openssl 3.3.3 → 4.0.2

data/ext/openssl/ossl_ssl.h

@@ -11,17 +11,17 @@
 #define _OSSL_SSL_H_
 
 #define GetSSL(obj, ssl) do { \
-	TypedData_Get_Struct((obj), SSL, &ossl_ssl_type, (ssl)); \
-	if (!(ssl)) { \
-		ossl_raise(rb_eRuntimeError, "SSL is not initialized"); \
-	} \
+    TypedData_Get_Struct((obj), SSL, &ossl_ssl_type, (ssl)); \
+    if (!(ssl)) { \
+        ossl_raise(rb_eRuntimeError, "SSL is not initialized"); \
+    } \
 } while (0)
 
 #define GetSSLSession(obj, sess) do { \
-	TypedData_Get_Struct((obj), SSL_SESSION, &ossl_ssl_session_type, (sess)); \
-	if (!(sess)) { \
-		ossl_raise(rb_eRuntimeError, "SSL Session wasn't initialized."); \
-	} \
+    TypedData_Get_Struct((obj), SSL_SESSION, &ossl_ssl_session_type, (sess)); \
+    if (!(sess)) { \
+        ossl_raise(rb_eRuntimeError, "SSL Session wasn't initialized."); \
+    } \
 } while (0)
 
 extern const rb_data_type_t ossl_ssl_type;

data/ext/openssl/ossl_ssl_session.c

@@ -17,14 +17,14 @@ ossl_ssl_session_free(void *ptr)
 const rb_data_type_t ossl_ssl_session_type = {
     "OpenSSL/SSL/Session",
     {
-	0, ossl_ssl_session_free,
+        0, ossl_ssl_session_free,
     },
     0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
 };
 
 static VALUE ossl_ssl_session_alloc(VALUE klass)
 {
-	return TypedData_Wrap_Struct(klass, &ossl_ssl_session_type, NULL);
+    return TypedData_Wrap_Struct(klass, &ossl_ssl_session_type, NULL);
 }
 
 /*
@@ -69,6 +69,7 @@ ossl_ssl_session_initialize(VALUE self, VALUE arg1)
     return self;
 }
 
+/* :nodoc: */
 static VALUE
 ossl_ssl_session_initialize_copy(VALUE self, VALUE other)
 {
@@ -79,9 +80,9 @@ ossl_ssl_session_initialize_copy(VALUE self, VALUE other)
     GetSSLSession(other, sess_other);
 
     sess_new = ASN1_dup((i2d_of_void *)i2d_SSL_SESSION, (d2i_of_void *)d2i_SSL_SESSION,
-			(char *)sess_other);
+                        (char *)sess_other);
     if (!sess_new)
-	ossl_raise(eSSLSession, "ASN1_dup");
+        ossl_raise(eSSLSession, "ASN1_dup");
 
     RTYPEDDATA_DATA(self) = sess_new;
     SSL_SESSION_free(sess);
@@ -98,9 +99,9 @@ ossl_SSL_SESSION_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
     const unsigned char *b_sid = SSL_SESSION_get_id(b, &b_len);
 
     if (SSL_SESSION_get_protocol_version(a) != SSL_SESSION_get_protocol_version(b))
-	return 1;
+        return 1;
     if (a_len != b_len)
-	return 1;
+        return 1;
 
     return CRYPTO_memcmp(a_sid, b_sid, a_len);
 }
@@ -113,15 +114,15 @@ ossl_SSL_SESSION_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
  */
 static VALUE ossl_ssl_session_eq(VALUE val1, VALUE val2)
 {
-	SSL_SESSION *ctx1, *ctx2;
+    SSL_SESSION *ctx1, *ctx2;
 
-	GetSSLSession(val1, ctx1);
-	GetSSLSession(val2, ctx2);
+    GetSSLSession(val1, ctx1);
+    GetSSLSession(val2, ctx2);
 
-	switch (ossl_SSL_SESSION_cmp(ctx1, ctx2)) {
-	case 0:		return Qtrue;
-	default:	return Qfalse;
-	}
+    switch (ossl_SSL_SESSION_cmp(ctx1, ctx2)) {
+      case 0:         return Qtrue;
+      default:        return Qfalse;
+    }
 }
 
 /*
@@ -139,7 +140,7 @@ ossl_ssl_session_get_time(VALUE self)
     GetSSLSession(self, ctx);
     t = SSL_SESSION_get_time(ctx);
     if (t == 0)
-	return Qnil;
+        return Qnil;
 
     return rb_funcall(rb_cTime, rb_intern("at"), 1, LONG2NUM(t));
 }
@@ -174,16 +175,16 @@ ossl_ssl_session_get_timeout(VALUE self)
  */
 static VALUE ossl_ssl_session_set_time(VALUE self, VALUE time_v)
 {
-	SSL_SESSION *ctx;
-	long t;
-
-	GetSSLSession(self, ctx);
-	if (rb_obj_is_instance_of(time_v, rb_cTime)) {
-		time_v = rb_funcall(time_v, rb_intern("to_i"), 0);
-	}
-	t = NUM2LONG(time_v);
-	SSL_SESSION_set_time(ctx, t);
-	return ossl_ssl_session_get_time(self);
+    SSL_SESSION *ctx;
+    long t;
+
+    GetSSLSession(self, ctx);
+    if (rb_obj_is_instance_of(time_v, rb_cTime)) {
+        time_v = rb_funcall(time_v, rb_intern("to_i"), 0);
+    }
+    t = NUM2LONG(time_v);
+    SSL_SESSION_set_time(ctx, t);
+    return ossl_ssl_session_get_time(self);
 }
 
 /*
@@ -194,13 +195,13 @@ static VALUE ossl_ssl_session_set_time(VALUE self, VALUE time_v)
  */
 static VALUE ossl_ssl_session_set_timeout(VALUE self, VALUE time_v)
 {
-	SSL_SESSION *ctx;
-	long t;
+    SSL_SESSION *ctx;
+    long t;
 
-	GetSSLSession(self, ctx);
-	t = NUM2LONG(time_v);
-	SSL_SESSION_set_timeout(ctx, t);
-	return ossl_ssl_session_get_timeout(self);
+    GetSSLSession(self, ctx);
+    t = NUM2LONG(time_v);
+    SSL_SESSION_set_timeout(ctx, t);
+    return ossl_ssl_session_get_timeout(self);
 }
 
 /*
@@ -208,18 +209,18 @@ static VALUE ossl_ssl_session_set_timeout(VALUE self, VALUE time_v)
  *    session.id -> String
  *
  * Returns the Session ID.
-*/
+ */
 static VALUE ossl_ssl_session_get_id(VALUE self)
 {
-	SSL_SESSION *ctx;
-	const unsigned char *p = NULL;
-	unsigned int i = 0;
+    SSL_SESSION *ctx;
+    const unsigned char *p = NULL;
+    unsigned int i = 0;
 
-	GetSSLSession(self, ctx);
+    GetSSLSession(self, ctx);
 
-	p = SSL_SESSION_get_id(ctx, &i);
+    p = SSL_SESSION_get_id(ctx, &i);
 
-	return rb_str_new((const char *) p, i);
+    return rb_str_new((const char *) p, i);
 }
 
 /*
@@ -230,22 +231,22 @@ static VALUE ossl_ssl_session_get_id(VALUE self)
  */
 static VALUE ossl_ssl_session_to_der(VALUE self)
 {
-	SSL_SESSION *ctx;
-	unsigned char *p;
-	int len;
-	VALUE str;
-
-	GetSSLSession(self, ctx);
-	len = i2d_SSL_SESSION(ctx, NULL);
-	if (len <= 0) {
-		ossl_raise(eSSLSession, "i2d_SSL_SESSION");
-	}
-
-	str = rb_str_new(0, len);
-	p = (unsigned char *)RSTRING_PTR(str);
-	i2d_SSL_SESSION(ctx, &p);
-	ossl_str_adjust(str, p);
-	return str;
+    SSL_SESSION *ctx;
+    unsigned char *p;
+    int len;
+    VALUE str;
+
+    GetSSLSession(self, ctx);
+    len = i2d_SSL_SESSION(ctx, NULL);
+    if (len <= 0) {
+        ossl_raise(eSSLSession, "i2d_SSL_SESSION");
+    }
+
+    str = rb_str_new(0, len);
+    p = (unsigned char *)RSTRING_PTR(str);
+    i2d_SSL_SESSION(ctx, &p);
+    ossl_str_adjust(str, p);
+    return str;
 }
 
 /*
@@ -256,22 +257,22 @@ static VALUE ossl_ssl_session_to_der(VALUE self)
  */
 static VALUE ossl_ssl_session_to_pem(VALUE self)
 {
-	SSL_SESSION *ctx;
-	BIO *out;
+    SSL_SESSION *ctx;
+    BIO *out;
 
-	GetSSLSession(self, ctx);
+    GetSSLSession(self, ctx);
 
-	if (!(out = BIO_new(BIO_s_mem()))) {
-		ossl_raise(eSSLSession, "BIO_s_mem()");
-	}
+    if (!(out = BIO_new(BIO_s_mem()))) {
+        ossl_raise(eSSLSession, "BIO_s_mem()");
+    }
 
-	if (!PEM_write_bio_SSL_SESSION(out, ctx)) {
-		BIO_free(out);
-		ossl_raise(eSSLSession, "SSL_SESSION_print()");
-	}
+    if (!PEM_write_bio_SSL_SESSION(out, ctx)) {
+        BIO_free(out);
+        ossl_raise(eSSLSession, "SSL_SESSION_print()");
+    }
 
 
-	return ossl_membio2str(out);
+    return ossl_membio2str(out);
 }
 
 
@@ -283,49 +284,44 @@ static VALUE ossl_ssl_session_to_pem(VALUE self)
  */
 static VALUE ossl_ssl_session_to_text(VALUE self)
 {
-	SSL_SESSION *ctx;
-	BIO *out;
+    SSL_SESSION *ctx;
+    BIO *out;
 
-	GetSSLSession(self, ctx);
+    GetSSLSession(self, ctx);
 
-	if (!(out = BIO_new(BIO_s_mem()))) {
-		ossl_raise(eSSLSession, "BIO_s_mem()");
-	}
+    if (!(out = BIO_new(BIO_s_mem()))) {
+        ossl_raise(eSSLSession, "BIO_s_mem()");
+    }
 
-	if (!SSL_SESSION_print(out, ctx)) {
-		BIO_free(out);
-		ossl_raise(eSSLSession, "SSL_SESSION_print()");
-	}
+    if (!SSL_SESSION_print(out, ctx)) {
+        BIO_free(out);
+        ossl_raise(eSSLSession, "SSL_SESSION_print()");
+    }
 
-	return ossl_membio2str(out);
+    return ossl_membio2str(out);
 }
 
 #endif /* !defined(OPENSSL_NO_SOCK) */
 
 void Init_ossl_ssl_session(void)
 {
-#if 0
-    mOSSL = rb_define_module("OpenSSL");
-    mSSL = rb_define_module_under(mOSSL, "SSL");
-    eOSSLError = rb_define_class_under(mOSSL, "OpenSSLError", rb_eStandardError);
-#endif
 #ifndef OPENSSL_NO_SOCK
-	cSSLSession = rb_define_class_under(mSSL, "Session", rb_cObject);
-	eSSLSession = rb_define_class_under(cSSLSession, "SessionError", eOSSLError);
-
-	rb_define_alloc_func(cSSLSession, ossl_ssl_session_alloc);
-	rb_define_method(cSSLSession, "initialize", ossl_ssl_session_initialize, 1);
-	rb_define_method(cSSLSession, "initialize_copy", ossl_ssl_session_initialize_copy, 1);
-
-	rb_define_method(cSSLSession, "==", ossl_ssl_session_eq, 1);
-
-	rb_define_method(cSSLSession, "time", ossl_ssl_session_get_time, 0);
-	rb_define_method(cSSLSession, "time=", ossl_ssl_session_set_time, 1);
-	rb_define_method(cSSLSession, "timeout", ossl_ssl_session_get_timeout, 0);
-	rb_define_method(cSSLSession, "timeout=", ossl_ssl_session_set_timeout, 1);
-	rb_define_method(cSSLSession, "id", ossl_ssl_session_get_id, 0);
-	rb_define_method(cSSLSession, "to_der", ossl_ssl_session_to_der, 0);
-	rb_define_method(cSSLSession, "to_pem", ossl_ssl_session_to_pem, 0);
-	rb_define_method(cSSLSession, "to_text", ossl_ssl_session_to_text, 0);
+    cSSLSession = rb_define_class_under(mSSL, "Session", rb_cObject);
+    eSSLSession = rb_define_class_under(cSSLSession, "SessionError", eOSSLError);
+
+    rb_define_alloc_func(cSSLSession, ossl_ssl_session_alloc);
+    rb_define_method(cSSLSession, "initialize", ossl_ssl_session_initialize, 1);
+    rb_define_method(cSSLSession, "initialize_copy", ossl_ssl_session_initialize_copy, 1);
+
+    rb_define_method(cSSLSession, "==", ossl_ssl_session_eq, 1);
+
+    rb_define_method(cSSLSession, "time", ossl_ssl_session_get_time, 0);
+    rb_define_method(cSSLSession, "time=", ossl_ssl_session_set_time, 1);
+    rb_define_method(cSSLSession, "timeout", ossl_ssl_session_get_timeout, 0);
+    rb_define_method(cSSLSession, "timeout=", ossl_ssl_session_set_timeout, 1);
+    rb_define_method(cSSLSession, "id", ossl_ssl_session_get_id, 0);
+    rb_define_method(cSSLSession, "to_der", ossl_ssl_session_to_der, 0);
+    rb_define_method(cSSLSession, "to_pem", ossl_ssl_session_to_pem, 0);
+    rb_define_method(cSSLSession, "to_text", ossl_ssl_session_to_text, 0);
 #endif /* !defined(OPENSSL_NO_SOCK) */
 }

data/ext/openssl/ossl_ts.c

@@ -103,7 +103,7 @@ static  const rb_data_type_t ossl_ts_resp_type = {
 static void
 ossl_ts_token_info_free(void *ptr)
 {
-        TS_TST_INFO_free(ptr);
+    TS_TST_INFO_free(ptr);
 }
 
 static const rb_data_type_t ossl_ts_token_info_type = {
@@ -132,44 +132,10 @@ asn1_to_der(void *template, int (*i2d)(void *template, unsigned char **pp))
     return str;
 }
 
-static ASN1_OBJECT*
-obj_to_asn1obj(VALUE obj)
-{
-    ASN1_OBJECT *a1obj;
-
-    StringValue(obj);
-    a1obj = OBJ_txt2obj(RSTRING_PTR(obj), 0);
-    if(!a1obj) a1obj = OBJ_txt2obj(RSTRING_PTR(obj), 1);
-    if(!a1obj) ossl_raise(eASN1Error, "invalid OBJECT ID");
-
-    return a1obj;
-}
-
 static VALUE
 obj_to_asn1obj_i(VALUE obj)
 {
-    return (VALUE)obj_to_asn1obj(obj);
-}
-
-static VALUE
-get_asn1obj(ASN1_OBJECT *obj)
-{
-    BIO *out;
-    VALUE ret;
-    int nid;
-    if ((nid = OBJ_obj2nid(obj)) != NID_undef)
-        ret = rb_str_new2(OBJ_nid2sn(nid));
-    else{
-        if (!(out = BIO_new(BIO_s_mem())))
-            ossl_raise(eTimestampError, "BIO_new(BIO_s_mem())");
-        if (i2a_ASN1_OBJECT(out, obj) <= 0) {
-            BIO_free(out);
-            ossl_raise(eTimestampError, "i2a_ASN1_OBJECT");
-        }
-        ret = ossl_membio2str(out);
-    }
-
-    return ret;
+    return (VALUE)ossl_to_asn1obj(obj);
 }
 
 static VALUE
@@ -236,11 +202,13 @@ ossl_ts_req_get_algorithm(VALUE self)
     TS_REQ *req;
     TS_MSG_IMPRINT *mi;
     X509_ALGOR *algor;
+    const ASN1_OBJECT *obj;
 
     GetTSRequest(self, req);
     mi = TS_REQ_get_msg_imprint(req);
     algor = TS_MSG_IMPRINT_get_algo(mi);
-    return get_asn1obj(algor->algorithm);
+    X509_ALGOR_get0(&obj, NULL, NULL, algor);
+    return ossl_asn1obj_to_string(obj);
 }
 
 /*
@@ -262,7 +230,7 @@ ossl_ts_req_set_algorithm(VALUE self, VALUE algo)
     X509_ALGOR *algor;
 
     GetTSRequest(self, req);
-    obj = obj_to_asn1obj(algo);
+    obj = ossl_to_asn1obj(algo);
     mi = TS_REQ_get_msg_imprint(req);
     algor = TS_MSG_IMPRINT_get_algo(mi);
     if (!X509_ALGOR_set0(algor, obj, V_ASN1_NULL, NULL)) {
@@ -369,7 +337,7 @@ ossl_ts_req_get_policy_id(VALUE self)
     GetTSRequest(self, req);
     if (!TS_REQ_get_policy_id(req))
         return Qnil;
-    return get_asn1obj(TS_REQ_get_policy_id(req));
+    return ossl_asn1obj_to_string(TS_REQ_get_policy_id(req));
 }
 
 /*
@@ -392,7 +360,7 @@ ossl_ts_req_set_policy_id(VALUE self, VALUE oid)
     int ok;
 
     GetTSRequest(self, req);
-    obj = obj_to_asn1obj(oid);
+    obj = ossl_to_asn1obj(oid);
     ok = TS_REQ_set_policy_id(req, obj);
     ASN1_OBJECT_free(obj);
     if (!ok)
@@ -490,13 +458,15 @@ ossl_ts_req_to_der(VALUE self)
     TS_REQ *req;
     TS_MSG_IMPRINT *mi;
     X509_ALGOR *algo;
+    const ASN1_OBJECT *obj;
     ASN1_OCTET_STRING *hashed_msg;
 
     GetTSRequest(self, req);
     mi = TS_REQ_get_msg_imprint(req);
 
     algo = TS_MSG_IMPRINT_get_algo(mi);
-    if (OBJ_obj2nid(algo->algorithm) == NID_undef)
+    X509_ALGOR_get0(&obj, NULL, NULL, algo);
+    if (OBJ_obj2nid(obj) == NID_undef)
         ossl_raise(eTimestampError, "Message imprint missing algorithm");
 
     hashed_msg = TS_MSG_IMPRINT_get_msg(mi);
@@ -620,14 +590,7 @@ ossl_ts_resp_get_failure_info(VALUE self)
 {
     TS_RESP *resp;
     TS_STATUS_INFO *si;
-
-    /* The ASN1_BIT_STRING_get_bit changed from 1.0.0. to 1.1.0, making this
-     * const. */
-    #if defined(HAVE_TS_STATUS_INFO_GET0_FAILURE_INFO)
     const ASN1_BIT_STRING *fi;
-    #else
-    ASN1_BIT_STRING *fi;
-    #endif
 
     GetTSResponse(self, resp);
     si = TS_RESP_get_status_info(resp);
@@ -858,16 +821,26 @@ ossl_ts_resp_verify(int argc, VALUE *argv, VALUE self)
         X509_up_ref(cert);
     }
 
+    if (!X509_STORE_up_ref(x509st)) {
+        sk_X509_pop_free(x509inter, X509_free);
+        TS_VERIFY_CTX_free(ctx);
+        ossl_raise(eTimestampError, "X509_STORE_up_ref");
+    }
+
+#ifdef HAVE_TS_VERIFY_CTX_SET0_CERTS
+    TS_VERIFY_CTX_set0_certs(ctx, x509inter);
+    TS_VERIFY_CTX_set0_store(ctx, x509st);
+#else
+# if OSSL_OPENSSL_PREREQ(3, 0, 0) || OSSL_IS_LIBRESSL
     TS_VERIFY_CTX_set_certs(ctx, x509inter);
-    TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE);
+# else
+    TS_VERIFY_CTS_set_certs(ctx, x509inter);
+# endif
     TS_VERIFY_CTX_set_store(ctx, x509st);
+#endif
+    TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE);
 
     ok = TS_RESP_verify_response(ctx, resp);
-    /*
-     * TS_VERIFY_CTX_set_store() call above does not increment the reference
-     * counter, so it must be unset before TS_VERIFY_CTX_free() is called.
-     */
-    TS_VERIFY_CTX_set_store(ctx, NULL);
     TS_VERIFY_CTX_free(ctx);
 
     if (!ok)
@@ -954,7 +927,7 @@ ossl_ts_token_info_get_policy_id(VALUE self)
     TS_TST_INFO *info;
 
     GetTSTokenInfo(self, info);
-    return get_asn1obj(TS_TST_INFO_get_policy_id(info));
+    return ossl_asn1obj_to_string(TS_TST_INFO_get_policy_id(info));
 }
 
 /*
@@ -976,11 +949,13 @@ ossl_ts_token_info_get_algorithm(VALUE self)
     TS_TST_INFO *info;
     TS_MSG_IMPRINT *mi;
     X509_ALGOR *algo;
+    const ASN1_OBJECT *obj;
 
     GetTSTokenInfo(self, info);
     mi = TS_TST_INFO_get_msg_imprint(info);
     algo = TS_MSG_IMPRINT_get_algo(mi);
-    return get_asn1obj(algo->algorithm);
+    X509_ALGOR_get0(&obj, NULL, NULL, algo);
+    return ossl_asn1obj_to_string(obj);
 }
 
 /*
@@ -1146,9 +1121,14 @@ ossl_tsfac_time_cb(struct TS_resp_ctx *ctx, void *data, time_t *sec, long *usec)
 }
 
 static VALUE
-ossl_evp_get_digestbyname_i(VALUE arg)
+ossl_evp_md_fetch_i(VALUE args_)
 {
-    return (VALUE)ossl_evp_get_digestbyname(arg);
+    VALUE *args = (VALUE *)args_, md_holder;
+    const EVP_MD *md;
+
+    md = ossl_evp_md_fetch(args[1], &md_holder);
+    rb_ary_push(args[0], md_holder);
+    return (VALUE)md;
 }
 
 static VALUE
@@ -1184,7 +1164,8 @@ ossl_obj2bio_i(VALUE arg)
 static VALUE
 ossl_tsfac_create_ts(VALUE self, VALUE key, VALUE certificate, VALUE request)
 {
-    VALUE serial_number, def_policy_id, gen_time, additional_certs, allowed_digests;
+    VALUE serial_number, def_policy_id, gen_time, additional_certs,
+          allowed_digests, allowed_digests_tmp = Qnil;
     VALUE str;
     STACK_OF(X509) *inter_certs;
     VALUE tsresp, ret = Qnil;
@@ -1245,7 +1226,7 @@ ossl_tsfac_create_ts(VALUE self, VALUE key, VALUE certificate, VALUE request)
     if (rb_obj_is_kind_of(additional_certs, rb_cArray)) {
         inter_certs = ossl_protect_x509_ary2sk(additional_certs, &status);
         if (status)
-                goto end;
+            goto end;
 
         /* this dups the sk_X509 and ups each cert's ref count */
         TS_RESP_CTX_set_certs(ctx, inter_certs);
@@ -1261,16 +1242,18 @@ ossl_tsfac_create_ts(VALUE self, VALUE key, VALUE certificate, VALUE request)
 
     allowed_digests = ossl_tsfac_get_allowed_digests(self);
     if (rb_obj_is_kind_of(allowed_digests, rb_cArray)) {
-        int i;
-        VALUE rbmd;
-        const EVP_MD *md;
-
-        for (i = 0; i < RARRAY_LEN(allowed_digests); i++) {
-            rbmd = rb_ary_entry(allowed_digests, i);
-            md = (const EVP_MD *)rb_protect(ossl_evp_get_digestbyname_i, rbmd, &status);
+        allowed_digests_tmp = rb_ary_new_capa(RARRAY_LEN(allowed_digests));
+        for (long i = 0; i < RARRAY_LEN(allowed_digests); i++) {
+            VALUE args[] = {
+                allowed_digests_tmp,
+                rb_ary_entry(allowed_digests, i),
+            };
+            const EVP_MD *md = (const EVP_MD *)rb_protect(ossl_evp_md_fetch_i,
+                                                          (VALUE)args, &status);
             if (status)
                 goto end;
-            TS_RESP_CTX_add_md(ctx, md);
+            if (!TS_RESP_CTX_add_md(ctx, md))
+                goto end;
         }
     }
 
@@ -1284,6 +1267,7 @@ ossl_tsfac_create_ts(VALUE self, VALUE key, VALUE certificate, VALUE request)
 
     response = TS_RESP_create_response(ctx, req_bio);
     BIO_free(req_bio);
+    RB_GC_GUARD(allowed_digests_tmp);
 
     if (!response) {
         err_msg = "Error during response generation";
@@ -1297,7 +1281,7 @@ ossl_tsfac_create_ts(VALUE self, VALUE key, VALUE certificate, VALUE request)
     SetTSResponse(tsresp, response);
     ret = tsresp;
 
-end:
+  end:
     ASN1_INTEGER_free(asn1_serial);
     ASN1_OBJECT_free(def_policy_id_obj);
     TS_RESP_CTX_free(ctx);
@@ -1314,10 +1298,6 @@ end:
 void
 Init_ossl_ts(void)
 {
-    #if 0
-    mOSSL = rb_define_module("OpenSSL"); /* let rdoc know about mOSSL */
-    #endif
-
     /*
      * Possible return value for +Response#failure_info+. Indicates that the
      * timestamp server rejects the message imprint algorithm used in the
@@ -1527,65 +1507,39 @@ Init_ossl_ts(void)
      *      fac.default_policy_id = '1.2.3.4.5'
      *      fac.additional_certificates = [ inter1, inter2 ]
      *      timestamp = fac.create_timestamp(p12.key, p12.certificate, req)
-     *
-     * ==Attributes
-     *
-     * ===default_policy_id
+     */
+    cTimestampFactory = rb_define_class_under(mTimestamp, "Factory", rb_cObject);
+    /*
+     * The list of digest algorithms that the factory is allowed
+     * create timestamps for. Known vulnerable or weak algorithms should not be
+     * allowed where possible. Must be an Array of String or OpenSSL::Digest
+     * subclass instances.
+     */
+    rb_attr(cTimestampFactory, rb_intern_const("allowed_digests"), 1, 1, 0);
+    /*
+     * A String representing the default policy object identifier, or +nil+.
      *
      * Request#policy_id will always be preferred over this if present in the
-     * Request, only if Request#policy_id is nil default_policy will be used.
+     * Request, only if Request#policy_id is +nil+ default_policy will be used.
      * If none of both is present, a TimestampError will be raised when trying
      * to create a Response.
-     *
-     * call-seq:
-     *       factory.default_policy_id = "string" -> string
-     *       factory.default_policy_id            -> string or nil
-     *
-     * ===serial_number
-     *
-     * Sets or retrieves the serial number to be used for timestamp creation.
-     * Must be present for timestamp creation.
-     *
-     * call-seq:
-     *       factory.serial_number = number -> number
-     *       factory.serial_number          -> number or nil
-     *
-     * ===gen_time
-     *
-     * Sets or retrieves the Time value to be used in the Response. Must be
-     * present for timestamp creation.
-     *
-     * call-seq:
-     *       factory.gen_time = Time -> Time
-     *       factory.gen_time        -> Time or nil
-     *
-     * ===additional_certs
-     *
-     * Sets or retrieves additional certificates apart from the timestamp
-     * certificate (e.g. intermediate certificates) to be added to the Response.
-     * Must be an Array of OpenSSL::X509::Certificate.
-     *
-     * call-seq:
-     *       factory.additional_certs = [cert1, cert2] -> [ cert1, cert2 ]
-     *       factory.additional_certs                  -> array or nil
-     *
-     * ===allowed_digests
-     *
-     * Sets or retrieves the digest algorithms that the factory is allowed
-     * create timestamps for. Known vulnerable or weak algorithms should not be
-     * allowed where possible.
-     * Must be an Array of String or OpenSSL::Digest subclass instances.
-     *
-     * call-seq:
-     *       factory.allowed_digests = ["sha1", OpenSSL::Digest.new('SHA256').new] -> [ "sha1", OpenSSL::Digest) ]
-     *       factory.allowed_digests                                               -> array or nil
-     *
      */
-    cTimestampFactory = rb_define_class_under(mTimestamp, "Factory", rb_cObject);
-    rb_attr(cTimestampFactory, rb_intern_const("allowed_digests"), 1, 1, 0);
     rb_attr(cTimestampFactory, rb_intern_const("default_policy_id"), 1, 1, 0);
+    /*
+     * The serial number to be used for timestamp creation. Must be present for
+     * timestamp creation. Must be an instance of OpenSSL::BN or Integer.
+     */
     rb_attr(cTimestampFactory, rb_intern_const("serial_number"), 1, 1, 0);
+    /*
+     * The Time value to be used in the Response. Must be present for timestamp
+     * creation.
+     */
     rb_attr(cTimestampFactory, rb_intern_const("gen_time"), 1, 1, 0);
+    /*
+     * Additional certificates apart from the timestamp certificate (e.g.
+     * intermediate certificates) to be added to the Response.
+     * Must be an Array of OpenSSL::X509::Certificate, or +nil+.
+     */
     rb_attr(cTimestampFactory, rb_intern_const("additional_certs"), 1, 1, 0);
     rb_define_method(cTimestampFactory, "create_timestamp", ossl_tsfac_create_ts, 3);
 }