From d963d4e276658d110bcb796722d76efa7fb68efa Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Tue, 13 Jun 2017 23:39:41 +0900

Subject: [PATCH] pkey: refactor DER/PEM-encoded string parsing code

Export the flow used by OpenSSL::PKey.read and let the subclasses call

it before attempting other formats.

---

diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c

index 7ba7b37..3982b9c 100644

--- a/ext/openssl/ossl_pkey.c

+++ b/ext/openssl/ossl_pkey.c

@@ -140,6 +140,35 @@ ossl_pkey_new(EVP_PKEY *pkey)

     return obj;

 }

+EVP_PKEY *

+ossl_pkey_read_generic(BIO *bio, VALUE pass)

+{

+    void *ppass = (void *)pass;

+    EVP_PKEY *pkey;

+

+    if ((pkey = d2i_PrivateKey_bio(bio, NULL)))

+ goto out;

+    OSSL_BIO_reset(bio);

+    if ((pkey = d2i_PKCS8PrivateKey_bio(bio, NULL, ossl_pem_passwd_cb, ppass)))

+ goto out;

+    OSSL_BIO_reset(bio);

+    if ((pkey = d2i_PUBKEY_bio(bio, NULL)))

+ goto out;

+    OSSL_BIO_reset(bio);

+    /* PEM_read_bio_PrivateKey() also parses PKCS #8 formats */

+    if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, ossl_pem_passwd_cb, ppass)))

+ goto out;

+    OSSL_BIO_reset(bio);

+    if ((pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL)))

+ goto out;

+    OSSL_BIO_reset(bio);

+    if ((pkey = PEM_read_bio_Parameters(bio, NULL)))

+ goto out;

+

+  out:

+    return pkey;

+}

+

 /*

  *  call-seq:

  *     OpenSSL::PKey.read(string [, pwd ]) -> PKey

@@ -164,29 +193,14 @@ ossl_pkey_new_from_data(int argc, VALUE *argv, VALUE self)

     VALUE data, pass;

     rb_scan_args(argc, argv, "11", &data, &pass);

-    pass = ossl_pem_passwd_value(pass);

     bio = ossl_obj2bio(&data);

-    if ((pkey = d2i_PrivateKey_bio(bio, NULL)))

-	goto ok;

-    OSSL_BIO_reset(bio);

-    if ((pkey = d2i_PKCS8PrivateKey_bio(bio, NULL, ossl_pem_passwd_cb, (void *)pass)))

-	goto ok;

-    OSSL_BIO_reset(bio);

-    if ((pkey = d2i_PUBKEY_bio(bio, NULL)))

-	goto ok;

-    OSSL_BIO_reset(bio);

-    /* PEM_read_bio_PrivateKey() also parses PKCS #8 formats */

-    if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, ossl_pem_passwd_cb, (void *)pass)))

-	goto ok;

-    OSSL_BIO_reset(bio);

-    if ((pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL)))

-	goto ok;

+    pkey = ossl_pkey_read_generic(bio, ossl_pem_passwd_value(pass));

     BIO_free(bio);

-    ossl_raise(ePKeyError, "Could not parse PKey");

+    if (!pkey)

+ ossl_raise(ePKeyError, "Could not parse PKey");

-ok:

     BIO_free(bio);

     return ossl_pkey_new(pkey);

 }

diff --git a/ext/openssl/ossl_pkey.h b/ext/openssl/ossl_pkey.h

index e363a261..895927e3 100644

--- a/ext/openssl/ossl_pkey.h

+++ b/ext/openssl/ossl_pkey.h

@@ -45,6 +45,7 @@ void ossl_generate_cb_stop(void *ptr);

 VALUE ossl_pkey_new(EVP_PKEY *);

 void ossl_pkey_check_public_key(const EVP_PKEY *);

+EVP_PKEY *ossl_pkey_read_generic(BIO *, VALUE);

 EVP_PKEY *GetPKeyPtr(VALUE);

 EVP_PKEY *DupPKeyPtr(VALUE);

 EVP_PKEY *GetPrivPKeyPtr(VALUE);

diff --git a/ext/openssl/ossl_pkey_dsa.c b/ext/openssl/ossl_pkey_dsa.c

index 431c20e..faa3dd6 100644

--- a/ext/openssl/ossl_pkey_dsa.c

+++ b/ext/openssl/ossl_pkey_dsa.c

@@ -213,24 +213,24 @@ static VALUE

 ossl_dsa_initialize(int argc, VALUE *argv, VALUE self)

 {

     EVP_PKEY *pkey;

-    DSA *dsa;

+    DSA *dsa = NULL;

     BIO *in;

     VALUE arg, pass;

     GetPKey(self, pkey);

-    if(rb_scan_args(argc, argv, "02", &arg, &pass) == 0) {

+    rb_scan_args(argc, argv, "02", &arg, &pass);

+    if (argc == 0) {

         dsa = DSA_new();

+        if (!dsa)

+            ossl_raise(eDSAError, "DSA_new");

     }

-    else if (RB_INTEGER_TYPE_P(arg)) {

-	if (!(dsa = dsa_generate(NUM2INT(arg)))) {

-	    ossl_raise(eDSAError, NULL);

-	}

+    else if (argc == 1 && RB_INTEGER_TYPE_P(arg)) {

+        dsa = dsa_generate(NUM2INT(arg));

     }

     else {

 	pass = ossl_pem_passwd_value(pass);

 	arg = ossl_to_der_if_possible(arg);

 	in = ossl_obj2bio(&arg;;

-	dsa = PEM_read_bio_DSAPrivateKey(in, NULL, ossl_pem_passwd_cb, (void *)pass);

 	if (!dsa) {

 	    OSSL_BIO_reset(in);

 	    dsa = PEM_read_bio_DSA_PUBKEY(in, NULL, NULL, NULL);

diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c

index aec9d1e6..ca8f5c6e 100644

--- a/ext/openssl/ossl_pkey_ec.c

+++ b/ext/openssl/ossl_pkey_ec.c

@@ -202,24 +202,17 @@ static VALUE ossl_ec_key_initialize(int argc, VALUE *argv, VALUE self)

     } else if (rb_obj_is_kind_of(arg, cEC_GROUP)) {

 	ec = ec_key_new_from_group(arg);

     } else {

-	BIO *in;

-

-	pass = ossl_pem_passwd_value(pass);

-	in = ossl_obj2bio(&arg;;

-

-	ec = PEM_read_bio_ECPrivateKey(in, NULL, ossl_pem_passwd_cb, (void *)pass);

-	if (!ec) {

-	    OSSL_BIO_reset(in);

-	    ec = PEM_read_bio_EC_PUBKEY(in, NULL, ossl_pem_passwd_cb, (void *)pass);

-	}

-	if (!ec) {

-	    OSSL_BIO_reset(in);

-	    ec = d2i_ECPrivateKey_bio(in, NULL);

-	}

-	if (!ec) {

-	    OSSL_BIO_reset(in);

-	    ec = d2i_EC_PUBKEY_bio(in, NULL);

-	}

+        BIO *in = ossl_obj2bio(&arg;;

+        EVP_PKEY *tmp;

+        pass = ossl_pem_passwd_value(pass);

+        tmp = ossl_pkey_read_generic(in, pass);

+        if (tmp) {

+            if (EVP_PKEY_base_id(tmp) != EVP_PKEY_EC)

+                rb_raise(eECError, "incorrect pkey type: %s",

+                         OBJ_nid2sn(EVP_PKEY_base_id(tmp)));

+            ec = EVP_PKEY_get1_EC_KEY(tmp);

+            EVP_PKEY_free(tmp);

+        }

 	BIO_free(in);

 	if (!ec) {

diff --git a/ext/openssl/ossl_pkey_rsa.c b/ext/openssl/ossl_pkey_rsa.c

index 6a57238..41844e5 100644

--- a/ext/openssl/ossl_pkey_rsa.c

+++ b/ext/openssl/ossl_pkey_rsa.c

@@ -226,7 +226,8 @@ ossl_rsa_initialize(int argc, VALUE *argv, VALUE self)

     VALUE arg, pass;

     GetPKey(self, pkey);

-    if(rb_scan_args(argc, argv, "02", &arg, &pass) == 0) {

+    rb_scan_args(argc, argv, "02", &arg, &pass);

+    if (argc == 0) {

 	rsa = RSA_new();

     }

     else if (RB_INTEGER_TYPE_P(arg)) {

@@ -265,6 +266,7 @@ ossl_rsa_initialize(int argc, VALUE *argv, VALUE self)

     }

     if (!EVP_PKEY_assign_RSA(pkey, rsa)) {

 	RSA_free(rsa);

+            ossl_clear_error();

 	ossl_raise(eRSAError, NULL);

     }

From c2bb3f5411441b0dbe3085e1825d8479baef6ee4 Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Sat, 22 Feb 2020 05:37:01 +0900

Subject: [PATCH 01/21] ts: use TS_VERIFY_CTX_set_certs instead of

 TS_VERIFY_CTS_set_certs

OpenSSL 3.0 fixed the typo in the function name and replaced the

current 'CTS' version with a macro.

---

 ext/openssl/extconf.rb        | 5 ++++-

 ext/openssl/openssl_missing.h | 5 +++++

 ext/openssl/ossl_ts.c         | 2 +-

 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb

index 5cb28f30..ea384fe9 100644

--- a/ext/openssl/extconf.rb

+++ b/ext/openssl/extconf.rb

@@ -169,13 +169,16 @@ def find_openssl_library

 have_func("TS_STATUS_INFO_get0_status")

 have_func("TS_STATUS_INFO_get0_text")

 have_func("TS_STATUS_INFO_get0_failure_info")

-have_func("TS_VERIFY_CTS_set_certs")

+have_func("TS_VERIFY_CTS_set_certs(NULL, NULL)", "openssl/ts.h") # became a macro in 3.0.0

 have_func("TS_VERIFY_CTX_set_store")

 have_func("TS_VERIFY_CTX_add_flags")

 have_func("TS_RESP_CTX_set_time_cb")

 have_func("EVP_PBE_scrypt")

 have_func("SSL_CTX_set_post_handshake_auth")

+# added in 3.0.0

+have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")

+

 Logging::message "=== Checking done. ===\n"

 create_header

diff --git a/ext/openssl/openssl_missing.h b/ext/openssl/openssl_missing.h

index 4d9b8801..1b1a54a8 100644

--- a/ext/openssl/openssl_missing.h

+++ b/ext/openssl/openssl_missing.h

@@ -254,4 +254,9 @@ IMPL_PKEY_GETTER(EC_KEY, ec)

     } while (0)

 #endif

+/* added in 3.0.0 */

+#if !defined(HAVE_TS_VERIFY_CTX_SET_CERTS)

+#  define TS_VERIFY_CTX_set_certs(ctx, crts) TS_VERIFY_CTS_set_certs(ctx, crts)

+#endif

+

 #endif /* _OSSL_OPENSSL_MISSING_H_ */

diff --git a/ext/openssl/ossl_ts.c b/ext/openssl/ossl_ts.c

index 4654babf..9d91710a 100644

--- a/ext/openssl/ossl_ts.c

+++ b/ext/openssl/ossl_ts.c

@@ -816,7 +816,7 @@ ossl_ts_resp_verify(int argc, VALUE *argv, VALUE self)

         X509_up_ref(cert);

     }

-    TS_VERIFY_CTS_set_certs(ctx, x509inter);

+    TS_VERIFY_CTX_set_certs(ctx, x509inter);

     TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE);

     TS_VERIFY_CTX_set_store(ctx, x509st);

From 5780e43ceda843c38dc1493a81d8ef8615b2a42b Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Sat, 22 Feb 2020 05:47:58 +0900

Subject: [PATCH 02/21] ssl: use SSL_CTX_load_verify_{file,dir}() if available

SSL_CTX_load_verify_locations() is deprecated in OpenSSL 3.0 and

replaced with those two separate functions. Use them if they exist.

---

 ext/openssl/extconf.rb | 1 +

 ext/openssl/ossl_ssl.c | 7 +++++++

 2 files changed, 8 insertions(+)

diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb

index ea384fe9..4b5ffd67 100644

--- a/ext/openssl/extconf.rb

+++ b/ext/openssl/extconf.rb

@@ -178,6 +178,7 @@ def find_openssl_library

 # added in 3.0.0

 have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")

+have_func("SSL_CTX_load_verify_file")

 Logging::message "=== Checking done. ===\n"

diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c

index 76db821e..c80c939e 100644

--- a/ext/openssl/ossl_ssl.c

+++ b/ext/openssl/ossl_ssl.c

@@ -886,10 +886,17 @@ ossl_sslctx_setup(VALUE self)

     ca_file = NIL_P(val) ? NULL : StringValueCStr(val);

     val = rb_attr_get(self, id_i_ca_path);

     ca_path = NIL_P(val) ? NULL : StringValueCStr(val);

+#if defined(HAVE_SSL_CTX_LOAD_VERIFY_FILE)

+    if (ca_file && !SSL_CTX_load_verify_file(ctx, ca_file))

+        ossl_raise(eSSLError, "SSL_CTX_load_verify_file");

+    if (ca_path && !SSL_CTX_load_verify_dir(ctx, ca_path))

+        ossl_raise(eSSLError, "SSL_CTX_load_verify_dir");

+#else

     if(ca_file || ca_path){

 	if (!SSL_CTX_load_verify_locations(ctx, ca_file, ca_path))

 	    rb_warning("can't set verify locations");

     }

+#endif

     val = rb_attr_get(self, id_i_verify_mode);

     verify_mode = NIL_P(val) ? SSL_VERIFY_NONE : NUM2INT(val);

From c26272113074bfe3ebbc698741974fce86b1c25a Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Sat, 22 Feb 2020 06:37:00 +0900

Subject: [PATCH 03/21] bn: use BN_check_prime() in

 OpenSSL::BN#prime{,_fasttest}?

BN_is_prime_ex() and BN_is_prime_fasttest_ex() are deprecated in OpenSSL

3.0. Instead, BN_check_prime() is added. This is equivalent to

BN_is_prime_fasttest_ex(bn, 0, bn_ctx, 1, cb), which is what

OpenSSL::BN#prime_fasttest? has called.

Let's make both OpenSSL::BN#prime? and #prime_fasttest? use

BN_check_prime() if available. Note that this implies that the

parameters of those two methods are now ignored, which could be used to

tune them to give up the test earlier.

---

 ext/openssl/extconf.rb |  1 +

 ext/openssl/ossl_bn.c  | 71 +++++++++++++-----------------------------

 2 files changed, 23 insertions(+), 49 deletions(-)

diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb

index 4b5ffd67..9fa092f5 100644

--- a/ext/openssl/extconf.rb

+++ b/ext/openssl/extconf.rb

@@ -179,6 +179,7 @@ def find_openssl_library

 # added in 3.0.0

 have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")

 have_func("SSL_CTX_load_verify_file")

+have_func("BN_check_prime")

 Logging::message "=== Checking done. ===\n"

diff --git a/ext/openssl/ossl_bn.c b/ext/openssl/ossl_bn.c

index 02530789..e0eef4cd 100644

--- a/ext/openssl/ossl_bn.c

+++ b/ext/openssl/ossl_bn.c

@@ -1058,34 +1058,29 @@ ossl_bn_hash(VALUE self)

  *    bn.prime? => true | false

  *    bn.prime?(checks) => true | false

  *

- * Performs a Miller-Rabin probabilistic primality test with _checks_

- * iterations. If _checks_ is not specified, a number of iterations is used

- * that yields a false positive rate of at most 2^-80 for random input.

+ * Performs Miller-Rabin primality test for _bn_.

  *

- * === Parameters

- * * _checks_ - integer

+ * As of Ruby/OpenSSL 2.3.0, the argument _checks_ is ignored.

  */

 static VALUE

 ossl_bn_is_prime(int argc, VALUE *argv, VALUE self)

 {

     BIGNUM *bn;

-    VALUE vchecks;

-    int checks = BN_prime_checks;

+    int ret;

-    if (rb_scan_args(argc, argv, "01", &vchecks) == 1) {

-	checks = NUM2INT(vchecks);

-    }

+    rb_check_arity(argc, 0, 1);

     GetBN(self, bn);

-    switch (BN_is_prime_ex(bn, checks, ossl_bn_ctx, NULL)) {

-    case 1:

-	return Qtrue;

-    case 0:

-	return Qfalse;

-    default:

-	ossl_raise(eBNError, NULL);

-    }

-    /* not reachable */

-    return Qnil;

+

+#if defined(HAVE_BN_CHECK_PRIME)

+    ret = BN_check_prime(bn, ossl_bn_ctx, NULL);

+    if (ret < 0)

+        ossl_raise(eBNError, "BN_check_prime");

+#else

+    ret = BN_is_prime_fasttest_ex(bn, BN_prime_checks, ossl_bn_ctx, 1, NULL);

+    if (ret < 0)

+        ossl_raise(eBNError, "BN_is_prime_fasttest_ex");

+#endif

+    return ret ? Qtrue : Qfalse;

 }

 /*

@@ -1094,40 +1089,18 @@ ossl_bn_is_prime(int argc, VALUE *argv, VALUE self)

  *    bn.prime_fasttest?(checks) => true | false

  *    bn.prime_fasttest?(checks, trial_div) => true | false

  *

- * Performs a Miller-Rabin primality test. This is same as #prime? except this

- * first attempts trial divisions with some small primes.

+ * Performs Miller-Rabin primality test for _bn_. This is an alias of #prime?.

  *

- * === Parameters

- * * _checks_ - integer

- * * _trial_div_ - boolean

+ * This method is deprecated. Use #prime? instead.

+ *

+ * As of Ruby/OpenSSL 2.3.0, the arguments _checks_ and _trial\_div_ are

+ * ignored.

  */

 static VALUE

 ossl_bn_is_prime_fasttest(int argc, VALUE *argv, VALUE self)

 {

-    BIGNUM *bn;

-    VALUE vchecks, vtrivdiv;

-    int checks = BN_prime_checks, do_trial_division = 1;

-

-    rb_scan_args(argc, argv, "02", &vchecks, &vtrivdiv);

-

-    if (!NIL_P(vchecks)) {

-	checks = NUM2INT(vchecks);

-    }

-    GetBN(self, bn);

-    /* handle true/false */

-    if (vtrivdiv == Qfalse) {

-	do_trial_division = 0;

-    }

-    switch (BN_is_prime_fasttest_ex(bn, checks, ossl_bn_ctx, do_trial_division, NULL)) {

-    case 1:

-	return Qtrue;

-    case 0:

-	return Qfalse;

-    default:

-	ossl_raise(eBNError, NULL);

-    }

-    /* not reachable */

-    return Qnil;

+    rb_check_arity(argc, 0, 2);

+    return ossl_bn_is_prime(0, argv, self);

 }

 /*

From 1fdea13743e5ee70befdfc79f22473b88ffe2eef Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Sat, 22 Feb 2020 18:58:29 +0900

Subject: [PATCH 04/21] ossl.c: use ERR_get_error_all() if available

OpenSSL 3.0 deprecated ERR_get_error_line_data() in favor of

ERR_get_error_all(), as part of the error queue structure changes.

---

 ext/openssl/extconf.rb |  1 +

 ext/openssl/ossl.c     | 40 +++++++++++++++++++++-------------------

 2 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb

index 9fa092f5..14e599ca 100644

--- a/ext/openssl/extconf.rb

+++ b/ext/openssl/extconf.rb

@@ -180,6 +180,7 @@ def find_openssl_library

 have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")

 have_func("SSL_CTX_load_verify_file")

 have_func("BN_check_prime")

+have_func("ERR_get_error_all")

 Logging::message "=== Checking done. ===\n"

diff --git a/ext/openssl/ossl.c b/ext/openssl/ossl.c

index 358b3b29..a040deae 100644

--- a/ext/openssl/ossl.c

+++ b/ext/openssl/ossl.c

@@ -304,27 +304,29 @@ void

 ossl_clear_error(void)

 {

     if (dOSSL == Qtrue) {

-	unsigned long e;

-	const char *file, *data, *errstr;

-	int line, flags;

-

-	while ((e = ERR_get_error_line_data(&file, &line, &data, &flags))) {

-	    errstr = ERR_error_string(e, NULL);

-	    if (!errstr)

-		errstr = "(null)";

-

-	    if (flags & ERR_TXT_STRING) {

-		if (!data)

-		    data = "(null)";

-		rb_warn("error on stack: %s (%s)", errstr, data);

-	    }

-	    else {

-		rb_warn("error on stack: %s", errstr);

-	    }

-	}

+        unsigned long e;

+        const char *file, *data;

+        int line, flags;

+

+#if defined(HAVE_ERR_GET_ERROR_ALL)

+        const char *func;

+        while ((e = ERR_get_error_all(&file, &line, &func, &data, &flags))) {

+#else

+            while ((e = ERR_get_error_line_data(&file, &line, &data, &flags))) {

+            const char *func = ERR_func_error_string(e);

+#endif

+            const char *lib = ERR_lib_error_string(e),

+                  *reason = ERR_reason_error_string(e);

+            char append[256] = "";

+

+            if (flags & ERR_TXT_STRING && data && strlen(data))

+                snprintf(append, sizeof(append), " (%s)", data);

+            rb_warn("error on stack: error:%08lX:%s:%s:%s%s", e, lib ? lib : "",

+                    func ? func : "", reason ? reason : "", append);

+        }

     }

     else {

-	ERR_clear_error();

+        ERR_clear_error();

     }

 }

From ce0bf33dd0c5a2ba3d445ccf00175db91d78b5a7 Mon Sep 17 00:00:00 2001

From: Kazuki Yamaguchi <k@rhe.jp>

Date: Sun, 17 May 2020 18:25:38 +0900

Subject: [PATCH 05/21] pkey: implement #to_text using EVP API

Use EVP_PKEY_print_private() instead of the low level *_print()

functions. Those low level functions are deprecated in OpenSSL 3.0.

Note that it falls back to EVP_PKEY_print_public() and

EVP_PKEY_print_params() as necessary. This is required for EVP_PKEY_DH

type - _private() fails if the private component is not set.

Since the new API works in the same way for all key types, we now

implement #to_text in the base class OpenSSL::PKey::PKey rather than in

each subclass.

---

diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c

index 0540cd2..e02c84b 100644

--- a/ext/openssl/ossl_pkey.c

+++ b/ext/openssl/ossl_pkey.c

@@ -349,6 +349,42 @@ ossl_pkey_inspect(VALUE self)

                       OBJ_nid2sn(nid));

 }

+/*

+ * call-seq:

+ *    pkey.to_text -> string

+ *

+ * THIS METHOD IS INSECURE, PRIVATE INFORMATION CAN LEAK OUT!!!

+ *

+ * Dumps all private, public, and parameter components of the key to a String

+ * in a human readable format.

+ */

+static VALUE

+ossl_pkey_to_text(VALUE self)

+{

+    EVP_PKEY *pkey;

+    BIO *bio;

+

+    GetPKey(self, pkey);

+    if (!(bio = BIO_new(BIO_s_mem())))

+        ossl_raise(ePKeyError, "BIO_new");

+

+    if (EVP_PKEY_print_private(bio, pkey, 0, NULL) == 1)

+        goto out;

+    OSSL_BIO_reset(bio);

+    if (EVP_PKEY_print_public(bio, pkey, 0, NULL) == 1)

+        goto out;

+    OSSL_BIO_reset(bio);

+    if (EVP_PKEY_print_params(bio, pkey, 0, NULL) == 1)

+        goto out;

+

+    BIO_free(bio);

+    ossl_raise(ePKeyError, "EVP_PKEY_print_params");

+

+  out:

+    return ossl_membio2str(bio);

+}

+

+

 static VALUE

 do_pkcs8_export(int argc, VALUE *argv, VALUE self, int to_der)

 {

diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c

index 6b477b07..acd3bf47 100644

--- a/ext/openssl/ossl_pkey_dh.c

+++ b/ext/openssl/ossl_pkey_dh.c

@@ -403,34 +403,6 @@ ossl_dh_get_params(VALUE self)

     return hash;

 }

-/*

- *  call-seq:

- *     dh.to_text -> aString

- *

- * Prints all parameters of key to buffer

- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!

- * Don't use :-)) (I's up to you)

- */

-static VALUE

-ossl_dh_to_text(VALUE self)

-{

-    DH *dh;

-    BIO *out;

-    VALUE str;

-

-    GetDH(self, dh);

-    if (!(out = BIO_new(BIO_s_mem()))) {

-	ossl_raise(eDHError, NULL);

-    }

-    if (!DHparams_print(out, dh)) {

-	BIO_free(out);

-	ossl_raise(eDHError, NULL);

-    }

-    str = ossl_membio2str(out);

-

-    return str;

-}

-

 /*

  *  call-seq:

  *     dh.public_key -> aDH

@@ -621,7 +593,6 @@ Init_ossl_dh(void)

     rb_define_method(cDH, "initialize_copy", ossl_dh_initialize_copy, 1);

     rb_define_method(cDH, "public?", ossl_dh_is_public, 0);

     rb_define_method(cDH, "private?", ossl_dh_is_private, 0);

-    rb_define_method(cDH, "to_text", ossl_dh_to_text, 0);

     rb_define_method(cDH, "export", ossl_dh_export, 0);

     rb_define_alias(cDH, "to_pem", "export");

     rb_define_alias(cDH, "to_s", "export");

diff --git a/ext/openssl/ossl_pkey_dsa.c b/ext/openssl/ossl_pkey_dsa.c

index c2b68c32..640a243d 100644

--- a/ext/openssl/ossl_pkey_dsa.c

+++ b/ext/openssl/ossl_pkey_dsa.c

@@ -433,34 +433,6 @@ ossl_dsa_get_params(VALUE self)

     return hash;

 }

-/*

- *  call-seq:

- *    dsa.to_text -> aString

- *

- * Prints all parameters of key to buffer

- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!

- * Don't use :-)) (I's up to you)

- */

-static VALUE

-ossl_dsa_to_text(VALUE self)

-{

-    DSA *dsa;

-    BIO *out;

-    VALUE str;

-

-    GetDSA(self, dsa);

-    if (!(out = BIO_new(BIO_s_mem()))) {

-	ossl_raise(eDSAError, NULL);

-    }

-    if (!DSA_print(out, dsa, 0)) { /* offset = 0 */

-	BIO_free(out);

-	ossl_raise(eDSAError, NULL);

-    }

-    str = ossl_membio2str(out);

-

-    return str;

-}

-

 /*

  *  call-seq:

  *    dsa.public_key -> aDSA

@@ -636,7 +608,6 @@ Init_ossl_dsa(void)

     rb_define_method(cDSA, "public?", ossl_dsa_is_public, 0);

     rb_define_method(cDSA, "private?", ossl_dsa_is_private, 0);

-    rb_define_method(cDSA, "to_text", ossl_dsa_to_text, 0);

     rb_define_method(cDSA, "export", ossl_dsa_export, -1);

     rb_define_alias(cDSA, "to_pem", "export");

     rb_define_alias(cDSA, "to_s", "export");

diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c

index 511e728..aa59c68 100644

--- a/ext/openssl/ossl_pkey_ec.c

+++ b/ext/openssl/ossl_pkey_ec.c

@@ -506,31 +506,6 @@ static VALUE ossl_ec_key_to_der(VALUE self)

     return ossl_ec_key_to_string(self, Qnil, Qnil, EXPORT_DER);

 }

-/*

- *  call-seq:

- *     key.to_text   => String

- *

- *  See the OpenSSL documentation for EC_KEY_print()

- */

-static VALUE ossl_ec_key_to_text(VALUE self)

-{

-    EC_KEY *ec;

-    BIO *out;

-    VALUE str;

-

-    GetEC(self, ec);

-    if (!(out = BIO_new(BIO_s_mem()))) {

-	ossl_raise(eECError, "BIO_new(BIO_s_mem())");

-    }

-    if (!EC_KEY_print(out, ec, 0)) {

-	BIO_free(out);

-	ossl_raise(eECError, "EC_KEY_print");

-    }

-    str = ossl_membio2str(out);

-

-    return str;

-}

-

 /*

  *  call-seq:

  *     key.generate_key!   => self

diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c

index aa59c68..1689200 100644

--- a/ext/openssl/ossl_pkey_ec.c

+++ b/ext/openssl/ossl_pkey_ec.c

@@ -1728,8 +1728,6 @@ void Init_ossl_ec(void)

     rb_define_method(cEC, "export", ossl_ec_key_export, -1);

     rb_define_alias(cEC, "to_pem", "export");