echspec 0.0.6 → 0.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dff1c822b0e5bef3e79cfbf5d1eb200f8312fb8fd0e0582e34d152dafdb8d810
-  data.tar.gz: 8082a87b962ee5ea9b05589558e4704919c63d69fc69bf4f3e35379164429d80
+  metadata.gz: b4b19de1ec6feae0372b847a16805e3f2711283341d85b8b1e309ba5034c4d1b
+  data.tar.gz: edb1bc1ad4ca9489a2de82a6406d3f7e6dd57ecb785c2063a024ccfea5cc995a
 SHA512:
-  metadata.gz: 37c0cfc5bc91f0be87099720490b2870921998f377d88b862152275586492670d4eb26c5ae6023a32345367b608830b4f9005b30a6df7b1fe7aea968769e0177
-  data.tar.gz: c6cf6cbbe9a0607117a173f5d921201a38d18986e37217665d51c2ff1f004ab1784bf6f9b01ac9263f686bf2192e9099b8a9df947ebf6622f3201585c035b255
+  metadata.gz: 93d42d067d4839ff7ba052a81b3b587be0b7fa10f0acb372a97f6cfee4240a3dec35fd76899116164cb8a3276114b3bf5ba315cab1228af72a56b5a8cc841867
+  data.tar.gz: f5fa1e47ed16a24708583c6a2fa6419616c6df389c7d993bb0b6e52b5626581d6d9140b974e87dcd64d923c08ed2fb24cc8ef8cd412502c4fc921246578071a5

data/.ruby-version

@@ -1 +1 @@
-4.0.2
+4.0.7

data/README.md

@@ -26,8 +26,11 @@ $ gem install echspec
 $ echspec --help
 Usage: echspec {SUBCOMMAND}
 
-Available subcommands: run, gen_configs, version, help.
+Available subcommands: run, gen_configs, resolve, grease, version, help.
 ```
+
+### run
+
 ```sh-session
 $ echspec run --help
 Usage: echspec run [OPTIONS...] {HOSTNAME}
@@ -53,6 +56,7 @@ Example output:
 $ echspec run research.cloudflare.com
 TLS Encrypted Client Hello Server
         ✔ MUST implement the following HPKE cipher suite: KEM: DHKEM(X25519, HKDF-SHA256), KDF: HKDF-SHA256 and AEAD: AES-128-GCM. [9]
+        ✔ MUST include an "encrypted_client_hello" extension with an 8-byte confirmation payload in HelloRetryRequest, if ClientHello offers the inner variant. [5-11]
         ✔ MUST abort with an "illegal_parameter" alert, if EncodedClientHelloInner is padded with non-zero values. [5.1-9]
         ✔ MUST abort with an "illegal_parameter" alert, if any referenced extension is missing in ClientHelloOuter. [5.1-10]
         ✔ MUST abort with an "illegal_parameter" alert, if any extension is referenced in OuterExtensions more than once. [5.1-10]
@@ -65,6 +69,7 @@ TLS Encrypted Client Hello Server
         ✔ MUST abort with a "missing_extension" alert, if 2nd ClientHelloOuter does not contains the "encrypted_client_hello" extension. [7.1.1-2]
         ✔ MUST abort with an "illegal_parameter" alert, if 2nd ClientHelloOuter "encrypted_client_hello" enc is empty. [7.1.1-2]
         ✔ MUST abort with a "decrypt_error" alert, if fails to decrypt 2nd ClientHelloOuter. [7.1.1-5]
+        ✔ MUST confirm ECH acceptance in ServerHello, if it confirmed ECH acceptance in HelloRetryRequest. [7.2-1]
 
 Failures:
 
@@ -75,7 +80,7 @@ Failures:
 1 failure
 ```
 
-By default, `echspec` retrieves ECHConfigs via DNS HTTPS records. You can specify a local PEM file using the `-f, --file FILE` option. To test a server on localhost:
+By default, `echspec` retrieves ECHConfigs via DNS HTTPS resource records. You can specify a local PEM file using the `-f, --file FILE` option. To test a server on localhost:
 
 ```sh-session
 $ echspec run -f fixtures/echconfigs.pem -p 4433 localhost
@@ -282,6 +287,8 @@ $ echspec run -s 7-5 -v research.cloudflare.com 2>&1 > /dev/null | jq .
 
 </details>
 
+### gen_configs
+
 You can generate an ECHConfig PEM file the following:
 
 ```sh-session
@@ -297,6 +304,104 @@ AQALZXhhbXBsZS5jb20AAA==
 -----END ECHCONFIG-----
 ```
 
+The generated file contains the following two PEM blocks:
+
+- `PRIVATE KEY`
+  - X25519
+- `ECHCONFIG`
+  - version
+    - 0xfe0d
+  - config_id
+    - 123
+  - KEM
+    - DHKEM(X25519, HKDF-SHA256)
+  - KDF
+    - HKDF-SHA256
+  - AEAD
+    - AES-128-GCM
+  - maximum\_name\_length
+    - 32
+  - public_name
+    - "localhost"
+  - extensions
+    - []
+
+### resolve
+
+You can resolve ECHConfigs for a hostname and print fields using the `resolve` subcommand.
+With `-w`, ECHConfigs are resolved from the well-known URI (`https://{HOSTNAME}/.well-known/origin-svcb`) defined in [draft-ietf-tls-wkech](https://datatracker.ietf.org/doc/html/draft-ietf-tls-wkech-12), instead of DNS HTTPS resource records:
+
+```sh-session
+$ echspec resolve --help
+Usage: echspec resolve [OPTIONS...] [{HOSTNAME}]
+
+Resolve ECHConfigs for a hostname and print fields.
+{HOSTNAME} is required unless -f is specified.
+
+Examples:
+
+  $ echspec resolve localhost
+  $ echspec resolve -w localhost
+  $ echspec resolve -f echconfigs.pem
+
+Options:
+    -f, --file FILE                  path to ECHConfigs PEM file       (default resolve ECHConfigs via DNS)
+    -w, --well-known                 resolve ECHConfigs via well-known URI, instead of DNS
+```
+```sh-session
+$ echspec resolve research.cloudflare.com
+ECHConfig:                        │ 
+  version(hex):                   │ fe 0d
+  length(integer):                │ 65
+  contents:                       │ 
+    key_config:                   │ 
+      config_id(integer):         │ 104
+      kem_id(hex):                │ 00 20
+      public_key(hex):            │ e8 49 25 b3 6c e3 fb 9c 72 c7 71 e2 7a b2 8c 65 84 ba c2 2a 90 c2 cb 59 23 b2 27 d8 c1 85 84 17
+      cipher_suites:              │ 
+        kdf_id(hex):              │ 00 01
+        aead_id(hex):             │ 00 01
+    maximum_name_length(integer): │ 0
+    public_name(string):          │ cloudflare-ech.com
+    extensions(hex):              │ 
+```
+
+### grease
+
+You can send a GREASE ECH to a server to trigger `retry_configs` and print the retry ECHConfigs fields using the `grease` subcommand:
+
+```sh-session
+$ echspec grease --help
+Usage: echspec grease [OPTIONS...] {HOSTNAME}
+
+Send GREASE ECH to a server and display retry_configs.
+
+Examples:
+
+  $ echspec grease localhost
+  $ echspec grease -p 4433 localhost
+
+Options:
+    -p, --port VALUE                 server port number                (default 443)
+```
+```sh-session
+$ echspec grease research.cloudflare.com
+ECHConfig:                        │ 
+  version(hex):                   │ fe 0d
+  length(integer):                │ 65
+  contents:                       │ 
+    key_config:                   │ 
+      config_id(integer):         │ 72
+      kem_id(hex):                │ 00 20
+      public_key(hex):            │ 0a 89 2a 9f 05 0a d5 21 da cc 42 65 df cf 70 38 22 7e 85 44 93 1b 68 fa a2 b5 37 ad d8 2c 89 39
+      cipher_suites:              │ 
+        kdf_id(hex):              │ 00 01
+        aead_id(hex):             │ 00 01
+    maximum_name_length(integer): │ 0
+    public_name(string):          │ cloudflare-ech.com
+    extensions(hex):              │ 
+```
+
 
 ## Note
 

data/lib/echspec/cli/ech_config_printer.rb

@@ -0,0 +1,55 @@
+module EchSpec
+  class CLI
+    module EchConfigPrinter
+      def print_ech_configs(ech_configs)
+        all_pairs = ech_configs.map { |c| field_pairs(c) }
+        label_width, value_width = evaluate_widths(all_pairs)
+
+        all_pairs.each_with_index do |pairs, i|
+          puts "#{'─' * label_width}┼#{'─' * value_width}" if i.positive?
+          pairs.each { |label, value| print_field(label, value, label_width) }
+        end
+      end
+
+      def evaluate_widths(all_pairs)
+        label_width = all_pairs.flat_map { |pairs| pairs.map { |label, _| label.length } }.max + 1
+        value_width = all_pairs.flat_map { |pairs| pairs.map { |_, value| value.to_s.length } }.max + 1
+        [label_width, value_width]
+      end
+
+      def print_field(label, value, label_width)
+        puts "#{label.ljust(label_width)}│ #{value}"
+      end
+
+      # rubocop: disable Metrics/AbcSize
+      def field_pairs(c)
+        ec = c.echconfig_contents
+        kc = ec.key_config
+        ext = ec.extensions.octet.unpack1('H*').scan(/.{2}/).join(' ')
+        cipher_suite_pairs = kc.cipher_suites.flat_map do |cs|
+          [
+            ['        kdf_id(hex):', cs.kdf_id.encode.unpack1('H4').scan(/.{2}/).join(' ')],
+            ['        aead_id(hex):', cs.aead_id.encode.unpack1('H4').scan(/.{2}/).join(' ')]
+          ]
+        end
+
+        [
+          ['ECHConfig:', ''],
+          ['  version(hex):', c.version.unpack1('H4').scan(/.{2}/).join(' ')],
+          ['  length(integer):', ec.encode.length],
+          ['  contents:', ''],
+          ['    key_config:', ''],
+          ['      config_id(integer):', kc.config_id],
+          ['      kem_id(hex):', kc.kem_id.encode.unpack1('H4').scan(/.{2}/).join(' ')],
+          ['      public_key(hex):', kc.public_key.opaque.unpack1('H*').scan(/.{2}/).join(' ')],
+          ['      cipher_suites:', ''],
+          *cipher_suite_pairs,
+          ['    maximum_name_length(integer):', ec.maximum_name_length],
+          ['    public_name(string):', ec.public_name],
+          ['    extensions(hex):', ext]
+        ]
+      end
+      # rubocop: enable Metrics/AbcSize
+    end
+  end
+end

data/lib/echspec/cli/gen_configs.rb

@@ -36,32 +36,8 @@ module EchSpec
       end
 
       def write(fpath)
-        hostname = 'localhost'
-
         key = OpenSSL::PKey.generate_key('X25519')
-        echconfigs = ECHConfigList.new(
-          [
-            ECHConfig.new(
-              "\xfe\x0d".b,
-              ECHConfig::ECHConfigContents.new(
-                ECHConfig::ECHConfigContents::HpkeKeyConfig.new(
-                  123,
-                  ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeKemId.new(HPKE::DHKEM_X25519_HKDF_SHA256),
-                  ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkePublicKey.new(key.raw_public_key),
-                  [
-                    ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite.new(
-                      ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite::HpkeKdfId.new(HPKE::HKDF_SHA256),
-                      ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite::HpkeAeadId.new(HPKE::AES_128_GCM)
-                    )
-                  ]
-                ),
-                32,
-                hostname.b,
-                ECHConfig::ECHConfigContents::Extensions.new('')
-              )
-            )
-          ]
-        )
+        echconfigs = ECHConfigList.new([EchConfig.gen_ech_config(key.raw_public_key)])
         File.write(fpath, key.private_to_pem + echconfigs.to_pem)
       end
     end

data/lib/echspec/cli/grease.rb

@@ -0,0 +1,73 @@
+module EchSpec
+  class CLI
+    class Grease
+      include EchConfigPrinter
+
+      def execute(argv)
+        port, hostname = parse_options(argv)
+
+        TTTLS13::Logging.logger.level = Logger::WARN
+        socket = TCPSocket.new(hostname, port)
+        recv = TLS13Client.send_ch_with_greased_ech(socket, hostname)
+        ex = recv.extensions[TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO]
+
+        if ex.nil? || ex.retry_configs.nil? || ex.retry_configs.empty?
+          warn "** #{hostname}:#{port} did not send retry_configs"
+          exit 1
+        end
+
+        print_ech_configs(ex.retry_configs)
+      rescue Timeout::Error
+        warn "** #{hostname}:#{port} connection timeout"
+        exit 1
+      rescue Errno::ECONNREFUSED
+        warn "** #{hostname}:#{port} connection refused"
+        exit 1
+      ensure
+        socket&.close
+      end
+
+      def parse_options(argv)
+        op = OptionParser.new
+        port = 443
+
+        op.on(
+          '-p',
+          '--port VALUE',
+          "server port number                (default #{port})"
+        ) do |v|
+          port = v
+        end
+
+        op.banner = <<~USAGE
+          Usage: echspec grease [OPTIONS...] {HOSTNAME}
+
+          Send GREASE ECH to a server and display retry_configs.
+
+          Examples:
+
+            $ echspec grease localhost
+            $ echspec grease -p 4433 localhost
+
+          Options:
+        USAGE
+
+        begin
+          args = op.parse(argv)
+        rescue OptionParser::InvalidOption, OptionParser::MissingArgument => e
+          warn op
+          warn "** #{e.message}"
+          exit 1
+        end
+
+        if args.length != 1
+          warn op
+          warn '** {HOSTNAME} argument is not specified'
+          exit 1
+        end
+
+        [port, args[0]]
+      end
+    end
+  end
+end

data/lib/echspec/cli/resolve.rb

@@ -0,0 +1,86 @@
+module EchSpec
+  class CLI
+    class Resolve
+      include EchConfigPrinter
+      def execute(argv)
+        fpath, well_known, hostname = parse_options(argv)
+
+        result = if !fpath.nil?
+                   Spec::Spec9.parse_pem(File.read(fpath))
+                 elsif well_known
+                   Spec::Spec9.well_known_origin_svcb(hostname)
+                 else
+                   Spec::Spec9.resolve_ech_configs(hostname)
+                 end
+
+        case result
+        in Ok(ech_configs)
+          print_ech_configs(ech_configs)
+        in Err(details, _)
+          warn "** #{details}"
+          exit 1
+        end
+      end
+
+      # rubocop: disable Metrics/MethodLength
+      def parse_options(argv)
+        op = OptionParser.new
+        fpath = nil
+        well_known = false
+
+        op.on(
+          '-f',
+          '--file FILE',
+          'path to ECHConfigs PEM file       (default resolve ECHConfigs via DNS)'
+        ) do |v|
+          fpath = v
+        end
+
+        op.on(
+          '-w',
+          '--well-known',
+          'resolve ECHConfigs via well-known URI, instead of DNS'
+        ) do
+          well_known = true
+        end
+
+        op.banner = <<~USAGE
+          Usage: echspec resolve [OPTIONS...] [{HOSTNAME}]
+
+          Resolve ECHConfigs for a hostname and print fields.
+          {HOSTNAME} is required unless -f is specified.
+
+          Examples:
+
+            $ echspec resolve localhost
+            $ echspec resolve -w localhost
+            $ echspec resolve -f echconfigs.pem
+
+          Options:
+        USAGE
+
+        begin
+          args = op.parse(argv)
+        rescue OptionParser::InvalidOption, OptionParser::MissingArgument => e
+          warn op
+          warn "** #{e.message}"
+          exit 1
+        end
+
+        if !fpath.nil? && !File.exist?(fpath)
+          warn '** {FILE} is not found'
+          exit 1
+        end
+
+        if fpath.nil? && args.length != 1
+          warn op
+          warn '** {HOSTNAME} argument is not specified'
+          exit 1
+        end
+
+        [fpath, well_known, args[0]]
+      end
+      # rubocop: enable Metrics/MethodLength
+    end
+  end
+end

data/lib/echspec/cli.rb

@@ -1,4 +1,7 @@
+require_relative 'cli/ech_config_printer'
 require_relative 'cli/gen_configs'
+require_relative 'cli/grease'
+require_relative 'cli/resolve'
 require_relative 'cli/run'
 
 module EchSpec
@@ -6,7 +9,7 @@ module EchSpec
     using Refinements
 
     def execute(argv = ARGV)
-      subcommands = %i[run gen_configs]
+      subcommands = %i[run gen_configs resolve grease]
 
       op = OptionParser.new
 

data/lib/echspec/ech_config.rb

@@ -0,0 +1,36 @@
+module EchSpec
+  module EchConfig
+    # @param public_key [String]
+    # @param kem_id [Integer]
+    # @param kdf_id [Integer]
+    # @param aead_id [Integer]
+    #
+    # @return [ECHConfig]
+    def self.gen_ech_config(public_key, kem_id: HPKE::DHKEM_X25519_HKDF_SHA256, kdf_id: HPKE::HKDF_SHA256, aead_id: HPKE::AES_128_GCM)
+      version = "\xfe\x0d".b
+      config_id = 123
+      maximum_name_length = 32
+      hostname = 'localhost'
+
+      ECHConfig.new(
+        version,
+        ECHConfig::ECHConfigContents.new(
+          ECHConfig::ECHConfigContents::HpkeKeyConfig.new(
+            config_id,
+            ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeKemId.new(kem_id),
+            ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkePublicKey.new(public_key),
+            [
+              ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite.new(
+                ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite::HpkeKdfId.new(kdf_id),
+                ECHConfig::ECHConfigContents::HpkeKeyConfig::HpkeSymmetricCipherSuite::HpkeAeadId.new(aead_id)
+              )
+            ]
+          ),
+          maximum_name_length,
+          hostname.b,
+          ECHConfig::ECHConfigContents::Extensions.new('')
+        )
+      )
+    end
+  end
+end

data/lib/echspec/spec/5-11.rb

@@ -0,0 +1,70 @@
+module EchSpec
+  module Spec
+    class Spec5_11 < WithSocket
+      # Finally, when the client offers the "encrypted_client_hello", if the
+      # payload is the inner variant and the server responds with
+      # HelloRetryRequest, it MUST include an "encrypted_client_hello"
+      # extension with the following payload:
+      #
+      #     struct {
+      #        opaque confirmation[8];
+      #     } ECHHelloRetryRequest;
+      #
+      # The value of ECHHelloRetryRequest.confirmation is set to
+      # hrr_accept_confirmation as described in Section 7.2.1.
+      #
+      # https://datatracker.ietf.org/doc/html/rfc9849#section-5-11
+
+      # @return [EchSpec::SpecGroup]
+      def self.spec_group
+        SpecGroup.new(
+          '5-11',
+          [
+            SpecCase.new(
+              'MUST include an "encrypted_client_hello" extension with an 8-byte confirmation payload in HelloRetryRequest, if ClientHello offers the inner variant.',
+              method(:validate_hrr_ech_length)
+            )
+          ]
+        )
+      end
+
+      # @param hostname [String]
+      # @param port [Integer]
+      # @param ech_config [ECHConfig]
+      #
+      # @return [EchSpec::Ok | Err]
+      def self.validate_hrr_ech_length(hostname, port, ech_config)
+        Spec5_11.new.do_validate_hrr_ech_length(hostname, port, ech_config)
+      end
+
+      # @param hostname [String]
+      # @param port [Integer]
+      # @param ech_config [ECHConfig]
+      #
+      # @return [EchSpec::Ok | Err]
+      def do_validate_hrr_ech_length(hostname, port, ech_config)
+        with_socket(hostname, port) do |socket|
+          _conn, _inner, _ch, hrr, = TLS13Client.recv_hrr(socket, hostname, ech_config, @stack)
+          validate_hrr_ech(hrr)
+        end
+      end
+
+      # @param hrr [TTTLS13::Message::ServerHello]
+      #
+      # @return [EchSpec::Ok | Err]
+      def validate_hrr_ech(hrr)
+        # Extensions#[] returns nil for UnknownExtension, so use super_fetch.
+        ex = hrr.extensions.super_fetch(TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO, nil)
+        case ex
+        in TTTLS13::Message::Extension::ECHHelloRetryRequest
+          Ok.new(nil)
+        in nil
+          Err.new('HelloRetryRequest did not include "encrypted_client_hello" extension', message_stack)
+        in TTTLS13::Message::Extension::UnknownExtension
+          # tttls1.3 deserializes the extension whose length is not 8 as UnknownExtension
+          Err.new("HelloRetryRequest \"encrypted_client_hello\" extension has #{ex.extension_data.length}-byte payload, expected 8 bytes", message_stack)
+        end
+      end
+    end
+  end
+end

data/lib/echspec/spec/5.1-9.rb

@@ -92,14 +92,9 @@ module EchSpec
         def self.padding_encoded_ch_inner(s,
                                           server_name_length,
                                           maximum_name_length)
-          padding_len =
-            if server_name_length.positive?
-              [maximum_name_length - server_name_length, 0].max
-            else
-              9 + maximum_name_length
-            end
-
-          padding_len = 31 - ((s.length + padding_len - 1) % 32)
+          padding_len = super.length - s.length
+          # at least one non-zero byte is needed for this test case
+          padding_len = 32 if padding_len.zero?
           s + NON_ZERO * padding_len # padding with non-zero value
         end
       end

data/lib/echspec/spec/7.1-14.2.1.rb

@@ -43,86 +43,32 @@ module EchSpec
       # @return [EchSpec::Ok | Err]
       def do_validate_ee_retry_configs(hostname, port)
         with_socket(hostname, port) do |socket|
-          recv = send_ch_with_greased_ech(socket, hostname)
-          ex = recv.extensions[TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO]
-          return Err.new('did not send expected alert: encrypted_client_hello', message_stack) \
-            unless ex.is_a?(TTTLS13::Message::Extension::ECHEncryptedExtensions)
-          return Err.new('ECHConfigs did not have "retry_configs"', message_stack) \
-            if ex.retry_configs.nil? || ex.retry_configs.empty?
-
-          Ok.new(nil)
+          recv = TLS13Client.send_ch_with_greased_ech(socket, hostname, @stack)
+          validate_ee_ech(recv)
+        rescue ECHConfig::DecodeError
+          Err.new('EncryptedExtensions "encrypted_client_hello" extension could not be decoded', message_stack)
         end
       end
 
-      # rubocop: disable Metrics/AbcSize
-      # rubocop: disable Metrics/MethodLength
-      def send_ch_with_greased_ech(socket, hostname)
-        # send ClientHello
-        conn = TLS13Client::Connection.new(socket, :client)
-        inner_ech = TTTLS13::Message::Extension::ECHClientHello.new_inner
-        exs, shared_secret = TLS13Client.gen_ch_extensions(hostname)
-        inner = TTTLS13::Message::ClientHello.new(
-          cipher_suites: TTTLS13::CipherSuites.new(
-            [
-              TTTLS13::CipherSuite::TLS_AES_256_GCM_SHA384,
-              TTTLS13::CipherSuite::TLS_CHACHA20_POLY1305_SHA256,
-              TTTLS13::CipherSuite::TLS_AES_128_GCM_SHA256
-            ]
-          ),
-          extensions: exs.merge(
-            TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO => inner_ech
-          )
-        )
-        @stack << inner
-
-        ch = TTTLS13::Ech.new_greased_ch(inner, TTTLS13::Ech.new_grease_ech)
-        conn.send_record(
-          TTTLS13::Message::Record.new(
-            type: TTTLS13::Message::ContentType::HANDSHAKE,
-            messages: [ch],
-            cipher: TTTLS13::Cryptograph::Passer.new
-          )
-        )
-        @stack << ch
-
-        # receive ServerHello
-        recv, = conn.recv_message(TTTLS13::Cryptograph::Passer.new)
-        @stack << recv
-        raise Error::BeforeTargetSituationError, 'not received ServerHello' \
-          unless recv.is_a?(TTTLS13::Message::ServerHello) && !recv.hrr?
+      # @param ee [TTTLS13::Message::EncryptedExtensions]
+      #
+      # @return [EchSpec::Ok | Err]
+      def validate_ee_ech(ee)
+        # Extensions#[] returns nil for UnknownExtension, so use super_fetch.
+        ex = ee.extensions.super_fetch(TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO, nil)
+        case ex
+        in TTTLS13::Message::Extension::ECHEncryptedExtensions
+          return Err.new('EncryptedExtensions "encrypted_client_hello" extension did not have "retry_configs"', message_stack) \
+            if ex.retry_configs.nil? || ex.retry_configs.empty?
 
-        # receive EncryptedExtensions
-        transcript = TTTLS13::Transcript.new
-        transcript[TTTLS13::CH] = [ch, ch.serialize]
-        sh = recv
-        transcript[TTTLS13::SH] = [sh, sh.serialize]
-        kse = sh.extensions[TTTLS13::Message::ExtensionType::KEY_SHARE]
-                .key_share_entry.first
-        key_schedule = TTTLS13::KeySchedule.new(
-          psk: nil,
-          shared_secret: shared_secret.build(kse.group, kse.key_exchange),
-          cipher_suite: sh.cipher_suite,
-          transcript:
-        )
-        hs_rcipher = TTTLS13::Endpoint.gen_cipher(
-          sh.cipher_suite,
-          key_schedule.server_handshake_write_key,
-          key_schedule.server_handshake_write_iv
-        )
-        recv, = conn.recv_message(hs_rcipher)
-        @stack << recv
-        if recv.is_a?(TTTLS13::Message::ChangeCipherSpec)
-          recv, = conn.recv_message(hs_rcipher)
-          @stack << recv
+          Ok.new(nil)
+        in nil
+          Err.new('EncryptedExtensions did not include "encrypted_client_hello" extension', message_stack)
+        in TTTLS13::Message::Extension::UnknownExtension
+          # tttls1.3 deserializes the extension whose length field mismatches as UnknownExtension
+          Err.new('EncryptedExtensions "encrypted_client_hello" extension could not be decoded', message_stack)
         end
-
-        raise Error::BeforeTargetSituationError, 'not received EncryptedExtensions' \
-          unless recv.is_a?(TTTLS13::Message::EncryptedExtensions)
-
-        recv
       end
-      # rubocop: enable Metrics/AbcSize
-      # rubocop: enable Metrics/MethodLength
     end
   end
 end

data/lib/echspec/spec/7.2-1.rb

@@ -0,0 +1,112 @@
+module EchSpec
+  module Spec
+    class Spec7_2_1 < WithSocket
+      # Upon receipt of an "encrypted_client_hello" extension of type inner
+      # in a ClientHello, if the backend server negotiates TLS 1.3 or higher,
+      # then it MUST confirm ECH acceptance to the client by computing its
+      # ServerHello as described here.
+      #
+      # https://datatracker.ietf.org/doc/html/rfc9849#section-7.2-1
+
+      # @return [EchSpec::SpecGroup]
+      def self.spec_group
+        SpecGroup.new(
+          '7.2-1',
+          [
+            SpecCase.new(
+              'MUST confirm ECH acceptance in ServerHello, if it confirmed ECH acceptance in HelloRetryRequest.',
+              method(:validate_sh_confirmation_after_hrr)
+            )
+          ]
+        )
+      end
+
+      # @param hostname [String]
+      # @param port [Integer]
+      # @param ech_config [ECHConfig]
+      #
+      # @return [EchSpec::Ok | Err]
+      def self.validate_sh_confirmation_after_hrr(hostname, port, ech_config)
+        Spec7_2_1.new.do_validate_sh_confirmation_after_hrr(hostname, port, ech_config)
+      end
+
+      # @param hostname [String]
+      # @param port [Integer]
+      # @param ech_config [ECHConfig]
+      #
+      # @return [EchSpec::Ok | Err]
+      def do_validate_sh_confirmation_after_hrr(hostname, port, ech_config)
+        with_socket(hostname, port) do |socket|
+          recv, confirmation = send_2nd_ch_after_hrr(socket, hostname, ech_config)
+          return Err.new('did not send expected handshake message: ServerHello', message_stack) \
+            unless recv.is_a?(TTTLS13::Message::ServerHello) && !recv.hrr?
+
+          validate_sh_confirmation(confirmation, recv)
+        end
+      end
+
+      # @param expected [String] accept_confirmation
+      # @param sh [TTTLS13::Message::ServerHello]
+      #
+      # @return [EchSpec::Ok | Err]
+      def validate_sh_confirmation(expected, sh)
+        return Ok.new(nil) if sh.random[-8..] == expected
+
+        Err.new('the last 8 bytes of ServerHello.random did not match accept_confirmation, although HelloRetryRequest confirmed ECH acceptance', message_stack)
+      end
+
+      # rubocop: disable Metrics/AbcSize
+      # rubocop: disable Metrics/MethodLength
+      def send_2nd_ch_after_hrr(socket, hostname, ech_config)
+        conn, inner1, _ch1, hrr, ech_state = TLS13Client.recv_hrr(socket, hostname, ech_config, @stack)
+        transcript = TTTLS13::Transcript.new
+        transcript[TTTLS13::CH1] = [inner1, inner1.serialize]
+        transcript[TTTLS13::HRR] = [hrr, hrr.serialize]
+        # shared_secret is not used to compute (hrr_)accept_confirmation
+        key_schedule = TTTLS13::KeySchedule.new(
+          shared_secret: nil,
+          cipher_suite: hrr.cipher_suite,
+          transcript:
+        )
+        ex = hrr.extensions[TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO]
+        raise Error::BeforeTargetSituationError, 'HelloRetryRequest did not confirm ECH acceptance' \
+          if ex.nil? || ex.confirmation != key_schedule.hrr_accept_confirmation
+
+        # send 2nd ClientHello; ClientHelloInner2 is based on ClientHelloInner1,
+        # and its "encrypted_client_hello" extension of type inner is left
+        # unmodified.
+        inner2 = TTTLS13::Message::ClientHello.new(
+          legacy_version: inner1.legacy_version,
+          random: inner1.random,
+          legacy_session_id: inner1.legacy_session_id,
+          cipher_suites: inner1.cipher_suites,
+          legacy_compression_methods: inner1.legacy_compression_methods,
+          extensions: TLS13Client.gen_newch_extensions(inner1, hrr)
+        )
+        ch, inner2 = TTTLS13::Ech.offer_new_ech(inner2, ech_state)
+        conn.send_record(
+          TTTLS13::Message::Record.new(
+            type: TTTLS13::Message::ContentType::HANDSHAKE,
+            messages: [ch],
+            cipher: TTTLS13::Cryptograph::Passer.new
+          )
+        )
+        @stack << inner2
+        @stack << ch
+
+        recv, = conn.recv_message(TTTLS13::Cryptograph::Passer.new)
+        recv, = conn.recv_message(TTTLS13::Cryptograph::Passer.new) \
+          if recv.is_a?(TTTLS13::Message::ChangeCipherSpec)
+        @stack << recv
+        return [recv, nil] unless recv.is_a?(TTTLS13::Message::ServerHello) && !recv.hrr?
+
+        transcript[TTTLS13::CH] = [inner2, inner2.serialize]
+        sh = recv
+        transcript[TTTLS13::SH] = [sh, sh.serialize]
+        [recv, key_schedule.accept_confirmation]
+      end
+      # rubocop: enable Metrics/AbcSize
+      # rubocop: enable Metrics/MethodLength
+    end
+  end
+end

data/lib/echspec/spec/9.rb

@@ -77,12 +77,87 @@ module EchSpec
           return Err.new("HTTPS resource record for #{hostname} does NOT have ech SvcParams.", nil) if rr.params[ech].nil?
 
           octet = rr.params[ech].value
-          Err.new('Failed to parse ECHConfig on HTTPS resource record.', nil) \
-            unless octet.length == octet.slice(0, 2).unpack1('n') + 2
+          return Err.new('Failed to parse ECHConfig on HTTPS resource record.', nil) \
+            unless octet.length >= 2 && octet.length == octet.slice(0, 2).unpack1('n') + 2
 
           Ok.new(ECHConfig.decode_vectors(octet.slice(2..)))
         end
 
+        # @param hostname [String]
+        #
+        # @return [EchSpec::Ok<Array<ECHConfig>> | Err]
+        def well_known_origin_svcb(hostname)
+          res = fetch_well_known(hostname)
+          body = case res
+                 in Ok(obj)
+                   obj
+                 in Err
+                   return res
+                 end
+
+          parse_origin_svcb(body)
+        end
+
+        # https://datatracker.ietf.org/doc/html/draft-ietf-tls-wkech-12
+        WK_ECH_PATH = '/.well-known/origin-svcb'.freeze
+        private_constant :WK_ECH_PATH
+
+        # @param hostname [String]
+        #
+        # @return [EchSpec::Ok | Err]
+        def fetch_well_known(hostname)
+          uri = URI("https://#{hostname}#{WK_ECH_PATH}")
+          res = Net::HTTP.get_response(uri)
+          return Err.new("GET #{uri} returned #{res.code}.", nil) unless res.is_a?(Net::HTTPSuccess)
+
+          Ok.new(res.body)
+        rescue StandardError => e
+          Err.new(e.message, nil)
+        end
+
+        # {
+        #   "regeninterval": 3600,
+        #   "endpoints": [
+        #     {
+        #       "priority": 1,
+        #       "params": {
+        #         "ipv4hint": [ "192.0.2.1", "192.0.2.254" ],
+        #         "ech": "AD7+DQA6NAAgACCn3zNTeX/WOD...AAA==",
+        #         "ipv6hint": [ "2001:DB::ec4" ],
+        #         "alpn": [ "h2", "http/1.1" ]
+        #       }
+        #     }
+        #   ]
+        # }
+        #
+        # https://datatracker.ietf.org/doc/html/draft-ietf-tls-wkech-12#section-5
+        #
+        # @param body [String]
+        #
+        # @return [EchSpec::Ok | Err]
+        # rubocop: disable Metrics/CyclomaticComplexity
+        # rubocop: disable Metrics/PerceivedComplexity
+        def parse_origin_svcb(body)
+          h = JSON.parse(body)
+          echs = h['endpoints']&.filter_map { |e| e.dig('params', 'ech') }
+          return Err.new('The origin-svcb well-known resource does NOT have ech SvcParams.', nil) if echs.nil? || echs.empty?
+
+          # if parsing any one of the ech values fails, return Err
+          ech_configs = echs.flat_map do |ech|
+            octet = Base64.decode64(ech)
+            return Err.new('Failed to parse ECHConfig on the origin-svcb well-known resource.', nil) \
+              unless octet.length >= 2 && octet.length == octet.slice(0, 2).unpack1('n') + 2
+
+            ECHConfig.decode_vectors(octet.slice(2..))
+          end
+
+          Ok.new(ech_configs)
+        rescue StandardError => e
+          Err.new(e.message, nil)
+        end
+        # rubocop: enable Metrics/CyclomaticComplexity
+        # rubocop: enable Metrics/PerceivedComplexity
+
         # @param pem [String]
         #
         # @return [EchSpec::Ok<Array<ECHConfig>> | Err]
@@ -92,6 +167,9 @@ module EchSpec
                  .first
                  .gsub("\n", '')
           b = Base64.decode64(s)
+          return Err.new('Failed to parse ECHConfig on the PEM file.', nil) \
+            unless b.length >= 2 && b.length == b.slice(0, 2).unpack1('n') + 2
+
           ech_configs = ECHConfig.decode_vectors(b.slice(2..))
           Ok.new(ech_configs)
         rescue StandardError

data/lib/echspec/spec.rb

@@ -176,10 +176,10 @@ module EchSpec
 
       def spec_groups
         # https://datatracker.ietf.org/doc/html/rfc9849#section-5
-        groups = [Spec5_1_9, Spec5_1_10]
+        groups = [Spec5_11, Spec5_1_9, Spec5_1_10]
 
         # https://datatracker.ietf.org/doc/html/rfc9849#section-7
-        groups += [Spec7_5, Spec7_1_11, Spec7_1_14_2_1, Spec7_1_1_2, Spec7_1_1_5]
+        groups += [Spec7_5, Spec7_1_11, Spec7_1_14_2_1, Spec7_1_1_2, Spec7_1_1_5, Spec7_2_1]
 
         groups.map(&:spec_group)
       end

data/lib/echspec/tls13_client.rb

@@ -1,4 +1,5 @@
 module EchSpec
+  # rubocop: disable Metrics/ModuleLength
   module TLS13Client
     class Connection < TTTLS13::Connection
       # @param socket [Socket]
@@ -95,6 +96,84 @@ module EchSpec
         ch1.extensions.merge(exs)
       end
 
+      # @param socket [TCPSocket]
+      # @param hostname [String]
+      # @param stack [EchSpec::Log::MessageStack | nil]
+      #
+      # @raise [EchSpec::Error::BeforeTargetSituationError]
+      #
+      # @return [TTTLS13::Message::EncryptedExtensions]
+      # rubocop: disable Metrics/AbcSize
+      # rubocop: disable Metrics/CyclomaticComplexity
+      # rubocop: disable Metrics/MethodLength
+      # rubocop: disable Metrics/PerceivedComplexity
+      def send_ch_with_greased_ech(socket, hostname, stack = nil)
+        conn = TLS13Client::Connection.new(socket, :client)
+        inner_ech = TTTLS13::Message::Extension::ECHClientHello.new_inner
+        exs, shared_secret = TLS13Client.gen_ch_extensions(hostname)
+        inner = TTTLS13::Message::ClientHello.new(
+          cipher_suites: TTTLS13::CipherSuites.new(
+            [
+              TTTLS13::CipherSuite::TLS_AES_256_GCM_SHA384,
+              TTTLS13::CipherSuite::TLS_CHACHA20_POLY1305_SHA256,
+              TTTLS13::CipherSuite::TLS_AES_128_GCM_SHA256
+            ]
+          ),
+          extensions: exs.merge(
+            TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO => inner_ech
+          )
+        )
+        stack << inner if stack
+
+        ch = TTTLS13::Ech.new_greased_ch(inner, TTTLS13::Ech.new_grease_ech)
+        conn.send_record(
+          TTTLS13::Message::Record.new(
+            type: TTTLS13::Message::ContentType::HANDSHAKE,
+            messages: [ch],
+            cipher: TTTLS13::Cryptograph::Passer.new
+          )
+        )
+        stack << ch if stack
+
+        recv, = conn.recv_message(TTTLS13::Cryptograph::Passer.new)
+        stack << recv if stack
+        raise Error::BeforeTargetSituationError, 'not received ServerHello' \
+          unless recv.is_a?(TTTLS13::Message::ServerHello) && !recv.hrr?
+
+        transcript = TTTLS13::Transcript.new
+        transcript[TTTLS13::CH] = [ch, ch.serialize]
+        sh = recv
+        transcript[TTTLS13::SH] = [sh, sh.serialize]
+        kse = sh.extensions[TTTLS13::Message::ExtensionType::KEY_SHARE]
+                .key_share_entry.first
+        key_schedule = TTTLS13::KeySchedule.new(
+          psk: nil,
+          shared_secret: shared_secret.build(kse.group, kse.key_exchange),
+          cipher_suite: sh.cipher_suite,
+          transcript:
+        )
+        hs_rcipher = TTTLS13::Endpoint.gen_cipher(
+          sh.cipher_suite,
+          key_schedule.server_handshake_write_key,
+          key_schedule.server_handshake_write_iv
+        )
+        recv, = conn.recv_message(hs_rcipher)
+        stack << recv if stack
+        if recv.is_a?(TTTLS13::Message::ChangeCipherSpec)
+          recv, = conn.recv_message(hs_rcipher)
+          stack << recv if stack
+        end
+
+        raise Error::BeforeTargetSituationError, 'not received EncryptedExtensions' \
+          unless recv.is_a?(TTTLS13::Message::EncryptedExtensions)
+
+        recv
+      end
+      # rubocop: enable Metrics/AbcSize
+      # rubocop: enable Metrics/CyclomaticComplexity
+      # rubocop: enable Metrics/MethodLength
+      # rubocop: enable Metrics/PerceivedComplexity
+
       # @param conf [ECHConfig::ECHConfigContents::HpkeKeyConfig]
       #
       # @return [Boolean]
@@ -164,4 +243,5 @@ module EchSpec
       # rubocop: enable Metrics/MethodLength
     end
   end
+  # rubocop: enable Metrics/ModuleLength
 end

data/lib/echspec/version.rb

@@ -1,3 +1,3 @@
 module EchSpec
-  VERSION = '0.0.6'.freeze
+  VERSION = '0.0.8'.freeze
 end

data/lib/echspec.rb

@@ -1,4 +1,6 @@
 require 'base64'
+require 'json'
+require 'net/http'
 require 'optparse'
 require 'pp'
 require 'resolv'
@@ -10,6 +12,7 @@ require_relative 'echspec/utils'
 require_relative 'echspec/log'
 require_relative 'echspec/error'
 require_relative 'echspec/result'
+require_relative 'echspec/ech_config'
 require_relative 'echspec/tls13_client'
 require_relative 'echspec/spec_case'
 require_relative 'echspec/spec_group'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: echspec
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.8
 platform: ruby
 authors:
 - thekuwayama
@@ -101,12 +101,17 @@ files:
 - fixtures/server.key
 - lib/echspec.rb
 - lib/echspec/cli.rb
+- lib/echspec/cli/ech_config_printer.rb
 - lib/echspec/cli/gen_configs.rb
+- lib/echspec/cli/grease.rb
+- lib/echspec/cli/resolve.rb
 - lib/echspec/cli/run.rb
+- lib/echspec/ech_config.rb
 - lib/echspec/error.rb
 - lib/echspec/log.rb
 - lib/echspec/result.rb
 - lib/echspec/spec.rb
+- lib/echspec/spec/5-11.rb
 - lib/echspec/spec/5.1-10.rb
 - lib/echspec/spec/5.1-9.rb
 - lib/echspec/spec/7-5.rb
@@ -114,6 +119,7 @@ files:
 - lib/echspec/spec/7.1-14.2.1.rb
 - lib/echspec/spec/7.1.1-2.rb
 - lib/echspec/spec/7.1.1-5.rb
+- lib/echspec/spec/7.2-1.rb
 - lib/echspec/spec/9.rb
 - lib/echspec/spec_case.rb
 - lib/echspec/spec_group.rb
@@ -138,7 +144,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A conformance testing tool for ECH implementation
 test_files: []