openssl 3.3.1 → 4.0.0

data/ext/openssl/ossl_pkey.h

@@ -22,12 +22,12 @@ extern const rb_data_type_t ossl_evp_pkey_type;
 #define GetPKey(obj, pkey) do {\
     TypedData_Get_Struct((obj), EVP_PKEY, &ossl_evp_pkey_type, (pkey)); \
     if (!(pkey)) { \
-	rb_raise(rb_eRuntimeError, "PKEY wasn't initialized!");\
+        rb_raise(rb_eRuntimeError, "PKEY wasn't initialized!");\
     } \
 } while (0)
 
 /* Takes ownership of the EVP_PKEY */
-VALUE ossl_pkey_new(EVP_PKEY *);
+VALUE ossl_pkey_wrap(EVP_PKEY *);
 void ossl_pkey_check_public_key(const EVP_PKEY *);
 EVP_PKEY *ossl_pkey_read_generic(BIO *, VALUE);
 EVP_PKEY *GetPKeyPtr(VALUE);
@@ -45,7 +45,7 @@ VALUE ossl_pkey_export_spki(VALUE self, int to_der);
  * #to_der.
  */
 VALUE ossl_pkey_export_traditional(int argc, VALUE *argv, VALUE self,
-				   int to_der);
+                                   int to_der);
 
 void Init_ossl_pkey(void);
 
@@ -74,120 +74,120 @@ extern VALUE cEC;
 VALUE ossl_ec_new(EVP_PKEY *);
 void Init_ossl_ec(void);
 
-#define OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, _name, _get)		\
-/*									\
- *  call-seq:								\
- *     _keytype##.##_name -> aBN					\
- */									\
-static VALUE ossl_##_keytype##_get_##_name(VALUE self)			\
-{									\
-	const _type *obj;						\
-	const BIGNUM *bn;						\
-									\
-	Get##_type(self, obj);						\
-	_get;								\
-	if (bn == NULL)							\
-		return Qnil;						\
-	return ossl_bn_new(bn);						\
+#define OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, _name, _get)          \
+/*                                                                      \
+ *  call-seq:                                                           \
+ *     _keytype##.##_name -> aBN                                        \
+ */                                                                     \
+static VALUE ossl_##_keytype##_get_##_name(VALUE self)                  \
+{                                                                       \
+        const _type *obj;                                               \
+        const BIGNUM *bn;                                               \
+                                                                        \
+        Get##_type(self, obj);                                          \
+        _get;                                                           \
+        if (bn == NULL)                                                 \
+                return Qnil;                                            \
+        return ossl_bn_new(bn);                                         \
 }
 
-#define OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3)	\
-	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1,			\
-		_type##_get0_##_group(obj, &bn, NULL, NULL))		\
-	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2,			\
-		_type##_get0_##_group(obj, NULL, &bn, NULL))		\
-	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a3,			\
-		_type##_get0_##_group(obj, NULL, NULL, &bn))
-
-#define OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2)	\
-	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1,			\
-		_type##_get0_##_group(obj, &bn, NULL))			\
-	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2,			\
-		_type##_get0_##_group(obj, NULL, &bn))
-
-#if !OSSL_OPENSSL_PREREQ(3, 0, 0)
-#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)	\
-/*									\
- *  call-seq:								\
- *     _keytype##.set_##_group(a1, a2, a3) -> self			\
- */									\
+#define OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3)   \
+        OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1,                   \
+                _type##_get0_##_group(obj, &bn, NULL, NULL))            \
+        OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2,                   \
+                _type##_get0_##_group(obj, NULL, &bn, NULL))            \
+        OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a3,                   \
+                _type##_get0_##_group(obj, NULL, NULL, &bn))
+
+#define OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2)       \
+        OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a1,                   \
+                _type##_get0_##_group(obj, &bn, NULL))                  \
+        OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2,                   \
+                _type##_get0_##_group(obj, NULL, &bn))
+
+#ifndef OSSL_HAVE_IMMUTABLE_PKEY
+#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)   \
+/*                                                                      \
+ *  call-seq:                                                           \
+ *     _keytype##.set_##_group(a1, a2, a3) -> self                      \
+ */                                                                     \
 static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2, VALUE v3) \
-{									\
-	_type *obj;							\
-	BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\
-	BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\
-	BIGNUM *bn3 = NULL, *orig_bn3 = NIL_P(v3) ? NULL : GetBNPtr(v3);\
-									\
-	Get##_type(self, obj);						\
-        if ((orig_bn1 && !(bn1 = BN_dup(orig_bn1))) ||			\
-            (orig_bn2 && !(bn2 = BN_dup(orig_bn2))) ||			\
-            (orig_bn3 && !(bn3 = BN_dup(orig_bn3)))) {			\
-		BN_clear_free(bn1);					\
-		BN_clear_free(bn2);					\
-		BN_clear_free(bn3);					\
-		ossl_raise(ePKeyError, "BN_dup");			\
-	}								\
-									\
-	if (!_type##_set0_##_group(obj, bn1, bn2, bn3)) {		\
-		BN_clear_free(bn1);					\
-		BN_clear_free(bn2);					\
-		BN_clear_free(bn3);					\
-		ossl_raise(ePKeyError, #_type"_set0_"#_group);		\
-	}								\
-	return self;							\
+{                                                                       \
+        _type *obj;                                                     \
+        BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\
+        BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\
+        BIGNUM *bn3 = NULL, *orig_bn3 = NIL_P(v3) ? NULL : GetBNPtr(v3);\
+                                                                        \
+        Get##_type(self, obj);                                          \
+        if ((orig_bn1 && !(bn1 = BN_dup(orig_bn1))) ||                  \
+            (orig_bn2 && !(bn2 = BN_dup(orig_bn2))) ||                  \
+            (orig_bn3 && !(bn3 = BN_dup(orig_bn3)))) {                  \
+                BN_clear_free(bn1);                                     \
+                BN_clear_free(bn2);                                     \
+                BN_clear_free(bn3);                                     \
+                ossl_raise(ePKeyError, "BN_dup");                       \
+        }                                                               \
+                                                                        \
+        if (!_type##_set0_##_group(obj, bn1, bn2, bn3)) {               \
+                BN_clear_free(bn1);                                     \
+                BN_clear_free(bn2);                                     \
+                BN_clear_free(bn3);                                     \
+                ossl_raise(ePKeyError, #_type"_set0_"#_group);          \
+        }                                                               \
+        return self;                                                    \
 }
 
-#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)	\
-/*									\
- *  call-seq:								\
- *     _keytype##.set_##_group(a1, a2) -> self				\
- */									\
+#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)       \
+/*                                                                      \
+ *  call-seq:                                                           \
+ *     _keytype##.set_##_group(a1, a2) -> self                          \
+ */                                                                     \
 static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2) \
-{									\
-	_type *obj;							\
-	BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\
-	BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\
-									\
-	Get##_type(self, obj);						\
-        if ((orig_bn1 && !(bn1 = BN_dup(orig_bn1))) ||			\
-            (orig_bn2 && !(bn2 = BN_dup(orig_bn2)))) {			\
-		BN_clear_free(bn1);					\
-		BN_clear_free(bn2);					\
-		ossl_raise(ePKeyError, "BN_dup");			\
-	}								\
-									\
-	if (!_type##_set0_##_group(obj, bn1, bn2)) {			\
-		BN_clear_free(bn1);					\
-		BN_clear_free(bn2);					\
-		ossl_raise(ePKeyError, #_type"_set0_"#_group);		\
-	}								\
-	return self;							\
+{                                                                       \
+        _type *obj;                                                     \
+        BIGNUM *bn1 = NULL, *orig_bn1 = NIL_P(v1) ? NULL : GetBNPtr(v1);\
+        BIGNUM *bn2 = NULL, *orig_bn2 = NIL_P(v2) ? NULL : GetBNPtr(v2);\
+                                                                        \
+        Get##_type(self, obj);                                          \
+        if ((orig_bn1 && !(bn1 = BN_dup(orig_bn1))) ||                  \
+            (orig_bn2 && !(bn2 = BN_dup(orig_bn2)))) {                  \
+                BN_clear_free(bn1);                                     \
+                BN_clear_free(bn2);                                     \
+                ossl_raise(ePKeyError, "BN_dup");                       \
+        }                                                               \
+                                                                        \
+        if (!_type##_set0_##_group(obj, bn1, bn2)) {                    \
+                BN_clear_free(bn1);                                     \
+                BN_clear_free(bn2);                                     \
+                ossl_raise(ePKeyError, #_type"_set0_"#_group);          \
+        }                                                               \
+        return self;                                                    \
 }
 #else
-#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)	\
+#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)   \
 static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2, VALUE v3) \
-{									\
-        rb_raise(ePKeyError,						\
+{                                                                       \
+        rb_raise(ePKeyError,                                            \
                  #_keytype"#set_"#_group"= is incompatible with OpenSSL 3.0"); \
 }
 
-#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)	\
+#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)       \
 static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2) \
-{									\
-        rb_raise(ePKeyError,						\
+{                                                                       \
+        rb_raise(ePKeyError,                                            \
                  #_keytype"#set_"#_group"= is incompatible with OpenSSL 3.0"); \
 }
 #endif
 
-#define OSSL_PKEY_BN_DEF3(_keytype, _type, _group, a1, a2, a3)		\
-	OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3)	\
-	OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)
+#define OSSL_PKEY_BN_DEF3(_keytype, _type, _group, a1, a2, a3)          \
+        OSSL_PKEY_BN_DEF_GETTER3(_keytype, _type, _group, a1, a2, a3)   \
+        OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)
 
-#define OSSL_PKEY_BN_DEF2(_keytype, _type, _group, a1, a2)		\
-	OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2)	\
-	OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)
+#define OSSL_PKEY_BN_DEF2(_keytype, _type, _group, a1, a2)              \
+        OSSL_PKEY_BN_DEF_GETTER2(_keytype, _type, _group, a1, a2)       \
+        OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)
 
-#define DEF_OSSL_PKEY_BN(class, keytype, name)				\
-	rb_define_method((class), #name, ossl_##keytype##_get_##name, 0)
+#define DEF_OSSL_PKEY_BN(class, keytype, name)                          \
+        rb_define_method((class), #name, ossl_##keytype##_get_##name, 0)
 
 #endif /* OSSL_PKEY_H */

data/ext/openssl/ossl_pkey_dh.c

@@ -14,20 +14,21 @@
 #define GetPKeyDH(obj, pkey) do { \
     GetPKey((obj), (pkey)); \
     if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH) { /* PARANOIA? */ \
-	ossl_raise(rb_eRuntimeError, "THIS IS NOT A DH!") ; \
+        ossl_raise(rb_eRuntimeError, "THIS IS NOT A DH!") ; \
     } \
 } while (0)
 #define GetDH(obj, dh) do { \
     EVP_PKEY *_pkey; \
     GetPKeyDH((obj), _pkey); \
     (dh) = EVP_PKEY_get0_DH(_pkey); \
+    if ((dh) == NULL) \
+        ossl_raise(ePKeyError, "failed to get DH from EVP_PKEY"); \
 } while (0)
 
 /*
  * Classes
  */
 VALUE cDH;
-static VALUE eDHError;
 
 /*
  * Private
@@ -43,6 +44,7 @@ static VALUE eDHError;
  * If called without arguments, an empty instance without any parameter or key
  * components is created. Use #set_pqg to manually set the parameters afterwards
  * (and optionally #set_key to set private and public key components).
+ * This form is not compatible with OpenSSL 3.0 or later.
  *
  * If a String is given, tries to parse it as a DER- or PEM- encoded parameters.
  * See also OpenSSL::PKey.read which can parse keys of any kinds.
@@ -58,14 +60,15 @@ static VALUE eDHError;
  *
  * Examples:
  *   # Creating an instance from scratch
- *   # Note that this is deprecated and will not work on OpenSSL 3.0 or later.
+ *   # Note that this is deprecated and will result in ArgumentError when
+ *   # using OpenSSL 3.0 or later.
  *   dh = OpenSSL::PKey::DH.new
  *   dh.set_pqg(bn_p, nil, bn_g)
  *
  *   # Generating a parameters and a key pair
  *   dh = OpenSSL::PKey::DH.new(2048) # An alias of OpenSSL::PKey::DH.generate(2048)
  *
- *   # Reading DH parameters
+ *   # Reading DH parameters from a PEM-encoded string
  *   dh_params = OpenSSL::PKey::DH.new(File.read('parameters.pem')) # loads parameters only
  *   dh = OpenSSL::PKey.generate_key(dh_params) # generates a key pair
  */
@@ -84,10 +87,15 @@ ossl_dh_initialize(int argc, VALUE *argv, VALUE self)
 
     /* The DH.new(size, generator) form is handled by lib/openssl/pkey.rb */
     if (rb_scan_args(argc, argv, "01", &arg) == 0) {
+#ifdef OSSL_HAVE_IMMUTABLE_PKEY
+        rb_raise(rb_eArgError, "OpenSSL::PKey::DH.new cannot be called " \
+                 "without arguments; pkeys are immutable with OpenSSL 3.0");
+#else
         dh = DH_new();
         if (!dh)
-            ossl_raise(eDHError, "DH_new");
+            ossl_raise(ePKeyError, "DH_new");
         goto legacy;
+#endif
     }
 
     arg = ossl_to_der_if_possible(arg);
@@ -105,12 +113,12 @@ ossl_dh_initialize(int argc, VALUE *argv, VALUE self)
     pkey = ossl_pkey_read_generic(in, Qnil);
     BIO_free(in);
     if (!pkey)
-        ossl_raise(eDHError, "could not parse pkey");
+        ossl_raise(ePKeyError, "could not parse pkey");
 
     type = EVP_PKEY_base_id(pkey);
     if (type != EVP_PKEY_DH) {
         EVP_PKEY_free(pkey);
-        rb_raise(eDHError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+        rb_raise(ePKeyError, "incorrect pkey type: %s", OBJ_nid2sn(type));
     }
     RTYPEDDATA_DATA(self) = pkey;
     return self;
@@ -121,13 +129,14 @@ ossl_dh_initialize(int argc, VALUE *argv, VALUE self)
     if (!pkey || EVP_PKEY_assign_DH(pkey, dh) != 1) {
         EVP_PKEY_free(pkey);
         DH_free(dh);
-        ossl_raise(eDHError, "EVP_PKEY_assign_DH");
+        ossl_raise(ePKeyError, "EVP_PKEY_assign_DH");
     }
     RTYPEDDATA_DATA(self) = pkey;
     return self;
 }
 
 #ifndef HAVE_EVP_PKEY_DUP
+/* :nodoc: */
 static VALUE
 ossl_dh_initialize_copy(VALUE self, VALUE other)
 {
@@ -142,26 +151,26 @@ ossl_dh_initialize_copy(VALUE self, VALUE other)
 
     dh = DHparams_dup(dh_other);
     if (!dh)
-	ossl_raise(eDHError, "DHparams_dup");
+        ossl_raise(ePKeyError, "DHparams_dup");
 
     DH_get0_key(dh_other, &pub, &priv);
     if (pub) {
-	BIGNUM *pub2 = BN_dup(pub);
-	BIGNUM *priv2 = BN_dup(priv);
+        BIGNUM *pub2 = BN_dup(pub);
+        BIGNUM *priv2 = BN_dup(priv);
 
         if (!pub2 || (priv && !priv2)) {
-	    BN_clear_free(pub2);
-	    BN_clear_free(priv2);
-	    ossl_raise(eDHError, "BN_dup");
-	}
-	DH_set0_key(dh, pub2, priv2);
+            BN_clear_free(pub2);
+            BN_clear_free(priv2);
+            ossl_raise(ePKeyError, "BN_dup");
+        }
+        DH_set0_key(dh, pub2, priv2);
     }
 
     pkey = EVP_PKEY_new();
     if (!pkey || EVP_PKEY_assign_DH(pkey, dh) != 1) {
         EVP_PKEY_free(pkey);
         DH_free(dh);
-        ossl_raise(eDHError, "EVP_PKEY_assign_DH");
+        ossl_raise(ePKeyError, "EVP_PKEY_assign_DH");
     }
     RTYPEDDATA_DATA(self) = pkey;
     return self;
@@ -240,11 +249,11 @@ ossl_dh_export(VALUE self)
 
     GetDH(self, dh);
     if (!(out = BIO_new(BIO_s_mem()))) {
-	ossl_raise(eDHError, NULL);
+        ossl_raise(ePKeyError, NULL);
     }
     if (!PEM_write_bio_DHparams(out, dh)) {
-	BIO_free(out);
-	ossl_raise(eDHError, NULL);
+        BIO_free(out);
+        ossl_raise(ePKeyError, NULL);
     }
     str = ossl_membio2str(out);
 
@@ -274,45 +283,16 @@ ossl_dh_to_der(VALUE self)
 
     GetDH(self, dh);
     if((len = i2d_DHparams(dh, NULL)) <= 0)
-	ossl_raise(eDHError, NULL);
+        ossl_raise(ePKeyError, NULL);
     str = rb_str_new(0, len);
     p = (unsigned char *)RSTRING_PTR(str);
     if(i2d_DHparams(dh, &p) < 0)
-	ossl_raise(eDHError, NULL);
+        ossl_raise(ePKeyError, NULL);
     ossl_str_adjust(str, p);
 
     return str;
 }
 
-/*
- *  call-seq:
- *     dh.params -> hash
- *
- * Stores all parameters of key to the hash
- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!
- * Don't use :-)) (I's up to you)
- */
-static VALUE
-ossl_dh_get_params(VALUE self)
-{
-    OSSL_3_const DH *dh;
-    VALUE hash;
-    const BIGNUM *p, *q, *g, *pub_key, *priv_key;
-
-    GetDH(self, dh);
-    DH_get0_pqg(dh, &p, &q, &g);
-    DH_get0_key(dh, &pub_key, &priv_key);
-
-    hash = rb_hash_new();
-    rb_hash_aset(hash, rb_str_new2("p"), ossl_bn_new(p));
-    rb_hash_aset(hash, rb_str_new2("q"), ossl_bn_new(q));
-    rb_hash_aset(hash, rb_str_new2("g"), ossl_bn_new(g));
-    rb_hash_aset(hash, rb_str_new2("pub_key"), ossl_bn_new(pub_key));
-    rb_hash_aset(hash, rb_str_new2("priv_key"), ossl_bn_new(priv_key));
-
-    return hash;
-}
-
 /*
  *  call-seq:
  *     dh.params_ok? -> true | false
@@ -334,7 +314,7 @@ ossl_dh_check_params(VALUE self)
     GetPKey(self, pkey);
     pctx = EVP_PKEY_CTX_new(pkey, /* engine */NULL);
     if (!pctx)
-        ossl_raise(eDHError, "EVP_PKEY_CTX_new");
+        ossl_raise(ePKeyError, "EVP_PKEY_CTX_new");
     ret = EVP_PKEY_param_check(pctx);
     EVP_PKEY_CTX_free(pctx);
 #else
@@ -377,19 +357,6 @@ OSSL_PKEY_BN_DEF2(dh, DH, key, pub_key, priv_key)
 void
 Init_ossl_dh(void)
 {
-#if 0
-    mPKey = rb_define_module_under(mOSSL, "PKey");
-    cPKey = rb_define_class_under(mPKey, "PKey", rb_cObject);
-    ePKeyError = rb_define_class_under(mPKey, "PKeyError", eOSSLError);
-#endif
-
-    /* Document-class: OpenSSL::PKey::DHError
-     *
-     * Generic exception that is raised if an operation on a DH PKey
-     * fails unexpectedly or in case an instantiation of an instance of DH
-     * fails due to non-conformant input data.
-     */
-    eDHError = rb_define_class_under(mPKey, "DHError", ePKeyError);
     /* Document-class: OpenSSL::PKey::DH
      *
      * An implementation of the Diffie-Hellman key exchange protocol based on
@@ -443,8 +410,6 @@ Init_ossl_dh(void)
     DEF_OSSL_PKEY_BN(cDH, dh, priv_key);
     rb_define_method(cDH, "set_pqg", ossl_dh_set_pqg, 3);
     rb_define_method(cDH, "set_key", ossl_dh_set_key, 2);
-
-    rb_define_method(cDH, "params", ossl_dh_get_params, 0);
 }
 
 #else /* defined NO_DH */

data/ext/openssl/ossl_pkey_dsa.c

@@ -14,13 +14,15 @@
 #define GetPKeyDSA(obj, pkey) do { \
     GetPKey((obj), (pkey)); \
     if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DSA) { /* PARANOIA? */ \
-	ossl_raise(rb_eRuntimeError, "THIS IS NOT A DSA!"); \
+        ossl_raise(rb_eRuntimeError, "THIS IS NOT A DSA!"); \
     } \
 } while (0)
 #define GetDSA(obj, dsa) do { \
     EVP_PKEY *_pkey; \
     GetPKeyDSA((obj), _pkey); \
     (dsa) = EVP_PKEY_get0_DSA(_pkey); \
+    if ((dsa) == NULL) \
+        ossl_raise(ePKeyError, "failed to get DSA from EVP_PKEY"); \
 } while (0)
 
 static inline int
@@ -41,7 +43,6 @@ DSA_PRIVATE(VALUE obj, OSSL_3_const DSA *dsa)
  * Classes
  */
 VALUE cDSA;
-static VALUE eDSAError;
 
 /*
  * Private
@@ -56,6 +57,7 @@ static VALUE eDSAError;
  *
  * If called without arguments, creates a new instance with no key components
  * set. They can be set individually by #set_pqg and #set_key.
+ * This form is not compatible with OpenSSL 3.0 or later.
  *
  * If called with a String, tries to parse as DER or PEM encoding of a \DSA key.
  * See also OpenSSL::PKey.read which can parse keys of any kinds.
@@ -96,10 +98,15 @@ ossl_dsa_initialize(int argc, VALUE *argv, VALUE self)
     /* The DSA.new(size, generator) form is handled by lib/openssl/pkey.rb */
     rb_scan_args(argc, argv, "02", &arg, &pass);
     if (argc == 0) {
+#ifdef OSSL_HAVE_IMMUTABLE_PKEY
+        rb_raise(rb_eArgError, "OpenSSL::PKey::DSA.new cannot be called " \
+                 "without arguments; pkeys are immutable with OpenSSL 3.0");
+#else
         dsa = DSA_new();
         if (!dsa)
-            ossl_raise(eDSAError, "DSA_new");
+            ossl_raise(ePKeyError, "DSA_new");
         goto legacy;
+#endif
     }
 
     pass = ossl_pem_passwd_value(pass);
@@ -117,12 +124,12 @@ ossl_dsa_initialize(int argc, VALUE *argv, VALUE self)
     pkey = ossl_pkey_read_generic(in, pass);
     BIO_free(in);
     if (!pkey)
-        ossl_raise(eDSAError, "Neither PUB key nor PRIV key");
+        ossl_raise(ePKeyError, "Neither PUB key nor PRIV key");
 
     type = EVP_PKEY_base_id(pkey);
     if (type != EVP_PKEY_DSA) {
         EVP_PKEY_free(pkey);
-        rb_raise(eDSAError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+        rb_raise(ePKeyError, "incorrect pkey type: %s", OBJ_nid2sn(type));
     }
     RTYPEDDATA_DATA(self) = pkey;
     return self;
@@ -133,13 +140,14 @@ ossl_dsa_initialize(int argc, VALUE *argv, VALUE self)
     if (!pkey || EVP_PKEY_assign_DSA(pkey, dsa) != 1) {
         EVP_PKEY_free(pkey);
         DSA_free(dsa);
-        ossl_raise(eDSAError, "EVP_PKEY_assign_DSA");
+        ossl_raise(ePKeyError, "EVP_PKEY_assign_DSA");
     }
     RTYPEDDATA_DATA(self) = pkey;
     return self;
 }
 
 #ifndef HAVE_EVP_PKEY_DUP
+/* :nodoc: */
 static VALUE
 ossl_dsa_initialize_copy(VALUE self, VALUE other)
 {
@@ -155,13 +163,13 @@ ossl_dsa_initialize_copy(VALUE self, VALUE other)
                               (d2i_of_void *)d2i_DSAPrivateKey,
                               (char *)dsa);
     if (!dsa_new)
-	ossl_raise(eDSAError, "ASN1_dup");
+        ossl_raise(ePKeyError, "ASN1_dup");
 
     pkey = EVP_PKEY_new();
     if (!pkey || EVP_PKEY_assign_DSA(pkey, dsa_new) != 1) {
         EVP_PKEY_free(pkey);
         DSA_free(dsa_new);
-        ossl_raise(eDSAError, "EVP_PKEY_assign_DSA");
+        ossl_raise(ePKeyError, "EVP_PKEY_assign_DSA");
     }
     RTYPEDDATA_DATA(self) = pkey;
 
@@ -303,35 +311,6 @@ ossl_dsa_to_der(VALUE self)
 }
 
 
-/*
- *  call-seq:
- *    dsa.params -> hash
- *
- * Stores all parameters of key to the hash
- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!
- * Don't use :-)) (I's up to you)
- */
-static VALUE
-ossl_dsa_get_params(VALUE self)
-{
-    OSSL_3_const DSA *dsa;
-    VALUE hash;
-    const BIGNUM *p, *q, *g, *pub_key, *priv_key;
-
-    GetDSA(self, dsa);
-    DSA_get0_pqg(dsa, &p, &q, &g);
-    DSA_get0_key(dsa, &pub_key, &priv_key);
-
-    hash = rb_hash_new();
-    rb_hash_aset(hash, rb_str_new2("p"), ossl_bn_new(p));
-    rb_hash_aset(hash, rb_str_new2("q"), ossl_bn_new(q));
-    rb_hash_aset(hash, rb_str_new2("g"), ossl_bn_new(g));
-    rb_hash_aset(hash, rb_str_new2("pub_key"), ossl_bn_new(pub_key));
-    rb_hash_aset(hash, rb_str_new2("priv_key"), ossl_bn_new(priv_key));
-
-    return hash;
-}
-
 /*
  * Document-method: OpenSSL::PKey::DSA#set_pqg
  * call-seq:
@@ -355,20 +334,6 @@ OSSL_PKEY_BN_DEF2(dsa, DSA, key, pub_key, priv_key)
 void
 Init_ossl_dsa(void)
 {
-#if 0
-    mPKey = rb_define_module_under(mOSSL, "PKey");
-    cPKey = rb_define_class_under(mPKey, "PKey", rb_cObject);
-    ePKeyError = rb_define_class_under(mPKey, "PKeyError", eOSSLError);
-#endif
-
-    /* Document-class: OpenSSL::PKey::DSAError
-     *
-     * Generic exception that is raised if an operation on a DSA PKey
-     * fails unexpectedly or in case an instantiation of an instance of DSA
-     * fails due to non-conformant input data.
-     */
-    eDSAError = rb_define_class_under(mPKey, "DSAError", ePKeyError);
-
     /* Document-class: OpenSSL::PKey::DSA
      *
      * DSA, the Digital Signature Algorithm, is specified in NIST's
@@ -396,8 +361,6 @@ Init_ossl_dsa(void)
     DEF_OSSL_PKEY_BN(cDSA, dsa, priv_key);
     rb_define_method(cDSA, "set_pqg", ossl_dsa_set_pqg, 3);
     rb_define_method(cDSA, "set_key", ossl_dsa_set_key, 2);
-
-    rb_define_method(cDSA, "params", ossl_dsa_get_params, 0);
 }
 
 #else /* defined NO_DSA */