= mutableListOf()
+
+ override fun createSocket(
+ socket: Socket,
+ host: String,
+ port: Int,
+ autoClose: Boolean,
+ ): SSLSocket {
+ val sslSocket = delegate.createSocket(socket, host, port, autoClose) as SSLSocket
+ val echConfigList = dns[host]
+ if (echConfigList != null) {
+ Conscrypt.setEchConfigList(sslSocket, echConfigList.toByteArray())
+ synchronized(encryptedHostnames) { encryptedHostnames += host }
+ }
+ return sslSocket
+ }
+}
diff --git a/network/src/test/kotlin/okhttp/testbed/network/EchClientHelloTest.kt b/network/src/test/kotlin/okhttp/testbed/network/EchClientHelloTest.kt
new file mode 100644
index 0000000..d2d1328
--- /dev/null
+++ b/network/src/test/kotlin/okhttp/testbed/network/EchClientHelloTest.kt
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.testbed.network
+
+import assertk.assertThat
+import assertk.assertions.isFalse
+import assertk.assertions.isTrue
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.io.OutputStream
+import java.net.InetAddress
+import java.net.ServerSocket
+import java.net.Socket
+import java.security.SecureRandom
+import javax.net.ssl.SSLSocket
+import kotlin.concurrent.thread
+import org.junit.jupiter.api.Assumptions.assumeTrue
+import org.junit.jupiter.api.Test
+
+/**
+ * Reads the client hello Conscrypt actually sends, and checks that the name is not in it.
+ *
+ * Every other ECH suite here asks a server whether it saw an encrypted client hello, which means
+ * every other ECH suite depends on somebody's uptime and on a network that doesn't intercept TLS.
+ * This one asks the only question that has to be true for any of the rest to be — did the bytes
+ * on the wire carry the name in the clear — and answers it against a socket that accepts a
+ * connection and says nothing. It needs no DNS, no internet and no server, so it is the suite
+ * that says whether a red result elsewhere is about ECH or about the network the run was on.
+ *
+ * The config list here is synthetic. A real one comes from a DNS `HTTPS` record and is paired
+ * with a key the server holds; nothing here completes a handshake, so an unpaired public key is
+ * fine. It does have to be a well-formed `ECHConfigList` — BoringSSL rejects a malformed one, and
+ * a rejected config means a client hello with no ECH in it, which is exactly the failure this
+ * would otherwise miss.
+ */
+class EchClientHelloTest {
+ @Test
+ fun theNameIsNotSentInTheClear() {
+ assumeTrue(ConscryptEch.isSupported) {
+ "requires a Conscrypt with ECH. Run conscrypt/fetch-conscrypt.sh."
+ }
+
+ val trustManager = EchEnablingTrustManager(ConscryptEch.platformTrustManager())
+ val sslContext = ConscryptEch.sslContext(trustManager)
+
+ val clientHello = captureClientHello { server ->
+ val socket =
+ sslContext.socketFactory.createSocket(
+ Socket(InetAddress.getLoopbackAddress(), server.localPort),
+ INNER_NAME,
+ server.localPort,
+ true,
+ ) as SSLSocket
+ org.conscrypt.Conscrypt.setEchConfigList(socket, echConfigList(PUBLIC_NAME))
+ try {
+ socket.startHandshake()
+ } catch (_: IOException) {
+ // Nothing answers. The first flight is all this needs.
+ }
+ }
+
+ // 0xfe0d is both the `encrypted_client_hello` extension type and the ECHConfig version, which
+ // is why matching the two bytes anywhere in the hello is enough: an ECH-less hello from this
+ // stack contains neither.
+ assertThat(clientHello.containsBytes(byteArrayOf(0xfe.toByte(), 0x0d))).isTrue()
+
+ // The outer hello names the public name, and the real one is encrypted. Both halves matter:
+ // a client that sent no SNI at all would pass the second check on its own.
+ assertThat(clientHello.containsBytes(PUBLIC_NAME.toByteArray(Charsets.US_ASCII))).isTrue()
+ assertThat(clientHello.containsBytes(INNER_NAME.toByteArray(Charsets.US_ASCII))).isFalse()
+ }
+
+ /** Runs [connect] against a socket that accepts once, reads the first flight, and closes. */
+ private fun captureClientHello(connect: (ServerSocket) -> Unit): ByteArray {
+ ServerSocket(0, 1, InetAddress.getLoopbackAddress()).use { server ->
+ var captured = ByteArray(0)
+ val accepter =
+ thread {
+ try {
+ server.accept().use { accepted ->
+ val buffer = ByteArray(16 * 1024)
+ val read = accepted.getInputStream().read(buffer)
+ if (read > 0) captured = buffer.copyOf(read)
+ }
+ } catch (_: IOException) {
+ }
+ }
+
+ connect(server)
+ accepter.join(5_000)
+ return captured
+ }
+ }
+
+ private fun ByteArray.containsBytes(needle: ByteArray): Boolean =
+ (0..size - needle.size).any { start ->
+ needle.indices.all { this[start + it] == needle[it] }
+ }
+
+ /**
+ * An `ECHConfigList` for [publicName], from RFC 9849 section 4.
+ *
+ * ```
+ * ECHConfigList uint16 length, then ECHConfig*
+ * ECHConfig uint16 version, uint16 length, ECHConfigContents
+ * ```
+ */
+ private fun echConfigList(publicName: String): ByteArray {
+ val publicKey = ByteArray(32).also(SecureRandom()::nextBytes)
+
+ val contents =
+ ByteArrayOutputStream().apply {
+ write(CONFIG_ID)
+ writeShort(KEM_X25519_HKDF_SHA256)
+ writeShort(publicKey.size)
+ write(publicKey)
+ writeShort(4) // cipher_suites, one suite of two uint16s.
+ writeShort(KDF_HKDF_SHA256)
+ writeShort(AEAD_AES_128_GCM)
+ write(MAXIMUM_NAME_LENGTH)
+ val name = publicName.toByteArray(Charsets.US_ASCII)
+ write(name.size)
+ write(name)
+ writeShort(0) // No extensions.
+ }.toByteArray()
+
+ val config =
+ ByteArrayOutputStream().apply {
+ writeShort(ECH_CONFIG_VERSION)
+ writeShort(contents.size)
+ write(contents)
+ }.toByteArray()
+
+ return ByteArrayOutputStream().apply {
+ writeShort(config.size)
+ write(config)
+ }.toByteArray()
+ }
+
+ private fun OutputStream.writeShort(value: Int) {
+ write((value ushr 8) and 0xff)
+ write(value and 0xff)
+ }
+
+ private companion object {
+ /** Neither name is resolved or connected to; they only have to be distinguishable. */
+ private const val PUBLIC_NAME = "public.example.com"
+ private const val INNER_NAME = "secret.example.com"
+
+ private const val ECH_CONFIG_VERSION = 0xfe0d
+ private const val CONFIG_ID = 42
+ private const val KEM_X25519_HKDF_SHA256 = 0x0020
+ private const val KDF_HKDF_SHA256 = 0x0001
+ private const val AEAD_AES_128_GCM = 0x0001
+ private const val MAXIMUM_NAME_LENGTH = 64
+ }
+}
diff --git a/network/src/test/kotlin/okhttp/testbed/network/EchConscryptTest.kt b/network/src/test/kotlin/okhttp/testbed/network/EchConscryptTest.kt
new file mode 100644
index 0000000..d89f9d6
--- /dev/null
+++ b/network/src/test/kotlin/okhttp/testbed/network/EchConscryptTest.kt
@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.testbed.network
+
+import assertk.assertThat
+import assertk.assertions.contains
+import assertk.assertions.doesNotContain
+import assertk.assertions.isNotNull
+import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.dnsoverhttps.DnsOverHttps
+import org.junit.jupiter.api.Assumptions.assumeTrue
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+
+/**
+ * The same servers [EchTest] calls, reached through a Conscrypt built from `google3-export`
+ * instead of through the JDK's TLS stack.
+ *
+ * [EchTest] fails its `sni=encrypted` assertions on the JVM, and that is a true result: no
+ * published TLS stack a JVM can load will encrypt a client hello. This suite exists to say what
+ * is missing rather than that something is. It supplies the two pieces the JVM lacks — a
+ * Conscrypt with ECH in it, and a network security policy that says ECH is allowed — and leaves
+ * everything else to OkHttp. When these pass and [EchTest] doesn't, the difference is the work
+ * still to be done, and it is a small and specific piece of work:
+ *
+ * * `ConscryptPlatform.configureTlsExtensions` accepts an `echConfigList` and ignores it. It
+ * needs to call `Conscrypt.setEchConfigList`, the way `Android10Platform` does.
+ * * `ConscryptPlatform.getEchRetryConfig` doesn't exist. Android's reads the retry config out
+ * of an `EchConfigMismatchException`; Conscrypt's OpenJDK `Platform` throws away both the
+ * retry configs and the public name, so on the JVM there is nothing to read. That one is a
+ * Conscrypt change, not an OkHttp change, which is why the stale-config case from [EchTest]
+ * has no counterpart here.
+ *
+ * The Conscrypt this needs is not published anywhere. `conscrypt/build-conscrypt.sh` builds it
+ * and the `conscrypt` workflow caches the result as a release; without it every test here skips.
+ * See `conscrypt/README.md`.
+ */
+@RequiresEndpoint(Endpoint.CLOUDFLARE_DOH)
+class EchConscryptTest {
+ private lateinit var client: OkHttpClient
+ private lateinit var dns: EchRecordingDns
+ private lateinit var socketFactory: EchSocketFactory
+
+ @BeforeEach
+ fun setUp() {
+ assumeTrue(ConscryptEch.isSupported) {
+ "requires a Conscrypt with ECH. Run conscrypt/fetch-conscrypt.sh."
+ }
+
+ val trustManager = EchEnablingTrustManager(ConscryptEch.platformTrustManager())
+ val sslContext = ConscryptEch.sslContext(trustManager)
+
+ // Conscrypt for the bootstrap client too, so one TLS stack is under test rather than two.
+ // The resolver is addressed by IP, so resolving it doesn't need a resolver.
+ val bootstrapClient =
+ OkHttpClient
+ .Builder()
+ .sslSocketFactory(sslContext.socketFactory, trustManager)
+ .build()
+
+ dns =
+ EchRecordingDns(
+ DnsOverHttps
+ .Builder()
+ .client(bootstrapClient)
+ .url("https://1.1.1.1/dns-query".toHttpUrl())
+ .includeServiceMetadata(true)
+ .build(),
+ )
+
+ socketFactory = EchSocketFactory(sslContext.socketFactory, dns)
+
+ client =
+ bootstrapClient
+ .newBuilder()
+ .sslSocketFactory(socketFactory, trustManager)
+ .dns(dns)
+ .build()
+ }
+
+ @Test
+ @RequiresEndpoint(Endpoint.CLOUDFLARE_ECH)
+ fun cloudflareAcceptsAnEncryptedClientHello() {
+ val body = get("https://cloudflare-ech.com/cdn-cgi/trace")
+
+ assertThat(socketFactory.encryptedHostnames).contains("cloudflare-ech.com")
+ assertThat(body).contains("sni=encrypted")
+ }
+
+ @Test
+ @RequiresEndpoint(Endpoint.TLS_ECH_DEV)
+ fun tlsEchDevAcceptsAnEncryptedClientHello() {
+ val body = get("https://tls-ech.dev/")
+
+ assertThat(socketFactory.encryptedHostnames).contains("tls-ech.dev")
+
+ // Only the heading identifies the server we reached; every page links to all of the others.
+ assertThat(body).contains("tls-ech.dev
")
+ assertThat(body).contains("You are using ECH")
+ assertThat(body).doesNotContain("not using ECH")
+ }
+
+ @Test
+ @RequiresEndpoint(Endpoint.DEFO_IE)
+ fun defoIeAcceptsAnEncryptedClientHello() {
+ val body = get("https://defo.ie/ech-check.php")
+
+ assertThat(socketFactory.encryptedHostnames).contains("defo.ie")
+ assertThat(body).contains("SSL_ECH_STATUS: success")
+ }
+
+ /**
+ * TLS 1.2 cannot carry ECH, and this name publishes no config list. The point is that the
+ * connection still happens: a client that can do ECH must not break the servers that can't.
+ */
+ @Test
+ @RequiresEndpoint(Endpoint.TLS_ECH_DEV)
+ fun tls12IsReachedWithoutEch() {
+ val body = get("https://tls12.tls-ech.dev/")
+
+ assertThat(body).contains("tls12.tls-ech.dev
")
+ assertThat(body).contains("You are not using ECH")
+ assertThat(body).doesNotContain("You are using ECH")
+ }
+
+ /**
+ * The config list still has to reach OkHttp for any of this to be OkHttp's ECH rather than the
+ * suite's. This asserts the half that already works, on the same connection as the rest.
+ */
+ @Test
+ @RequiresEndpoint(Endpoint.CLOUDFLARE_ECH)
+ fun okHttpResolvesTheConfigListFromDns() {
+ get("https://cloudflare-ech.com/cdn-cgi/trace")
+
+ assertThat(dns["cloudflare-ech.com"]).isNotNull()
+ }
+
+ private fun get(url: String): String =
+ client.newCall(Request(url.toHttpUrl())).execute().use { it.body.string() }
+}
diff --git a/site/tools/collect_results.py b/site/tools/collect_results.py
index e2b0d59..2337c69 100644
--- a/site/tools/collect_results.py
+++ b/site/tools/collect_results.py
@@ -45,7 +45,13 @@
import xml.etree.ElementTree as ElementTree
# Gradle test tasks whose failures are findings about OkHttp rather than breakage here.
-REPORTING_TASKS = {"loomTest", "echTest", "networkTest"}
+REPORTING_TASKS = {"loomTest", "echTest", "echConscryptTest", "networkTest"}
+
+# The same distinction for suites that can't make it with a task name. Android instrumentation
+# runs under one task whatever it is testing, so the Android suite that calls tls-ech.dev and
+# defo.ie has no way to say it reports rather than gates except by being named here. Everything
+# else in the Android module runs against containers this repository starts.
+REPORTING_CLASSES = {"PublicEncryptedClientHelloTest"}
# How many collections the history keeps. Enough for the trend strip to show a few weeks of
# daily runs without the file growing without bound.
@@ -98,7 +104,7 @@ def parse_suite(path: pathlib.Path, task: str, workflow: str, run_url: str) -> d
"workflow": workflow,
"runUrl": run_url,
"task": task,
- "reporting": task in REPORTING_TASKS,
+ "reporting": task in REPORTING_TASKS or simple_name in REPORTING_CLASSES,
"timeSeconds": float(root.get("time") or 0.0),
"passed": sum(1 for c in cases if c["status"] == "passed"),
"failed": sum(1 for c in cases if c["status"] == "failed"),
diff --git a/site/topics/ech.html b/site/topics/ech.html
index 2bdcaa9..b353704 100644
--- a/site/topics/ech.html
+++ b/site/topics/ech.html
@@ -96,6 +96,60 @@ What runs today
DnsOverHttps.Builder.includeServiceMetadata, and no release has it: 5.4.0 resolves
A and AAAA records only, so there is no HTTPS record to carry a config list at all.
+
+ The same emulator also runs PublicEncryptedClientHelloTest, which is the JVM
+ suite's cases against tls-ech.dev, defo.ie and
+ cloudflare-ech.com. The fixture suite says whether the client is right; this one
+ makes the JVM and Android rows of the status page comparable, since they are then the same
+ assertions against the same servers with only the TLS stack differing. It reports rather than
+ gates, for the reason everything calling those servers does.
+
+
+ What it would take on the JVM
+
+ network:echTest runs the same cases against the public servers on a JVM, and its
+ route assertions pass while its assertions about what the server saw fail. That is a true
+ result and a slightly misleading one: it reads as "OkHttp cannot do ECH on the JVM", where the
+ accurate version is that three separate things are in the way and only one of them is OkHttp's.
+
+
+
+ network:echConscryptTest supplies the first and leaves the rest to OkHttp, so the
+ gap between it and echTest is the second row and nothing else. Under it,
+ EchClientHelloTest reads the client hello off a local socket that answers nothing
+ and asserts the name is not in the bytes — no DNS, no server, no network — which makes it the
+ one ECH result that is never about somebody else's uptime.
+
+
+ The third row is why stale.tls-ech.dev has no JVM counterpart. On Android a
+ rejected config arrives as an EchConfigMismatchException carrying the config the
+ server offered instead; on OpenJDK the same path throws the retry configs away, and nothing
+ public exposes them. A stale config can be detected there and not recovered from, whatever
+ OkHttp does.
+
Specifications