Build failure with OpenSSL 4.0

[raviksharma]

This bug was filed using automation as part of the Debian OpenSSL 4.0 migration effort. Please ignore if the build issue is already fixed.

More details and build logs in the Debian bug report:
https://bugs.debian.org/1138475

[vmpyr]

The log of the build failure is:

gcc -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fdebug-prefix-map=/<<PKGBUILDDIR>>=/usr/src/ncrack-0.7+debian-6build2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE  -I. -Wdate-time -D_FORTIFY_SOURCE=3 -DHAVE_CONFIG_H -c cipher-bf1.c
cipher-bf1.c: In function ‘evp_ssh1_bf’:
cipher-bf1.c:93:19: error: implicit declaration of function ‘EVP_CIPHER_meth_dup’; did you mean ‘EVP_CIPHER_CTX_dup’? [-Wimplicit-function-declaration]
   93 |         ssh1_bf = EVP_CIPHER_meth_dup(EVP_bf_cbc());
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   EVP_CIPHER_CTX_dup
cipher-bf1.c:93:17: error: assignment to ‘EVP_CIPHER *’ {aka ‘struct evp_cipher_st *’} from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
   93 |         ssh1_bf = EVP_CIPHER_meth_dup(EVP_bf_cbc());
      |                 ^
cipher-bf1.c:94:26: error: implicit declaration of function ‘EVP_CIPHER_meth_get_do_cipher’; did you mean ‘EVP_CIPHER_CTX_get1_cipher’? [-Wimplicit-function-declaration]
   94 |         orig_do_cipher = EVP_CIPHER_meth_get_do_cipher(ssh1_bf);
      |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                          EVP_CIPHER_CTX_get1_cipher
cipher-bf1.c:94:24: error: assignment to ‘int (*)(EVP_CIPHER_CTX *, u_char *, const u_char *, size_t)’ {aka ‘int (*)(struct evp_cipher_ctx_st *, unsigned char *, const unsigned char *, long unsigned int)’} from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
   94 |         orig_do_cipher = EVP_CIPHER_meth_get_do_cipher(ssh1_bf);
      |                        ^
cipher-bf1.c:99:9: error: implicit declaration of function ‘EVP_CIPHER_meth_set_do_cipher’; did you mean ‘EVP_CIPHER_CTX_get1_cipher’? [-Wimplicit-function-declaration]
   99 |         EVP_CIPHER_meth_set_do_cipher(ssh1_bf, bf_ssh1_do_cipher);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |         EVP_CIPHER_CTX_get1_cipher
make[2]: *** [Makefile:72: cipher-bf1.o] Error 1
make[2]: Leaving directory '/<<PKGBUILDDIR>>/opensshlib'

Since ncrack doesn't invoke the --with-ssh1 flag during the configure step, this function can be wrapped in a #ifdef WITH_SSH1 block. I have submitted a patch in Ubuntu as fix:

Description: Fix FTBFS with OpenSSL 4.
 The bundled opensshlib files cipher-3des1.c and cipher-bf1.c implement the
 SSH protocol 1 "3des" and "blowfish" ciphers using the EVP_CIPHER_meth_*()
 API, which was deprecated in OpenSSL 3.0 and removed entirely in OpenSSL 4.0.
 Compiling them against OpenSSL 4 fails with implicit-declaration errors.
 .
 These ciphers are only referenced from cipher.c inside #ifdef WITH_SSH1
 blocks, and Ncrack's build never enables SSH protocol 1 support (it does not
 pass --with-ssh1 to the bundled opensshlib configure), so this code is never
 actually used. Guard the affected code with WITH_SSH1 so it is compiled out,
 matching how its only consumers in cipher.c are already guarded. This keeps
 the package building with both OpenSSL 3 and OpenSSL 4.
Author: Ujjwal Sarswat <ujjwal.sarswat@canonical.com>
Last-Update: 2026-07-08
--- a/opensshlib/cipher-3des1.c
+++ b/opensshlib/cipher-3des1.c
@@ -26,6 +26,8 @@
 
 #include "ssherr.h"
 
+#ifdef WITH_SSH1
+
 /*
  * This is used by SSH1:
  *
@@ -155,3 +157,5 @@
 	EVP_CIPHER_meth_set_flags(ssh1_3des, EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH);
 	return ssh1_3des;
 }
+
+#endif /* WITH_SSH1 */
--- a/opensshlib/cipher-bf1.c
+++ b/opensshlib/cipher-bf1.c
@@ -20,7 +20,7 @@
 
 #include "includes.h"
 
-#ifdef WITH_OPENSSL
+#if defined(WITH_OPENSSL) && defined(WITH_SSH1)
 
 #include <sys/types.h>
 
@@ -99,4 +99,4 @@
 	EVP_CIPHER_meth_set_do_cipher(ssh1_bf, bf_ssh1_do_cipher);
 	return (ssh1_bf);
 }
-#endif /* WITH_OPENSSL */
+#endif /* WITH_OPENSSL && WITH_SSH1 */

Please let me know if there is a better fix. Cheers!

[loqs]

@vmpyr will you be opening a pull request to resolve the issue?

[vmpyr]

sure, I've created a PR for resolving this :)

[loqs]

Thank You.