openssl 3.3.2 → 4.0.0

data/ext/openssl/ossl_asn1.c

@@ -9,63 +9,81 @@
  */
 #include "ossl.h"
 
-static VALUE ossl_asn1_decode0(unsigned char **pp, long length, long *offset,
-			       int depth, int yield, long *num_read);
+/********/
+/*
+ * ASN1 module
+ */
+#define ossl_asn1_get_value(o)           rb_attr_get((o),sivVALUE)
+#define ossl_asn1_get_tag(o)             rb_attr_get((o),sivTAG)
+#define ossl_asn1_get_tagging(o)         rb_attr_get((o),sivTAGGING)
+#define ossl_asn1_get_tag_class(o)       rb_attr_get((o),sivTAG_CLASS)
+#define ossl_asn1_get_indefinite_length(o) rb_attr_get((o),sivINDEFINITE_LENGTH)
+
+#define ossl_asn1_set_value(o,v)           rb_ivar_set((o),sivVALUE,(v))
+#define ossl_asn1_set_tag(o,v)             rb_ivar_set((o),sivTAG,(v))
+#define ossl_asn1_set_tagging(o,v)         rb_ivar_set((o),sivTAGGING,(v))
+#define ossl_asn1_set_tag_class(o,v)       rb_ivar_set((o),sivTAG_CLASS,(v))
+#define ossl_asn1_set_indefinite_length(o,v) rb_ivar_set((o),sivINDEFINITE_LENGTH,(v))
+
+VALUE mASN1;
+static VALUE eASN1Error;
+
+VALUE cASN1Data;
+static VALUE cASN1Primitive;
+static VALUE cASN1Constructive;
+
+static VALUE cASN1EndOfContent;
+static VALUE cASN1Boolean;                           /* BOOLEAN           */
+static VALUE cASN1Integer, cASN1Enumerated;          /* INTEGER           */
+static VALUE cASN1BitString;                         /* BIT STRING        */
+static VALUE cASN1OctetString, cASN1UTF8String;      /* STRINGs           */
+static VALUE cASN1NumericString, cASN1PrintableString;
+static VALUE cASN1T61String, cASN1VideotexString;
+static VALUE cASN1IA5String, cASN1GraphicString;
+static VALUE cASN1ISO64String, cASN1GeneralString;
+static VALUE cASN1UniversalString, cASN1BMPString;
+static VALUE cASN1Null;                              /* NULL              */
+static VALUE cASN1ObjectId;                          /* OBJECT IDENTIFIER */
+static VALUE cASN1UTCTime, cASN1GeneralizedTime;     /* TIME              */
+static VALUE cASN1Sequence, cASN1Set;                /* CONSTRUCTIVE      */
+
+static VALUE sym_IMPLICIT, sym_EXPLICIT;
+static VALUE sym_UNIVERSAL, sym_APPLICATION, sym_CONTEXT_SPECIFIC, sym_PRIVATE;
+static ID sivVALUE, sivTAG, sivTAG_CLASS, sivTAGGING, sivINDEFINITE_LENGTH, sivUNUSED_BITS;
+static ID id_each;
 
 /*
  * DATE conversion
  */
+static VALUE
+time_utc_new(VALUE args)
+{
+    return rb_funcallv(rb_cTime, rb_intern("utc"), 6, (VALUE *)args);
+}
+
+static VALUE
+time_utc_new_rescue(VALUE args, VALUE exc)
+{
+    rb_raise(eASN1Error, "invalid time");
+}
+
 VALUE
 asn1time_to_time(const ASN1_TIME *time)
 {
     struct tm tm;
-    VALUE argv[6];
-    int count;
-
-    memset(&tm, 0, sizeof(struct tm));
-
-    switch (time->type) {
-    case V_ASN1_UTCTIME:
-	count = sscanf((const char *)time->data, "%2d%2d%2d%2d%2d%2dZ",
-		&tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min,
-		&tm.tm_sec);
-
-	if (count == 5) {
-	    tm.tm_sec = 0;
-	} else if (count != 6) {
-	    ossl_raise(rb_eTypeError, "bad UTCTIME format: \"%s\"",
-		    time->data);
-	}
-	if (tm.tm_year < 69) {
-	    tm.tm_year += 2000;
-	} else {
-	    tm.tm_year += 1900;
-	}
-	break;
-    case V_ASN1_GENERALIZEDTIME:
-	count = sscanf((const char *)time->data, "%4d%2d%2d%2d%2d%2dZ",
-		&tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min,
-		&tm.tm_sec);
-	if (count == 5) {
-		tm.tm_sec = 0;
-	}
-	else if (count != 6) {
-		ossl_raise(rb_eTypeError, "bad GENERALIZEDTIME format: \"%s\"",
-			time->data);
-	}
-	break;
-    default:
-	rb_warning("unknown time format");
-        return Qnil;
-    }
-    argv[0] = INT2NUM(tm.tm_year);
-    argv[1] = INT2NUM(tm.tm_mon);
-    argv[2] = INT2NUM(tm.tm_mday);
-    argv[3] = INT2NUM(tm.tm_hour);
-    argv[4] = INT2NUM(tm.tm_min);
-    argv[5] = INT2NUM(tm.tm_sec);
-
-    return rb_funcall2(rb_cTime, rb_intern("utc"), 6, argv);
+    if (!ASN1_TIME_to_tm(time, &tm))
+        ossl_raise(eASN1Error, "ASN1_TIME_to_tm");
+
+    VALUE args[] = {
+        INT2NUM(tm.tm_year + 1900),
+        INT2NUM(tm.tm_mon + 1),
+        INT2NUM(tm.tm_mday),
+        INT2NUM(tm.tm_hour),
+        INT2NUM(tm.tm_min),
+        INT2NUM(tm.tm_sec),
+    };
+    return rb_rescue2(time_utc_new, (VALUE)args, time_utc_new_rescue, Qnil,
+                      rb_eArgError, 0);
 }
 
 static VALUE
@@ -80,13 +98,13 @@ ossl_time_split(VALUE time, time_t *sec, int *days)
     VALUE num = rb_Integer(time);
 
     if (FIXNUM_P(num)) {
-	time_t t = FIX2LONG(num);
-	*sec = t % 86400;
-	*days = rb_long2int(t / 86400);
+        time_t t = FIX2LONG(num);
+        *sec = t % 86400;
+        *days = rb_long2int(t / 86400);
     }
     else {
-	*days = NUM2INT(rb_funcall(num, rb_intern("/"), 1, INT2FIX(86400)));
-	*sec = NUM2TIMET(rb_funcall(num, rb_intern("%"), 1, INT2FIX(86400)));
+        *days = NUM2INT(rb_funcall(num, rb_intern("/"), 1, INT2FIX(86400)));
+        *sec = NUM2TIMET(rb_funcall(num, rb_intern("%"), 1, INT2FIX(86400)));
     }
 }
 
@@ -96,7 +114,8 @@ ossl_time_split(VALUE time, time_t *sec, int *days)
 VALUE
 asn1str_to_str(const ASN1_STRING *str)
 {
-    return rb_str_new((const char *)str->data, str->length);
+    return rb_str_new((const char *)ASN1_STRING_get0_data(str),
+                      ASN1_STRING_length(str));
 }
 
 /*
@@ -109,16 +128,15 @@ asn1integer_to_num(const ASN1_INTEGER *ai)
     VALUE num;
 
     if (!ai) {
-	ossl_raise(rb_eTypeError, "ASN1_INTEGER is NULL!");
+        ossl_raise(rb_eTypeError, "ASN1_INTEGER is NULL!");
     }
-    if (ai->type == V_ASN1_ENUMERATED)
-	/* const_cast: workaround for old OpenSSL */
-	bn = ASN1_ENUMERATED_to_BN((ASN1_ENUMERATED *)ai, NULL);
+    if (ASN1_STRING_type(ai) == V_ASN1_ENUMERATED)
+        bn = ASN1_ENUMERATED_to_BN(ai, NULL);
     else
-	bn = ASN1_INTEGER_to_BN(ai, NULL);
+        bn = ASN1_INTEGER_to_BN(ai, NULL);
 
     if (!bn)
-	ossl_raise(eOSSLError, NULL);
+        ossl_raise(eOSSLError, NULL);
     num = ossl_bn_new(bn);
     BN_free(bn);
 
@@ -131,12 +149,12 @@ num_to_asn1integer(VALUE obj, ASN1_INTEGER *ai)
     BIGNUM *bn;
 
     if (NIL_P(obj))
-	ossl_raise(rb_eTypeError, "Can't convert nil into Integer");
+        ossl_raise(rb_eTypeError, "Can't convert nil into Integer");
 
     bn = GetBNPtr(obj);
 
     if (!(ai = BN_to_ASN1_INTEGER(bn, ai)))
-	ossl_raise(eOSSLError, NULL);
+        ossl_raise(eOSSLError, NULL);
 
     return ai;
 }
@@ -147,43 +165,47 @@ asn1integer_to_num_i(VALUE arg)
     return asn1integer_to_num((ASN1_INTEGER *)arg);
 }
 
-/********/
 /*
- * ASN1 module
+ * ASN1_OBJECT conversions
  */
-#define ossl_asn1_get_value(o)           rb_attr_get((o),sivVALUE)
-#define ossl_asn1_get_tag(o)             rb_attr_get((o),sivTAG)
-#define ossl_asn1_get_tagging(o)         rb_attr_get((o),sivTAGGING)
-#define ossl_asn1_get_tag_class(o)       rb_attr_get((o),sivTAG_CLASS)
-#define ossl_asn1_get_indefinite_length(o) rb_attr_get((o),sivINDEFINITE_LENGTH)
-
-#define ossl_asn1_set_indefinite_length(o,v) rb_ivar_set((o),sivINDEFINITE_LENGTH,(v))
-
-VALUE mASN1;
-VALUE eASN1Error;
+VALUE
+ossl_asn1obj_to_string_oid(const ASN1_OBJECT *a1obj)
+{
+    VALUE str;
+    int len;
 
-VALUE cASN1Data;
-static VALUE cASN1Primitive;
-static VALUE cASN1Constructive;
+    str = rb_usascii_str_new(NULL, 127);
+    len = OBJ_obj2txt(RSTRING_PTR(str), RSTRING_LENINT(str), a1obj, 1);
+    if (len <= 0 || len == INT_MAX)
+        ossl_raise(eOSSLError, "OBJ_obj2txt");
+    if (len > RSTRING_LEN(str)) {
+        /* +1 is for the \0 terminator added by OBJ_obj2txt() */
+        rb_str_resize(str, len + 1);
+        len = OBJ_obj2txt(RSTRING_PTR(str), len + 1, a1obj, 1);
+        if (len <= 0)
+            ossl_raise(eOSSLError, "OBJ_obj2txt");
+    }
+    rb_str_set_len(str, len);
+    return str;
+}
 
-static VALUE cASN1EndOfContent;
-static VALUE cASN1Boolean;                           /* BOOLEAN           */
-static VALUE cASN1Integer, cASN1Enumerated;          /* INTEGER           */
-static VALUE cASN1BitString;                         /* BIT STRING        */
-static VALUE cASN1OctetString, cASN1UTF8String;      /* STRINGs           */
-static VALUE cASN1NumericString, cASN1PrintableString;
-static VALUE cASN1T61String, cASN1VideotexString;
-static VALUE cASN1IA5String, cASN1GraphicString;
-static VALUE cASN1ISO64String, cASN1GeneralString;
-static VALUE cASN1UniversalString, cASN1BMPString;
-static VALUE cASN1Null;                              /* NULL              */
-static VALUE cASN1ObjectId;                          /* OBJECT IDENTIFIER */
-static VALUE cASN1UTCTime, cASN1GeneralizedTime;     /* TIME              */
-static VALUE cASN1Sequence, cASN1Set;                /* CONSTRUCTIVE      */
+VALUE
+ossl_asn1obj_to_string(const ASN1_OBJECT *obj)
+{
+    int nid = OBJ_obj2nid(obj);
+    if (nid != NID_undef)
+        return rb_str_new_cstr(OBJ_nid2sn(nid));
+    return ossl_asn1obj_to_string_oid(obj);
+}
 
-static VALUE sym_IMPLICIT, sym_EXPLICIT;
-static VALUE sym_UNIVERSAL, sym_APPLICATION, sym_CONTEXT_SPECIFIC, sym_PRIVATE;
-static ID sivVALUE, sivTAG, sivTAG_CLASS, sivTAGGING, sivINDEFINITE_LENGTH, sivUNUSED_BITS;
+VALUE
+ossl_asn1obj_to_string_long_name(const ASN1_OBJECT *obj)
+{
+    int nid = OBJ_obj2nid(obj);
+    if (nid != NID_undef)
+        return rb_str_new_cstr(OBJ_nid2ln(nid));
+    return ossl_asn1obj_to_string_oid(obj);
+}
 
 /*
  * Ruby to ASN1 converters
@@ -192,9 +214,9 @@ static ASN1_BOOLEAN
 obj_to_asn1bool(VALUE obj)
 {
     if (NIL_P(obj))
-	ossl_raise(rb_eTypeError, "Can't convert nil into Boolean");
+        ossl_raise(rb_eTypeError, "Can't convert nil into Boolean");
 
-     return RTEST(obj) ? 0xff : 0x0;
+    return RTEST(obj) ? 0xff : 0x0;
 }
 
 static ASN1_INTEGER*
@@ -209,11 +231,11 @@ obj_to_asn1bstr(VALUE obj, long unused_bits)
     ASN1_BIT_STRING *bstr;
 
     if (unused_bits < 0 || unused_bits > 7)
-	ossl_raise(eASN1Error, "unused_bits for a bitstring value must be in "\
-		   "the range 0 to 7");
+        ossl_raise(eASN1Error, "unused_bits for a bitstring value must be in "\
+                   "the range 0 to 7");
     StringValue(obj);
     if(!(bstr = ASN1_BIT_STRING_new()))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ASN1_BIT_STRING_set(bstr, (unsigned char *)RSTRING_PTR(obj), RSTRING_LENINT(obj));
     bstr->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */
     bstr->flags |= ASN1_STRING_FLAG_BITS_LEFT | unused_bits;
@@ -228,7 +250,7 @@ obj_to_asn1str(VALUE obj)
 
     StringValue(obj);
     if(!(str = ASN1_STRING_new()))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ASN1_STRING_set(str, RSTRING_PTR(obj), RSTRING_LENINT(obj));
 
     return str;
@@ -240,15 +262,15 @@ obj_to_asn1null(VALUE obj)
     ASN1_NULL *null;
 
     if(!NIL_P(obj))
-	ossl_raise(eASN1Error, "nil expected");
+        ossl_raise(eASN1Error, "nil expected");
     if(!(null = ASN1_NULL_new()))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
 
     return null;
 }
 
-static ASN1_OBJECT*
-obj_to_asn1obj(VALUE obj)
+ASN1_OBJECT *
+ossl_to_asn1obj(VALUE obj)
 {
     ASN1_OBJECT *a1obj;
 
@@ -270,7 +292,7 @@ obj_to_asn1utime(VALUE time)
 
     ossl_time_split(time, &sec, &off_days);
     if (!(t = ASN1_UTCTIME_adj(NULL, sec, off_days, 0)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
 
     return t;
 }
@@ -285,7 +307,7 @@ obj_to_asn1gtime(VALUE time)
 
     ossl_time_split(time, &sec, &off_days);
     if (!(t = ASN1_GENERALIZEDTIME_adj(NULL, sec, off_days, 0)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
 
     return t;
 }
@@ -298,7 +320,7 @@ obj_to_asn1derstr(VALUE obj)
 
     str = ossl_to_der(obj);
     if(!(a1str = ASN1_STRING_new()))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ASN1_STRING_set(a1str, RSTRING_PTR(str), RSTRING_LENINT(str));
 
     return a1str;
@@ -313,9 +335,9 @@ decode_bool(unsigned char* der, long length)
     const unsigned char *p = der;
 
     if (length != 3)
-	ossl_raise(eASN1Error, "invalid length for BOOLEAN");
+        ossl_raise(eASN1Error, "invalid length for BOOLEAN");
     if (p[0] != 1 || p[1] != 1)
-	ossl_raise(eASN1Error, "invalid BOOLEAN");
+        ossl_raise(eASN1Error, "invalid BOOLEAN");
 
     return p[2] ? Qtrue : Qfalse;
 }
@@ -330,9 +352,9 @@ decode_int(unsigned char* der, long length)
 
     p = der;
     if(!(ai = d2i_ASN1_INTEGER(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ret = rb_protect(asn1integer_to_num_i,
-		     (VALUE)ai, &status);
+                     (VALUE)ai, &status);
     ASN1_INTEGER_free(ai);
     if(status) rb_jump_tag(status);
 
@@ -349,11 +371,11 @@ decode_bstr(unsigned char* der, long length, long *unused_bits)
 
     p = der;
     if(!(bstr = d2i_ASN1_BIT_STRING(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     len = bstr->length;
     *unused_bits = 0;
     if(bstr->flags & ASN1_STRING_FLAG_BITS_LEFT)
-	*unused_bits = bstr->flags & 0x07;
+        *unused_bits = bstr->flags & 0x07;
     ret = rb_str_new((const char *)bstr->data, len);
     ASN1_BIT_STRING_free(bstr);
 
@@ -370,9 +392,9 @@ decode_enum(unsigned char* der, long length)
 
     p = der;
     if(!(ai = d2i_ASN1_ENUMERATED(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ret = rb_protect(asn1integer_to_num_i,
-		     (VALUE)ai, &status);
+                     (VALUE)ai, &status);
     ASN1_ENUMERATED_free(ai);
     if(status) rb_jump_tag(status);
 
@@ -387,38 +409,33 @@ decode_null(unsigned char* der, long length)
 
     p = der;
     if(!(null = d2i_ASN1_NULL(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ASN1_NULL_free(null);
 
     return Qnil;
 }
 
+VALUE
+asn1obj_to_string_i(VALUE arg)
+{
+    return ossl_asn1obj_to_string((const ASN1_OBJECT *)arg);
+}
+
 static VALUE
 decode_obj(unsigned char* der, long length)
 {
     ASN1_OBJECT *obj;
     const unsigned char *p;
     VALUE ret;
-    int nid;
-    BIO *bio;
+    int state;
 
     p = der;
-    if(!(obj = d2i_ASN1_OBJECT(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
-    if((nid = OBJ_obj2nid(obj)) != NID_undef){
-	ASN1_OBJECT_free(obj);
-	ret = rb_str_new2(OBJ_nid2sn(nid));
-    }
-    else{
-	if(!(bio = BIO_new(BIO_s_mem()))){
-	    ASN1_OBJECT_free(obj);
-	    ossl_raise(eASN1Error, NULL);
-	}
-	i2a_ASN1_OBJECT(bio, obj);
-	ASN1_OBJECT_free(obj);
-	ret = ossl_membio2str(bio);
-    }
-
+    if (!(obj = d2i_ASN1_OBJECT(NULL, &p, length)))
+        ossl_raise(eASN1Error, "d2i_ASN1_OBJECT");
+    ret = rb_protect(asn1obj_to_string_i, (VALUE)obj, &state);
+    ASN1_OBJECT_free(obj);
+    if (state)
+        rb_jump_tag(state);
     return ret;
 }
 
@@ -432,9 +449,9 @@ decode_time(unsigned char* der, long length)
 
     p = der;
     if(!(time = d2i_ASN1_TIME(NULL, &p, length)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
     ret = rb_protect(asn1time_to_time_i,
-		     (VALUE)time, &status);
+                     (VALUE)time, &status);
     ASN1_TIME_free(time);
     if(status) rb_jump_tag(status);
 
@@ -445,7 +462,7 @@ static VALUE
 decode_eoc(unsigned char *der, long length)
 {
     if (length != 2 || !(der[0] == 0x00 && der[1] == 0x00))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
 
     return rb_str_new("", 0);
 }
@@ -510,62 +527,62 @@ ossl_asn1_get_asn1type(VALUE obj)
     tag = ossl_asn1_default_tag(obj);
     value = ossl_asn1_get_value(obj);
     switch(tag){
-    case V_ASN1_BOOLEAN:
-	ptr = (void*)(VALUE)obj_to_asn1bool(value);
-	free_func = NULL;
-	break;
-    case V_ASN1_INTEGER:         /* FALLTHROUGH */
-    case V_ASN1_ENUMERATED:
-	ptr = obj_to_asn1int(value);
-	free_func = (free_func_type *)ASN1_INTEGER_free;
-	break;
-    case V_ASN1_BIT_STRING:
+      case V_ASN1_BOOLEAN:
+        ptr = (void*)(VALUE)obj_to_asn1bool(value);
+        free_func = NULL;
+        break;
+      case V_ASN1_INTEGER:         /* FALLTHROUGH */
+      case V_ASN1_ENUMERATED:
+        ptr = obj_to_asn1int(value);
+        free_func = (free_func_type *)ASN1_INTEGER_free;
+        break;
+      case V_ASN1_BIT_STRING:
         rflag = rb_attr_get(obj, sivUNUSED_BITS);
-	ptr = obj_to_asn1bstr(value, NUM2INT(rflag));
-	free_func = (free_func_type *)ASN1_BIT_STRING_free;
-	break;
-    case V_ASN1_NULL:
-	ptr = obj_to_asn1null(value);
-	free_func = (free_func_type *)ASN1_NULL_free;
-	break;
-    case V_ASN1_OCTET_STRING:    /* FALLTHROUGH */
-    case V_ASN1_UTF8STRING:      /* FALLTHROUGH */
-    case V_ASN1_NUMERICSTRING:   /* FALLTHROUGH */
-    case V_ASN1_PRINTABLESTRING: /* FALLTHROUGH */
-    case V_ASN1_T61STRING:       /* FALLTHROUGH */
-    case V_ASN1_VIDEOTEXSTRING:  /* FALLTHROUGH */
-    case V_ASN1_IA5STRING:       /* FALLTHROUGH */
-    case V_ASN1_GRAPHICSTRING:   /* FALLTHROUGH */
-    case V_ASN1_ISO64STRING:     /* FALLTHROUGH */
-    case V_ASN1_GENERALSTRING:   /* FALLTHROUGH */
-    case V_ASN1_UNIVERSALSTRING: /* FALLTHROUGH */
-    case V_ASN1_BMPSTRING:
-	ptr = obj_to_asn1str(value);
-	free_func = (free_func_type *)ASN1_STRING_free;
-	break;
-    case V_ASN1_OBJECT:
-	ptr = obj_to_asn1obj(value);
-	free_func = (free_func_type *)ASN1_OBJECT_free;
-	break;
-    case V_ASN1_UTCTIME:
-	ptr = obj_to_asn1utime(value);
-	free_func = (free_func_type *)ASN1_TIME_free;
-	break;
-    case V_ASN1_GENERALIZEDTIME:
-	ptr = obj_to_asn1gtime(value);
-	free_func = (free_func_type *)ASN1_TIME_free;
-	break;
-    case V_ASN1_SET:             /* FALLTHROUGH */
-    case V_ASN1_SEQUENCE:
-	ptr = obj_to_asn1derstr(obj);
-	free_func = (free_func_type *)ASN1_STRING_free;
-	break;
-    default:
-	ossl_raise(eASN1Error, "unsupported ASN.1 type");
+        ptr = obj_to_asn1bstr(value, NUM2INT(rflag));
+        free_func = (free_func_type *)ASN1_BIT_STRING_free;
+        break;
+      case V_ASN1_NULL:
+        ptr = obj_to_asn1null(value);
+        free_func = (free_func_type *)ASN1_NULL_free;
+        break;
+      case V_ASN1_OCTET_STRING:    /* FALLTHROUGH */
+      case V_ASN1_UTF8STRING:      /* FALLTHROUGH */
+      case V_ASN1_NUMERICSTRING:   /* FALLTHROUGH */
+      case V_ASN1_PRINTABLESTRING: /* FALLTHROUGH */
+      case V_ASN1_T61STRING:       /* FALLTHROUGH */
+      case V_ASN1_VIDEOTEXSTRING:  /* FALLTHROUGH */
+      case V_ASN1_IA5STRING:       /* FALLTHROUGH */
+      case V_ASN1_GRAPHICSTRING:   /* FALLTHROUGH */
+      case V_ASN1_ISO64STRING:     /* FALLTHROUGH */
+      case V_ASN1_GENERALSTRING:   /* FALLTHROUGH */
+      case V_ASN1_UNIVERSALSTRING: /* FALLTHROUGH */
+      case V_ASN1_BMPSTRING:
+        ptr = obj_to_asn1str(value);
+        free_func = (free_func_type *)ASN1_STRING_free;
+        break;
+      case V_ASN1_OBJECT:
+        ptr = ossl_to_asn1obj(value);
+        free_func = (free_func_type *)ASN1_OBJECT_free;
+        break;
+      case V_ASN1_UTCTIME:
+        ptr = obj_to_asn1utime(value);
+        free_func = (free_func_type *)ASN1_TIME_free;
+        break;
+      case V_ASN1_GENERALIZEDTIME:
+        ptr = obj_to_asn1gtime(value);
+        free_func = (free_func_type *)ASN1_TIME_free;
+        break;
+      case V_ASN1_SET:             /* FALLTHROUGH */
+      case V_ASN1_SEQUENCE:
+        ptr = obj_to_asn1derstr(obj);
+        free_func = (free_func_type *)ASN1_STRING_free;
+        break;
+      default:
+        ossl_raise(eASN1Error, "unsupported ASN.1 type");
     }
     if(!(ret = OPENSSL_malloc(sizeof(ASN1_TYPE)))){
-	if(free_func) free_func(ptr);
-	ossl_raise(eASN1Error, "ASN1_TYPE alloc failure");
+        if(free_func) free_func(ptr);
+        ossl_raise(eASN1Error, "ASN1_TYPE alloc failure");
     }
     memset(ret, 0, sizeof(ASN1_TYPE));
     ASN1_TYPE_set(ret, tag, ptr);
@@ -580,10 +597,10 @@ ossl_asn1_default_tag(VALUE obj)
 
     tmp_class = CLASS_OF(obj);
     while (!NIL_P(tmp_class)) {
-	tag = rb_hash_lookup(class_tag_map, tmp_class);
-	if (tag != Qnil)
-	    return NUM2INT(tag);
-	tmp_class = rb_class_superclass(tmp_class);
+        tag = rb_hash_lookup(class_tag_map, tmp_class);
+        if (tag != Qnil)
+            return NUM2INT(tag);
+        tmp_class = rb_class_superclass(tmp_class);
     }
 
     return -1;
@@ -596,7 +613,7 @@ ossl_asn1_tag(VALUE obj)
 
     tag = ossl_asn1_get_tag(obj);
     if(NIL_P(tag))
-	ossl_raise(eASN1Error, "tag number not specified");
+        ossl_raise(eASN1Error, "tag number not specified");
 
     return NUM2INT(tag);
 }
@@ -608,28 +625,57 @@ ossl_asn1_tag_class(VALUE obj)
 
     s = ossl_asn1_get_tag_class(obj);
     if (NIL_P(s) || s == sym_UNIVERSAL)
-	return V_ASN1_UNIVERSAL;
+        return V_ASN1_UNIVERSAL;
     else if (s == sym_APPLICATION)
-	return V_ASN1_APPLICATION;
+        return V_ASN1_APPLICATION;
     else if (s == sym_CONTEXT_SPECIFIC)
-	return V_ASN1_CONTEXT_SPECIFIC;
+        return V_ASN1_CONTEXT_SPECIFIC;
     else if (s == sym_PRIVATE)
-	return V_ASN1_PRIVATE;
+        return V_ASN1_PRIVATE;
     else
-	ossl_raise(eASN1Error, "invalid tag class");
+        ossl_raise(eASN1Error, "invalid tag class");
 }
 
 static VALUE
 ossl_asn1_class2sym(int tc)
 {
     if((tc & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-	return sym_PRIVATE;
+        return sym_PRIVATE;
     else if((tc & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-	return sym_CONTEXT_SPECIFIC;
+        return sym_CONTEXT_SPECIFIC;
     else if((tc & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-	return sym_APPLICATION;
+        return sym_APPLICATION;
     else
-	return sym_UNIVERSAL;
+        return sym_UNIVERSAL;
+}
+
+/*
+ * call-seq:
+ *    OpenSSL::ASN1::ASN1Data.new(value, tag, tag_class) => ASN1Data
+ *
+ * _value_: Please have a look at Constructive and Primitive to see how Ruby
+ * types are mapped to ASN.1 types and vice versa.
+ *
+ * _tag_: An Integer indicating the tag number.
+ *
+ * _tag_class_: A Symbol indicating the tag class. Please cf. ASN1 for
+ * possible values.
+ *
+ * == Example
+ *   asn1_int = OpenSSL::ASN1Data.new(42, 2, :UNIVERSAL) # => Same as OpenSSL::ASN1::Integer.new(42)
+ *   tagged_int = OpenSSL::ASN1Data.new(42, 0, :CONTEXT_SPECIFIC) # implicitly 0-tagged INTEGER
+ */
+static VALUE
+ossl_asn1data_initialize(VALUE self, VALUE value, VALUE tag, VALUE tag_class)
+{
+    if(!SYMBOL_P(tag_class))
+        ossl_raise(eASN1Error, "invalid tag class");
+    ossl_asn1_set_tag(self, tag);
+    ossl_asn1_set_value(self, value);
+    ossl_asn1_set_tag_class(self, tag_class);
+    ossl_asn1_set_indefinite_length(self, Qfalse);
+
+    return self;
 }
 
 static VALUE
@@ -645,35 +691,35 @@ to_der_internal(VALUE self, int constructed, int indef_len, VALUE body)
 
     body_length = RSTRING_LENINT(body);
     if (ossl_asn1_get_tagging(self) == sym_EXPLICIT) {
-	int inner_length, e_encoding = indef_len ? 2 : 1;
-
-	if (default_tag_number == -1)
-	    ossl_raise(eASN1Error, "explicit tagging of unknown tag");
-
-	inner_length = ASN1_object_size(encoding, body_length, default_tag_number);
-	total_length = ASN1_object_size(e_encoding, inner_length, tag_number);
-	str = rb_str_new(NULL, total_length);
-	p = (unsigned char *)RSTRING_PTR(str);
-	/* Put explicit tag */
-	ASN1_put_object(&p, e_encoding, inner_length, tag_number, tag_class);
-	/* Append inner object */
-	ASN1_put_object(&p, encoding, body_length, default_tag_number, V_ASN1_UNIVERSAL);
-	memcpy(p, RSTRING_PTR(body), body_length);
-	p += body_length;
-	if (indef_len) {
-	    ASN1_put_eoc(&p); /* For inner object */
-	    ASN1_put_eoc(&p); /* For wrapper object */
-	}
+        int inner_length, e_encoding = indef_len ? 2 : 1;
+
+        if (default_tag_number == -1)
+            ossl_raise(eASN1Error, "explicit tagging of unknown tag");
+
+        inner_length = ASN1_object_size(encoding, body_length, default_tag_number);
+        total_length = ASN1_object_size(e_encoding, inner_length, tag_number);
+        str = rb_str_new(NULL, total_length);
+        p = (unsigned char *)RSTRING_PTR(str);
+        /* Put explicit tag */
+        ASN1_put_object(&p, e_encoding, inner_length, tag_number, tag_class);
+        /* Append inner object */
+        ASN1_put_object(&p, encoding, body_length, default_tag_number, V_ASN1_UNIVERSAL);
+        memcpy(p, RSTRING_PTR(body), body_length);
+        p += body_length;
+        if (indef_len) {
+            ASN1_put_eoc(&p); /* For inner object */
+            ASN1_put_eoc(&p); /* For wrapper object */
+        }
     }
     else {
-	total_length = ASN1_object_size(encoding, body_length, tag_number);
-	str = rb_str_new(NULL, total_length);
-	p = (unsigned char *)RSTRING_PTR(str);
-	ASN1_put_object(&p, encoding, body_length, tag_number, tag_class);
-	memcpy(p, RSTRING_PTR(body), body_length);
-	p += body_length;
-	if (indef_len)
-	    ASN1_put_eoc(&p);
+        total_length = ASN1_object_size(encoding, body_length, tag_number);
+        str = rb_str_new(NULL, total_length);
+        p = (unsigned char *)RSTRING_PTR(str);
+        ASN1_put_object(&p, encoding, body_length, tag_number, tag_class);
+        memcpy(p, RSTRING_PTR(body), body_length);
+        p += body_length;
+        if (indef_len)
+            ASN1_put_eoc(&p);
     }
     assert(p - (unsigned char *)RSTRING_PTR(str) == total_length);
     return str;
@@ -696,18 +742,22 @@ ossl_asn1data_to_der(VALUE self)
     VALUE value = ossl_asn1_get_value(self);
 
     if (rb_obj_is_kind_of(value, rb_cArray))
-	return ossl_asn1cons_to_der(self);
+        return ossl_asn1cons_to_der(self);
     else {
-	if (RTEST(ossl_asn1_get_indefinite_length(self)))
-	    ossl_raise(eASN1Error, "indefinite length form cannot be used " \
-		       "with primitive encoding");
-	return ossl_asn1prim_to_der(self);
+        if (RTEST(ossl_asn1_get_indefinite_length(self)))
+            ossl_raise(eASN1Error, "indefinite length form cannot be used " \
+                       "with primitive encoding");
+        return ossl_asn1prim_to_der(self);
     }
 }
 
+static VALUE ossl_asn1_initialize(int argc, VALUE *argv, VALUE self);
+static VALUE ossl_asn1_decode0(unsigned char **pp, long length, long *offset,
+                               int depth, int yield, long *num_read);
+
 static VALUE
 int_ossl_asn1_decode0_prim(unsigned char **pp, long length, long hlen, int tag,
-			   VALUE tc, long *num_read)
+                           VALUE tc, long *num_read)
 {
     VALUE value, asn1data;
     unsigned char *p;
@@ -716,63 +766,64 @@ int_ossl_asn1_decode0_prim(unsigned char **pp, long length, long hlen, int tag,
     p = *pp;
 
     if(tc == sym_UNIVERSAL && tag < ossl_asn1_info_size) {
-	switch(tag){
-	case V_ASN1_EOC:
-	    value = decode_eoc(p, hlen+length);
-	    break;
-	case V_ASN1_BOOLEAN:
-	    value = decode_bool(p, hlen+length);
-	    break;
-	case V_ASN1_INTEGER:
-	    value = decode_int(p, hlen+length);
-	    break;
-	case V_ASN1_BIT_STRING:
-	    value = decode_bstr(p, hlen+length, &flag);
-	    break;
-	case V_ASN1_NULL:
-	    value = decode_null(p, hlen+length);
-	    break;
-	case V_ASN1_ENUMERATED:
-	    value = decode_enum(p, hlen+length);
-	    break;
-	case V_ASN1_OBJECT:
-	    value = decode_obj(p, hlen+length);
-	    break;
-	case V_ASN1_UTCTIME:           /* FALLTHROUGH */
-	case V_ASN1_GENERALIZEDTIME:
-	    value = decode_time(p, hlen+length);
-	    break;
-	default:
-	    /* use original value */
-	    p += hlen;
-	    value = rb_str_new((const char *)p, length);
-	    break;
-	}
+        switch(tag){
+          case V_ASN1_EOC:
+            value = decode_eoc(p, hlen+length);
+            break;
+          case V_ASN1_BOOLEAN:
+            value = decode_bool(p, hlen+length);
+            break;
+          case V_ASN1_INTEGER:
+            value = decode_int(p, hlen+length);
+            break;
+          case V_ASN1_BIT_STRING:
+            value = decode_bstr(p, hlen+length, &flag);
+            break;
+          case V_ASN1_NULL:
+            value = decode_null(p, hlen+length);
+            break;
+          case V_ASN1_ENUMERATED:
+            value = decode_enum(p, hlen+length);
+            break;
+          case V_ASN1_OBJECT:
+            value = decode_obj(p, hlen+length);
+            break;
+          case V_ASN1_UTCTIME:           /* FALLTHROUGH */
+          case V_ASN1_GENERALIZEDTIME:
+            value = decode_time(p, hlen+length);
+            break;
+          default:
+            /* use original value */
+            p += hlen;
+            value = rb_str_new((const char *)p, length);
+            break;
+        }
     }
     else {
-	p += hlen;
-	value = rb_str_new((const char *)p, length);
+        p += hlen;
+        value = rb_str_new((const char *)p, length);
     }
 
     *pp += hlen + length;
     *num_read = hlen + length;
 
     if (tc == sym_UNIVERSAL &&
-	tag < ossl_asn1_info_size && ossl_asn1_info[tag].klass) {
-	VALUE klass = *ossl_asn1_info[tag].klass;
-	if (tag == V_ASN1_EOC)
-	    asn1data = rb_funcall(cASN1EndOfContent, rb_intern("new"), 0);
-	else {
-	    VALUE args[4] = { value, INT2NUM(tag), Qnil, tc };
-	    asn1data = rb_funcallv_public(klass, rb_intern("new"), 4, args);
-	}
-	if(tag == V_ASN1_BIT_STRING){
-	    rb_ivar_set(asn1data, sivUNUSED_BITS, LONG2NUM(flag));
-	}
+        tag < ossl_asn1_info_size && ossl_asn1_info[tag].klass) {
+        VALUE klass = *ossl_asn1_info[tag].klass;
+        VALUE args[4];
+        args[0] = value;
+        args[1] = INT2NUM(tag);
+        args[2] = Qnil;
+        args[3] = tc;
+        asn1data = rb_obj_alloc(klass);
+        ossl_asn1_initialize(4, args, asn1data);
+        if(tag == V_ASN1_BIT_STRING){
+            rb_ivar_set(asn1data, sivUNUSED_BITS, LONG2NUM(flag));
+        }
     }
     else {
-        VALUE args[3] = { value, INT2NUM(tag), tc };
-        asn1data = rb_funcallv_public(cASN1Data, rb_intern("new"), 3, args);
+        asn1data = rb_obj_alloc(cASN1Data);
+        ossl_asn1data_initialize(asn1data, value, INT2NUM(tag), tc);
     }
 
     return asn1data;
@@ -780,8 +831,8 @@ int_ossl_asn1_decode0_prim(unsigned char **pp, long length, long hlen, int tag,
 
 static VALUE
 int_ossl_asn1_decode0_cons(unsigned char **pp, long max_len, long length,
-			   long *offset, int depth, int yield, int j,
-			   int tag, VALUE tc, long *num_read)
+                           long *offset, int depth, int yield, int j,
+                           int tag, VALUE tc, long *num_read)
 {
     VALUE value, asn1data, ary;
     int indefinite;
@@ -792,40 +843,42 @@ int_ossl_asn1_decode0_cons(unsigned char **pp, long max_len, long length,
 
     available_len = indefinite ? max_len : length;
     while (available_len > 0) {
-	long inner_read = 0;
-	value = ossl_asn1_decode0(pp, available_len, &off, depth + 1, yield, &inner_read);
-	*num_read += inner_read;
-	available_len -= inner_read;
-
-	if (indefinite &&
-	    ossl_asn1_tag(value) == V_ASN1_EOC &&
-	    ossl_asn1_get_tag_class(value) == sym_UNIVERSAL) {
-	    break;
-	}
-	rb_ary_push(ary, value);
+        long inner_read = 0;
+        value = ossl_asn1_decode0(pp, available_len, &off, depth + 1, yield, &inner_read);
+        *num_read += inner_read;
+        available_len -= inner_read;
+
+        if (indefinite) {
+            if (ossl_asn1_tag(value) == V_ASN1_EOC &&
+                ossl_asn1_get_tag_class(value) == sym_UNIVERSAL)
+                break;
+            if (available_len == 0)
+                ossl_raise(eASN1Error, "EOC missing in indefinite length encoding");
+        }
+        rb_ary_push(ary, value);
     }
 
     if (tc == sym_UNIVERSAL) {
-        if (tag == V_ASN1_SEQUENCE) {
-            VALUE args[4] = { ary, INT2NUM(tag), Qnil, tc };
-            asn1data = rb_funcallv_public(cASN1Sequence, rb_intern("new"), 4, args);
-        } else if (tag == V_ASN1_SET) {
-            VALUE args[4] = { ary, INT2NUM(tag), Qnil, tc };
-            asn1data = rb_funcallv_public(cASN1Set, rb_intern("new"), 4, args);
-        } else {
-            VALUE args[4] = { ary, INT2NUM(tag), Qnil, tc };
-            asn1data = rb_funcallv_public(cASN1Constructive, rb_intern("new"), 4, args);
-        }
+        VALUE args[4];
+        if (tag == V_ASN1_SEQUENCE || tag == V_ASN1_SET)
+            asn1data = rb_obj_alloc(*ossl_asn1_info[tag].klass);
+        else
+            asn1data = rb_obj_alloc(cASN1Constructive);
+        args[0] = ary;
+        args[1] = INT2NUM(tag);
+        args[2] = Qnil;
+        args[3] = tc;
+        ossl_asn1_initialize(4, args, asn1data);
     }
     else {
-        VALUE args[3] = {ary, INT2NUM(tag), tc};
-        asn1data = rb_funcallv_public(cASN1Data, rb_intern("new"), 3, args);
+        asn1data = rb_obj_alloc(cASN1Data);
+        ossl_asn1data_initialize(asn1data, ary, INT2NUM(tag), tc);
     }
 
     if (indefinite)
-	ossl_asn1_set_indefinite_length(asn1data, Qtrue);
+        ossl_asn1_set_indefinite_length(asn1data, Qtrue);
     else
-	ossl_asn1_set_indefinite_length(asn1data, Qfalse);
+        ossl_asn1_set_indefinite_length(asn1data, Qfalse);
 
     *offset = off;
     return asn1data;
@@ -833,7 +886,7 @@ int_ossl_asn1_decode0_cons(unsigned char **pp, long max_len, long length,
 
 static VALUE
 ossl_asn1_decode0(unsigned char **pp, long length, long *offset, int depth,
-		  int yield, long *num_read)
+                  int yield, long *num_read)
 {
     unsigned char *start, *p;
     const unsigned char *p0;
@@ -849,46 +902,46 @@ ossl_asn1_decode0(unsigned char **pp, long length, long *offset, int depth,
     if(j & 0x80) ossl_raise(eASN1Error, NULL);
     if(len > length) ossl_raise(eASN1Error, "value is too short");
     if((tc & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-	tag_class = sym_PRIVATE;
+        tag_class = sym_PRIVATE;
     else if((tc & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-	tag_class = sym_CONTEXT_SPECIFIC;
+        tag_class = sym_CONTEXT_SPECIFIC;
     else if((tc & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-	tag_class = sym_APPLICATION;
+        tag_class = sym_APPLICATION;
     else
-	tag_class = sym_UNIVERSAL;
+        tag_class = sym_UNIVERSAL;
 
     hlen = p - start;
 
     if(yield) {
-	VALUE arg = rb_ary_new();
-	rb_ary_push(arg, LONG2NUM(depth));
-	rb_ary_push(arg, LONG2NUM(*offset));
-	rb_ary_push(arg, LONG2NUM(hlen));
-	rb_ary_push(arg, LONG2NUM(len));
-	rb_ary_push(arg, (j & V_ASN1_CONSTRUCTED) ? Qtrue : Qfalse);
-	rb_ary_push(arg, ossl_asn1_class2sym(tc));
-	rb_ary_push(arg, INT2NUM(tag));
-	rb_yield(arg);
+        VALUE arg = rb_ary_new();
+        rb_ary_push(arg, LONG2NUM(depth));
+        rb_ary_push(arg, LONG2NUM(*offset));
+        rb_ary_push(arg, LONG2NUM(hlen));
+        rb_ary_push(arg, LONG2NUM(len));
+        rb_ary_push(arg, (j & V_ASN1_CONSTRUCTED) ? Qtrue : Qfalse);
+        rb_ary_push(arg, ossl_asn1_class2sym(tc));
+        rb_ary_push(arg, INT2NUM(tag));
+        rb_yield(arg);
     }
 
     if(j & V_ASN1_CONSTRUCTED) {
-	*pp += hlen;
-	off += hlen;
-	asn1data = int_ossl_asn1_decode0_cons(pp, length - hlen, len, &off, depth, yield, j, tag, tag_class, &inner_read);
-	inner_read += hlen;
+        *pp += hlen;
+        off += hlen;
+        asn1data = int_ossl_asn1_decode0_cons(pp, length - hlen, len, &off, depth, yield, j, tag, tag_class, &inner_read);
+        inner_read += hlen;
     }
     else {
-	if ((j & 0x01) && (len == 0))
-	    ossl_raise(eASN1Error, "indefinite length for primitive value");
-	asn1data = int_ossl_asn1_decode0_prim(pp, len, hlen, tag, tag_class, &inner_read);
-	off += hlen + len;
+        if ((j & 0x01) && (len == 0))
+            ossl_raise(eASN1Error, "indefinite length for primitive value");
+        asn1data = int_ossl_asn1_decode0_prim(pp, len, hlen, tag, tag_class, &inner_read);
+        off += hlen + len;
     }
     if (num_read)
-	*num_read = inner_read;
+        *num_read = inner_read;
     if (len != 0 && inner_read != hlen + len) {
-	ossl_raise(eASN1Error,
-		   "Type mismatch. Bytes read: %ld Bytes available: %ld",
-		   inner_read, hlen + len);
+        ossl_raise(eASN1Error,
+                   "Type mismatch. Bytes read: %ld Bytes available: %ld",
+                   inner_read, hlen + len);
     }
 
     *offset = off;
@@ -899,9 +952,9 @@ static void
 int_ossl_decode_sanity_check(long len, long read, long offset)
 {
     if (len != 0 && (read != len || offset != len)) {
-	ossl_raise(eASN1Error,
-		   "Type mismatch. Total bytes read: %ld Bytes available: %ld Offset: %ld",
-		   read, len, offset);
+        ossl_raise(eASN1Error,
+                   "Type mismatch. Total bytes read: %ld Bytes available: %ld Offset: %ld",
+                   read, len, offset);
     }
 }
 
@@ -1001,17 +1054,94 @@ ossl_asn1_decode_all(VALUE self, VALUE obj)
     tmp_len = len;
     ary = rb_ary_new();
     while (tmp_len > 0) {
-	long tmp_read = 0;
-	val = ossl_asn1_decode0(&p, tmp_len, &offset, 0, 0, &tmp_read);
-	rb_ary_push(ary, val);
-	read += tmp_read;
-	tmp_len -= tmp_read;
+        long tmp_read = 0;
+        val = ossl_asn1_decode0(&p, tmp_len, &offset, 0, 0, &tmp_read);
+        rb_ary_push(ary, val);
+        read += tmp_read;
+        tmp_len -= tmp_read;
     }
     RB_GC_GUARD(tmp);
     int_ossl_decode_sanity_check(len, read, offset);
     return ary;
 }
 
+/*
+ * call-seq:
+ *    OpenSSL::ASN1::Primitive.new(value [, tag, tagging, tag_class ]) => Primitive
+ *
+ * _value_: is mandatory.
+ *
+ * _tag_: optional, may be specified for tagged values. If no _tag_ is
+ * specified, the UNIVERSAL tag corresponding to the Primitive sub-class
+ * is used by default.
+ *
+ * _tagging_: may be used as an encoding hint to encode a value either
+ * explicitly or implicitly, see ASN1 for possible values.
+ *
+ * _tag_class_: if _tag_ and _tagging_ are +nil+ then this is set to
+ * +:UNIVERSAL+ by default. If either _tag_ or _tagging_ are set then
+ * +:CONTEXT_SPECIFIC+ is used as the default. For possible values please
+ * cf. ASN1.
+ *
+ * == Example
+ *   int = OpenSSL::ASN1::Integer.new(42)
+ *   zero_tagged_int = OpenSSL::ASN1::Integer.new(42, 0, :IMPLICIT)
+ *   private_explicit_zero_tagged_int = OpenSSL::ASN1::Integer.new(42, 0, :EXPLICIT, :PRIVATE)
+ */
+static VALUE
+ossl_asn1_initialize(int argc, VALUE *argv, VALUE self)
+{
+    VALUE value, tag, tagging, tag_class;
+    int default_tag;
+
+    rb_scan_args(argc, argv, "13", &value, &tag, &tagging, &tag_class);
+    default_tag = ossl_asn1_default_tag(self);
+
+    if (default_tag == -1 || argc > 1) {
+        if(NIL_P(tag))
+            ossl_raise(eASN1Error, "must specify tag number");
+        if(!NIL_P(tagging) && !SYMBOL_P(tagging))
+            ossl_raise(eASN1Error, "invalid tagging method");
+        if(NIL_P(tag_class)) {
+            if (NIL_P(tagging))
+                tag_class = sym_UNIVERSAL;
+            else
+                tag_class = sym_CONTEXT_SPECIFIC;
+        }
+        if(!SYMBOL_P(tag_class))
+            ossl_raise(eASN1Error, "invalid tag class");
+    }
+    else{
+        tag = INT2NUM(default_tag);
+        tagging = Qnil;
+        tag_class = sym_UNIVERSAL;
+    }
+    ossl_asn1_set_tag(self, tag);
+    ossl_asn1_set_value(self, value);
+    ossl_asn1_set_tagging(self, tagging);
+    ossl_asn1_set_tag_class(self, tag_class);
+    ossl_asn1_set_indefinite_length(self, Qfalse);
+    if (default_tag == V_ASN1_BIT_STRING)
+        rb_ivar_set(self, sivUNUSED_BITS, INT2FIX(0));
+
+    return self;
+}
+
+static VALUE
+ossl_asn1eoc_initialize(VALUE self) {
+    VALUE tag, tagging, tag_class, value;
+    tag = INT2FIX(0);
+    tagging = Qnil;
+    tag_class = sym_UNIVERSAL;
+    value = rb_str_new("", 0);
+    ossl_asn1_set_tag(self, tag);
+    ossl_asn1_set_value(self, value);
+    ossl_asn1_set_tagging(self, tagging);
+    ossl_asn1_set_tag_class(self, tag_class);
+    ossl_asn1_set_indefinite_length(self, Qfalse);
+    return self;
+}
+
 static VALUE
 ossl_asn1eoc_to_der(VALUE self)
 {
@@ -1034,20 +1164,20 @@ ossl_asn1prim_to_der(VALUE self)
     VALUE str;
 
     if (ossl_asn1_default_tag(self) == -1) {
-	str = ossl_asn1_get_value(self);
-	return to_der_internal(self, 0, 0, StringValue(str));
+        str = ossl_asn1_get_value(self);
+        return to_der_internal(self, 0, 0, StringValue(str));
     }
 
     asn1 = ossl_asn1_get_asn1type(self);
     alllen = i2d_ASN1_TYPE(asn1, NULL);
     if (alllen < 0) {
-	ASN1_TYPE_free(asn1);
-	ossl_raise(eASN1Error, "i2d_ASN1_TYPE");
+        ASN1_TYPE_free(asn1);
+        ossl_raise(eASN1Error, "i2d_ASN1_TYPE");
     }
     str = ossl_str_new(NULL, alllen, &state);
     if (state) {
-	ASN1_TYPE_free(asn1);
-	rb_jump_tag(state);
+        ASN1_TYPE_free(asn1);
+        rb_jump_tag(state);
     }
     p0 = p1 = (unsigned char *)RSTRING_PTR(str);
     if (i2d_ASN1_TYPE(asn1, &p0) < 0) {
@@ -1060,7 +1190,7 @@ ossl_asn1prim_to_der(VALUE self)
     /* Strip header since to_der_internal() wants only the payload */
     j = ASN1_get_object((const unsigned char **)&p1, &bodylen, &tag, &tc, alllen);
     if (j & 0x80)
-	ossl_raise(eASN1Error, "ASN1_get_object"); /* should not happen */
+        ossl_raise(eASN1Error, "ASN1_get_object"); /* should not happen */
 
     return to_der_internal(self, 0, 0, rb_str_drop_bytes(str, alllen - bodylen));
 }
@@ -1082,27 +1212,48 @@ ossl_asn1cons_to_der(VALUE self)
     ary = rb_convert_type(ossl_asn1_get_value(self), T_ARRAY, "Array", "to_a");
     str = rb_str_new(NULL, 0);
     for (i = 0; i < RARRAY_LEN(ary); i++) {
-	VALUE item = RARRAY_AREF(ary, i);
-
-	if (indef_len && rb_obj_is_kind_of(item, cASN1EndOfContent)) {
-	    if (i != RARRAY_LEN(ary) - 1)
-		ossl_raise(eASN1Error, "illegal EOC octets in value");
-
-	    /*
-	     * EOC is not really part of the content, but we required to add one
-	     * at the end in the past.
-	     */
-	    break;
-	}
-
-	item = ossl_to_der_if_possible(item);
-	StringValue(item);
-	rb_str_append(str, item);
+        VALUE item = RARRAY_AREF(ary, i);
+
+        if (indef_len && rb_obj_is_kind_of(item, cASN1EndOfContent)) {
+            if (i != RARRAY_LEN(ary) - 1)
+                ossl_raise(eASN1Error, "illegal EOC octets in value");
+
+            /*
+             * EOC is not really part of the content, but we required to add one
+             * at the end in the past.
+             */
+            break;
+        }
+
+        item = ossl_to_der_if_possible(item);
+        StringValue(item);
+        rb_str_append(str, item);
     }
 
     return to_der_internal(self, 1, indef_len, str);
 }
 
+/*
+ * call-seq:
+ *    asn1_ary.each { |asn1| block } => asn1_ary
+ *
+ * Calls the given block once for each element in self, passing that element
+ * as parameter _asn1_. If no block is given, an enumerator is returned
+ * instead.
+ *
+ * == Example
+ *   asn1_ary.each do |asn1|
+ *     puts asn1
+ *   end
+ */
+static VALUE
+ossl_asn1cons_each(VALUE self)
+{
+    rb_block_call(ossl_asn1_get_value(self), id_each, 0, 0, 0, 0);
+
+    return self;
+}
+
 /*
  * call-seq:
  *    OpenSSL::ASN1::ObjectId.register(object_id, short_name, long_name)
@@ -1122,7 +1273,7 @@ ossl_asn1obj_s_register(VALUE self, VALUE oid, VALUE sn, VALUE ln)
     StringValueCStr(ln);
 
     if(!OBJ_create(RSTRING_PTR(oid), RSTRING_PTR(sn), RSTRING_PTR(ln)))
-	ossl_raise(eASN1Error, NULL);
+        ossl_raise(eASN1Error, NULL);
 
     return Qtrue;
 }
@@ -1142,7 +1293,7 @@ ossl_asn1obj_get_sn(VALUE self)
 
     val = ossl_asn1_get_value(self);
     if ((nid = OBJ_txt2nid(StringValueCStr(val))) != NID_undef)
-	ret = rb_str_new2(OBJ_nid2sn(nid));
+        ret = rb_str_new2(OBJ_nid2sn(nid));
 
     return ret;
 }
@@ -1162,7 +1313,7 @@ ossl_asn1obj_get_ln(VALUE self)
 
     val = ossl_asn1_get_value(self);
     if ((nid = OBJ_txt2nid(StringValueCStr(val))) != NID_undef)
-	ret = rb_str_new2(OBJ_nid2ln(nid));
+        ret = rb_str_new2(OBJ_nid2ln(nid));
 
     return ret;
 }
@@ -1170,23 +1321,7 @@ ossl_asn1obj_get_ln(VALUE self)
 static VALUE
 asn1obj_get_oid_i(VALUE vobj)
 {
-    ASN1_OBJECT *a1obj = (void *)vobj;
-    VALUE str;
-    int len;
-
-    str = rb_usascii_str_new(NULL, 127);
-    len = OBJ_obj2txt(RSTRING_PTR(str), RSTRING_LENINT(str), a1obj, 1);
-    if (len <= 0 || len == INT_MAX)
-	ossl_raise(eASN1Error, "OBJ_obj2txt");
-    if (len > RSTRING_LEN(str)) {
-	/* +1 is for the \0 terminator added by OBJ_obj2txt() */
-	rb_str_resize(str, len + 1);
-	len = OBJ_obj2txt(RSTRING_PTR(str), len + 1, a1obj, 1);
-	if (len <= 0)
-	    ossl_raise(eASN1Error, "OBJ_obj2txt");
-    }
-    rb_str_set_len(str, len);
-    return str;
+    return ossl_asn1obj_to_string_oid((const ASN1_OBJECT *)vobj);
 }
 
 /*
@@ -1203,11 +1338,11 @@ ossl_asn1obj_get_oid(VALUE self)
     ASN1_OBJECT *a1obj;
     int state;
 
-    a1obj = obj_to_asn1obj(ossl_asn1_get_value(self));
+    a1obj = ossl_to_asn1obj(ossl_asn1_get_value(self));
     str = rb_protect(asn1obj_get_oid_i, (VALUE)a1obj, &state);
     ASN1_OBJECT_free(a1obj);
     if (state)
-	rb_jump_tag(state);
+        rb_jump_tag(state);
     return str;
 }
 
@@ -1232,7 +1367,7 @@ ossl_asn1obj_eq(VALUE self, VALUE other)
 
 #define OSSL_ASN1_IMPL_FACTORY_METHOD(klass) \
 static VALUE ossl_asn1_##klass(int argc, VALUE *argv, VALUE self)\
-{ return rb_funcallv_public(cASN1##klass, rb_intern("new"), argc, argv); }
+{ return rb_funcall3(cASN1##klass, rb_intern("new"), argc, argv); }
 
 OSSL_ASN1_IMPL_FACTORY_METHOD(Boolean)
 OSSL_ASN1_IMPL_FACTORY_METHOD(Integer)
@@ -1262,13 +1397,6 @@ void
 Init_ossl_asn1(void)
 {
 #undef rb_intern
-    VALUE ary;
-    int i;
-
-#if 0
-    mOSSL = rb_define_module("OpenSSL");
-    eOSSLError = rb_define_class_under(mOSSL, "OpenSSLError", rb_eStandardError);
-#endif
 
     sym_UNIVERSAL = ID2SYM(rb_intern_const("UNIVERSAL"));
     sym_CONTEXT_SPECIFIC = ID2SYM(rb_intern_const("CONTEXT_SPECIFIC"));
@@ -1418,17 +1546,20 @@ Init_ossl_asn1(void)
     rb_define_module_function(mASN1, "traverse", ossl_asn1_traverse, 1);
     rb_define_module_function(mASN1, "decode", ossl_asn1_decode, 1);
     rb_define_module_function(mASN1, "decode_all", ossl_asn1_decode_all, 1);
-    ary = rb_ary_new();
 
+    VALUE ary = rb_ary_new_capa(ossl_asn1_info_size);
+    for (int i = 0; i < ossl_asn1_info_size; i++) {
+        const char *name = ossl_asn1_info[i].name;
+        if (name[0] == '[')
+            continue;
+        rb_define_const(mASN1, name, INT2NUM(i));
+        rb_ary_store(ary, i, rb_obj_freeze(rb_str_new_cstr(name)));
+    }
+    rb_obj_freeze(ary);
     /*
      * Array storing tag names at the tag's index.
      */
     rb_define_const(mASN1, "UNIVERSAL_TAG_NAME", ary);
-    for(i = 0; i < ossl_asn1_info_size; i++){
-	if(ossl_asn1_info[i].name[0] == '[') continue;
-	rb_define_const(mASN1, ossl_asn1_info[i].name, INT2NUM(i));
-	rb_ary_store(ary, i, rb_str_new2(ossl_asn1_info[i].name));
-    }
 
     /* Document-class: OpenSSL::ASN1::ASN1Data
      *
@@ -1518,6 +1649,42 @@ Init_ossl_asn1(void)
      *   puts int2.value # => 1
      */
     cASN1Data = rb_define_class_under(mASN1, "ASN1Data", rb_cObject);
+    /*
+     * Carries the value of a ASN.1 type.
+     * Please confer Constructive and Primitive for the mappings between
+     * ASN.1 data types and Ruby classes.
+     */
+    rb_attr(cASN1Data, rb_intern("value"), 1, 1, 0);
+    /*
+     * An Integer representing the tag number of this ASN1Data. Never +nil+.
+     */
+    rb_attr(cASN1Data, rb_intern("tag"), 1, 1, 0);
+    /*
+     * A Symbol representing the tag class of this ASN1Data. Never +nil+.
+     * See ASN1Data for possible values.
+     */
+    rb_attr(cASN1Data, rb_intern("tag_class"), 1, 1, 0);
+    /*
+     * Never +nil+. A boolean value indicating whether the encoding uses
+     * indefinite length (in the case of parsing) or whether an indefinite
+     * length form shall be used (in the encoding case).
+     * In DER, every value uses definite length form. But in scenarios where
+     * large amounts of data need to be transferred it might be desirable to
+     * have some kind of streaming support available.
+     * For example, huge OCTET STRINGs are preferably sent in smaller-sized
+     * chunks, each at a time.
+     * This is possible in BER by setting the length bytes of an encoding
+     * to zero and by this indicating that the following value will be
+     * sent in chunks. Indefinite length encodings are always constructed.
+     * The end of such a stream of chunks is indicated by sending a EOC
+     * (End of Content) tag. SETs and SEQUENCEs may use an indefinite length
+     * encoding, but also primitive types such as e.g. OCTET STRINGS or
+     * BIT STRINGS may leverage this functionality (cf. ITU-T X.690).
+     */
+    rb_attr(cASN1Data, rb_intern("indefinite_length"), 1, 1, 0);
+    rb_define_alias(cASN1Data, "infinite_length", "indefinite_length");
+    rb_define_alias(cASN1Data, "infinite_length=", "indefinite_length=");
+    rb_define_method(cASN1Data, "initialize", ossl_asn1data_initialize, 3);
     rb_define_method(cASN1Data, "to_der", ossl_asn1data_to_der, 0);
 
     /* Document-class: OpenSSL::ASN1::Primitive
@@ -1585,6 +1752,16 @@ Init_ossl_asn1(void)
      *   prim_zero_tagged_explicit = <class>.new(value, 0, :EXPLICIT)
      */
     cASN1Primitive = rb_define_class_under(mASN1, "Primitive", cASN1Data);
+    /*
+     * May be used as a hint for encoding a value either implicitly or
+     * explicitly by setting it either to +:IMPLICIT+ or to +:EXPLICIT+.
+     * _tagging_ is not set when a ASN.1 structure is parsed using
+     * OpenSSL::ASN1.decode.
+     */
+    rb_attr(cASN1Primitive, rb_intern("tagging"), 1, 1, Qtrue);
+    rb_undef_method(cASN1Primitive, "indefinite_length=");
+    rb_undef_method(cASN1Primitive, "infinite_length=");
+    rb_define_method(cASN1Primitive, "initialize", ossl_asn1_initialize, -1);
     rb_define_method(cASN1Primitive, "to_der", ossl_asn1prim_to_der, 0);
 
     /* Document-class: OpenSSL::ASN1::Constructive
@@ -1615,7 +1792,17 @@ Init_ossl_asn1(void)
      *   set = OpenSSL::ASN1::Set.new( [ int, str ] )
      */
     cASN1Constructive = rb_define_class_under(mASN1,"Constructive", cASN1Data);
+    rb_include_module(cASN1Constructive, rb_mEnumerable);
+    /*
+     * May be used as a hint for encoding a value either implicitly or
+     * explicitly by setting it either to +:IMPLICIT+ or to +:EXPLICIT+.
+     * _tagging_ is not set when a ASN.1 structure is parsed using
+     * OpenSSL::ASN1.decode.
+     */
+    rb_attr(cASN1Constructive, rb_intern("tagging"), 1, 1, Qtrue);
+    rb_define_method(cASN1Constructive, "initialize", ossl_asn1_initialize, -1);
     rb_define_method(cASN1Constructive, "to_der", ossl_asn1cons_to_der, 0);
+    rb_define_method(cASN1Constructive, "each", ossl_asn1cons_each, 0);
 
 #define OSSL_ASN1_DEFINE_CLASS(name, super) \
 do{\
@@ -1664,10 +1851,13 @@ do{\
     rb_define_alias(cASN1ObjectId, "short_name", "sn");
     rb_define_alias(cASN1ObjectId, "long_name", "ln");
     rb_define_method(cASN1ObjectId, "==", ossl_asn1obj_eq, 1);
+    rb_attr(cASN1BitString, rb_intern("unused_bits"), 1, 1, 0);
 
+    rb_define_method(cASN1EndOfContent, "initialize", ossl_asn1eoc_initialize, 0);
     rb_define_method(cASN1EndOfContent, "to_der", ossl_asn1eoc_to_der, 0);
 
     class_tag_map = rb_hash_new();
+    rb_gc_register_mark_object(class_tag_map);
     rb_hash_aset(class_tag_map, cASN1EndOfContent, INT2NUM(V_ASN1_EOC));
     rb_hash_aset(class_tag_map, cASN1Boolean, INT2NUM(V_ASN1_BOOLEAN));
     rb_hash_aset(class_tag_map, cASN1Integer, INT2NUM(V_ASN1_INTEGER));
@@ -1691,5 +1881,7 @@ do{\
     rb_hash_aset(class_tag_map, cASN1GeneralString, INT2NUM(V_ASN1_GENERALSTRING));
     rb_hash_aset(class_tag_map, cASN1UniversalString, INT2NUM(V_ASN1_UNIVERSALSTRING));
     rb_hash_aset(class_tag_map, cASN1BMPString, INT2NUM(V_ASN1_BMPSTRING));
-    rb_define_const(mASN1, "CLASS_TAG_MAP", class_tag_map);
+    rb_obj_freeze(class_tag_map);
+
+    id_each = rb_intern_const("each");
 }