Rename BIO_print_errors_fp back to ERR_print_errors_fp & refactor it.

A previous change in BoringSSL renamed ERR_print_errors_fp to
BIO_print_errors_fp as part of refactoring the code to improve the
layering of modules within BoringSSL. Rename it back for better
compatibility with code that was using the function under the original
name. Move its definition back to crypto/err using an implementation
that avoids depending on crypto/bio.

Change-Id: Iee7703bb1eb4a3d640aff6485712bea71d7c1052
Reviewed-on: https://boringssl-review.googlesource.com/4310
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/bio/bio.c b/crypto/bio/bio.c
index 4d947a6..86fb853 100644
--- a/crypto/bio/bio.c
+++ b/crypto/bio/bio.c
@@ -462,12 +462,6 @@
   return 1;
 }
 
-void BIO_print_errors_fp(FILE *out) {
-  BIO *bio = BIO_new_fp(out, BIO_NOCLOSE);
-  BIO_print_errors(bio);
-  BIO_free(bio);
-}
-
 static int print_bio(const char *str, size_t len, void *bio) {
   return BIO_write((BIO *)bio, str, len);
 }
diff --git a/crypto/bio/bio_test.cc b/crypto/bio/bio_test.cc
index 00a9e32..b56f641 100644
--- a/crypto/bio/bio_test.cc
+++ b/crypto/bio/bio_test.cc
@@ -111,7 +111,7 @@
   if (BIO_write(bio.get(), kTestMessage, sizeof(kTestMessage)) !=
       sizeof(kTestMessage)) {
     fprintf(stderr, "BIO_write failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
diff --git a/crypto/bn/bn_test.cc b/crypto/bn/bn_test.cc
index a1f294d..caef572 100644
--- a/crypto/bn/bn_test.cc
+++ b/crypto/bn/bn_test.cc
@@ -945,7 +945,7 @@
       a->neg = rand_neg();
       b->neg = rand_neg();
       if (!BN_mod_mul(e.get(), a.get(), b.get(), c.get(), ctx)) {
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         return false;
       }
       if (bp != NULL) {
@@ -975,7 +975,7 @@
       }
       if (!BN_is_zero(b.get())) {
         fprintf(stderr, "Modulo multiply test failed!\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         return false;
       }
     }
@@ -1323,7 +1323,7 @@
                  0 /* don't modify bottom bit */) ||
         !BN_mul(nn.get(), n.get(), n.get(), ctx) ||
         !BN_sqrt(sqrt.get(), nn.get(), ctx)) {
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return false;
     }
     if (BN_cmp(n.get(), sqrt.get()) != 0) {
@@ -1339,7 +1339,7 @@
                  0 /* don't modify bottom bit */) ||
         !BN_mul(nn.get(), n.get(), n.get(), ctx) ||
         !BN_add(nn.get(), nn.get(), BN_value_one())) {
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return false;
     }
 
@@ -1380,7 +1380,7 @@
   for (size_t bytes = 128 - 7; bytes <= 128; bytes++) {
     if (!BN_rand(n.get(), bytes * 8, 0 /* make sure top bit is 1 */,
                  0 /* don't modify bottom bit */)) {
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return false;
     }
     if (BN_num_bytes(n.get()) != bytes ||
diff --git a/crypto/cipher/aead_test.c b/crypto/cipher/aead_test.c
index 833efa4..2bdff03 100644
--- a/crypto/cipher/aead_test.c
+++ b/crypto/cipher/aead_test.c
@@ -18,7 +18,6 @@
 #include <string.h>
 
 #include <openssl/aead.h>
-#include <openssl/bio.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 
@@ -298,7 +297,7 @@
 
       if (any_values_set) {
         if (!run_test_case(aead, bufs, lengths, line_no)) {
-          BIO_print_errors_fp(stderr);
+          ERR_print_errors_fp(stderr);
           return 4;
         }
 
diff --git a/crypto/cipher/cipher_test.c b/crypto/cipher/cipher_test.c
index 75dbe7e..109c82b 100644
--- a/crypto/cipher/cipher_test.c
+++ b/crypto/cipher/cipher_test.c
@@ -57,7 +57,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/bio.h>
 #include <openssl/cipher.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
@@ -158,39 +157,39 @@
     if (mode == EVP_CIPH_GCM_MODE) {
       if (!EVP_EncryptInit_ex(&ctx, c, NULL, NULL, NULL)) {
         fprintf(stderr, "EncryptInit failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(10);
       }
       if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_IVLEN, in, NULL)) {
         fprintf(stderr, "IV length set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(11);
       }
       if (!EVP_EncryptInit_ex(&ctx, NULL, NULL, key, iv)) {
         fprintf(stderr, "Key/IV set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(12);
       }
       if (an && !EVP_EncryptUpdate(&ctx, NULL, &outl, aad, an)) {
         fprintf(stderr, "AAD set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(13);
       }
     } else if (!EVP_EncryptInit_ex(&ctx, c, NULL, key, iv)) {
       fprintf(stderr, "EncryptInit failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(10);
     }
     EVP_CIPHER_CTX_set_padding(&ctx, 0);
 
     if (!EVP_EncryptUpdate(&ctx, out, &outl, plaintext, pn)) {
       fprintf(stderr, "Encrypt failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(6);
     }
     if (!EVP_EncryptFinal_ex(&ctx, out + outl, &outl2)) {
       fprintf(stderr, "EncryptFinal failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(7);
     }
 
@@ -213,7 +212,7 @@
        */
       if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, tn, rtag)) {
         fprintf(stderr, "Get tag failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(14);
       }
       if (memcmp(rtag, tag, tn)) {
@@ -229,45 +228,45 @@
     if (mode == EVP_CIPH_GCM_MODE) {
       if (!EVP_DecryptInit_ex(&ctx, c, NULL, NULL, NULL)) {
         fprintf(stderr, "EncryptInit failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(10);
       }
       if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_IVLEN, in, NULL)) {
         fprintf(stderr, "IV length set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(11);
       }
       if (!EVP_DecryptInit_ex(&ctx, NULL, NULL, key, iv)) {
         fprintf(stderr, "Key/IV set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(12);
       }
       if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, tn, (void *)tag)) {
         fprintf(stderr, "Set tag failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(14);
       }
       if (an && !EVP_DecryptUpdate(&ctx, NULL, &outl, aad, an)) {
         fprintf(stderr, "AAD set failed\n");
-        BIO_print_errors_fp(stderr);
+        ERR_print_errors_fp(stderr);
         exit(13);
       }
     } else if (!EVP_DecryptInit_ex(&ctx, c, NULL, key, iv)) {
       fprintf(stderr, "DecryptInit failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(11);
     }
     EVP_CIPHER_CTX_set_padding(&ctx, 0);
 
     if (!EVP_DecryptUpdate(&ctx, out, &outl, ciphertext, cn)) {
       fprintf(stderr, "Decrypt failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(6);
     }
     outl2 = 0;
     if (!EVP_DecryptFinal_ex(&ctx, out + outl, &outl2)) {
       fprintf(stderr, "DecryptFinal failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       exit(7);
     }
 
diff --git a/crypto/dh/dh_test.c b/crypto/dh/dh_test.c
index d03b1b3..4c22bbb 100644
--- a/crypto/dh/dh_test.c
+++ b/crypto/dh/dh_test.c
@@ -62,6 +62,7 @@
 #include <openssl/bio.h>
 #include <openssl/bn.h>
 #include <openssl/crypto.h>
+#include <openssl/err.h>
 #include <openssl/mem.h>
 
 #include "internal.h"
@@ -194,7 +195,7 @@
   }
 
 err:
-  BIO_print_errors_fp(stderr);
+  ERR_print_errors_fp(stderr);
 
   if (abuf != NULL) {
     OPENSSL_free(abuf);
@@ -498,7 +499,7 @@
 
 bad_err:
   fprintf(stderr, "Initalisation error RFC5114 set %d\n", i + 1);
-  BIO_print_errors_fp(stderr);
+  ERR_print_errors_fp(stderr);
 
 err:
   if (Z1 != NULL) {
diff --git a/crypto/ec/ec_test.c b/crypto/ec/ec_test.c
index 8d53f87..cffd332 100644
--- a/crypto/ec/ec_test.c
+++ b/crypto/ec/ec_test.c
@@ -15,7 +15,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/bio.h>
 #include <openssl/crypto.h>
 #include <openssl/ec_key.h>
 #include <openssl/err.h>
@@ -44,7 +43,7 @@
 
   if (key == NULL || inp != kECKeyWithoutPublic + sizeof(kECKeyWithoutPublic)) {
     fprintf(stderr, "Failed to parse private key.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     goto out;
   }
 
@@ -53,7 +52,7 @@
   outp = out;
   if (len != i2d_ECPrivateKey(key, &outp)) {
     fprintf(stderr, "Failed to serialize private key.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     goto out;
   }
 
diff --git a/crypto/err/err.c b/crypto/err/err.c
index 2552586..680663b 100644
--- a/crypto/err/err.c
+++ b/crypto/err/err.c
@@ -612,6 +612,17 @@
   }
 }
 
+static int print_errors_to_file(const char* msg, size_t msg_len, void* ctx) {
+  assert(msg[msg_len] == '\0');
+  FILE* fp = ctx;
+  int res = fputs(msg, fp);
+  return res < 0 ? 0 : 1;
+}
+
+void ERR_print_errors_fp(FILE *file) {
+  ERR_print_errors_cb(print_errors_to_file, file);
+}
+
 /* err_set_error_data sets the data on the most recent error. The |flags|
  * argument is a combination of the |ERR_FLAG_*| values. */
 static void err_set_error_data(char *data, int flags) {
diff --git a/crypto/evp/evp_test.cc b/crypto/evp/evp_test.cc
index a63f087..674547d 100644
--- a/crypto/evp/evp_test.cc
+++ b/crypto/evp/evp_test.cc
@@ -18,7 +18,6 @@
 
 #include <vector>
 
-#include <openssl/bio.h>
 #include <openssl/bytestring.h>
 #include <openssl/crypto.h>
 #include <openssl/digest.h>
@@ -541,59 +540,59 @@
 
   if (!TestEVP_DigestSignInit()) {
     fprintf(stderr, "EVP_DigestSignInit failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!TestEVP_DigestVerifyInit()) {
     fprintf(stderr, "EVP_DigestVerifyInit failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!TestEVP_DigestSignAlgorithm()) {
     fprintf(stderr, "EVP_DigestSignInit failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!TestEVP_DigestVerifyInitFromAlgorithm()) {
     fprintf(stderr, "EVP_DigestVerifyInitFromAlgorithm failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!Testd2i_AutoPrivateKey(kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER),
                               EVP_PKEY_RSA)) {
     fprintf(stderr, "d2i_AutoPrivateKey(kExampleRSAKeyDER) failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!Testd2i_AutoPrivateKey(kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8),
                               EVP_PKEY_RSA)) {
     fprintf(stderr, "d2i_AutoPrivateKey(kExampleRSAKeyPKCS8) failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!Testd2i_AutoPrivateKey(kExampleECKeyDER, sizeof(kExampleECKeyDER),
                               EVP_PKEY_EC)) {
     fprintf(stderr, "d2i_AutoPrivateKey(kExampleECKeyDER) failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!Testd2i_AutoPrivateKey(kExampleDSAKeyDER, sizeof(kExampleDSAKeyDER),
                               EVP_PKEY_DSA)) {
     fprintf(stderr, "d2i_AutoPrivateKey(kExampleDSAKeyDER) failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (!TestEVP_PKCS82PKEY()) {
     fprintf(stderr, "TestEVP_PKCS82PKEY failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
diff --git a/crypto/evp/pbkdf_test.cc b/crypto/evp/pbkdf_test.cc
index dfe595c..ae2f405 100644
--- a/crypto/evp/pbkdf_test.cc
+++ b/crypto/evp/pbkdf_test.cc
@@ -46,7 +46,7 @@
                          (const uint8_t *)salt, salt_len, iterations, digest,
                          key_len, key)) {
     fprintf(stderr, "Call to PKCS5_PBKDF2_HMAC failed\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
diff --git a/crypto/hkdf/hkdf_test.c b/crypto/hkdf/hkdf_test.c
index 7467fe0..63070dc 100644
--- a/crypto/hkdf/hkdf_test.c
+++ b/crypto/hkdf/hkdf_test.c
@@ -15,7 +15,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/bio.h>
 #include <openssl/crypto.h>
 #include <openssl/digest.h>
 #include <openssl/err.h>
@@ -224,7 +223,7 @@
     if (!HKDF(buf, test->out_len, test->md_func(), test->ikm, test->ikm_len,
               test->salt, test->salt_len, test->info, test->info_len)) {
       fprintf(stderr, "Call to HKDF failed\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 1;
     }
     if (memcmp(buf, test->out, test->out_len) != 0) {
diff --git a/crypto/pkcs8/pkcs12_test.c b/crypto/pkcs8/pkcs12_test.c
index 2292b77..e401786 100644
--- a/crypto/pkcs8/pkcs12_test.c
+++ b/crypto/pkcs8/pkcs12_test.c
@@ -690,7 +690,7 @@
   CBS_init(&pkcs12, der, der_len);
   if (!PKCS12_get_key_and_certs(&key, certs, &pkcs12, "foo")) {
     fprintf(stderr, "PKCS12 failed on %s data.\n", name);
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 0;
   }
 
@@ -717,14 +717,14 @@
   p12 = d2i_PKCS12_bio(bio, NULL);
   if (p12 == NULL) {
     fprintf(stderr, "PKCS12_parse failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 0;
   }
   BIO_free(bio);
 
   if (!PKCS12_parse(p12, "foo", &key, &cert, &ca_certs)) {
     fprintf(stderr, "PKCS12_parse failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 0;
   }
 
diff --git a/crypto/rsa/rsa_test.c b/crypto/rsa/rsa_test.c
index 386ecac..640ffb8 100644
--- a/crypto/rsa/rsa_test.c
+++ b/crypto/rsa/rsa_test.c
@@ -58,7 +58,6 @@
 
 #include <string.h>
 
-#include <openssl/bio.h>
 #include <openssl/bn.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
@@ -249,13 +248,13 @@
 
   if (!RSA_generate_key_ex(key, 512, &e, NULL)) {
     fprintf(stderr, "RSA_generate_key_ex failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 0;
   }
 
   if (!BN_add(key->p, key->p, BN_value_one())) {
     fprintf(stderr, "BN error.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 0;
   }
 
@@ -292,19 +291,19 @@
 
   if (!RSA_check_key(key)) {
     fprintf(stderr, "RSA_check_key failed with only d given.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     goto err;
   }
 
   if (!RSA_sign(NID_md5, kDummyHash, sizeof(kDummyHash), buf, &buf_len, key)) {
     fprintf(stderr, "RSA_sign failed with only d given.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     goto err;
   }
 
   if (!RSA_verify(NID_md5, kDummyHash, sizeof(kDummyHash), buf, buf_len, key)) {
     fprintf(stderr, "RSA_verify failed with only d given.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     goto err;
   }
 
@@ -331,13 +330,13 @@
     key1 = RSA_new();
     if (!RSA_generate_key_ex(key1, 512, e, NULL)) {
       fprintf(stderr, "RSA_generate_key_ex failed.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
     if (!RSA_check_key(key1)) {
       fprintf(stderr, "RSA_check_key failed with original key.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
@@ -349,7 +348,7 @@
 
     if (!RSA_recover_crt_params(key2)) {
       fprintf(stderr, "RSA_recover_crt_params failed.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
@@ -359,21 +358,21 @@
 
     if (!RSA_check_key(key2)) {
       fprintf(stderr, "RSA_check_key failed with recovered key.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
     if (!RSA_sign(NID_md5, kDummyHash, sizeof(kDummyHash), buf, &buf_len,
                   key2)) {
       fprintf(stderr, "RSA_sign failed with recovered key.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
     if (!RSA_verify(NID_md5, kDummyHash, sizeof(kDummyHash), buf, buf_len,
                     key2)) {
       fprintf(stderr, "RSA_verify failed with recovered key.\n");
-      BIO_print_errors_fp(stderr);
+      ERR_print_errors_fp(stderr);
       return 0;
     }
 
diff --git a/include/openssl/bio.h b/include/openssl/bio.h
index 349a073..0a637e4 100644
--- a/include/openssl/bio.h
+++ b/include/openssl/bio.h
@@ -62,6 +62,7 @@
 #include <stdarg.h>
 #include <stdio.h>  /* For FILE */
 
+#include <openssl/err.h> /* for ERR_print_errors_fp */
 #include <openssl/ex_data.h>
 #include <openssl/stack.h>
 
@@ -331,10 +332,6 @@
 OPENSSL_EXPORT int BIO_hexdump(BIO *bio, const uint8_t *data, size_t len,
                                unsigned indent);
 
-/* BIO_print_errors_fp prints the current contents of the error stack to |out|
- * using human readable strings where possible. */
-OPENSSL_EXPORT void BIO_print_errors_fp(FILE *out);
-
 /* BIO_print_errors prints the current contents of the error stack to |bio|
  * using human readable strings where possible. */
 OPENSSL_EXPORT void BIO_print_errors(BIO *bio);
@@ -706,6 +703,14 @@
 #define BIO_CTRL_SET_FILENAME	30	/* BIO_s_file special */
 
 
+/* Android compatibility section.
+ *
+ * A previous version of BoringSSL used in Android renamed ERR_print_errors_fp
+ * to BIO_print_errors_fp. It has subsequently been renamed back to
+ * ERR_print_errors_fp. */
+#define BIO_print_errors_fp ERR_print_errors_fp
+
+
 /* Private functions */
 
 #define BIO_FLAGS_READ 0x01
diff --git a/include/openssl/err.h b/include/openssl/err.h
index 340cf9b..738e8c5 100644
--- a/include/openssl/err.h
+++ b/include/openssl/err.h
@@ -109,6 +109,8 @@
 #ifndef OPENSSL_HEADER_ERR_H
 #define OPENSSL_HEADER_ERR_H
 
+#include <stdio.h>
+
 #include <openssl/base.h>
 #include <openssl/thread.h>
 #include <openssl/lhash.h>
@@ -251,6 +253,10 @@
                                         void *ctx);
 
 
+/* ERR_print_errors_fp prints the current contents of the error stack to |file|

+ * using human readable strings where possible. */
+OPENSSL_EXPORT void ERR_print_errors_fp(FILE *file);
+
 /* Clearing errors. */
 
 /* ERR_clear_error clears the error queue for the current thread. */
diff --git a/ssl/ssl_test.cc b/ssl/ssl_test.cc
index aba758e..8becc63 100644
--- a/ssl/ssl_test.cc
+++ b/ssl/ssl_test.cc
@@ -486,7 +486,7 @@
       !TestDefaultVersion(DTLS1_VERSION, &DTLSv1_method) ||
       !TestDefaultVersion(DTLS1_2_VERSION, &DTLSv1_2_method) ||
       !TestCipherGetRFCName()) {
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index 7c9654d..091dc30 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -37,6 +37,7 @@
 #include <openssl/bio.h>
 #include <openssl/buf.h>
 #include <openssl/bytestring.h>
+#include <openssl/err.h>
 #include <openssl/ssl.h>
 
 #include <memory>
@@ -986,21 +987,21 @@
 
   ScopedSSL_CTX ssl_ctx = SetupCtx(&config);
   if (!ssl_ctx) {
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   ScopedSSL_SESSION session;
   if (!DoExchange(&session, ssl_ctx.get(), &config, false /* is_resume */,
                   NULL /* session */)) {
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
   if (config.resume &&
       !DoExchange(NULL, ssl_ctx.get(), &config, true /* is_resume */,
                   session.get())) {
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }
 
diff --git a/tool/pkcs12.cc b/tool/pkcs12.cc
index 7ce2bd0..c191531 100644
--- a/tool/pkcs12.cc
+++ b/tool/pkcs12.cc
@@ -31,6 +31,7 @@
 #endif
 
 #include <openssl/bytestring.h>
+#include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs8.h>
 #include <openssl/stack.h>
@@ -123,7 +124,7 @@
 
   if (!PKCS12_get_key_and_certs(&key, certs, &pkcs12, password)) {
     fprintf(stderr, "Failed to parse PKCS#12 data:\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
diff --git a/tool/speed.cc b/tool/speed.cc
index d16b164..3834a68 100644
--- a/tool/speed.cc
+++ b/tool/speed.cc
@@ -22,8 +22,8 @@
 #include <time.h>
 
 #include <openssl/aead.h>
-#include <openssl/bio.h>
 #include <openssl/digest.h>
+#include <openssl/err.h>
 #include <openssl/obj.h>
 #include <openssl/rsa.h>
 
@@ -147,7 +147,7 @@
                         sig.get(), &sig_len, key);
       })) {
     fprintf(stderr, "RSA_sign failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
   results.Print(key_name + " signing");
@@ -158,7 +158,7 @@
                           sizeof(fake_sha256_hash), sig.get(), sig_len, key);
       })) {
     fprintf(stderr, "RSA_verify failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
   results.Print(key_name + " verify");
@@ -199,7 +199,7 @@
                                         EVP_AEAD_DEFAULT_TAG_LENGTH,
                                         evp_aead_seal)) {
     fprintf(stderr, "Failed to create EVP_AEAD_CTX.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
@@ -213,7 +213,7 @@
             nonce_len, in, chunk_len, ad.get(), ad_len);
       })) {
     fprintf(stderr, "EVP_AEAD_CTX_seal failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
@@ -250,7 +250,7 @@
                EVP_DigestFinal_ex(ctx, digest, &md_len);
       })) {
     fprintf(stderr, "EVP_DigestInit_ex failed.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
@@ -273,7 +273,7 @@
   inp = kDERRSAPrivate2048;
   if (NULL == d2i_RSAPrivateKey(&key, &inp, kDERRSAPrivate2048Len)) {
     fprintf(stderr, "Failed to parse RSA key.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return false;
   }
 
@@ -287,7 +287,7 @@
   inp = kDERRSAPrivate4096;
   if (NULL == d2i_RSAPrivateKey(&key, &inp, kDERRSAPrivate4096Len)) {
     fprintf(stderr, "Failed to parse 4096-bit RSA key.\n");
-    BIO_print_errors_fp(stderr);
+    ERR_print_errors_fp(stderr);
     return 1;
   }