Class: EchSpec::Spec::Spec7_1_14_2_1

Inherits:
WithSocket show all
Defined in:
lib/echspec/spec/7.1-14.2.1.rb

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from WithSocket

#initialize, #message_stack, #with_socket

Constructor Details

This class inherits a constructor from EchSpec::Spec::WithSocket

Class Method Details

.spec_group ⇒ EchSpec::SpecGroup

Returns:



19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/echspec/spec/7.1-14.2.1.rb', line 19

def self.spec_group
  SpecGroup.new(
    '7.1-14.2.1',
    [
      SpecCase.new(
        'MUST include the "encrypted_client_hello" extension in its EncryptedExtensions with the "retry_configs" field set to one or more ECHConfig.',
        method(:validate_ee_retry_configs)
      )
    ]
  )
end

.validate_ee_retry_configs(hostname, port, _) ⇒ EchSpec::Ok | Err

Parameters:

  • hostname (String)
  • port (Integer)
  • _ (ECHConfig)

Returns:



36
37
38
 
# File 'lib/echspec/spec/7.1-14.2.1.rb', line 36

def self.validate_ee_retry_configs(hostname, port, _)
  Spec7_1_14_2_1.new.do_validate_ee_retry_configs(hostname, port)
end

Instance Method Details

#do_validate_ee_retry_configs(hostname, port) ⇒ EchSpec::Ok | Err

Parameters:

  • hostname (String)
  • port (Integer)

Returns:



44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/echspec/spec/7.1-14.2.1.rb', line 44

def do_validate_ee_retry_configs(hostname, port)
  with_socket(hostname, port) do |socket|
    recv = send_ch_with_greased_ech(socket, hostname)
    ex = recv.extensions[TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO]
    return Err.new('did not send expected alert: encrypted_client_hello', message_stack) \
      unless ex.is_a?(TTTLS13::Message::Extension::ECHEncryptedExtensions)
    return Err.new('ECHConfigs did not have "retry_configs"', message_stack) \
      if ex.retry_configs.nil? || ex.retry_configs.empty?

    Ok.new(nil)
  end
end

#send_ch_with_greased_ech(socket, hostname) ⇒ Object

rubocop: disable Metrics/AbcSize rubocop: disable Metrics/MethodLength

Raises:



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
 
# File 'lib/echspec/spec/7.1-14.2.1.rb', line 59

def send_ch_with_greased_ech(socket, hostname)
  # send ClientHello
  conn = TLS13Client::Connection.new(socket, :client)
  inner_ech = TTTLS13::Message::Extension::ECHClientHello.new_inner
  exs, priv_keys = TLS13Client.gen_ch_extensions(hostname)
  inner = TTTLS13::Message::ClientHello.new(
    cipher_suites: TTTLS13::CipherSuites.new(
      [
        TTTLS13::CipherSuite::TLS_AES_256_GCM_SHA384,
        TTTLS13::CipherSuite::TLS_CHACHA20_POLY1305_SHA256,
        TTTLS13::CipherSuite::TLS_AES_128_GCM_SHA256
      ]
    ),
    extensions: exs.merge(
      TTTLS13::Message::ExtensionType::ENCRYPTED_CLIENT_HELLO => inner_ech
    )
  )
  @stack << inner

  ch = TTTLS13::Ech.new_greased_ch(inner, TTTLS13::Ech.new_grease_ech)
  conn.send_record(
    TTTLS13::Message::Record.new(
      type: TTTLS13::Message::ContentType::HANDSHAKE,
      messages: [ch],
      cipher: TTTLS13::Cryptograph::Passer.new
    )
  )
  @stack << ch

  # receive ServerHello
  recv, = conn.recv_message(TTTLS13::Cryptograph::Passer.new)
  @stack << recv
  raise Error::BeforeTargetSituationError, 'not received ServerHello' \
    unless recv.is_a?(TTTLS13::Message::ServerHello) && !recv.hrr?

  # receive EncryptedExtensions
  transcript = TTTLS13::Transcript.new
  transcript[TTTLS13::CH] = [ch, ch.serialize]
  sh = recv
  transcript[TTTLS13::SH] = [sh, sh.serialize]
  kse = sh.extensions[TTTLS13::Message::ExtensionType::KEY_SHARE]
          .key_share_entry.first
  shared_secret = TTTLS13::Endpoint.gen_shared_secret(
    kse.key_exchange,
    priv_keys[kse.group],
    kse.group
  )
  key_schedule = TTTLS13::KeySchedule.new(
    psk: nil,
    shared_secret:,
    cipher_suite: sh.cipher_suite,
    transcript:
  )
  hs_rcipher = TTTLS13::Endpoint.gen_cipher(
    sh.cipher_suite,
    key_schedule.server_handshake_write_key,
    key_schedule.server_handshake_write_iv
  )
  recv, = conn.recv_message(hs_rcipher)
  @stack << recv
  if recv.is_a?(TTTLS13::Message::ChangeCipherSpec)
    recv, = conn.recv_message(hs_rcipher)
    @stack << recv
  end

  raise Error::BeforeTargetSituationError, 'not received EncryptedExtensions' \
    unless recv.is_a?(TTTLS13::Message::EncryptedExtensions)

  recv
end