tttls1.3 0.3.3 → 0.3.5

data/lib/tttls1.3/ech.rb

@@ -19,7 +19,7 @@ module TTTLS13
     # @param hpke_cipher_suite_selector [Method]
     #
     # @return [TTTLS13::Message::ClientHello]
-    # @return [TTTLS13::Message::ClientHello]
+    # @return [TTTLS13::Message::ClientHello] ClientHelloInner
     # @return [TTTLS13::EchState]
     # rubocop: disable Metrics/AbcSize
     def self.offer_ech(inner, ech_config, hpke_cipher_suite_selector)
@@ -110,7 +110,7 @@ module TTTLS13
     # @param ech_state [TTTLS13::EchState]
     #
     # @return [TTTLS13::Message::ClientHello]
-    # @return [TTTLS13::Message::ClientHello]
+    # @return [TTTLS13::Message::ClientHello] ClientHelloInner
     def self.offer_new_ech(inner, ech_state)
       # for ech_outer_extensions
       replaced = \
@@ -209,9 +209,9 @@ module TTTLS13
                               payload_len,
                               server_name)
       aad_ech = Message::Extension::ECHClientHello.new_outer(
-        cipher_suite: cipher_suite,
-        config_id: config_id,
-        enc: enc,
+        cipher_suite:,
+        config_id:,
+        enc:,
         payload: payload_len.zeros
       )
       Message::ClientHello.new(
@@ -237,10 +237,10 @@ module TTTLS13
     # @return [TTTLS13::Message::ClientHello]
     def self.new_ch_outer(aad, cipher_suite, config_id, enc, payload)
       outer_ech = Message::Extension::ECHClientHello.new_outer(
-        cipher_suite: cipher_suite,
-        config_id: config_id,
-        enc: enc,
-        payload: payload
+        cipher_suite:,
+        config_id:,
+        enc:,
+        payload:
       )
       Message::ClientHello.new(
         legacy_version: aad.legacy_version,
@@ -284,16 +284,16 @@ module TTTLS13
                     + aead_id2overhead_len(AeadId::AES_128_GCM)
 
       Message::Extension::ECHClientHello.new_outer(
-        cipher_suite: cipher_suite,
+        cipher_suite:,
         config_id: Convert.bin2i(OpenSSL::Random.random_bytes(1)),
-        enc: enc,
+        enc:,
         payload: OpenSSL::Random.random_bytes(payload_len)
       )
     end
 
     # @return [Integer]
     def self.placeholder_encoded_ch_inner_len
-      448
+      480
     end
 
     # @param inner [TTTLS13::Message::ClientHello]
@@ -399,11 +399,7 @@ module TTTLS13
   end
 
   class EchState
-    attr_reader :maximum_name_length
-    attr_reader :config_id
-    attr_reader :cipher_suite
-    attr_reader :public_name
-    attr_reader :ctx
+    attr_reader :maximum_name_length, :config_id, :cipher_suite, :public_name, :ctx
 
     # @param maximum_name_length [Integer]
     # @param config_id [Integer]

data/lib/tttls1.3/endpoint.rb

@@ -26,9 +26,9 @@ module TTTLS13
     def self.gen_cipher(cipher_suite, write_key, write_iv)
       seq_num = SequenceNumber.new
       Cryptograph::Aead.new(
-        cipher_suite: cipher_suite,
-        write_key: write_key,
-        write_iv: write_iv,
+        cipher_suite:,
+        write_key:,
+        write_iv:,
         sequence_number: seq_num
       )
     end
@@ -60,7 +60,6 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [String]
-    # rubocop: disable Metrics/CyclomaticComplexity
     def self.sign_certificate_verify(key:, signature_scheme:, context:, hash:)
       content = "\x20" * 64 + context + "\x00" + hash
 
@@ -92,7 +91,6 @@ module TTTLS13
         terminate(:internal_error)
       end
     end
-    # rubocop: enable Metrics/CyclomaticComplexity
 
     # @param public_key [OpenSSL::PKey::PKey]
     # @param signature_scheme [TTTLS13::SignatureScheme]
@@ -103,7 +101,6 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [Boolean]
-    # rubocop: disable Metrics/CyclomaticComplexity
     def self.verified_certificate_verify?(public_key:, signature_scheme:,
                                           signature:, context:, hash:)
       content = "\x20" * 64 + context + "\x00" + hash
@@ -136,7 +133,6 @@ module TTTLS13
         terminate(:internal_error)
       end
     end
-    # rubocop: enable Metrics/CyclomaticComplexity
 
     # @param digest [String] name of digest algorithm
     # @param finished_key [String]
@@ -154,27 +150,10 @@ module TTTLS13
     #
     # @return [Boolean]
     def self.verified_finished?(finished:, digest:, finished_key:, hash:)
-      sign_finished(digest: digest, finished_key: finished_key, hash: hash) \
+      sign_finished(digest:, finished_key:, hash:) \
       == finished.verify_data
     end
 
-    # @param key_exchange [String]
-    # @param priv_key [OpenSSL::PKey::$Object]
-    # @param group [TTTLS13::NamedGroup]
-    #
-    # @return [String]
-    def self.gen_shared_secret(key_exchange, priv_key, group)
-      curve = NamedGroup.curve_name(group)
-      terminate(:internal_error) if curve.nil?
-
-      pub_key = OpenSSL::PKey::EC::Point.new(
-        OpenSSL::PKey::EC::Group.new(curve),
-        OpenSSL::BN.new(key_exchange, 2)
-      )
-
-      priv_key.dh_compute_key(pub_key)
-    end
-
     # @param certificate_list [Array of CertificateEntry]
     # @param ca_file [String] path to ca.crt
     # @param hostname [String]

data/lib/tttls1.3/key_schedule.rb

@@ -9,7 +9,7 @@ module TTTLS13
     # @param shared_secret [String]
     # @param cipher_suite [TTTLS13::CipherSuite]
     # @param transcript [TTTLS13::Transcript]
-    def initialize(psk: nil, shared_secret:, cipher_suite:, transcript:)
+    def initialize(shared_secret:, cipher_suite:, transcript:, psk: nil)
       @digest = CipherSuite.digest(cipher_suite)
       @hash_len = CipherSuite.hash_len(cipher_suite)
       @key_len = CipherSuite.key_len(cipher_suite)
@@ -250,7 +250,7 @@ module TTTLS13
     #
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
-    # @param [String]
+    # @return [String]
     def self.hkdf_expand(secret, info, length, digest)
       hash_len = OpenSSL::Digest.new(digest).digest_length
       raise Error::ErrorAlerts, :internal_error if length > 255 * hash_len

data/lib/tttls1.3/logging.rb

@@ -8,7 +8,7 @@ module TTTLS13
     end
 
     def self.logger
-      @logger ||= Logger.new(STDERR, Logger::WARN)
+      @logger ||= Logger.new($stderr, Logger::WARN)
     end
   end
 end

data/lib/tttls1.3/message/alert.rb

@@ -42,12 +42,11 @@ module TTTLS13
     # rubocop: enable Layout/HashAlignment
 
     class Alert
-      attr_reader :level
-      attr_reader :description
+      attr_reader :level, :description
 
       # @param level [TTTLS13::Message::AlertLevel]
       # @param description [String] value of ALERT_DESCRIPTION
-      def initialize(level: nil, description:)
+      def initialize(description:, level: nil)
         @level = level
         @description = description
         if @level.nil? && (@description == ALERT_DESCRIPTION[:user_canceled] ||
@@ -74,7 +73,7 @@ module TTTLS13
 
         level = binary[0]
         description = binary[1]
-        Alert.new(level: level, description: description)
+        Alert.new(level:, description:)
       end
 
       # @return [TTTLS13::Error::ErrorAlerts]

data/lib/tttls1.3/message/application_data.rb

@@ -6,7 +6,7 @@ module TTTLS13
     class ApplicationData
       attr_reader :fragment
 
-      # @param [String]
+      # @param fragment [String]
       def initialize(fragment)
         @fragment = fragment
       end

data/lib/tttls1.3/message/certificate.rb

@@ -12,9 +12,7 @@ module TTTLS13
     private_constant :APPEARABLE_CT_EXTENSIONS
 
     class Certificate
-      attr_reader :msg_type
-      attr_reader :certificate_request_context
-      attr_reader :certificate_list
+      attr_reader :msg_type, :certificate_request_context, :certificate_list
 
       # @param certificate_request_context [String]
       # @param certificate_list [Array of CertificateEntry]
@@ -60,8 +58,8 @@ module TTTLS13
                                                        i == binary.length
 
         Certificate.new(
-          certificate_request_context: certificate_request_context,
-          certificate_list: certificate_list
+          certificate_request_context:,
+          certificate_list:
         )
       end
 
@@ -115,8 +113,7 @@ module TTTLS13
     end
 
     class CertificateEntry
-      attr_reader :cert_data
-      attr_reader :extensions
+      attr_reader :cert_data, :extensions
 
       # @param cert_data [OpenSSL::X509::Certificate]
       # @param extensions [TTTLS13::Message::Extensions]

data/lib/tttls1.3/message/certificate_verify.rb

@@ -5,9 +5,7 @@ module TTTLS13
   using Refinements
   module Message
     class CertificateVerify
-      attr_reader :msg_type
-      attr_reader :signature_scheme
-      attr_reader :signature
+      attr_reader :msg_type, :signature_scheme, :signature
 
       # @param signature_scheme [TTTLS13::SignatureScheme]
       # @param signature [String]
@@ -51,8 +49,8 @@ module TTTLS13
           unless signature_len + 4 == msg_len &&
                  signature_len + 8 == binary.length
 
-        CertificateVerify.new(signature_scheme: signature_scheme,
-                              signature: signature)
+        CertificateVerify.new(signature_scheme:,
+                              signature:)
       end
     end
   end

data/lib/tttls1.3/message/client_hello.rb

@@ -37,13 +37,8 @@ module TTTLS13
     private_constant :APPEARABLE_CH_EXTENSIONS
 
     class ClientHello
-      attr_reader :msg_type
-      attr_reader :legacy_version
-      attr_reader :random
-      attr_reader :legacy_session_id
-      attr_reader :cipher_suites
-      attr_reader :legacy_compression_methods
-      attr_reader :extensions
+      attr_reader :msg_type, :legacy_version, :random, :legacy_session_id, :cipher_suites, :legacy_compression_methods,
+                  :extensions
 
       # @param legacy_version [String]
       # @param random [String]
@@ -52,10 +47,9 @@ module TTTLS13
       # @param legacy_compression_methods [Array of String]
       # @param extensions [TTTLS13::Message::Extensions]
       # rubocop: disable Metrics/ParameterLists
-      def initialize(legacy_version: ProtocolVersion::TLS_1_2,
+      def initialize(cipher_suites:, legacy_version: ProtocolVersion::TLS_1_2,
                      random: OpenSSL::Random.random_bytes(32),
                      legacy_session_id: OpenSSL::Random.random_bytes(32),
-                     cipher_suites:,
                      legacy_compression_methods: ["\x00"],
                      extensions: Extensions.new)
         @msg_type = HandshakeType::CLIENT_HELLO
@@ -118,12 +112,12 @@ module TTTLS13
         raise Error::ErrorAlerts, :decode_error unless i == msg_len + 4 &&
                                                        i == binary.length
 
-        ClientHello.new(legacy_version: legacy_version,
-                        random: random,
-                        legacy_session_id: legacy_session_id,
-                        cipher_suites: cipher_suites,
-                        legacy_compression_methods: legacy_compression_methods,
-                        extensions: extensions)
+        ClientHello.new(legacy_version:,
+                        random:,
+                        legacy_session_id:,
+                        cipher_suites:,
+                        legacy_compression_methods:,
+                        extensions:)
       end
       # rubocop: enable Metrics/AbcSize
       # rubocop: enable Metrics/MethodLength
@@ -160,6 +154,14 @@ module TTTLS13
           sg_groups.filter { |g| ks_groups.include?(g) } == ks_groups &&
           ks_groups.uniq == ks_groups
       end
+
+      # @return [Boolean]
+      def ch_inner?
+        ech = @extensions[Message::ExtensionType::ENCRYPTED_CLIENT_HELLO]
+        return false if ech.nil?
+
+        ech.type == Message::Extension::ECHClientHelloType::INNER
+      end
     end
   end
 end

data/lib/tttls1.3/message/compressed_certificate.rb

@@ -5,9 +5,7 @@ module TTTLS13
   using Refinements
   module Message
     class CompressedCertificate
-      attr_reader :msg_type
-      attr_reader :certificate_message
-      attr_reader :algorithm
+      attr_reader :msg_type, :certificate_message, :algorithm
 
       # @param certificate_message [TTTLS13::Message::Certificate]
       # @param algorithm [CertificateCompressionAlgorithm]
@@ -41,8 +39,6 @@ module TTTLS13
       #
       # @return [TTTLS13::Message::CompressedCertificate]
       # rubocop: disable Metrics/AbcSize
-      # rubocop: disable Metrics/CyclomaticComplexity
-      # rubocop: disable Metrics/PerceivedComplexity
       def self.deserialize(binary)
         raise Error::ErrorAlerts, :internal_error if binary.nil?
         raise Error::ErrorAlerts, :decode_error if binary.length < 5
@@ -70,13 +66,11 @@ module TTTLS13
           HandshakeType::CERTIFICATE + ct_bin.prefix_uint24_length
         )
         CompressedCertificate.new(
-          certificate_message: certificate_message,
-          algorithm: algorithm
+          certificate_message:,
+          algorithm:
         )
       end
       # rubocop: enable Metrics/AbcSize
-      # rubocop: enable Metrics/CyclomaticComplexity
-      # rubocop: enable Metrics/PerceivedComplexity
     end
   end
 end

data/lib/tttls1.3/message/encrypted_extensions.rb

@@ -21,8 +21,7 @@ module TTTLS13
     private_constant :APPEARABLE_EE_EXTENSIONS
 
     class EncryptedExtensions
-      attr_reader :msg_type
-      attr_reader :extensions
+      attr_reader :msg_type, :extensions
 
       # @param extensions [TTTLS13::Message::Extensions]
       def initialize(extensions = Extensions.new)

data/lib/tttls1.3/message/extension/alpn.rb

@@ -6,10 +6,9 @@ module TTTLS13
   module Message
     module Extension
       class Alpn
-        attr_reader :extension_type
-        attr_reader :protocol_name_list
+        attr_reader :extension_type, :protocol_name_list
 
-        # @param named_group_list [Array of String]
+        # @param protocol_name_list [Array] Array of String
         #
         # @raise [TTTLS13::Error::ErrorAlerts]
         #
@@ -39,8 +38,6 @@ module TTTLS13
         # @raise [TTTLS13::Error::ErrorAlerts]
         #
         # @return [TTTLS13::Message::Extension::Alpn, nil]
-        # rubocop: disable Metrics/CyclomaticComplexity
-        # rubocop: disable Metrics/PerceivedComplexity
         def self.deserialize(binary)
           raise Error::ErrorAlerts, :internal_error if binary.nil?
 
@@ -64,8 +61,6 @@ module TTTLS13
 
           Alpn.new(protocol_name_list)
         end
-        # rubocop: enable Metrics/CyclomaticComplexity
-        # rubocop: enable Metrics/PerceivedComplexity
       end
     end
   end

data/lib/tttls1.3/message/extension/compress_certificate.rb

@@ -13,8 +13,7 @@ module TTTLS13
 
       # https://datatracker.ietf.org/doc/html/rfc8879
       class CompressCertificate
-        attr_reader :extension_type
-        attr_reader :algorithms
+        attr_reader :extension_type, :algorithms
 
         # @param algorithms [Array of CertificateCompressionAlgorithm]
         #

data/lib/tttls1.3/message/extension/cookie.rb

@@ -6,8 +6,7 @@ module TTTLS13
   module Message
     module Extension
       class Cookie
-        attr_reader :extension_type
-        attr_reader :cookie
+        attr_reader :extension_type, :cookie
 
         # @param cookie [String]
         #

data/lib/tttls1.3/message/extension/early_data_indication.rb

@@ -6,8 +6,7 @@ module TTTLS13
   module Message
     module Extension
       class EarlyDataIndication
-        attr_reader :extension_type
-        attr_reader :max_early_data_size
+        attr_reader :extension_type, :max_early_data_size
 
         # @param max_early_data_size [Integer, nil]
         #

data/lib/tttls1.3/message/extension/ech.rb

@@ -12,7 +12,6 @@ module TTTLS13
         INNER = "\x01"
       end
 
-      # NOTE:
       #     struct {
       #         ECHClientHelloType type;
       #         select (ECHClientHello.type) {
@@ -26,12 +25,7 @@ module TTTLS13
       #         };
       #     } ECHClientHello;
       class ECHClientHello
-        attr_reader :extension_type
-        attr_reader :type
-        attr_reader :cipher_suite
-        attr_reader :config_id
-        attr_reader :enc
-        attr_reader :payload
+        attr_reader :extension_type, :type, :cipher_suite, :config_id, :enc, :payload
 
         # @param type [TTTLS13::Message::Extension::ECHClientHelloType]
         # @param cipher_suite [HpkeSymmetricCipherSuite]
@@ -126,8 +120,8 @@ module TTTLS13
               type: ECHClientHelloType::OUTER,
               cipher_suite: cs,
               config_id: cid,
-              enc: enc,
-              payload: payload
+              enc:,
+              payload:
             )
           end
 
@@ -157,21 +151,19 @@ module TTTLS13
         def self.new_outer(cipher_suite:, config_id:, enc:, payload:)
           ECHClientHello.new(
             type: ECHClientHelloType::OUTER,
-            cipher_suite: cipher_suite,
-            config_id: config_id,
-            enc: enc,
-            payload: payload
+            cipher_suite:,
+            config_id:,
+            enc:,
+            payload:
           )
         end
       end
 
-      # NOTE:
       #     struct {
       #         ECHConfigList retry_configs;
       #     } ECHEncryptedExtensions;
       class ECHEncryptedExtensions
-        attr_reader :extension_type
-        attr_reader :retry_configs
+        attr_reader :extension_type, :retry_configs
 
         # @param retry_configs [Array of ECHConfig]
         def initialize(retry_configs)
@@ -202,13 +194,11 @@ module TTTLS13
         end
       end
 
-      # NOTE:
       #     struct {
       #         opaque confirmation[8];
       #     } ECHHelloRetryRequest;
       class ECHHelloRetryRequest
-        attr_reader :extension_type
-        attr_reader :confirmation
+        attr_reader :extension_type, :confirmation
 
         # @param confirmation [String]
         def initialize(confirmation)

data/lib/tttls1.3/message/extension/ech_outer_extensions.rb

@@ -5,11 +5,9 @@ module TTTLS13
   using Refinements
   module Message
     module Extension
-      # NOTE:
       #     ExtensionType OuterExtensions<2..254>;
       class ECHOuterExtensions
-        attr_reader :extension_type
-        attr_reader :outer_extensions
+        attr_reader :extension_type, :outer_extensions
 
         # @param outer_extensions [Array of TTTLS13::Message::ExtensionType]
         def initialize(outer_extensions)