen */
+	/*
+	 * Skip the memcpy entirely when the requested IV length is zero,
+	 * since the iv pointer may be NULL or invalid.
+	 */
+	if (len != 0) {
+		if (iv == NULL)
+			return 0;
+# ifdef HAVE_EVP_CIPHER_CTX_IV
+		memcpy(iv, EVP_CIPHER_CTX_iv(ctx), len);
+# else
+		memcpy(iv, ctx->iv, len);
+# endif /* HAVE_EVP_CIPHER_CTX_IV */
+	}
+	return 1;
+}
+#endif /* HAVE_EVP_CIPHER_CTX_GET_IV */
+
+#ifndef HAVE_EVP_CIPHER_CTX_SET_IV
+int
+EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, const unsigned char *iv, size_t len)
+{
+	if (ctx == NULL)
+		return 0;
+	if (EVP_CIPHER_CTX_iv_length(ctx) < 0)
+		return 0;
+	if (len != (size_t)EVP_CIPHER_CTX_iv_length(ctx))
+		return 0;
+	if (len > EVP_MAX_IV_LENGTH)
+		return 0; /* sanity check; shouldn't happen */
+	/*
+	 * Skip the memcpy entirely when the requested IV length is zero,
+	 * since the iv pointer may be NULL or invalid.
+	 */
+	if (len != 0) {
+		if (iv == NULL)
+			return 0;
+# ifdef HAVE_EVP_CIPHER_CTX_IV_NOCONST
+		memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, len);
+# else
+		memcpy(ctx->iv, iv, len);
+# endif /* HAVE_EVP_CIPHER_CTX_IV_NOCONST */
+	}
+	return 1;
+}
+#endif /* HAVE_EVP_CIPHER_CTX_SET_IV */
+
 #endif /* WITH_OPENSSL */
diff --git a/lib/libssh/openbsd-compat/openssl-compat.h b/lib/libssh/openbsd-compat/openssl-compat.h
index 25638ef827..87d85d8b9f 100644
--- a/lib/libssh/openbsd-compat/openssl-compat.h
+++ b/lib/libssh/openbsd-compat/openssl-compat.h
@@ -46,5 +46,15 @@ void ssh_libcrypto_init(void);
 # define OPENSSL_DSA_MAX_MODULUS_BITS	10000
 #endif
 
+#ifndef HAVE_EVP_CIPHER_CTX_GET_IV
+int EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx,
+    unsigned char *iv, size_t len);
+#endif /* HAVE_EVP_CIPHER_CTX_GET_IV */
+
+#ifndef HAVE_EVP_CIPHER_CTX_SET_IV
+int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx,
+    const unsigned char *iv, size_t len);
+#endif /* HAVE_EVP_CIPHER_CTX_SET_IV */
+
 #endif /* WITH_OPENSSL */
 #endif /* _OPENSSL_COMPAT_H */
diff --git a/lib/libssl/Makefile b/lib/libssl/Makefile
new file mode 100644
index 0000000000..7dc39cf3fe
--- /dev/null
+++ b/lib/libssl/Makefile
@@ -0,0 +1,45 @@
+LIB=		private_ssl
+SHLIB_MAJOR=	49
+PRIVATELIB=	shpub
+SHLIBDIR?=	/lib
+
+WARNS?=		2
+
+OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
+
+.PATH:	${OPENSSL_SRC}/include/openssl \
+	${OPENSSL_SRC}/ssl \
+	${OPENSSL_SRC}/ssl/record \
+	${OPENSSL_SRC}/ssl/statem
+
+# base sources
+SRCS=	bio_ssl.c d1_lib.c d1_msg.c d1_srtp.c methods.c pqueue.c s3_enc.c \
+	s3_lib.c s3_msg.c ssl_asn1.c ssl_cert.c ssl_ciph.c ssl_conf.c \
+	ssl_err.c ssl_err_legacy.c ssl_init.c ssl_lib.c ssl_mcnf.c ssl_rsa.c \
+	ssl_rsa_legacy.c ssl_sess.c ssl_stat.c ssl_txt.c ssl_utst.c t1_enc.c \
+	t1_lib.c t1_trce.c tls13_enc.c tls_depr.c tls_srp.c
+
+# record
+SRCS+=	dtls1_bitmap.c rec_layer_d1.c rec_layer_s3.c ssl3_buffer.c \
+	ssl3_record.c ssl3_record_tls13.c
+
+# statem
+SRCS+=	extensions.c extensions_clnt.c extensions_cust.c extensions_srvr.c \
+	statem.c statem_clnt.c statem_dtls.c statem_lib.c statem_srvr.c
+
+CFLAGS+=-DAES_ASM \
+	-Wa,--noexecstack \
+	-DL_ENDIAN \
+	${PRIVATELIB_CFLAGS} \
+	-I${OPENSSL_SRC} \
+	-I${OPENSSL_SRC}/include \
+	-DOPENSSLDIR="\"/etc/ssl\""
+
+INCS=	dtls1.h prov_ssl.h srtp.h ssl.h sslerr.h sslerr_legacy.h ssl2.h \
+	ssl3.h tls1.h
+INCSDIR=${INCLUDEDIR}/priv/openssl
+
+DPADD=	${LIBPTHREAD}
+LDADD=	-lpthread
+
+.include <bsd.lib.mk>
diff --git a/lib/libtcplay/Makefile b/lib/libtcplay/Makefile
index 65f158f93c..104710a34e 100644
--- a/lib/libtcplay/Makefile
+++ b/lib/libtcplay/Makefile
@@ -19,7 +19,7 @@ MLINKS+=	tcplay.3	tc_api_task_get_error.3
 
 CFLAGS+=	-DMAJ_VER=${MAJ_VER} -DMIN_VER=${MIN_VER}
 CFLAGS+=	-D_FILE_OFFSET_BITS=64
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 SRCS+=		tcplay.c crc32.c safe_mem.c io.c hdr.c humanize.c
 SRCS+=		crypto.c generic_xts.c
diff --git a/lib/libtelnet/Makefile b/lib/libtelnet/Makefile
index 580f41111b..cbb586ac34 100644
--- a/lib/libtelnet/Makefile
+++ b/lib/libtelnet/Makefile
@@ -10,7 +10,8 @@ SRCS=		auth.c enc_des.c encrypt.c genget.c getent.c misc.c sra.c pk.c
 WARNS?=		2
 
 CFLAGS+=	-DENCRYPTION -DAUTHENTICATION -DSRA
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .if defined(RESCUE)
 CFLAGS+=	-DNOPAM
diff --git a/lib/libtelnet/pk.c b/lib/libtelnet/pk.c
index 8ef55f1906..0b028e3f5b 100644
--- a/lib/libtelnet/pk.c
+++ b/lib/libtelnet/pk.c
@@ -175,7 +175,6 @@ itobn(long i)
 	if ((n = BN_new()) == NULL)
 		errx(1, "could not create BIGNUM: %s",
 		     ERR_error_string(ERR_get_error(), 0));
-	BN_init(n);
 	if (i > 0)
 		BN_add_word(n, (u_long)i);
 	else
diff --git a/libexec/dma/dma-mbox-create/Makefile b/libexec/dma/dma-mbox-create/Makefile
index 4a372047e6..57bbf22e7c 100644
--- a/libexec/dma/dma-mbox-create/Makefile
+++ b/libexec/dma/dma-mbox-create/Makefile
@@ -4,7 +4,7 @@ CFLAGS+=-I${.CURDIR}/..
 CFLAGS+= -DHAVE_REALLOCF -DHAVE_STRLCPY -DHAVE_GETPROGNAME
 CFLAGS+=-DCONF_PATH='"/etc/dma"'
 CFLAGS+=-DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.13+"'
-CFLAGS+=-I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+=-I${.CURDIR}/../../../crypto/openssl/include
 
 PROG=	dma-mbox-create
 NOMAN=
diff --git a/libexec/dma/dma/Makefile b/libexec/dma/dma/Makefile
index 51ae9ae932..cce336f466 100644
--- a/libexec/dma/dma/Makefile
+++ b/libexec/dma/dma/Makefile
@@ -13,7 +13,8 @@ CFLAGS+=	-DLIBEXEC_PATH='"/usr/libexec"' -DDMA_VERSION='"v0.13+"'
 DPADD=		${LIBSSL} ${LIBCRYPTO}
 LDADD=		-lprivate_ssl -lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 BINOWN= root
 BINGRP= mail
diff --git a/libexec/ftpd/Makefile b/libexec/ftpd/Makefile
index 179893fdb7..1dceaa6ca4 100644
--- a/libexec/ftpd/Makefile
+++ b/libexec/ftpd/Makefile
@@ -35,6 +35,7 @@ LDFLAGS+= ${LDFLAGSPAM}
 CFLAGS+= -DNOMD5
 .else
 SRCS+= site_md5.c
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
diff --git a/libexec/sftp-server/Makefile b/libexec/sftp-server/Makefile
index 1ed713c46d..d65ddc849a 100644
--- a/libexec/sftp-server/Makefile
+++ b/libexec/sftp-server/Makefile
@@ -8,7 +8,7 @@ MAN=	sftp-server.8
 WARNS?=	3
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/libexec/ssh-keysign/Makefile b/libexec/ssh-keysign/Makefile
index 664271cdbf..f58d29792b 100644
--- a/libexec/ssh-keysign/Makefile
+++ b/libexec/ssh-keysign/Makefile
@@ -16,7 +16,7 @@ CFLAGS+= -DXAUTH_PATH=\"${XAUTH_PATH}\"
 .endif
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/libexec/ssh-pkcs11-helper/Makefile b/libexec/ssh-pkcs11-helper/Makefile
index 479ca9255e..e5cf6e7f68 100644
--- a/libexec/ssh-pkcs11-helper/Makefile
+++ b/libexec/ssh-pkcs11-helper/Makefile
@@ -11,7 +11,7 @@ WARNS=	3
 .PATH: ${.CURDIR}/../../crypto/openssh
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/libexec/telnetd/Makefile b/libexec/telnetd/Makefile
index 30d4d4745c..734f9509cc 100644
--- a/libexec/telnetd/Makefile
+++ b/libexec/telnetd/Makefile
@@ -26,7 +26,7 @@ LDFLAGS+=	${PRIVATELIB_LDFLAGS}
 CFLAGS+=	-I${_SHLIBDIRPREFIX}/usr/include/priv/ncurses
 
 CFLAGS+=	-DAUTHENTICATION -DENCRYPTION
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD+=		${LIBCRYPTO} ${LIBCRYPT} ${LIBPAM}
 LDADD+=		-lprivate_crypto -lcrypt ${MINUSLPAM}
 
diff --git a/sbin/cryptdisks/Makefile b/sbin/cryptdisks/Makefile
index 3af45a0ea9..47e8ea58ee 100644
--- a/sbin/cryptdisks/Makefile
+++ b/sbin/cryptdisks/Makefile
@@ -4,13 +4,13 @@ NOSHARED=	YES
 
 SRCS+=		cryptdisks.c safe_mem.c
 
-LDADD=		-lcryptsetup -lluks -ldm -ltcplay -lprop -lutil
+LDADD=		-lcryptsetup -lluks -ldm -ltcplay -lprop -lutil -lpthread
 DPADD=		${LIBCRYPTSETUP} ${LIBLUKS} ${LIBDM} ${LIBTCPLAY}
-DPADD+=		${LIBPROP} ${LIBUTIL}
+DPADD+=		${LIBPROP} ${LIBUTIL} ${LIBPTHREAD}
 
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
diff --git a/sbin/dhcpcd/Makefile b/sbin/dhcpcd/Makefile
index b0bd2a3d19..3ced7dd380 100644
--- a/sbin/dhcpcd/Makefile
+++ b/sbin/dhcpcd/Makefile
@@ -41,6 +41,7 @@ SRCS+=		hmac.c
 CFLAGS+=	-DUSE_PRIVATECRYPTO
 FLAGS_GROUPS=	openssl
 openssl_FLAGS=	-I${_SHLIBDIRPREFIX}/usr/include/priv/openssl
+openssl_FLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 openssl_FLAGS+=	-DMD5Init=MD5_Init -DMD5Update=MD5_Update -DMD5Final=MD5_Final
 openssl_FLAGS_FILES= hmac.c ipv6.c
 
diff --git a/sbin/fsck_hammer2/Makefile b/sbin/fsck_hammer2/Makefile
index 823908d5cf..ff75301687 100644
--- a/sbin/fsck_hammer2/Makefile
+++ b/sbin/fsck_hammer2/Makefile
@@ -5,6 +5,8 @@ MAN=  fsck_hammer2.8
 CFLAGS+= -I${.CURDIR}/../../sys -I${.CURDIR}/../hammer2
 CFLAGS+= -DXXH_NAMESPACE=h2_
 CFLAGS+= -DHAMMER2_USE_OPENSSL
+CFLAGS+= -DOPENSSL_SUPPRESS_DEPRECATED
+
 CFLAGS+= ${PRIVATELIB_CFLAGS}
 
 DPADD=   ${LIBCRYPTO}
diff --git a/sbin/hammer/Makefile b/sbin/hammer/Makefile
index 4d4bfe9911..090de698eb 100644
--- a/sbin/hammer/Makefile
+++ b/sbin/hammer/Makefile
@@ -10,6 +10,7 @@ SRCS=	hammer.c ondisk.c blockmap.c cache.c misc.c cycle.c uuid.c \
 MAN=	hammer.8
 
 CFLAGS+= -I${.CURDIR}/../../sys
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBM} ${LIBUTIL} ${LIBHAMMER} ${LIBCRYPTO}
 LDADD=		-lm -lutil -lhammer -lprivate_crypto
diff --git a/sbin/hammer2/Makefile b/sbin/hammer2/Makefile
index 30b0b71dc5..e5aec8e241 100644
--- a/sbin/hammer2/Makefile
+++ b/sbin/hammer2/Makefile
@@ -11,6 +11,7 @@ MAN=	hammer2.8
 CFLAGS+= -DXXH_NAMESPACE=h2_
 CFLAGS+= -I${.CURDIR}/../../sys
 CFLAGS+= -pthread
+CFLAGS+= -DOPENSSL_SUPPRESS_DEPRECATED
 
 DPADD=	${LIBDMSG} ${LIBM} ${LIBUTIL}
 LDADD=	-ldmsg -lm -lutil
diff --git a/sbin/iscontrol/Makefile b/sbin/iscontrol/Makefile
index 72735d17c5..1c0f678170 100644
--- a/sbin/iscontrol/Makefile
+++ b/sbin/iscontrol/Makefile
@@ -2,6 +2,7 @@
 
 SRCS= iscontrol.c pdu.c fsm.c config.c login.c auth_subr.c misc.c
 PROG= iscontrol
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBCAM} ${LIBCRYPTO}
 LDADD=		-lcam -lprivate_crypto
diff --git a/sbin/md5/Makefile b/sbin/md5/Makefile
index d076a0dd6b..3ef6b37bff 100644
--- a/sbin/md5/Makefile
+++ b/sbin/md5/Makefile
@@ -13,6 +13,7 @@ MLINKS=	md5.1 rmd160.1 \
 	md5.1 sha256.1 \
 	md5.1 sha512.1
 
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
diff --git a/sbin/mount_hammer2/Makefile b/sbin/mount_hammer2/Makefile
index a743c5c2ad..7f81ff8c32 100644
--- a/sbin/mount_hammer2/Makefile
+++ b/sbin/mount_hammer2/Makefile
@@ -2,7 +2,7 @@ PROG=	mount_hammer2
 MAN=	mount_hammer2.8
 
 CFLAGS+= -I${.CURDIR}/../../sys
-CFLAGS+= -I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+= -I${.CURDIR}/../../crypto/openssl/include
 LDADD=  -lutil
 DPADD=  ${LIBUTIL}
 
diff --git a/sbin/ping6/Makefile b/sbin/ping6/Makefile
index 4f87e62051..2ae5726300 100644
--- a/sbin/ping6/Makefile
+++ b/sbin/ping6/Makefile
@@ -4,6 +4,7 @@ PROG=	ping6
 MAN=	ping6.8
 
 CFLAGS+=-DINET6 -DHAVE_POLL_H -DHAVE_ARC4RANDOM -DUSE_RFC3542
+CFLAGS+=-DOPENSSL_SUPPRESS_DEPRECATED
 
 BINOWN=	root
 BINMODE=4555
diff --git a/sbin/routed/Makefile b/sbin/routed/Makefile
index f340535ce2..6bc044a73c 100644
--- a/sbin/routed/Makefile
+++ b/sbin/routed/Makefile
@@ -5,6 +5,7 @@ SRCS=   if.c input.c main.c output.c parms.c radix.c rdisc.c table.c trace.c
 MAN=   routed.8
 SUBDIR= rtquery
 
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
diff --git a/sbin/routed/rtquery/Makefile b/sbin/routed/rtquery/Makefile
index 9409289945..6a98ff1638 100644
--- a/sbin/routed/rtquery/Makefile
+++ b/sbin/routed/rtquery/Makefile
@@ -4,6 +4,7 @@
 PROG=	rtquery
 MAN=	rtquery.8
 NO_WARRAY_BOUNDS=
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 LDADD=		-lprivate_crypto
diff --git a/sbin/tcplay/Makefile b/sbin/tcplay/Makefile
index 17bdc89ce5..0cdd09e13a 100644
--- a/sbin/tcplay/Makefile
+++ b/sbin/tcplay/Makefile
@@ -17,7 +17,7 @@ DPADD=		${LIBDM} ${LIBPROP} ${LIBUTIL}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 CFLAGS+=	-I${TCPLAY_DIR}
 CFLAGS+=	-DMAJ_VER=${MAJ_VER} -DMIN_VER=${MIN_VER}
diff --git a/share/examples/etc/README.examples b/share/examples/etc/README.examples
index d6405793e1..9c53ab2d74 100644
--- a/share/examples/etc/README.examples
+++ b/share/examples/etc/README.examples
@@ -79,5 +79,4 @@ ssh/moduli		- default prime numbers for sshd(8)
 ssh/ssh_config		- default SSH client configuration
 ssh/sshd_config		- default SSH daemon configuration
 ssl/			- directory containing default ssl files
-ssl/cert.pem		- default certificate bundle
 ssl/openssl.cnf		- default certificate configuration
diff --git a/share/examples/ssl/Makefile b/share/examples/ssl/Makefile
index 05b24abf73..50989062ca 100644
--- a/share/examples/ssl/Makefile
+++ b/share/examples/ssl/Makefile
@@ -1,4 +1,4 @@
-.PATH: ${.CURDIR}/../../../crypto/libressl/apps/openssl
+.PATH: ${.CURDIR}/../../../crypto/openssl/apps
 
 NOOBJ=	noobj
 FILES=	cert.pem openssl.cnf
diff --git a/tools/tools/net80211/w00t/Makefile.inc b/tools/tools/net80211/w00t/Makefile.inc
index 84257f3abe..e784349220 100644
--- a/tools/tools/net80211/w00t/Makefile.inc
+++ b/tools/tools/net80211/w00t/Makefile.inc
@@ -9,7 +9,7 @@ LDFLAGS=	-L${W00T}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../../../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../../../../crypto/openssl/include
 
 BINDIR=	/usr/local/bin
 CFLAGS+=	-g -I${W00T}
diff --git a/usr.bin/bdes/Makefile b/usr.bin/bdes/Makefile
index fcbd7ef5e8..e1dc1daacb 100644
--- a/usr.bin/bdes/Makefile
+++ b/usr.bin/bdes/Makefile
@@ -8,6 +8,7 @@ WARNS?=	2
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/chkey/Makefile b/usr.bin/chkey/Makefile
index e4e1f89c5d..7428fc78a9 100644
--- a/usr.bin/chkey/Makefile
+++ b/usr.bin/chkey/Makefile
@@ -11,6 +11,6 @@ LDADD=	-lrpcsvc
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/dc/Makefile b/usr.bin/dc/Makefile
index 63f051cb71..397eeacdf5 100644
--- a/usr.bin/dc/Makefile
+++ b/usr.bin/dc/Makefile
@@ -7,6 +7,7 @@ WARNS?=	2
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/dc/bcode.c b/usr.bin/dc/bcode.c
index 629e389b1f..13687385d3 100644
--- a/usr.bin/dc/bcode.c
+++ b/usr.bin/dc/bcode.c
@@ -388,7 +388,7 @@ split_number(const struct number *n, BIGNUM *i, BIGNUM *f)
 	bn_checkp(BN_copy(i, n->number));
 
 	if (n->scale == 0 && f != NULL)
-		bn_check(BN_zero(f));
+		bn_check(BN_set_word(f, 0));
 	else if (n->scale < sizeof(factors)/sizeof(factors[0])) {
 		rem = BN_div_word(i, factors[n->scale]);
 		if (f != NULL)
@@ -794,7 +794,7 @@ load(void)
 		v = stack_tos(&bmachine.reg[index]);
 		if (v == NULL) {
 			n = new_number();
-			bn_check(BN_zero(n->number));
+			bn_check(BN_set_word(n->number, 0));
 			push_number(n);
 		} else
 			push(stack_dup_value(v, &copy));
@@ -878,7 +878,7 @@ load_array(void)
 			v = frame_retrieve(stack, index);
 			if (v == NULL || v->type == BCODE_NONE ) {
 				n = new_number();
-				bn_check(BN_zero(n->number));
+				bn_check(BN_set_word(n->number, 0));
 				push_number(n);
 			}
 			else
diff --git a/usr.bin/dc/bcode.h b/usr.bin/dc/bcode.h
index bf4348b254..48565c66aa 100644
--- a/usr.bin/dc/bcode.h
+++ b/usr.bin/dc/bcode.h
@@ -21,6 +21,7 @@
 
 #include <sys/types.h>
 #include <openssl/bn.h>
+#include <crypto/bn/bn_local.h>
 
 
 struct number {
diff --git a/usr.bin/dc/inout.c b/usr.bin/dc/inout.c
index 69739c0f5e..032b2e75b5 100644
--- a/usr.bin/dc/inout.c
+++ b/usr.bin/dc/inout.c
@@ -188,7 +188,7 @@ readnumber(struct source *src, u_int base)
 	BN_ULONG	v;
 
 	n = new_number();
-	bn_check(BN_zero(n->number));
+	bn_check(BN_set_word(n->number, 0));
 
 	while ((ch = (*src->vtable->readchar)(src)) != EOF) {
 
@@ -325,19 +325,19 @@ printnumber(FILE *f, const struct number *b, u_int base)
 	stack_clear(&stack);
 	if (b->scale > 0) {
 		struct number	*num_base;
-		BIGNUM		mult, stop;
+		BIGNUM		*mult, *stop;
 
 		putcharwrap(f, '.');
 		num_base = new_number();
 		bn_check(BN_set_word(num_base->number, base));
-		BN_init(&mult);
-		bn_check(BN_one(&mult));
-		BN_init(&stop);
-		bn_check(BN_one(&stop));
-		scale_number(&stop, b->scale);
+		mult = BN_new();
+		bn_check(BN_one(mult));
+		stop = BN_new();
+		bn_check(BN_one(stop));
+		scale_number(stop, b->scale);
 
 		i = 0;
-		while (BN_cmp(&mult, &stop) < 0) {
+		while (BN_cmp(mult, stop) < 0) {
 			u_long	rem;
 
 			if (i && base > 16)
@@ -355,11 +355,11 @@ printnumber(FILE *f, const struct number *b, u_int base)
 			    int_part->number));
 			printwrap(f, p);
 			free(p);
-			bn_check(BN_mul_word(&mult, base));
+			bn_check(BN_mul_word(mult, base));
 		}
 		free_number(num_base);
-		BN_free(&mult);
-		BN_free(&stop);
+		BN_free(mult);
+		BN_free(stop);
 	}
 	flushwrap(f);
 	free_number(int_part);
diff --git a/usr.bin/drill/Makefile b/usr.bin/drill/Makefile
index ecee45593b..04e7921663 100644
--- a/usr.bin/drill/Makefile
+++ b/usr.bin/drill/Makefile
@@ -12,7 +12,7 @@ CFLAGS+=	-I${LDNSBASE}/ldns -I${LDNS} -I${LDNS}/drill
 
 LDADD=		-lprivate_ldns -lprivate_crypto
 DPADD=		${LIBLDNS} ${LIBCRYPTO}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/dsynth/Makefile b/usr.bin/dsynth/Makefile
index 803fc272af..35435ca030 100644
--- a/usr.bin/dsynth/Makefile
+++ b/usr.bin/dsynth/Makefile
@@ -23,6 +23,7 @@ DPADD+=		${LIBPTHREAD} ${LIBUTIL}
 
 # ncurses, md5, for DragonFlyBSD
 #
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=        -I${_SHLIBDIRPREFIX}/usr/include/priv/ncurses
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 LDFLAGS+=       ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/nc/Makefile b/usr.bin/nc/Makefile
index eb57558b9b..c8e4cc3a7a 100644
--- a/usr.bin/nc/Makefile
+++ b/usr.bin/nc/Makefile
@@ -1,30 +1,8 @@
-# This version of nc(1) is from LibreSSL
-.PATH: ${.CURDIR}/../../crypto/libressl/apps/nc
-.PATH: ${.CURDIR}/../../crypto/libressl/tls
+# $FreeBSD$
 
 PROG=	nc
 SRCS=	netcat.c atomicio.c socks.c
 
-# TLS block (no separate libtls.a)
-SRCS+=	tls_bio_cb.c	\
-	tls_client.c	\
-	tls_config.c	\
-	tls_conninfo.c	\
-	tls_keypair.c	\
-	tls_peer.c	\
-	tls_ocsp.c	\
-	tls_server.c	\
-	tls_util.c	\
-	tls_verify.c	\
-	tls.c
-
 WARNS?=	2
 
-CFLAGS+= -DLIBRESSL_INTERNAL
-CFLAGS+=-I${.CURDIR}/../../crypto/libressl/include
-
-DPADD=	${LIBCRYPTO} ${LIBSSL}
-LDADD=	-lprivate_ssl -lprivate_crypto
-LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-
 .include <bsd.prog.mk>
diff --git a/usr.bin/nc/atomicio.c b/usr.bin/nc/atomicio.c
new file mode 100644
index 0000000000..344ac63ab9
--- /dev/null
+++ b/usr.bin/nc/atomicio.c
@@ -0,0 +1,67 @@
+/* $OpenBSD: atomicio.c,v 1.11 2012/12/04 02:24:47 deraadt Exp $ */
+/*
+ * Copyright (c) 2006 Damien Miller. All rights reserved.
+ * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
+ * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <errno.h>
+#include <poll.h>
+#include <unistd.h>
+
+#include "atomicio.h"
+
+/*
+ * ensure all of data on socket comes through. f==read || f==vwrite
+ */
+size_t
+atomicio(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n)
+{
+	char *s = _s;
+	size_t pos = 0;
+	ssize_t res;
+	struct pollfd pfd;
+
+	pfd.fd = fd;
+	pfd.events = f == read ? POLLIN : POLLOUT;
+	while (n > pos) {
+		res = (f) (fd, s + pos, n - pos);
+		switch (res) {
+		case -1:
+			if (errno == EINTR)
+				continue;
+			if ((errno == EAGAIN) || (errno == ENOBUFS)) {
+				(void)poll(&pfd, 1, -1);
+				continue;
+			}
+			return 0;
+		case 0:
+			errno = EPIPE;
+			return pos;
+		default:
+			pos += (size_t)res;
+		}
+	}
+	return (pos);
+}
diff --git a/usr.bin/nc/atomicio.h b/usr.bin/nc/atomicio.h
new file mode 100644
index 0000000000..7bf5b25418
--- /dev/null
+++ b/usr.bin/nc/atomicio.h
@@ -0,0 +1,39 @@
+/* $OpenBSD: atomicio.h,v 1.2 2007/09/07 14:50:44 tobias Exp $ */
+
+/*
+ * Copyright (c) 2006 Damien Miller.  All rights reserved.
+ * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _ATOMICIO_H
+#define _ATOMICIO_H
+
+/*
+ * Ensure all of data on socket comes through. f==read || f==vwrite
+ */
+size_t	atomicio(ssize_t (*)(int, void *, size_t), int, void *, size_t);
+
+#define vwrite (ssize_t (*)(int, void *, size_t))write
+
+#endif /* _ATOMICIO_H */
diff --git a/usr.bin/nc/nc.1 b/usr.bin/nc/nc.1
new file mode 100644
index 0000000000..2627920cca
--- /dev/null
+++ b/usr.bin/nc/nc.1
@@ -0,0 +1,532 @@
+.\"     $OpenBSD: nc.1,v 1.68 2015/03/26 10:35:04 tobias Exp $
+.\"
+.\" Copyright (c) 1996 David Sacerdote
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. The name of the author may not be used to endorse or promote products
+.\"    derived from this software without specific prior written permission
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd July 10, 2020
+.Dt NC 1
+.Os
+.Sh NAME
+.Nm nc
+.Nd arbitrary TCP and UDP connections and listens
+.Sh SYNOPSIS
+.Nm nc
+.Bk -words
+.Op Fl 46DdEFhklMNnrStUuvz
+.Op Fl e Ar IPsec_policy
+.Op Fl I Ar length
+.Op Fl i Ar interval
+.Op Fl -no-tcpopt
+.Op Fl -sctp
+.Op Fl O Ar length
+.Op Fl P Ar proxy_username
+.Op Fl p Ar source_port
+.Op Fl s Ar source
+.Op Fl T Ar toskeyword
+.Op Fl V Ar rtable
+.Op Fl w Ar timeout
+.Op Fl X Ar proxy_protocol
+.Oo Xo
+.Fl x Ar proxy_address Ns Oo : Ns
+.Ar port Oc
+.Xc Oc
+.Op Ar destination
+.Op Ar port
+.Ek
+.Sh DESCRIPTION
+The
+.Nm
+(or
+.Nm netcat )
+utility is used for just about anything under the sun involving TCP,
+UDP, or
+.Ux Ns -domain
+sockets.
+It can open TCP connections, send UDP packets, listen on arbitrary
+TCP and UDP ports, do port scanning, and deal with both IPv4 and
+IPv6.
+Unlike
+.Xr telnet 1 ,
+.Nm
+scripts nicely, and separates error messages onto standard error instead
+of sending them to standard output, as
+.Xr telnet 1
+does with some.
+.Pp
+Common uses include:
+.Pp
+.Bl -bullet -offset indent -compact
+.It
+simple TCP proxies
+.It
+shell-script based HTTP clients and servers
+.It
+network daemon testing
+.It
+a SOCKS or HTTP ProxyCommand for
+.Xr ssh 1
+.It
+and much, much more
+.El
+.Pp
+The options are as follows:
+.Bl -tag -width Ds
+.It Fl 4
+Forces
+.Nm
+to use IPv4 addresses only.
+.It Fl 6
+Forces
+.Nm
+to use IPv6 addresses only.
+.It Fl D
+Enable debugging on the socket.
+.It Fl d
+Do not attempt to read from stdin.
+.It Fl E
+Shortcut for
+.Qo
+.Li "-e 'in ipsec esp/transport//require'"
+.Li "-e 'out ipsec esp/transport//require'" 
+.Qc ,
+which enables IPsec ESP transport mode in both
+directions.
+.It Fl e
+If IPsec support is available, then one can specify the IPsec policies
+to be used using the syntax described in
+.Xr ipsec_set_policy 3 .
+This flag can be specified up to two times, as typically one policy for
+each direction is needed.
+.It Fl F
+Pass the first connected socket using
+.Xr sendmsg 2
+to stdout and exit.
+This is useful in conjunction with
+.Fl X
+to have
+.Nm
+perform connection setup with a proxy but then leave the rest of the
+connection to another program (e.g.\&
+.Xr ssh 1
+using the
+.Xr ssh_config 5
+.Cm ProxyUseFdpass
+option).
+.It Fl h
+Prints out
+.Nm
+help.
+.It Fl I Ar length
+Specifies the size of the TCP receive buffer.
+.It Fl i Ar interval
+Specifies a delay time interval between lines of text sent and received.
+Also causes a delay time between connections to multiple ports.
+.It Fl k
+Forces
+.Nm
+to stay listening for another connection after its current connection
+is completed.
+It is an error to use this option without the
+.Fl l
+option.
+When used together with the
+.Fl u
+option, the server socket is not connected and it can receive UDP datagrams from
+multiple hosts.
+.It Fl l
+Used to specify that
+.Nm
+should listen for an incoming connection rather than initiate a
+connection to a remote host.
+It is an error to use this option in conjunction with the
+.Fl p ,
+.Fl s ,
+or
+.Fl z
+options.
+Additionally, any timeouts specified with the
+.Fl w
+option are ignored.
+.It Fl M
+Collect per-connection TCP statistics using the
+.Xr stats 3
+framework and print them in JSON format to
+.Xr stderr 4
+after the connection is closed.
+.It Fl N
+.Xr shutdown 2
+the network socket after EOF on the input.
+Some servers require this to finish their work.
+.It Fl n
+Do not do any DNS or service lookups on any specified addresses,
+hostnames or ports.
+.It Fl -no-tcpopt
+Disables the use of TCP options on the socket, by setting the boolean
+TCP_NOOPT
+socket option.
+.It Fl -sctp
+Use SCTP instead of the default option of TCP.
+.It Fl O Ar length
+Specifies the size of the TCP send buffer.
+.It Fl P Ar proxy_username
+Specifies a username to present to a proxy server that requires authentication.
+If no username is specified then authentication will not be attempted.
+Proxy authentication is only supported for HTTP CONNECT proxies at present.
+.It Fl p Ar source_port
+Specifies the source port
+.Nm
+should use, subject to privilege restrictions and availability.
+It is an error to use this option in conjunction with the
+.Fl l
+option.
+.It Fl r
+Specifies that source and/or destination ports should be chosen randomly
+instead of sequentially within a range or in the order that the system
+assigns them.
+.It Fl S
+Enables the RFC 2385 TCP MD5 signature option.
+.It Fl s Ar source
+Specifies the IP of the interface which is used to send the packets.
+For
+.Ux Ns -domain
+datagram sockets, specifies the local temporary socket file
+to create and use so that datagrams can be received.
+It is an error to use this option in conjunction with the
+.Fl l
+option.
+.It Fl T Ar toskeyword
+Change IPv4 TOS value.
+.Ar toskeyword
+may be one of
+.Ar critical ,
+.Ar inetcontrol ,
+.Ar lowdelay ,
+.Ar netcontrol ,
+.Ar throughput ,
+.Ar reliability ,
+or one of the DiffServ Code Points:
+.Ar ef ,
+.Ar af11 ... af43 ,
+.Ar cs0 ... cs7 ;
+or a number in either hex or decimal.
+.It Fl t
+Causes
+.Nm
+to send RFC 854 DON'T and WON'T responses to RFC 854 DO and WILL requests.
+This makes it possible to use
+.Nm
+to script telnet sessions.
+.It Fl U
+Specifies to use
+.Ux Ns -domain
+sockets.
+.It Fl u
+Use UDP instead of the default option of TCP.
+For
+.Ux Ns -domain
+sockets, use a datagram socket instead of a stream socket.
+If a
+.Ux Ns -domain
+socket is used, a temporary receiving socket is created in
+.Pa /tmp
+unless the
+.Fl s
+flag is given.
+.It Fl V Ar rtable
+Set the routing table
+.Pq Dq FIB
+to be used.
+.It Fl v
+Have
+.Nm
+give more verbose output.
+.It Fl w Ar timeout
+Connections which cannot be established or are idle timeout after
+.Ar timeout
+seconds.
+The
+.Fl w
+flag has no effect on the
+.Fl l
+option, i.e.\&
+.Nm
+will listen forever for a connection, with or without the
+.Fl w
+flag.
+The default is no timeout.
+.It Fl X Ar proxy_protocol
+Requests that
+.Nm
+should use the specified protocol when talking to the proxy server.
+Supported protocols are
+.Dq 4
+(SOCKS v.4),
+.Dq 5
+(SOCKS v.5)
+and
+.Dq connect
+(HTTPS proxy).
+If the protocol is not specified, SOCKS version 5 is used.
+.It Xo
+.Fl x Ar proxy_address Ns Oo : Ns
+.Ar port Oc
+.Xc
+Requests that
+.Nm
+should connect to
+.Ar destination
+using a proxy at
+.Ar proxy_address
+and
+.Ar port .
+If
+.Ar port
+is not specified, the well-known port for the proxy protocol is used (1080
+for SOCKS, 3128 for HTTPS).
+.It Fl z
+Specifies that
+.Nm
+should just scan for listening daemons, without sending any data to them.
+It is an error to use this option in conjunction with the
+.Fl l
+option.
+.El
+.Pp
+.Ar destination
+can be a numerical IP address or a symbolic hostname
+(unless the
+.Fl n
+option is given).
+In general, a destination must be specified,
+unless the
+.Fl l
+option is given
+(in which case the local host is used).
+For
+.Ux Ns -domain
+sockets, a destination is required and is the socket path to connect to
+(or listen on if the
+.Fl l
+option is given).
+.Pp
+.Ar port
+can be a single integer or a range of ports.
+Ranges are in the form nn-mm.
+In general,
+a destination port must be specified,
+unless the
+.Fl U
+option is given.
+.Sh CLIENT/SERVER MODEL
+It is quite simple to build a very basic client/server model using
+.Nm .
+On one console, start
+.Nm
+listening on a specific port for a connection.
+For example:
+.Pp
+.Dl $ nc -l 1234
+.Pp
+.Nm
+is now listening on port 1234 for a connection.
+On a second console
+.Pq or a second machine ,
+connect to the machine and port being listened on:
+.Pp
+.Dl $ nc 127.0.0.1 1234
+.Pp
+There should now be a connection between the ports.
+Anything typed at the second console will be concatenated to the first,
+and vice-versa.
+After the connection has been set up,
+.Nm
+does not really care which side is being used as a
+.Sq server
+and which side is being used as a
+.Sq client .
+The connection may be terminated using an
+.Dv EOF
+.Pq Sq ^D .
+.Sh DATA TRANSFER
+The example in the previous section can be expanded to build a
+basic data transfer model.
+Any information input into one end of the connection will be output
+to the other end, and input and output can be easily captured in order to
+emulate file transfer.
+.Pp
+Start by using
+.Nm
+to listen on a specific port, with output captured into a file:
+.Pp
+.Dl $ nc -l 1234 \*(Gt filename.out
+.Pp
+Using a second machine, connect to the listening
+.Nm
+process, feeding it the file which is to be transferred:
+.Pp
+.Dl $ nc -N host.example.com 1234 \*(Lt filename.in
+.Pp
+After the file has been transferred, the connection will close automatically.
+.Sh TALKING TO SERVERS
+It is sometimes useful to talk to servers
+.Dq by hand
+rather than through a user interface.
+It can aid in troubleshooting,
+when it might be necessary to verify what data a server is sending
+in response to commands issued by the client.
+For example, to retrieve the home page of a web site:
+.Bd -literal -offset indent
+$ printf "GET / HTTP/1.0\er\en\er\en" | nc host.example.com 80
+.Ed
+.Pp
+Note that this also displays the headers sent by the web server.
+They can be filtered, using a tool such as
+.Xr sed 1 ,
+if necessary.
+.Pp
+More complicated examples can be built up when the user knows the format
+of requests required by the server.
+As another example, an email may be submitted to an SMTP server using:
+.Bd -literal -offset indent
+$ nc localhost 25 \*(Lt\*(Lt EOF
+HELO host.example.com
+MAIL FROM:\*(Ltuser@host.example.com\*(Gt
+RCPT TO:\*(Ltuser2@host.example.com\*(Gt
+DATA
+Body of email.
+\&.
+QUIT
+EOF
+.Ed
+.Sh PORT SCANNING
+It may be useful to know which ports are open and running services on
+a target machine.
+The
+.Fl z
+flag can be used to tell
+.Nm
+to report open ports,
+rather than initiate a connection.
+For example:
+.Bd -literal -offset indent
+$ nc -z host.example.com 20-30
+Connection to host.example.com 22 port [tcp/ssh] succeeded!
+Connection to host.example.com 25 port [tcp/smtp] succeeded!
+.Ed
+.Pp
+The port range was specified to limit the search to ports 20 \- 30.
+.Pp
+Alternatively, it might be useful to know which server software
+is running, and which versions.
+This information is often contained within the greeting banners.
+In order to retrieve these, it is necessary to first make a connection,
+and then break the connection when the banner has been retrieved.
+This can be accomplished by specifying a small timeout with the
+.Fl w
+flag, or perhaps by issuing a
+.Qq Dv QUIT
+command to the server:
+.Bd -literal -offset indent
+$ echo "QUIT" | nc host.example.com 20-30
+SSH-1.99-OpenSSH_3.6.1p2
+Protocol mismatch.
+220 host.example.com IMS SMTP Receiver Version 0.84 Ready
+.Ed
+.Sh EXAMPLES
+Open a TCP connection to port 42 of host.example.com, using port 31337 as
+the source port, with a timeout of 5 seconds:
+.Pp
+.Dl $ nc -p 31337 -w 5 host.example.com 42
+.Pp
+Open a UDP connection to port 53 of host.example.com:
+.Pp
+.Dl $ nc -u host.example.com 53
+.Pp
+Open a TCP connection to port 42 of host.example.com using 10.1.2.3 as the
+IP for the local end of the connection:
+.Pp
+.Dl $ nc -s 10.1.2.3 host.example.com 42
+.Pp
+Open a TCP connection to port 42 of host.example.com using IPsec ESP for
+incoming and outgoing traffic.
+.Pp
+.Dl $ nc -E host.example.com 42
+.Pp
+Open a TCP connection to port 42 of host.example.com using IPsec ESP for
+outgoing traffic only.
+.Pp
+.Dl $ nc -e 'out ipsec esp/transport//require' host.example.com 42
+.Pp
+Create and listen on a
+.Ux Ns -domain
+stream socket:
+.Pp
+.Dl $ nc -lU /var/tmp/dsocket
+.Pp
+Connect to port 42 of host.example.com via an HTTP proxy at 10.2.3.4,
+port 8080.
+This example could also be used by
+.Xr ssh 1 ;
+see the
+.Cm ProxyCommand
+directive in
+.Xr ssh_config 5
+for more information.
+.Pp
+.Dl $ nc -x10.2.3.4:8080 -Xconnect host.example.com 42
+.Pp
+The same example again, this time enabling proxy authentication with username
+.Dq ruser
+if the proxy requires it:
+.Pp
+.Dl $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42
+.Sh EXIT STATUS
+.Ex -std
+.Sh SEE ALSO
+.Xr cat 1 ,
+.Xr setfib 1 ,
+.Xr ssh 1 ,
+.Xr tcp 4
+.Sh AUTHORS
+Original implementation by *Hobbit*
+.Aq Mt hobbit@avian.org .
+.br
+Rewritten with IPv6 support by
+.An Eric Jackson Aq Mt ericj@monkey.org .
+.Sh CAVEATS
+UDP port scans using the
+.Fl uz
+combination of flags will always report success irrespective of
+the target machine's state.
+However,
+in conjunction with a traffic sniffer either on the target machine
+or an intermediary device,
+the
+.Fl uz
+combination could be useful for communications diagnostics.
+Note that the amount of UDP traffic generated may be limited either
+due to hardware resources and/or configuration settings.
diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
new file mode 100644
index 0000000000..5d3af6d330
--- /dev/null
+++ b/usr.bin/nc/netcat.c
@@ -0,0 +1,1370 @@
+/* $OpenBSD: netcat.c,v 1.130 2015/07/26 19:12:28 chl Exp $ */
+/*
+ * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *   derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+/*
+ * Re-written nc(1) for OpenBSD. Original implementation by
+ * *Hobbit* <hobbit@avian.org>.
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <sys/limits.h>
+#include <sys/types.h>
+#include <sys/sbuf.h>
+#include <sys/socket.h>
+#include <sys/sysctl.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+#include <sys/un.h>
+
+#include <netinet/in.h>
+#ifdef IPSEC
+#include <netipsec/ipsec.h>
+#endif
+#include <netinet/tcp.h>
+#include <netinet/ip.h>
+#include <arpa/telnet.h>
+
+#include <err.h>
+#include <getopt.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <netdb.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "atomicio.h"
+
+#ifndef SUN_LEN
+#define SUN_LEN(su) \
+	(sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
+#endif
+
+#define PORT_MAX	65535
+#define PORT_MAX_LEN	6
+#define UNIX_DG_TMP_SOCKET_SIZE	19
+
+#define POLL_STDIN 0
+#define POLL_NETOUT 1
+#define POLL_NETIN 2
+#define POLL_STDOUT 3
+#define BUFSIZE 16384
+
+/* Command Line Options */
+int	dflag;					/* detached, no stdin */
+int	Fflag;					/* fdpass sock to stdout */
+unsigned int iflag;				/* Interval Flag */
+int	kflag;					/* More than one connect */
+int	lflag;					/* Bind to local port */
+int	Nflag;					/* shutdown() network socket */
+int	nflag;					/* Don't do name look up */
+int	FreeBSD_Oflag;				/* Do not use TCP options */
+char   *Pflag;					/* Proxy username */
+char   *pflag;					/* Localport flag */
+int	rflag;					/* Random ports flag */
+char   *sflag;					/* Source Address */
+int	tflag;					/* Telnet Emulation */
+int	uflag;					/* UDP - Default to TCP */
+int	vflag;					/* Verbosity */
+int	xflag;					/* Socks proxy */
+int	zflag;					/* Port Scan Flag */
+int	Dflag;					/* sodebug */
+int	Iflag;					/* TCP receive buffer size */
+int	Oflag;					/* TCP send buffer size */
+int	Tflag = -1;				/* IP Type of Service */
+
+int timeout = -1;
+int family = AF_UNSPEC;
+char *portlist[PORT_MAX+1];
+char *unix_dg_tmp_socket;
+
+void	atelnet(int, unsigned char *, unsigned int);
+void	build_ports(char *);
+void	help(void);
+int	local_listen(char *, char *, struct addrinfo);
+void	readwrite(int);
+void	fdpass(int nfd) __attribute__((noreturn));
+int	remote_connect(const char *, const char *, struct addrinfo);
+int	timeout_connect(int, const struct sockaddr *, socklen_t);
+int	socks_connect(const char *, const char *, struct addrinfo,
+	    const char *, const char *, struct addrinfo, int, const char *);
+int	udptest(int);
+int	unix_bind(char *);
+int	unix_connect(char *);
+int	unix_listen(char *);
+void	set_common_sockopts(int, int);
+int	map_tos(char *, int *);
+void	report_connect(const struct sockaddr *, socklen_t);
+void	usage(int);
+ssize_t drainbuf(int, unsigned char *, size_t *);
+ssize_t fillbuf(int, unsigned char *, size_t *);
+
+#ifdef IPSEC
+void	add_ipsec_policy(int, int, char *);
+
+char	*ipsec_policy[2];
+#endif
+
+int
+main(int argc, char *argv[])
+{
+	int ch, s, ret, socksv, ipsec_count;
+	char *host, *uport;
+	struct addrinfo hints;
+	struct servent *sv;
+	socklen_t len;
+	struct sockaddr_storage cliaddr;
+	char *proxy;
+	const char *errstr, *proxyhost = "", *proxyport = NULL;
+	struct addrinfo proxyhints;
+	char unix_dg_tmp_socket_buf[UNIX_DG_TMP_SOCKET_SIZE];
+	struct option longopts[] = {
+		{ "no-tcpopt",	no_argument,	&FreeBSD_Oflag,	1 },
+		{ NULL,		0,		NULL,		0 }
+	};
+
+	ret = 1;
+	ipsec_count = 0;
+	s = 0;
+	socksv = 5;
+	host = NULL;
+	uport = NULL;
+	sv = NULL;
+
+	signal(SIGPIPE, SIG_IGN);
+
+	while ((ch = getopt_long(argc, argv,
+	    "46DdEe:FhI:i:klNnoO:P:p:rs:tT:Uuvw:X:x:z",
+	    longopts, NULL)) != -1) {
+		switch (ch) {
+		case '4':
+			family = AF_INET;
+			break;
+		case '6':
+			family = AF_INET6;
+			break;
+		case 'U':
+			family = AF_UNIX;
+			break;
+		case 'X':
+			if (strcasecmp(optarg, "connect") == 0)
+				socksv = -1; /* HTTP proxy CONNECT */
+			else if (strcmp(optarg, "4") == 0)
+				socksv = 4; /* SOCKS v.4 */
+			else if (strcmp(optarg, "5") == 0)
+				socksv = 5; /* SOCKS v.5 */
+			else
+				errx(1, "unsupported proxy protocol");
+			break;
+		case 'd':
+			dflag = 1;
+			break;
+		case 'e':
+#ifdef IPSEC
+			ipsec_policy[ipsec_count++ % 2] = optarg;
+#else
+			errx(1, "IPsec support unavailable.");
+#endif
+			break;
+		case 'E':
+#ifdef IPSEC
+			ipsec_policy[0] = "in  ipsec esp/transport//require";
+			ipsec_policy[1] = "out ipsec esp/transport//require";
+#else
+			errx(1, "IPsec support unavailable.");
+#endif
+			break;
+		case 'F':
+			Fflag = 1;
+			break;
+		case 'h':
+			help();
+			break;
+		case 'i':
+			iflag = strtonum(optarg, 0, UINT_MAX, &errstr);
+			if (errstr)
+				errx(1, "interval %s: %s", errstr, optarg);
+			break;
+		case 'k':
+			kflag = 1;
+			break;
+		case 'l':
+			lflag = 1;
+			break;
+		case 'N':
+			Nflag = 1;
+			break;
+		case 'n':
+			nflag = 1;
+			break;
+		case 'o':
+			fprintf(stderr, "option -o is deprecated.\n");
+			break;
+		case 'P':
+			Pflag = optarg;
+			break;
+		case 'p':
+			pflag = optarg;
+			break;
+		case 'r':
+			rflag = 1;
+			break;
+		case 's':
+			sflag = optarg;
+			break;
+		case 't':
+			tflag = 1;
+			break;
+		case 'u':
+			uflag = 1;
+			break;
+		case 'v':
+			vflag = 1;
+			break;
+		case 'w':
+			timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr);
+			if (errstr)
+				errx(1, "timeout %s: %s", errstr, optarg);
+			timeout *= 1000;
+			break;
+		case 'x':
+			xflag = 1;
+			if ((proxy = strdup(optarg)) == NULL)
+				err(1, NULL);
+			break;
+		case 'z':
+			zflag = 1;
+			break;
+		case 'D':
+			Dflag = 1;
+			break;
+		case 'I':
+			Iflag = strtonum(optarg, 1, 65536 << 14, &errstr);
+			if (errstr != NULL)
+				errx(1, "TCP receive window %s: %s",
+				    errstr, optarg);
+			break;
+		case 'O':
+			Oflag = strtonum(optarg, 1, 65536 << 14, &errstr);
+			if (errstr != NULL) {
+			    if (strcmp(errstr, "invalid") != 0)
+				errx(1, "TCP send window %s: %s",
+				    errstr, optarg);
+			}
+			break;
+		case 'T':
+			errstr = NULL;
+			errno = 0;
+			if (map_tos(optarg, &Tflag))
+				break;
+			if (strlen(optarg) > 1 && optarg[0] == '0' &&
+			    optarg[1] == 'x')
+				Tflag = (int)strtol(optarg, NULL, 16);
+			else
+				Tflag = (int)strtonum(optarg, 0, 255,
+				    &errstr);
+			if (Tflag < 0 || Tflag > 255 || errstr || errno)
+				errx(1, "illegal tos value %s", optarg);
+			break;
+		case 0:
+			/* Long option. */
+			break;
+		default:
+			usage(1);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	/* Cruft to make sure options are clean, and used properly. */
+	if (argv[0] && !argv[1] && family == AF_UNIX) {
+		host = argv[0];
+		uport = NULL;
+	} else if (argv[0] && !argv[1]) {
+		if  (!lflag)
+			usage(1);
+		uport = argv[0];
+		host = NULL;
+	} else if (argv[0] && argv[1]) {
+		host = argv[0];
+		uport = argv[1];
+	} else
+		usage(1);
+
+	if (lflag && sflag)
+		errx(1, "cannot use -s and -l");
+	if (lflag && pflag)
+		errx(1, "cannot use -p and -l");
+	if (lflag && zflag)
+		errx(1, "cannot use -z and -l");
+	if (!lflag && kflag)
+		errx(1, "must use -l with -k");
+
+	/* Get name of temporary socket for unix datagram client */
+	if ((family == AF_UNIX) && uflag && !lflag) {
+		if (sflag) {
+			unix_dg_tmp_socket = sflag;
+		} else {
+			strlcpy(unix_dg_tmp_socket_buf, "/tmp/nc.XXXXXXXXXX",
+				UNIX_DG_TMP_SOCKET_SIZE);
+			if (mktemp(unix_dg_tmp_socket_buf) == NULL)
+				err(1, "mktemp");
+			unix_dg_tmp_socket = unix_dg_tmp_socket_buf;
+		}
+	}
+
+	/* Initialize addrinfo structure. */
+	if (family != AF_UNIX) {
+		memset(&hints, 0, sizeof(struct addrinfo));
+		hints.ai_family = family;
+		hints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+		hints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
+		if (nflag)
+			hints.ai_flags |= AI_NUMERICHOST;
+	}
+
+	if (xflag) {
+		if (uflag)
+			errx(1, "no proxy support for UDP mode");
+
+		if (lflag)
+			errx(1, "no proxy support for listen");
+
+		if (family == AF_UNIX)
+			errx(1, "no proxy support for unix sockets");
+
+		/* XXX IPv6 transport to proxy would probably work */
+		if (family == AF_INET6)
+			errx(1, "no proxy support for IPv6");
+
+		if (sflag)
+			errx(1, "no proxy support for local source address");
+
+		proxyhost = strsep(&proxy, ":");
+		proxyport = proxy;
+
+		memset(&proxyhints, 0, sizeof(struct addrinfo));
+		proxyhints.ai_family = family;
+		proxyhints.ai_socktype = SOCK_STREAM;
+		proxyhints.ai_protocol = IPPROTO_TCP;
+		if (nflag)
+			proxyhints.ai_flags |= AI_NUMERICHOST;
+	}
+
+	if (lflag) {
+		int connfd;
+		ret = 0;
+
+		if (family == AF_UNIX) {
+			if (uflag)
+				s = unix_bind(host);
+			else
+				s = unix_listen(host);
+		}
+
+		/* Allow only one connection at a time, but stay alive. */
+		for (;;) {
+			if (family != AF_UNIX)
+				s = local_listen(host, uport, hints);
+			if (s < 0)
+				err(1, NULL);
+			/*
+			 * For UDP and -k, don't connect the socket, let it
+			 * receive datagrams from multiple socket pairs.
+			 */
+			if (uflag && kflag)
+				readwrite(s);
+			/*
+			 * For UDP and not -k, we will use recvfrom() initially
+			 * to wait for a caller, then use the regular functions
+			 * to talk to the caller.
+			 */
+			else if (uflag && !kflag) {
+				int rv, plen;
+				char buf[16384];
+				struct sockaddr_storage z;
+
+				len = sizeof(z);
+				plen = 2048;
+				rv = recvfrom(s, buf, plen, MSG_PEEK,
+				    (struct sockaddr *)&z, &len);
+				if (rv < 0)
+					err(1, "recvfrom");
+
+				rv = connect(s, (struct sockaddr *)&z, len);
+				if (rv < 0)
+					err(1, "connect");
+
+				if (vflag)
+					report_connect((struct sockaddr *)&z, len);
+
+				readwrite(s);
+			} else {
+				len = sizeof(cliaddr);
+				connfd = accept(s, (struct sockaddr *)&cliaddr,
+				    &len);
+				if (connfd == -1) {
+					/* For now, all errnos are fatal */
+					err(1, "accept");
+				}
+				if (vflag)
+					report_connect((struct sockaddr *)&cliaddr, len);
+
+				readwrite(connfd);
+				close(connfd);
+			}
+
+			if (family != AF_UNIX)
+				close(s);
+			else if (uflag) {
+				if (connect(s, NULL, 0) < 0)
+					err(1, "connect");
+			}
+
+			if (!kflag)
+				break;
+		}
+	} else if (family == AF_UNIX) {
+		ret = 0;
+
+		if ((s = unix_connect(host)) > 0 && !zflag) {
+			readwrite(s);
+			close(s);
+		} else
+			ret = 1;
+
+		if (uflag)
+			unlink(unix_dg_tmp_socket);
+		exit(ret);
+
+	} else {
+		int i = 0;
+
+		/* Construct the portlist[] array. */
+		build_ports(uport);
+
+		/* Cycle through portlist, connecting to each port. */
+		for (i = 0; portlist[i] != NULL; i++) {
+			if (s)
+				close(s);
+
+			if (xflag)
+				s = socks_connect(host, portlist[i], hints,
+				    proxyhost, proxyport, proxyhints, socksv,
+				    Pflag);
+			else
+				s = remote_connect(host, portlist[i], hints);
+
+			if (s < 0)
+				continue;
+
+			ret = 0;
+			if (vflag || zflag) {
+				/* For UDP, make sure we are connected. */
+				if (uflag) {
+					if (udptest(s) == -1) {
+						ret = 1;
+						continue;
+					}
+				}
+
+				/* Don't look up port if -n. */
+				if (nflag)
+					sv = NULL;
+				else {
+					sv = getservbyport(
+					    ntohs(atoi(portlist[i])),
+					    uflag ? "udp" : "tcp");
+				}
+
+				fprintf(stderr,
+				    "Connection to %s %s port [%s/%s] "
+				    "succeeded!\n", host, portlist[i],
+				    uflag ? "udp" : "tcp",
+				    sv ? sv->s_name : "*");
+			}
+			if (Fflag)
+				fdpass(s);
+			else if (!zflag)
+				readwrite(s);
+		}
+	}
+
+	if (s)
+		close(s);
+
+	exit(ret);
+}
+
+/*
+ * unix_bind()
+ * Returns a unix socket bound to the given path
+ */
+int
+unix_bind(char *path)
+{
+	struct sockaddr_un sun;
+	int s;
+
+	/* Create unix domain socket. */
+	if ((s = socket(AF_UNIX, uflag ? SOCK_DGRAM : SOCK_STREAM,
+	     0)) < 0)
+		return (-1);
+
+	memset(&sun, 0, sizeof(struct sockaddr_un));
+	sun.sun_family = AF_UNIX;
+
+	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
+	    sizeof(sun.sun_path)) {
+		close(s);
+		errno = ENAMETOOLONG;
+		return (-1);
+	}
+
+	if (bind(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
+		close(s);
+		return (-1);
+	}
+	return (s);
+}
+
+/*
+ * unix_connect()
+ * Returns a socket connected to a local unix socket. Returns -1 on failure.
+ */
+int
+unix_connect(char *path)
+{
+	struct sockaddr_un sun;
+	int s;
+
+	if (uflag) {
+		if ((s = unix_bind(unix_dg_tmp_socket)) < 0)
+			return (-1);
+	} else {
+		if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
+			return (-1);
+	}
+	(void)fcntl(s, F_SETFD, FD_CLOEXEC);
+
+	memset(&sun, 0, sizeof(struct sockaddr_un));
+	sun.sun_family = AF_UNIX;
+
+	if (strlcpy(sun.sun_path, path, sizeof(sun.sun_path)) >=
+	    sizeof(sun.sun_path)) {
+		close(s);
+		errno = ENAMETOOLONG;
+		return (-1);
+	}
+	if (connect(s, (struct sockaddr *)&sun, SUN_LEN(&sun)) < 0) {
+		close(s);
+		return (-1);
+	}
+	return (s);
+
+}
+
+/*
+ * unix_listen()
+ * Create a unix domain socket, and listen on it.
+ */
+int
+unix_listen(char *path)
+{
+	int s;
+	if ((s = unix_bind(path)) < 0)
+		return (-1);
+
+	if (listen(s, 5) < 0) {
+		close(s);
+		return (-1);
+	}
+	return (s);
+}
+
+/*
+ * remote_connect()
+ * Returns a socket connected to a remote host. Properly binds to a local
+ * port or source address if needed. Returns -1 on failure.
+ */
+int
+remote_connect(const char *host, const char *port, struct addrinfo hints)
+{
+	struct addrinfo *res, *res0;
+	int s, error;
+
+	if ((error = getaddrinfo(host, port, &hints, &res)))
+		errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+	res0 = res;
+	do {
+		if ((s = socket(res0->ai_family, res0->ai_socktype,
+		    res0->ai_protocol)) < 0)
+			continue;
+
+		/* Bind to a local port or source address if specified. */
+		if (sflag || pflag) {
+			struct addrinfo ahints, *ares;
+
+			memset(&ahints, 0, sizeof(struct addrinfo));
+			ahints.ai_family = res0->ai_family;
+			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+			ahints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
+			ahints.ai_flags = AI_PASSIVE;
+			if ((error = getaddrinfo(sflag, pflag, &ahints, &ares)))
+				errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+			if (bind(s, (struct sockaddr *)ares->ai_addr,
+			    ares->ai_addrlen) < 0)
+				err(1, "bind failed");
+			freeaddrinfo(ares);
+		}
+
+		set_common_sockopts(s, res0->ai_family);
+
+		if (timeout_connect(s, res0->ai_addr, res0->ai_addrlen) == 0)
+			break;
+		else if (vflag)
+			warn("connect to %s port %s (%s) failed", host, port,
+			    uflag ? "udp" : "tcp");
+
+		close(s);
+		s = -1;
+	} while ((res0 = res0->ai_next) != NULL);
+
+	freeaddrinfo(res);
+
+	return (s);
+}
+
+int
+timeout_connect(int s, const struct sockaddr *name, socklen_t namelen)
+{
+	struct pollfd pfd;
+	socklen_t optlen;
+	int flags, optval;
+	int ret;
+
+	if (timeout != -1) {
+		flags = fcntl(s, F_GETFL, 0);
+		if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
+			err(1, "set non-blocking mode");
+	}
+
+	if ((ret = connect(s, name, namelen)) != 0 && errno == EINPROGRESS) {
+		pfd.fd = s;
+		pfd.events = POLLOUT;
+		if ((ret = poll(&pfd, 1, timeout)) == 1) {
+			optlen = sizeof(optval);
+			if ((ret = getsockopt(s, SOL_SOCKET, SO_ERROR,
+			    &optval, &optlen)) == 0) {
+				errno = optval;
+				ret = optval == 0 ? 0 : -1;
+			}
+		} else if (ret == 0) {
+			errno = ETIMEDOUT;
+			ret = -1;
+		} else
+			err(1, "poll failed");
+	}
+
+	if (timeout != -1 && fcntl(s, F_SETFL, flags) == -1)
+		err(1, "restoring flags");
+
+	return (ret);
+}
+
+/*
+ * local_listen()
+ * Returns a socket listening on a local port, binds to specified source
+ * address. Returns -1 on failure.
+ */
+int
+local_listen(char *host, char *port, struct addrinfo hints)
+{
+	struct addrinfo *res, *res0;
+	int s, ret, x = 1;
+	int error;
+
+	/* Allow nodename to be null. */
+	hints.ai_flags |= AI_PASSIVE;
+
+	/*
+	 * In the case of binding to a wildcard address
+	 * default to binding to an ipv4 address.
+	 */
+	if (host == NULL && hints.ai_family == AF_UNSPEC)
+		hints.ai_family = AF_INET;
+
+	if ((error = getaddrinfo(host, port, &hints, &res)))
+		errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+	res0 = res;
+	do {
+		if ((s = socket(res0->ai_family, res0->ai_socktype,
+		    res0->ai_protocol)) < 0)
+			continue;
+
+		ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
+		if (ret == -1)
+			err(1, NULL);
+
+		if (FreeBSD_Oflag) {
+			if (setsockopt(s, IPPROTO_TCP, TCP_NOOPT,
+			    &FreeBSD_Oflag, sizeof(FreeBSD_Oflag)) == -1)
+				err(1, "disable TCP options");
+		}
+
+		set_common_sockopts(s, res0->ai_family);
+
+		if (bind(s, (struct sockaddr *)res0->ai_addr,
+		    res0->ai_addrlen) == 0)
+			break;
+
+		close(s);
+		s = -1;
+	} while ((res0 = res0->ai_next) != NULL);
+
+	if (!uflag && s != -1) {
+		if (listen(s, 1) < 0)
+			err(1, "listen");
+	}
+
+	freeaddrinfo(res);
+
+	return (s);
+}
+
+/*
+ * readwrite()
+ * Loop that polls on the network file descriptor and stdin.
+ */
+void
+readwrite(int net_fd)
+{
+	struct pollfd pfd[4];
+	int stdin_fd = STDIN_FILENO;
+	int stdout_fd = STDOUT_FILENO;
+	unsigned char netinbuf[BUFSIZE];
+	size_t netinbufpos = 0;
+	unsigned char stdinbuf[BUFSIZE];
+	size_t stdinbufpos = 0;
+	int n, num_fds;
+	ssize_t ret;
+
+	/* don't read from stdin if requested */
+	if (dflag)
+		stdin_fd = -1;
+
+	/* stdin */
+	pfd[POLL_STDIN].fd = stdin_fd;
+	pfd[POLL_STDIN].events = POLLIN;
+
+	/* network out */
+	pfd[POLL_NETOUT].fd = net_fd;
+	pfd[POLL_NETOUT].events = 0;
+
+	/* network in */
+	pfd[POLL_NETIN].fd = net_fd;
+	pfd[POLL_NETIN].events = POLLIN;
+
+	/* stdout */
+	pfd[POLL_STDOUT].fd = stdout_fd;
+	pfd[POLL_STDOUT].events = 0;
+
+	while (1) {
+		/* both inputs are gone, buffers are empty, we are done */
+		if (pfd[POLL_STDIN].fd == -1 && pfd[POLL_NETIN].fd == -1
+		    && stdinbufpos == 0 && netinbufpos == 0) {
+			close(net_fd);
+			return;
+		}
+		/* both outputs are gone, we can't continue */
+		if (pfd[POLL_NETOUT].fd == -1 && pfd[POLL_STDOUT].fd == -1) {
+			close(net_fd);
+			return;
+		}
+		/* listen and net in gone, queues empty, done */
+		if (lflag && pfd[POLL_NETIN].fd == -1
+		    && stdinbufpos == 0 && netinbufpos == 0) {
+			close(net_fd);
+			return;
+		}
+
+		/* help says -i is for "wait between lines sent". We read and
+		 * write arbitrary amounts of data, and we don't want to start
+		 * scanning for newlines, so this is as good as it gets */
+		if (iflag)
+			sleep(iflag);
+
+		/* poll */
+		num_fds = poll(pfd, 4, timeout);
+
+		/* treat poll errors */
+		if (num_fds == -1) {
+			close(net_fd);
+			err(1, "polling error");
+		}
+
+		/* timeout happened */
+		if (num_fds == 0)
+			return;
+
+		/* treat socket error conditions */
+		for (n = 0; n < 4; n++) {
+			if (pfd[n].revents & (POLLERR|POLLNVAL)) {
+				pfd[n].fd = -1;
+			}
+		}
+		/* reading is possible after HUP */
+		if (pfd[POLL_STDIN].events & POLLIN &&
+		    pfd[POLL_STDIN].revents & POLLHUP &&
+		    ! (pfd[POLL_STDIN].revents & POLLIN))
+				pfd[POLL_STDIN].fd = -1;
+
+		if (pfd[POLL_NETIN].events & POLLIN &&
+		    pfd[POLL_NETIN].revents & POLLHUP &&
+		    ! (pfd[POLL_NETIN].revents & POLLIN))
+				pfd[POLL_NETIN].fd = -1;
+
+		if (pfd[POLL_NETOUT].revents & POLLHUP) {
+			if (Nflag)
+				shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
+			pfd[POLL_NETOUT].fd = -1;
+		}
+		/* if HUP, stop watching stdout */
+		if (pfd[POLL_STDOUT].revents & POLLHUP)
+			pfd[POLL_STDOUT].fd = -1;
+		/* if no net out, stop watching stdin */
+		if (pfd[POLL_NETOUT].fd == -1)
+			pfd[POLL_STDIN].fd = -1;
+		/* if no stdout, stop watching net in */
+		if (pfd[POLL_STDOUT].fd == -1) {
+			if (pfd[POLL_NETIN].fd != -1)
+				shutdown(pfd[POLL_NETIN].fd, SHUT_RD);
+			pfd[POLL_NETIN].fd = -1;
+		}
+
+		/* try to read from stdin */
+		if (pfd[POLL_STDIN].revents & POLLIN && stdinbufpos < BUFSIZE) {
+			ret = fillbuf(pfd[POLL_STDIN].fd, stdinbuf,
+			    &stdinbufpos);
+			/* error or eof on stdin - remove from pfd */
+			if (ret == 0 || ret == -1)
+				pfd[POLL_STDIN].fd = -1;
+			/* read something - poll net out */
+			if (stdinbufpos > 0)
+				pfd[POLL_NETOUT].events = POLLOUT;
+			/* filled buffer - remove self from polling */
+			if (stdinbufpos == BUFSIZE)
+				pfd[POLL_STDIN].events = 0;
+		}
+		/* try to write to network */
+		if (pfd[POLL_NETOUT].revents & POLLOUT && stdinbufpos > 0) {
+			ret = drainbuf(pfd[POLL_NETOUT].fd, stdinbuf,
+			    &stdinbufpos);
+			if (ret == -1)
+				pfd[POLL_NETOUT].fd = -1;
+			/* buffer empty - remove self from polling */
+			if (stdinbufpos == 0)
+				pfd[POLL_NETOUT].events = 0;
+			/* buffer no longer full - poll stdin again */
+			if (stdinbufpos < BUFSIZE)
+				pfd[POLL_STDIN].events = POLLIN;
+		}
+		/* try to read from network */
+		if (pfd[POLL_NETIN].revents & POLLIN && netinbufpos < BUFSIZE) {
+			ret = fillbuf(pfd[POLL_NETIN].fd, netinbuf,
+			    &netinbufpos);
+			if (ret == -1)
+				pfd[POLL_NETIN].fd = -1;
+			/* eof on net in - remove from pfd */
+			if (ret == 0) {
+				shutdown(pfd[POLL_NETIN].fd, SHUT_RD);
+				pfd[POLL_NETIN].fd = -1;
+			}
+			/* read something - poll stdout */
+			if (netinbufpos > 0)
+				pfd[POLL_STDOUT].events = POLLOUT;
+			/* filled buffer - remove self from polling */
+			if (netinbufpos == BUFSIZE)
+				pfd[POLL_NETIN].events = 0;
+			/* handle telnet */
+			if (tflag)
+				atelnet(pfd[POLL_NETIN].fd, netinbuf,
+				    netinbufpos);
+		}
+		/* try to write to stdout */
+		if (pfd[POLL_STDOUT].revents & POLLOUT && netinbufpos > 0) {
+			ret = drainbuf(pfd[POLL_STDOUT].fd, netinbuf,
+			    &netinbufpos);
+			if (ret == -1)
+				pfd[POLL_STDOUT].fd = -1;
+			/* buffer empty - remove self from polling */
+			if (netinbufpos == 0)
+				pfd[POLL_STDOUT].events = 0;
+			/* buffer no longer full - poll net in again */
+			if (netinbufpos < BUFSIZE)
+				pfd[POLL_NETIN].events = POLLIN;
+		}
+
+		/* stdin gone and queue empty? */
+		if (pfd[POLL_STDIN].fd == -1 && stdinbufpos == 0) {
+			if (pfd[POLL_NETOUT].fd != -1 && Nflag)
+				shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
+			pfd[POLL_NETOUT].fd = -1;
+		}
+		/* net in gone and queue empty? */
+		if (pfd[POLL_NETIN].fd == -1 && netinbufpos == 0) {
+			pfd[POLL_STDOUT].fd = -1;
+		}
+	}
+}
+
+ssize_t
+drainbuf(int fd, unsigned char *buf, size_t *bufpos)
+{
+	ssize_t n;
+	ssize_t adjust;
+
+	n = write(fd, buf, *bufpos);
+	/* don't treat EAGAIN, EINTR as error */
+	if (n == -1 && (errno == EAGAIN || errno == EINTR))
+		n = -2;
+	if (n <= 0)
+		return n;
+	/* adjust buffer */
+	adjust = *bufpos - n;
+	if (adjust > 0)
+		memmove(buf, buf + n, adjust);
+	*bufpos -= n;
+	return n;
+}
+
+
+ssize_t
+fillbuf(int fd, unsigned char *buf, size_t *bufpos)
+{
+	size_t num = BUFSIZE - *bufpos;
+	ssize_t n;
+
+	n = read(fd, buf + *bufpos, num);
+	/* don't treat EAGAIN, EINTR as error */
+	if (n == -1 && (errno == EAGAIN || errno == EINTR))
+		n = -2;
+	if (n <= 0)
+		return n;
+	*bufpos += n;
+	return n;
+}
+
+/*
+ * fdpass()
+ * Pass the connected file descriptor to stdout and exit.
+ */
+void
+fdpass(int nfd)
+{
+	struct msghdr mh;
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
+	struct cmsghdr *cmsg;
+	struct iovec iov;
+	char c = '\0';
+	ssize_t r;
+	struct pollfd pfd;
+
+	/* Avoid obvious stupidity */
+	if (isatty(STDOUT_FILENO))
+		errx(1, "Cannot pass file descriptor to tty");
+
+	bzero(&mh, sizeof(mh));
+	bzero(&cmsgbuf, sizeof(cmsgbuf));
+	bzero(&iov, sizeof(iov));
+
+	mh.msg_control = (caddr_t)&cmsgbuf.buf;
+	mh.msg_controllen = sizeof(cmsgbuf.buf);
+	cmsg = CMSG_FIRSTHDR(&mh);
+	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+	cmsg->cmsg_level = SOL_SOCKET;
+	cmsg->cmsg_type = SCM_RIGHTS;
+	*(int *)CMSG_DATA(cmsg) = nfd;
+
+	iov.iov_base = &c;
+	iov.iov_len = 1;
+	mh.msg_iov = &iov;
+	mh.msg_iovlen = 1;
+
+	bzero(&pfd, sizeof(pfd));
+	pfd.fd = STDOUT_FILENO;
+	pfd.events = POLLOUT;
+	for (;;) {
+		r = sendmsg(STDOUT_FILENO, &mh, 0);
+		if (r == -1) {
+			if (errno == EAGAIN || errno == EINTR) {
+				if (poll(&pfd, 1, -1) == -1)
+					err(1, "poll");
+				continue;
+			}
+			err(1, "sendmsg");
+		} else if (r != 1)
+			errx(1, "sendmsg: unexpected return value %zd", r);
+		else
+			break;
+	}
+	exit(0);
+}
+
+/* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */
+void
+atelnet(int nfd, unsigned char *buf, unsigned int size)
+{
+	unsigned char *p, *end;
+	unsigned char obuf[4];
+
+	if (size < 3)
+		return;
+	end = buf + size - 2;
+
+	for (p = buf; p < end; p++) {
+		if (*p != IAC)
+			continue;
+
+		obuf[0] = IAC;
+		p++;
+		if ((*p == WILL) || (*p == WONT))
+			obuf[1] = DONT;
+		else if ((*p == DO) || (*p == DONT))
+			obuf[1] = WONT;
+		else
+			continue;
+
+		p++;
+		obuf[2] = *p;
+		if (atomicio(vwrite, nfd, obuf, 3) != 3)
+			warn("Write Error!");
+	}
+}
+
+/*
+ * build_ports()
+ * Build an array of ports in portlist[], listing each port
+ * that we should try to connect to.
+ */
+void
+build_ports(char *p)
+{
+	const char *errstr;
+	char *n;
+	int hi, lo, cp;
+	int x = 0;
+
+	if ((n = strchr(p, '-')) != NULL) {
+		*n = '\0';
+		n++;
+
+		/* Make sure the ports are in order: lowest->highest. */
+		hi = strtonum(n, 1, PORT_MAX, &errstr);
+		if (errstr)
+			errx(1, "port number %s: %s", errstr, n);
+		lo = strtonum(p, 1, PORT_MAX, &errstr);
+		if (errstr)
+			errx(1, "port number %s: %s", errstr, p);
+
+		if (lo > hi) {
+			cp = hi;
+			hi = lo;
+			lo = cp;
+		}
+
+		/* Load ports sequentially. */
+		for (cp = lo; cp <= hi; cp++) {
+			portlist[x] = calloc(1, PORT_MAX_LEN);
+			if (portlist[x] == NULL)
+				err(1, NULL);
+			snprintf(portlist[x], PORT_MAX_LEN, "%d", cp);
+			x++;
+		}
+
+		/* Randomly swap ports. */
+		if (rflag) {
+			int y;
+			char *c;
+
+			for (x = 0; x <= (hi - lo); x++) {
+				y = (arc4random() & 0xFFFF) % (hi - lo);
+				c = portlist[x];
+				portlist[x] = portlist[y];
+				portlist[y] = c;
+			}
+		}
+	} else {
+		hi = strtonum(p, 1, PORT_MAX, &errstr);
+		if (errstr)
+			errx(1, "port number %s: %s", errstr, p);
+		portlist[0] = strdup(p);
+		if (portlist[0] == NULL)
+			err(1, NULL);
+	}
+}
+
+/*
+ * udptest()
+ * Do a few writes to see if the UDP port is there.
+ * Fails once PF state table is full.
+ */
+int
+udptest(int s)
+{
+	int i, ret;
+
+	for (i = 0; i <= 3; i++) {
+		if (write(s, "X", 1) == 1)
+			ret = 1;
+		else
+			ret = -1;
+	}
+	return (ret);
+}
+
+void
+set_common_sockopts(int s, int af)
+{
+	int x = 1;
+
+	if (Dflag) {
+		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
+			&x, sizeof(x)) == -1)
+			err(1, NULL);
+	}
+	if (Tflag != -1) {
+		int proto, option;
+
+		if (af == AF_INET6) {
+			proto = IPPROTO_IPV6;
+			option = IPV6_TCLASS;
+		} else {
+			proto = IPPROTO_IP;
+			option = IP_TOS;
+		}
+
+		if (setsockopt(s, proto, option, &Tflag, sizeof(Tflag)) == -1)
+			err(1, "set IP ToS");
+	}
+	if (Iflag) {
+		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
+		    &Iflag, sizeof(Iflag)) == -1)
+			err(1, "set TCP receive buffer size");
+	}
+	if (Oflag) {
+		if (setsockopt(s, SOL_SOCKET, SO_SNDBUF,
+		    &Oflag, sizeof(Oflag)) == -1)
+			err(1, "set TCP send buffer size");
+	}
+	if (FreeBSD_Oflag) {
+		if (setsockopt(s, IPPROTO_TCP, TCP_NOOPT,
+		    &FreeBSD_Oflag, sizeof(FreeBSD_Oflag)) == -1)
+			err(1, "disable TCP options");
+	}
+#ifdef IPSEC
+	if (ipsec_policy[0] != NULL)
+		add_ipsec_policy(s, af, ipsec_policy[0]);
+	if (ipsec_policy[1] != NULL)
+		add_ipsec_policy(s, af, ipsec_policy[1]);
+#endif
+}
+
+int
+map_tos(char *s, int *val)
+{
+	/* DiffServ Codepoints and other TOS mappings */
+	const struct toskeywords {
+		const char	*keyword;
+		int		 val;
+	} *t, toskeywords[] = {
+		{ "af11",		IPTOS_DSCP_AF11 },
+		{ "af12",		IPTOS_DSCP_AF12 },
+		{ "af13",		IPTOS_DSCP_AF13 },
+		{ "af21",		IPTOS_DSCP_AF21 },
+		{ "af22",		IPTOS_DSCP_AF22 },
+		{ "af23",		IPTOS_DSCP_AF23 },
+		{ "af31",		IPTOS_DSCP_AF31 },
+		{ "af32",		IPTOS_DSCP_AF32 },
+		{ "af33",		IPTOS_DSCP_AF33 },
+		{ "af41",		IPTOS_DSCP_AF41 },
+		{ "af42",		IPTOS_DSCP_AF42 },
+		{ "af43",		IPTOS_DSCP_AF43 },
+		{ "critical",		IPTOS_PREC_CRITIC_ECP },
+		{ "cs0",		IPTOS_DSCP_CS0 },
+		{ "cs1",		IPTOS_DSCP_CS1 },
+		{ "cs2",		IPTOS_DSCP_CS2 },
+		{ "cs3",		IPTOS_DSCP_CS3 },
+		{ "cs4",		IPTOS_DSCP_CS4 },
+		{ "cs5",		IPTOS_DSCP_CS5 },
+		{ "cs6",		IPTOS_DSCP_CS6 },
+		{ "cs7",		IPTOS_DSCP_CS7 },
+		{ "ef",			IPTOS_DSCP_EF },
+		{ "inetcontrol",	IPTOS_PREC_INTERNETCONTROL },
+		{ "lowdelay",		IPTOS_LOWDELAY },
+		{ "netcontrol",		IPTOS_PREC_NETCONTROL },
+		{ "reliability",	IPTOS_RELIABILITY },
+		{ "throughput",		IPTOS_THROUGHPUT },
+		{ NULL, 		-1 },
+	};
+
+	for (t = toskeywords; t->keyword != NULL; t++) {
+		if (strcmp(s, t->keyword) == 0) {
+			*val = t->val;
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+void
+report_connect(const struct sockaddr *sa, socklen_t salen)
+{
+	char remote_host[NI_MAXHOST];
+	char remote_port[NI_MAXSERV];
+	int herr;
+	int flags = NI_NUMERICSERV;
+	
+	if (nflag)
+		flags |= NI_NUMERICHOST;
+	
+	if ((herr = getnameinfo(sa, salen,
+	    remote_host, sizeof(remote_host),
+	    remote_port, sizeof(remote_port),
+	    flags)) != 0) {
+		if (herr == EAI_SYSTEM)
+			err(1, "getnameinfo");
+		else
+			errx(1, "getnameinfo: %s", gai_strerror(herr));
+	}
+	
+	fprintf(stderr,
+	    "Connection from %s %s "
+	    "received!\n", remote_host, remote_port);
+}
+
+void
+help(void)
+{
+	usage(0);
+	fprintf(stderr, "\tCommand Summary:\n\
+	\t-4		Use IPv4\n\
+	\t-6		Use IPv6\n\
+	\t-D		Enable the debug socket option\n\
+	\t-d		Detach from stdin\n");
+#ifdef IPSEC
+	fprintf(stderr, "\
+	\t-E		Use IPsec ESP\n\
+	\t-e policy	Use specified IPsec policy\n");
+#endif
+	fprintf(stderr, "\
+	\t-F		Pass socket fd\n\
+	\t-h		This help text\n\
+	\t-I length	TCP receive buffer length\n\
+	\t-i secs\t	Delay interval for lines sent, ports scanned\n\
+	\t-k		Keep inbound sockets open for multiple connects\n\
+	\t-l		Listen mode, for inbound connects\n\
+	\t-N		Shutdown the network socket after EOF on stdin\n\
+	\t-n		Suppress name/port resolutions\n\
+	\t--no-tcpopt	Disable TCP options\n\
+	\t-O length	TCP send buffer length\n\
+	\t-P proxyuser\tUsername for proxy authentication\n\
+	\t-p port\t	Specify local port for remote connects\n\
+	\t-r		Randomize remote ports\n\
+	\t-S		Enable the TCP MD5 signature option\n\
+	\t-s addr\t	Local source address\n\
+	\t-T toskeyword\tSet IP Type of Service\n\
+	\t-t		Answer TELNET negotiation\n\
+	\t-U		Use UNIX domain socket\n\
+	\t-u		UDP mode\n\
+	\t-v		Verbose\n\
+	\t-w secs\t	Timeout for connects and final net reads\n\
+	\t-X proto	Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
+	\t-x addr[:port]\tSpecify proxy address and port\n\
+	\t-z		Zero-I/O mode [used for scanning]\n\
+	Port numbers can be individual or ranges: lo-hi [inclusive]\n");
+#ifdef IPSEC
+	fprintf(stderr, "\tSee ipsec_set_policy(3) for -e argument format\n");
+#endif
+	exit(1);
+}
+
+#ifdef IPSEC
+void
+add_ipsec_policy(int s, int af, char *policy)
+{
+	char *raw;
+	int e;
+
+	raw = ipsec_set_policy(policy, strlen(policy));
+	if (raw == NULL)
+		errx(1, "ipsec_set_policy `%s': %s", policy,
+		     ipsec_strerror());
+	if (af == AF_INET)
+		e = setsockopt(s, IPPROTO_IP, IP_IPSEC_POLICY, raw,
+		    ipsec_get_policylen(raw));
+	if (af == AF_INET6)
+		e = setsockopt(s, IPPROTO_IPV6, IPV6_IPSEC_POLICY, raw,
+		    ipsec_get_policylen(raw));
+	if (e < 0)
+		err(1, "ipsec policy cannot be configured");
+	free(raw);
+	if (vflag)
+		fprintf(stderr, "ipsec policy configured: `%s'\n", policy);
+	return;
+}
+#endif /* IPSEC */
+
+void
+usage(int ret)
+{
+	fprintf(stderr,
+#ifdef IPSEC
+	    "usage: nc [-46DdEFhklNnrStUuvz] [-e policy] [-I length] [-i interval] [-O length]\n"
+#else
+	    "usage: nc [-46DdFhklNnrStUuvz] [-I length] [-i interval] [-O length]\n"
+#endif
+	    "\t  [--no-tcpopt]\n"
+	    "\t  [-P proxy_username] [-p source_port] [-s source] [-T ToS]\n"
+	    "\t  [-w timeout] [-X proxy_protocol]\n"
+	    "\t  [-x proxy_address[:port]] [destination] [port]\n");
+	if (ret)
+		exit(1);
+}
diff --git a/usr.bin/nc/socks.c b/usr.bin/nc/socks.c
new file mode 100644
index 0000000000..1b06e0e12d
--- /dev/null
+++ b/usr.bin/nc/socks.c
@@ -0,0 +1,340 @@
+/*	$OpenBSD: socks.c,v 1.21 2015/03/26 21:19:51 tobias Exp $	*/
+
+/*
+ * Copyright (c) 1999 Niklas Hallqvist.  All rights reserved.
+ * Copyright (c) 2004, 2005 Damien Miller.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <err.h>
+#include <errno.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <resolv.h>
+#include <readpassphrase.h>
+#include "atomicio.h"
+
+#define SOCKS_PORT	"1080"
+#define HTTP_PROXY_PORT	"3128"
+#define HTTP_MAXHDRS	64
+#define SOCKS_V5	5
+#define SOCKS_V4	4
+#define SOCKS_NOAUTH	0
+#define SOCKS_NOMETHOD	0xff
+#define SOCKS_CONNECT	1
+#define SOCKS_IPV4	1
+#define SOCKS_DOMAIN	3
+#define SOCKS_IPV6	4
+
+int	remote_connect(const char *, const char *, struct addrinfo);
+int	socks_connect(const char *, const char *, struct addrinfo,
+	    const char *, const char *, struct addrinfo, int,
+	    const char *);
+
+static int
+decode_addrport(const char *h, const char *p, struct sockaddr *addr,
+    socklen_t addrlen, int v4only, int numeric)
+{
+	int r;
+	struct addrinfo hints, *res;
+
+	bzero(&hints, sizeof(hints));
+	hints.ai_family = v4only ? PF_INET : PF_UNSPEC;
+	hints.ai_flags = numeric ? AI_NUMERICHOST : 0;
+	hints.ai_socktype = SOCK_STREAM;
+	r = getaddrinfo(h, p, &hints, &res);
+	/* Don't fatal when attempting to convert a numeric address */
+	if (r != 0) {
+		if (!numeric) {
+			errx(1, "getaddrinfo(\"%.64s\", \"%.64s\"): %s", h, p,
+			    gai_strerror(r));
+		}
+		return (-1);
+	}
+	if (addrlen < res->ai_addrlen) {
+		freeaddrinfo(res);
+		errx(1, "internal error: addrlen < res->ai_addrlen");
+	}
+	memcpy(addr, res->ai_addr, res->ai_addrlen);
+	freeaddrinfo(res);
+	return (0);
+}
+
+static int
+proxy_read_line(int fd, char *buf, size_t bufsz)
+{
+	size_t off;
+
+	for(off = 0;;) {
+		if (off >= bufsz)
+			errx(1, "proxy read too long");
+		if (atomicio(read, fd, buf + off, 1) != 1)
+			err(1, "proxy read");
+		/* Skip CR */
+		if (buf[off] == '\r')
+			continue;
+		if (buf[off] == '\n') {
+			buf[off] = '\0';
+			break;
+		}
+		off++;
+	}
+	return (off);
+}
+
+static const char *
+getproxypass(const char *proxyuser, const char *proxyhost)
+{
+	char prompt[512];
+	static char pw[256];
+
+	snprintf(prompt, sizeof(prompt), "Proxy password for %s@%s: ",
+	   proxyuser, proxyhost);
+	if (readpassphrase(prompt, pw, sizeof(pw), RPP_REQUIRE_TTY) == NULL)
+		errx(1, "Unable to read proxy passphrase");
+	return (pw);
+}
+
+int
+socks_connect(const char *host, const char *port,
+    struct addrinfo hints __attribute__ ((__unused__)),
+    const char *proxyhost, const char *proxyport, struct addrinfo proxyhints,
+    int socksv, const char *proxyuser)
+{
+	int proxyfd, r, authretry = 0;
+	size_t hlen, wlen;
+	unsigned char buf[1024];
+	size_t cnt;
+	struct sockaddr_storage addr;
+	struct sockaddr_in *in4 = (struct sockaddr_in *)&addr;
+	struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)&addr;
+	in_port_t serverport;
+	const char *proxypass = NULL;
+
+	if (proxyport == NULL)
+		proxyport = (socksv == -1) ? HTTP_PROXY_PORT : SOCKS_PORT;
+
+	/* Abuse API to lookup port */
+	if (decode_addrport("0.0.0.0", port, (struct sockaddr *)&addr,
+	    sizeof(addr), 1, 1) == -1)
+		errx(1, "unknown port \"%.64s\"", port);
+	serverport = in4->sin_port;
+
+ again:
+	if (authretry++ > 3)
+		errx(1, "Too many authentication failures");
+
+	proxyfd = remote_connect(proxyhost, proxyport, proxyhints);
+
+	if (proxyfd < 0)
+		return (-1);
+
+	if (socksv == 5) {
+		if (decode_addrport(host, port, (struct sockaddr *)&addr,
+		    sizeof(addr), 0, 1) == -1)
+			addr.ss_family = 0; /* used in switch below */
+
+		/* Version 5, one method: no authentication */
+		buf[0] = SOCKS_V5;
+		buf[1] = 1;
+		buf[2] = SOCKS_NOAUTH;
+		cnt = atomicio(vwrite, proxyfd, buf, 3);
+		if (cnt != 3)
+			err(1, "write failed (%zu/3)", cnt);
+
+		cnt = atomicio(read, proxyfd, buf, 2);
+		if (cnt != 2)
+			err(1, "read failed (%zu/3)", cnt);
+
+		if (buf[1] == SOCKS_NOMETHOD)
+			errx(1, "authentication method negotiation failed");
+
+		switch (addr.ss_family) {
+		case 0:
+			/* Version 5, connect: domain name */
+
+			/* Max domain name length is 255 bytes */
+			hlen = strlen(host);
+			if (hlen > 255)
+				errx(1, "host name too long for SOCKS5");
+			buf[0] = SOCKS_V5;
+			buf[1] = SOCKS_CONNECT;
+			buf[2] = 0;
+			buf[3] = SOCKS_DOMAIN;
+			buf[4] = hlen;
+			memcpy(buf + 5, host, hlen);			
+			memcpy(buf + 5 + hlen, &serverport, sizeof serverport);
+			wlen = 7 + hlen;
+			break;
+		case AF_INET:
+			/* Version 5, connect: IPv4 address */
+			buf[0] = SOCKS_V5;
+			buf[1] = SOCKS_CONNECT;
+			buf[2] = 0;
+			buf[3] = SOCKS_IPV4;
+			memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+			memcpy(buf + 8, &in4->sin_port, sizeof in4->sin_port);
+			wlen = 10;
+			break;
+		case AF_INET6:
+			/* Version 5, connect: IPv6 address */
+			buf[0] = SOCKS_V5;
+			buf[1] = SOCKS_CONNECT;
+			buf[2] = 0;
+			buf[3] = SOCKS_IPV6;
+			memcpy(buf + 4, &in6->sin6_addr, sizeof in6->sin6_addr);
+			memcpy(buf + 20, &in6->sin6_port,
+			    sizeof in6->sin6_port);
+			wlen = 22;
+			break;
+		default:
+			errx(1, "internal error: silly AF");
+		}
+
+		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+		if (cnt != wlen)
+			err(1, "write failed (%zu/%zu)", cnt, wlen);
+
+		cnt = atomicio(read, proxyfd, buf, 4);
+		if (cnt != 4)
+			err(1, "read failed (%zu/4)", cnt);
+		if (buf[1] != 0)
+			errx(1, "connection failed, SOCKS error %d", buf[1]);
+		switch (buf[3]) {
+		case SOCKS_IPV4:
+			cnt = atomicio(read, proxyfd, buf + 4, 6);
+			if (cnt != 6)
+				err(1, "read failed (%zu/6)", cnt);
+			break;
+		case SOCKS_IPV6:
+			cnt = atomicio(read, proxyfd, buf + 4, 18);
+			if (cnt != 18)
+				err(1, "read failed (%zu/18)", cnt);
+			break;
+		default:
+			errx(1, "connection failed, unsupported address type");
+		}
+	} else if (socksv == 4) {
+		/* This will exit on lookup failure */
+		decode_addrport(host, port, (struct sockaddr *)&addr,
+		    sizeof(addr), 1, 0);
+
+		/* Version 4 */
+		buf[0] = SOCKS_V4;
+		buf[1] = SOCKS_CONNECT;	/* connect */
+		memcpy(buf + 2, &in4->sin_port, sizeof in4->sin_port);
+		memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+		buf[8] = 0;	/* empty username */
+		wlen = 9;
+
+		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+		if (cnt != wlen)
+			err(1, "write failed (%zu/%zu)", cnt, wlen);
+
+		cnt = atomicio(read, proxyfd, buf, 8);
+		if (cnt != 8)
+			err(1, "read failed (%zu/8)", cnt);
+		if (buf[1] != 90)
+			errx(1, "connection failed, SOCKS error %d", buf[1]);
+	} else if (socksv == -1) {
+		/* HTTP proxy CONNECT */
+
+		/* Disallow bad chars in hostname */
+		if (strcspn(host, "\r\n\t []:") != strlen(host))
+			errx(1, "Invalid hostname");
+
+		/* Try to be sane about numeric IPv6 addresses */
+		if (strchr(host, ':') != NULL) {
+			r = snprintf(buf, sizeof(buf),
+			    "CONNECT [%s]:%d HTTP/1.0\r\n",
+			    host, ntohs(serverport));
+		} else {
+			r = snprintf(buf, sizeof(buf),
+			    "CONNECT %s:%d HTTP/1.0\r\n",
+			    host, ntohs(serverport));
+		}
+		if (r == -1 || (size_t)r >= sizeof(buf))
+			errx(1, "hostname too long");
+		r = strlen(buf);
+
+		cnt = atomicio(vwrite, proxyfd, buf, r);
+		if (cnt != r)
+			err(1, "write failed (%zu/%d)", cnt, r);
+
+		if (authretry > 1) {
+			char resp[1024];
+
+			proxypass = getproxypass(proxyuser, proxyhost);
+			r = snprintf(buf, sizeof(buf), "%s:%s",
+			    proxyuser, proxypass);
+			if (r == -1 || (size_t)r >= sizeof(buf) ||
+			    b64_ntop(buf, strlen(buf), resp,
+			    sizeof(resp)) == -1)
+				errx(1, "Proxy username/password too long");
+			r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
+			    "Basic %s\r\n", resp);
+			if (r == -1 || (size_t)r >= sizeof(buf))
+				errx(1, "Proxy auth response too long");
+			r = strlen(buf);
+			if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != r)
+				err(1, "write failed (%zu/%d)", cnt, r);
+		}
+
+		/* Terminate headers */
+		if ((cnt = atomicio(vwrite, proxyfd, "\r\n", 2)) != 2)
+			err(1, "write failed (%zu/2)", cnt);
+
+		/* Read status reply */
+		proxy_read_line(proxyfd, buf, sizeof(buf));
+		if (proxyuser != NULL &&
+		    strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
+			if (authretry > 1) {
+				fprintf(stderr, "Proxy authentication "
+				    "failed\n");
+			}
+			close(proxyfd);
+			goto again;
+		} else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
+		    strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
+			errx(1, "Proxy error: \"%s\"", buf);
+
+		/* Headers continue until we hit an empty line */
+		for (r = 0; r < HTTP_MAXHDRS; r++) {
+			proxy_read_line(proxyfd, buf, sizeof(buf));
+			if (*buf == '\0')
+				break;
+		}
+		if (*buf != '\0')
+			errx(1, "Too many proxy headers received");
+	} else
+		errx(1, "Unknown proxy protocol %d", socksv);
+
+	return (proxyfd);
+}
diff --git a/usr.bin/newkey/Makefile b/usr.bin/newkey/Makefile
index 5b59c5c6a2..5b82f92ec8 100644
--- a/usr.bin/newkey/Makefile
+++ b/usr.bin/newkey/Makefile
@@ -13,6 +13,6 @@ LDADD=	-lrpcsvc
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/newkey/generic.c b/usr.bin/newkey/generic.c
index b2f3c68ced..74d6b2d947 100644
--- a/usr.bin/newkey/generic.c
+++ b/usr.bin/newkey/generic.c
@@ -74,7 +74,6 @@ itobn(long i)
 	if ((n = BN_new()) == NULL)
 		errx(1, "could not create BIGNUM: %s",
 		     ERR_error_string(ERR_get_error(), 0));
-	BN_init(n);
 	if (i > 0)
 		BN_add_word(n, (u_long)i);
 	else
diff --git a/usr.bin/openssl/Makefile b/usr.bin/openssl/Makefile
index 464a43050c..b21c9bba4c 100644
--- a/usr.bin/openssl/Makefile
+++ b/usr.bin/openssl/Makefile
@@ -1,27 +1,3 @@
-# This version of openssl(1) is from LibreSSL
-PROG=	openssl
-WARNS?=	2
-MAN=	openssl.1 openssl.cnf.5
+SUBDIR=	libapps openssl
 
-.include "${.CURDIR}/../../lib/librecrypto/Makefile.inc"
-
-CFLAGS+=	-DLIBRESSL_INTERNAL
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
-CFLAGS+= 	-I${.CURDIR}
-
-DPADD+=		${LIBSSL} ${LIBCRYPTO}
-LDADD+=		-lprivate_ssl -lprivate_crypto
-LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-
-SRCS=	apps_posix.c apps.c asn1pars.c ca.c certhash.c ciphers.c cms.c \
-	crl2p7.c crl.c \
-	dgst.c dh.c dhparam.c dsa.c dsaparam.c ec.c ecparam.c enc.c errstr.c \
-	gendh.c gendsa.c genpkey.c genrsa.c nseq.c ocsp.c openssl.c \
-	passwd.c pkcs12.c pkcs7.c pkcs8.c pkey.c pkeyparam.c pkeyutl.c \
-	prime.c rand.c req.c rsa.c rsautl.c \
-	s_cb.c s_client.c s_server.c s_socket.c s_time.c sess_id.c \
-	smime.c speed.c spkac.c ts.c verify.c version.c x509.c
-
-.include <bsd.prog.mk>
-
-.PATH:	${LIBRESSL_SRC}/apps/openssl ${LIBRESSL_SRC}/man
+.include <bsd.subdir.mk>
diff --git a/usr.bin/openssl/Makefile.etc b/usr.bin/openssl/Makefile.etc
index 2e1666f3fa..228f737b9d 100644
--- a/usr.bin/openssl/Makefile.etc
+++ b/usr.bin/openssl/Makefile.etc
@@ -4,6 +4,11 @@ FILESOWN=	${BINOWN}
 FILESGRP=	${BINGRP}
 FILESMODE=	644
 
-.include "../../lib/librecrypto/Makefile.inc"
-.PATH: ${LIBRESSL_SRC}/apps/openssl
+OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
+
+SCRIPTS=	CA.pl
+SCRIPTSDIR=	/etc/ssl
+
+.include "../../lib/libcrypto/Makefile.inc"
+.PATH: ${OPENSSL_SRC}/apps
 .include <bsd.prog.mk>
diff --git a/usr.bin/openssl/Makefile.inc b/usr.bin/openssl/Makefile.inc
new file mode 100644
index 0000000000..1f5b79aa2c
--- /dev/null
+++ b/usr.bin/openssl/Makefile.inc
@@ -0,0 +1,3 @@
+WARNS?=	2
+
+.include "../Makefile.inc"
diff --git a/usr.bin/openssl/libapps/Makefile b/usr.bin/openssl/libapps/Makefile
new file mode 100644
index 0000000000..ad41e9f29e
--- /dev/null
+++ b/usr.bin/openssl/libapps/Makefile
@@ -0,0 +1,14 @@
+LIB=		apps
+INTERNALLIB=
+CFLAGS+=	${PRIVATELIB_CFLAGS}
+CFLAGS+=	-I${OPENSSL_SRC} -I${OPENSSL_SRC}/include
+CFLAGS+=	-I${OPENSSL_SRC}/apps/include
+
+OPENSSL_SRC=	${.CURDIR}/../../../crypto/openssl
+
+.PATH:	${OPENSSL_SRC}/apps/lib
+
+SRCS=	app_libctx.c app_params.c app_provider.c app_rand.c apps.c apps_ui.c app_x509.c columns.c engine.c engine_loader.c fmt.c http_server.c names.c opt.c
+SRCS+=	s_cb.c s_socket.c tlssrp_depr.c
+
+.include <bsd.lib.mk>
diff --git a/usr.bin/openssl/openssl/Makefile b/usr.bin/openssl/openssl/Makefile
new file mode 100644
index 0000000000..905003def1
--- /dev/null
+++ b/usr.bin/openssl/openssl/Makefile
@@ -0,0 +1,27 @@
+# This version of openssl(1) is from LibreSSL
+PROG=	openssl
+#MAN=	openssl.1 openssl.cnf.5
+NOMAN=
+
+OPENSSL_SRC=	${.CURDIR}/../../../crypto/openssl
+
+.PATH:	${OPENSSL_SRC}/apps ${OPENSSL_SRC}/apps/lib ${OPENSSL_SRC}/man
+
+.if exists(${.OBJDIR}/../libapps)
+LIBAPPS=${.OBJDIR}/../libapps/libapps.a
+.else
+LIBAPPS=${.CURDIR}/../libapps/libapps.a
+.endif
+
+CFLAGS+=	${PRIVATELIB_CFLAGS}
+CFLAGS+=	-I${OPENSSL_SRC} -I${OPENSSL_SRC}/include
+CFLAGS+=	-I${OPENSSL_SRC}/apps/include
+CFLAGS+= 	-Wa,--noexecstack
+
+DPADD+=		${LIBSSL} ${LIBCRYPTO} ${LIBPTHREAD} ${LIBAPPS}
+LDADD+=		-lprivate_ssl -lprivate_crypto -lpthread ${LIBAPPS}
+LDFLAGS+=	${PRIVATELIB_LDFLAGS}
+
+SRCS=	cmp_mock_srv.c  asn1parse.c ca.c  ciphers.c cmp.c  cms.c crl.c  crl2pkcs7.c dgst.c  dhparam.c dsa.c  dsaparam.c ec.c  ecparam.c enc.c  engine.c errstr.c  fipsinstall.c gendsa.c  genpkey.c genrsa.c  info.c kdf.c  list.c mac.c  nseq.c ocsp.c  openssl.c passwd.c  pkcs12.c pkcs7.c  pkcs8.c pkey.c  pkeyparam.c pkeyutl.c  prime.c progs.c  rand.c rehash.c  req.c rsa.c  rsautl.c s_client.c  s_server.c s_time.c  sess_id.c smime.c  speed.c spkac.c  srp.c storeutl.c  ts.c verify.c  version.c x509.c
+
+.include <bsd.prog.mk>
diff --git a/usr.bin/scp/Makefile b/usr.bin/scp/Makefile
index 6b8c21fd07..9852e4e53b 100644
--- a/usr.bin/scp/Makefile
+++ b/usr.bin/scp/Makefile
@@ -8,7 +8,7 @@ SRCS+=	sftp-common.c sftp-client.c sftp-glob.c
 WARNS?=	3
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/sort/Makefile b/usr.bin/sort/Makefile
index 4f2c164adb..bfd3766519 100644
--- a/usr.bin/sort/Makefile
+++ b/usr.bin/sort/Makefile
@@ -12,6 +12,7 @@ SRCS=	bwstring.c \
 CFLAGS+= -DWITHOUT_NLS
 
 .if !defined(BOOTSTRAPPING) && !defined(RESCUE)
+CFLAGS+= -DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+= -DSORT_RANDOM
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD+=		${LIBCRYPTO}
diff --git a/usr.bin/ssh-add/Makefile b/usr.bin/ssh-add/Makefile
index bcb3a4165e..c339c11fa0 100644
--- a/usr.bin/ssh-add/Makefile
+++ b/usr.bin/ssh-add/Makefile
@@ -5,7 +5,7 @@ PROG=	ssh-add
 WARNS?=	3
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/ssh-agent/Makefile b/usr.bin/ssh-agent/Makefile
index dbe37db730..3b9b8042a9 100644
--- a/usr.bin/ssh-agent/Makefile
+++ b/usr.bin/ssh-agent/Makefile
@@ -8,7 +8,7 @@ WARNS?=	3
 # not needed: ssh-pkcs11-client.c
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/ssh-keygen/Makefile b/usr.bin/ssh-keygen/Makefile
index e4f6473886..729796c452 100644
--- a/usr.bin/ssh-keygen/Makefile
+++ b/usr.bin/ssh-keygen/Makefile
@@ -5,7 +5,8 @@ PROG=	ssh-keygen
 WARNS?=	3
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/ssh-keyscan/Makefile b/usr.bin/ssh-keyscan/Makefile
index cc1719034e..bd7042db18 100644
--- a/usr.bin/ssh-keyscan/Makefile
+++ b/usr.bin/ssh-keyscan/Makefile
@@ -5,7 +5,7 @@ PROG=	ssh-keyscan
 WARNS?=	3
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/ssh/Makefile b/usr.bin/ssh/Makefile
index f350a04e25..0a2db97c24 100644
--- a/usr.bin/ssh/Makefile
+++ b/usr.bin/ssh/Makefile
@@ -16,7 +16,7 @@ CFLAGS+= -DXAUTH_PATH=\"${XAUTH_PATH}\"
 .endif
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.bin/telnet/Makefile b/usr.bin/telnet/Makefile
index 9d141c1b49..9da9d73af7 100644
--- a/usr.bin/telnet/Makefile
+++ b/usr.bin/telnet/Makefile
@@ -22,7 +22,7 @@ CFLAGS+=	-I${_SHLIBDIRPREFIX}/usr/include/priv/ncurses
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
 
 CFLAGS+=	-DENCRYPTION -DAUTHENTICATION
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 DPADD+=		${LIBCRYPTO} ${LIBCRYPT}
 LDADD+=		-lprivate_crypto -lcrypt
 
diff --git a/usr.sbin/802_11/Makefile.crypto b/usr.sbin/802_11/Makefile.crypto
index 5c86dbc164..b39159aa0e 100644
--- a/usr.sbin/802_11/Makefile.crypto
+++ b/usr.sbin/802_11/Makefile.crypto
@@ -3,8 +3,9 @@
 SRCS+=		crypto_openssl.c random.c sha1-prf.c sha256-prf.c
 DPADD+=		${LIBSSL} ${LIBCRYPTO}
 LDADD+=		-lprivate_ssl -lprivate_crypto
-CFLAGS+= 	-DCONFIG_SHA256 -I${.CURDIR}/../../../crypto/libressl/include
+CFLAGS+= 	-DCONFIG_SHA256 -I${.CURDIR}/../../../crypto/openssl/include
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .if defined(TLS_FUNCS)
 NEED_TLS_PRF=y
diff --git a/usr.sbin/ckdist/Makefile b/usr.sbin/ckdist/Makefile
index 0e857e79f0..f1f48c1d18 100644
--- a/usr.sbin/ckdist/Makefile
+++ b/usr.sbin/ckdist/Makefile
@@ -5,7 +5,7 @@
 PROG=	ckdist
 SRCS=   ckdist.c crc.c
 
-
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
diff --git a/usr.sbin/keyserv/Makefile b/usr.sbin/keyserv/Makefile
index 153fe87ae6..2488aa95e3 100644
--- a/usr.sbin/keyserv/Makefile
+++ b/usr.sbin/keyserv/Makefile
@@ -17,7 +17,7 @@ LDADD=	-lrpcsvc
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 RPCDIR=	${DESTDIR}/usr/include/rpcsvc
 
diff --git a/usr.sbin/mtree/Makefile b/usr.sbin/mtree/Makefile
index 9e77a15bc8..e3730861fc 100644
--- a/usr.sbin/mtree/Makefile
+++ b/usr.sbin/mtree/Makefile
@@ -19,6 +19,7 @@ SRCS+= getid.c
 
 .if !defined(BOOTSTRAPPING) && !defined(RESCUE)
 SRCS+= hash.c
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+= 	${PRIVATELIB_CFLAGS}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
diff --git a/usr.sbin/pfctl/Makefile b/usr.sbin/pfctl/Makefile
index 1ddf2ac34f..9f0c1ab39b 100644
--- a/usr.sbin/pfctl/Makefile
+++ b/usr.sbin/pfctl/Makefile
@@ -16,6 +16,7 @@ DPADD=	${LIBM}
 
 WARNS?=	2
 
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
diff --git a/usr.sbin/ppp/Makefile b/usr.sbin/ppp/Makefile
index 1da54ad563..80de831a83 100644
--- a/usr.sbin/ppp/Makefile
+++ b/usr.sbin/ppp/Makefile
@@ -89,6 +89,7 @@ SRCS+=	netgraph.c
 
 NO_STRICT_ALIASING=
 
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 CFLAGS+=	${PRIVATELIB_CFLAGS}
 DPADD+=		${LIBCRYPTO}
 LDADD+=		-lprivate_crypto
diff --git a/usr.sbin/sshd/Makefile b/usr.sbin/sshd/Makefile
index fb5731cbcf..04056234d9 100644
--- a/usr.sbin/sshd/Makefile
+++ b/usr.sbin/sshd/Makefile
@@ -36,7 +36,8 @@ LDADD+=	-lcrypt ${MINUSLPAM}
 DPADD+=	${LIBCRYPT} ${LIBPAM}
 
 CFLAGS+=	-I${.CURDIR}/../../lib/libssh -I${.CURDIR}/../../crypto/openssh
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
+CFLAGS+=	-DOPENSSL_SUPPRESS_DEPRECATED
 DPADD+=		${LIBSSH} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 LDADD+=		-lprivate_ssh -lprivate_crypto -lutil -lz
 LDFLAGS+=	-rpath /usr/lib/priv ${PRIVATELIB_LDFLAGS}
diff --git a/usr.sbin/tcpdump/Makefile b/usr.sbin/tcpdump/Makefile
index 2a28a44da1..ec665ff932 100644
--- a/usr.sbin/tcpdump/Makefile
+++ b/usr.sbin/tcpdump/Makefile
@@ -84,7 +84,8 @@ LDADD=	-lpcap
 
 CFLAGS+=-DHAVE_LIBCRYPTO -DHAVE_OPENSSL_EVP_H \
 	-DHAVE_EVP_CIPHERINIT_EX -DHAVE_EVP_CIPHER_CTX_NEW
-CFLAGS+=-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=-DOPENSSL_SUPPRESS_DEPRECATED
+CFLAGS+=-I${.CURDIR}/../../crypto/openssl/include
 LDFLAGS+=${PRIVATELIB_LDFLAGS}
 DPADD+=	${LIBCRYPTO}
 LDADD+=	-lprivate_crypto
diff --git a/usr.sbin/uefisign/Makefile b/usr.sbin/uefisign/Makefile
index cbe1f483f8..af675b9664 100644
--- a/usr.sbin/uefisign/Makefile
+++ b/usr.sbin/uefisign/Makefile
@@ -7,6 +7,6 @@ MAN=	uefisign.8
 LDADD=	-lprivate_crypto
 DPADD=	${LIBCRYPTO}
 LDFLAGS+= ${PRIVATELIB_LDFLAGS}
-CFLAGS+= -I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+= -I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
-- 
2.32.0

