ssl: add SSLSocket#peer_signature_digest_name, #peer_signature_name, #group_name

ext/openssl/extconf.rb

@@ -156,9 +156,15 @@ def find_openssl_library
 have_func("EVP_PKEY_eq(NULL, NULL)", evp_h)
 have_func("EVP_PKEY_dup(NULL)", evp_h)
 
+# added in 3.2.0
+have_func("SSL_get0_group_name(NULL)", ssl_h)
+
 # added in 3.4.0
 have_func("TS_VERIFY_CTX_set0_certs(NULL, NULL)", ts_h)
 
+# added in 3.5.0
+have_func("SSL_get0_peer_signature_name(NULL, NULL)", ssl_h)
+
 Logging::message "=== Checking done. ===\n"
 
 # Append flags from environment variables.

ext/openssl/ossl.h

@@ -45,6 +45,8 @@
 #include <openssl/dsa.h>
 #include <openssl/evp.h>
 #include <openssl/dh.h>
+#include <openssl/obj_mac.h>
+#include <openssl/objects.h>
 #include "openssl_missing.h"
 
 #ifndef LIBRESSL_VERSION_NUMBER

ext/openssl/ossl_ssl.c

@@ -2644,6 +2644,70 @@ ossl_ssl_tmp_key(VALUE self)
 	return Qnil;
     return ossl_pkey_new(key);
 }
+
+/*
+ * call-seq:
+ *    ssl.peer_signature_digest_name => String
+ *
+ * Returns the digest name string used by the peer to sign TLS messages.
+ */
+static VALUE
+ossl_ssl_get_peer_signature_digest_name(VALUE self)
+{
+    SSL *ssl;
+    const char *name;
+    int nid;
+
+    GetSSL(self, ssl);
+    if (!SSL_get_peer_signature_nid(ssl, &nid))
+        return Qnil;
+    if (nid == NID_undef)
+        return Qnil;
+    name = OBJ_nid2sn(nid);
+    if (!name)
+        return Qnil;
+    return rb_str_new2(name);
+}
+
+#ifdef HAVE_SSL_GET0_PEER_SIGNATURE_NAME
+/*
+ * call-seq:
+ *    ssl.peer_signature_name => String
+ *
+ * Returns the signature algorithms string used by the peer to sign the TLS
+ * handshake.
+ */
+static VALUE
+ossl_ssl_get_peer_signature_name(VALUE self)
+{
+    SSL *ssl;
+    const char *name;
+
+    GetSSL(self, ssl);
+    if (!SSL_get0_peer_signature_name(ssl, &name))
+        return Qnil;
+    return rb_str_new2(name);
+}
+#endif
+
+#ifdef HAVE_SSL_GET0_GROUP_NAME
+/*
+ * call-seq:
+ *    ssl.group_name => String
+ *
+ * Returns the name string of the group that was used for the key agreement of
+ * the current TLS session establishment.
+ */
+static VALUE
+ossl_ssl_get_group_name(VALUE self)
+{
+    SSL *ssl;
+
+    GetSSL(self, ssl);
+    return rb_str_new2(SSL_get0_group_name(ssl));
+}
+#endif
+
 #endif /* !defined(OPENSSL_NO_SOCK) */
 
 void
@@ -3067,6 +3131,13 @@ Init_ossl_ssl(void)
 # ifdef OSSL_USE_NEXTPROTONEG
     rb_define_method(cSSLSocket, "npn_protocol", ossl_ssl_npn_protocol, 0);
 # endif
+    rb_define_method(cSSLSocket, "peer_signature_digest_name", ossl_ssl_get_peer_signature_digest_name, 0);
+#ifdef HAVE_SSL_GET0_PEER_SIGNATURE_NAME
+    rb_define_method(cSSLSocket, "peer_signature_name", ossl_ssl_get_peer_signature_name, 0);
+#endif
+#ifdef HAVE_SSL_GET0_GROUP_NAME
+    rb_define_method(cSSLSocket, "group_name", ossl_ssl_get_group_name, 0);
+#endif
 
     rb_define_const(mSSL, "VERIFY_NONE", INT2NUM(SSL_VERIFY_NONE));
     rb_define_const(mSSL, "VERIFY_PEER", INT2NUM(SSL_VERIFY_PEER));

test/openssl/test_ssl.rb

@@ -2213,6 +2213,47 @@ def test_export_keying_material
     end
   end
 
+  def test_peer_signature_digest_name
+    start_server do |port|
+      cli_ctx = OpenSSL::SSL::SSLContext.new
+      server_connect(port, cli_ctx) do |ssl|
+        # Observing the "SHA256" for OpenSSL and "SHA512" for LibreSSL.
+        assert_match(/^SHA/, ssl.peer_signature_digest_name)
+        ssl.puts "abc"; ssl.gets
+      end
+    end
+  end
+
+  def test_peer_signature_name
+    # SSL_get0_peer_signature_name() not supported
+    return unless openssl?(3, 5, 0)
+
+    start_server do |port|
+      cli_ctx = OpenSSL::SSL::SSLContext.new
+      server_connect(port, cli_ctx) do |ssl|
+        assert_equal('rsa_pss_rsae_sha256', ssl.peer_signature_name)
+        ssl.puts "abc"; ssl.gets
+      end
+    end
+  end
+
+  def test_group_name
+    # SSL_get0_group_name() not supported
+    return unless openssl?(3, 2, 0)
+
+    start_server do |port|
+      cli_ctx = OpenSSL::SSL::SSLContext.new
+      server_connect(port, cli_ctx) do |ssl|
+        if openssl?(3, 5, 0)
+          assert_equal('X25519MLKEM768', ssl.group_name)
+        else
+          assert_equal('x25519', ssl.group_name)
+        end
+        ssl.puts "abc"; ssl.gets
+      end
+    end
+  end
+
   private
 
   def server_connect(port, ctx = nil)