Add support for ECH on Android 37 by yschimke · Pull Request #9383 · square/okhttp

yschimke · 2026-03-19T16:41:28Z

Adds an Android 17 platform path that uses public Android APIs for ALPN, session tickets, domain encryption policy, and ECH socket configuration.
Uses Android DnsResolver HTTPS/SVCB lookups to capture ECH configuration records alongside address resolution.
Introduces typed ECH DNS records so Dns implementations can expose platform-specific ECH data without returning raw Any values.
Applies Android EchConfigList values to TLS sockets when the active EchMode attempts ECH.
Uses NetworkSecurityPolicy.getDomainEncryptionMode() to select the ECH mode for each host.
Retries once without ECH when the platform reports an ECH configuration mismatch and the active mode permits fallback.
Tags live external ECH checks as Remote so they don't run in normal CI.
Includes CI cleanup for the AGP source-set API change and Android localhost cleartext test traffic.

Validation is mostly local Android/JVM compile and API checks, plus host-side tests for the DNS/ECH policy plumbing. The live ECH tests remain opt-in because
they depend on external servers.

+          emulator-options: >
+            -no-window
+            -gpu swiftshader_indirect
+            -noaudio


ardakazanci · 2026-05-24T18:05:42Z

waiting. thanks.

swankjesse

Still working through this. The tech is solid but I have lots of API questions

swankjesse · 2026-06-09T13:56:28Z

+internal class AndroidDnsResolverDns internal constructor(
+  private val dnsResolver: AndroidDnsLookup = AndroidDnsResolver(),
+) : Dns,
+  EchAware {


I don’t have a good intuition on whether ECH should be glued to DNS in this way. I think it’s probably a mistake to structure it this way, because if you decorate your Dns interface you lose ECH

I think they are tied, if you change Dns, you better change ECH lookups.

I tried a field.

But I still think we will lose it if you override platform AsyncDns with a custom Dns. Not sure we have a fix for that.

swankjesse · 2026-06-09T13:57:12Z

+
+  override fun lookup(hostname: String): List<InetAddress> {
+    val result = dnsResolver.lookup(hostname)
+    result.echConfig?.let {


Why cache these?

Is it because our API assumes you’re gonna call lookup and then getEchConfig in that order? ew?

Yeah, I don't want to do Dns twice. Having the dns records becomes a side effect.

Open to other ideas, maybe we can call again, but ensure it's a caching instance that will reuse?

I think this is optimal - other choices

make a second request later - slower and might change in meantime, it seems better if Dns + Ech are done together

? - I don't have another alternative...

swankjesse · 2026-06-09T13:58:47Z

+      handlerThread.start()
+      DnsResolver(PlatformRegistry.applicationContext!!, handlerThread.looper)
+    },
+  private val executor: Executor = Executor { it.run() },


Ooooh eeek, something dragonous is happening here

After a brief investigation, it looks fine. The callback isn’t actually doing any work

I'll comment.

swankjesse · 2026-06-09T13:59:31Z

+      DnsResolver(PlatformRegistry.applicationContext!!, handlerThread.looper)
+    },
+  private val executor: Executor = Executor { it.run() },
+  private val timeoutSeconds: Long = 5L,


I don’t like that seconds is the unit, and I don’t like that the default is specified here and not far away in some caller that has more context

addressed the unit, but not the location.

swankjesse · 2026-06-09T14:26:56Z

+      handlerThread.start()
+      DnsResolver(PlatformRegistry.applicationContext!!, handlerThread.looper)
+    },
+  private val executor: Executor = Executor { it.run() },


After a brief investigation, it looks fine. The callback isn’t actually doing any work

swankjesse · 2026-06-09T14:37:06Z

+      val isSupported: Boolean = (isAndroid && Build.VERSION.SDK_INT >= 37)
+
+      @ChecksSdkIntAtLeast(37)
+      fun buildIfSupported(): Platform? = if (isSupported) Android17Platform() else null


OH MAN, today I learned there’s also a thing called C Extensions 22, and we probably aught to figure out how to support this on whatever devices can do it, which is more complex?!

https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getDomainEncryptionMode(java.lang.String)

I chose violence.
https://bsky.app/profile/swank.ca/post/3mnuhrpsbrc2g

I'm not sure we have something to do here, since 37 is C?

yschimke · 2026-06-17T08:54:31Z

+ * Typical implementations are backed by Android's `DnsResolver`, OkHttp's DnsOverHttps, or other
+ * resolver libraries. Implementations must be safe for concurrent use.
+ */
+internal fun interface AsyncDns {


Should we make this public? Probably as follow up.

yschimke · 2026-06-17T08:54:41Z

+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp3


Should move to internal package.

Maybe awkward if it's exposed on public APIs

yschimke · 2026-06-17T08:56:41Z

+   * The asynchronous DNS resolver, or null to resolve with [dns] only. When set, the connection
+   * path can use HTTPS/SVCB records it returns (including Encrypted Client Hello configuration).
+   */
+  internal val asyncDns: AsyncDns? = builder.asyncDns


Should setting dns null this out?

yschimke · 2026-06-17T08:58:16Z

+      },
+    // executor is only used for handoff, so a minimal direct Executor
+    private val executor: Executor = Executor { it.run() },
+    private val timeoutMillis: Int = 5_000,


TODO - move outside AndroidAsyncDns, something Call timeout related?

Introduce a call-aware async DNS path that can carry ECH configuration from HTTPS/SVCB records, and wire ECH into the Android and JVM platforms. - New public AsyncDns / DnsResult and okhttp3.ech (EchConfig, EchMode, EchModeConfiguration) APIs. - Internal call-aware resolution (Resolve.kt, BlockingAsyncDns) that prefers a platform AsyncDns and attaches ECH to the RealCall, falling back to the public Dns when none is configured. - An explicitly configured Dns now takes precedence over the platform AsyncDns: OkHttpClient.Builder.dns() clears asyncDns so a custom Dns is honored (this also disables ECH, which only the async resolver carries). - Android17 platform support: AndroidAsyncDns (DnsResolver-backed, with a system-resolver fallback for localhost/loopback/lenient names) and Android17SocketAdapter wrapping the Conscrypt SNI handling. - Platform.configureTlsExtensions gains a call parameter; update the mockwebserver callers and compile against API 37 (agp 9.2.0).

- EchTest and AndroidSocketAdapter tests, plus OkHttpTest updates for the AsyncDns/ECH behavior and the API 37 emulator. - android-test/android-test-app build config for API 37 (compileApi 37; Robolectric unit tests disabled while no android-all artifact exists), network security config and manifest for the ECH test endpoints. - Robolectric --add-opens workaround in base-conventions.

yschimke mentioned this pull request Mar 19, 2026

Encrypted SNI or ClientHello #6539

Closed

This comment has been minimized.

Sign in to view

yschimke mentioned this pull request Apr 5, 2026

Basic TLS Encrypted ClientHello (ECH) support (java layer) google/conscrypt#1406

Open

yschimke changed the title ~~Testing ech~~ Add support for ECH on Android 37 May 4, 2026

yschimke marked this pull request as ready for review May 4, 2026 10:19

yschimke force-pushed the testing_ech branch from d010489 to e4a5c1a Compare May 4, 2026 10:38

yschimke requested a review from swankjesse May 4, 2026 10:51

yschimke force-pushed the testing_ech branch 6 times, most recently from 4d5b91f to b2652bb Compare May 4, 2026 12:26

github-advanced-security AI found potential problems May 4, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Dismissed

github-advanced-security AI found potential problems May 4, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

emulator-options: >

-no-window

-gpu swiftshader_indirect

-noaudio

yoshimo mentioned this pull request May 18, 2026

FR: An option to select Domain Name for the on-device block list dl server. celzero/rethink-app#2658

Open

swankjesse reviewed Jun 9, 2026

View reviewed changes

yschimke mentioned this pull request Jun 16, 2026

Address ECH PR review feedback yschimke/okhttp#24

Merged

yschimke commented Jun 17, 2026

View reviewed changes

Comment thread okhttp/src/androidMain/kotlin/okhttp3/android/AndroidAsyncDns.kt

yschimke commented Jun 17, 2026

View reviewed changes

yschimke mentioned this pull request Jun 17, 2026

Support pre-release API versions? ReactiveCircus/android-emulator-runner#473

Closed

yschimke commented Jun 25, 2026

View reviewed changes

Comment thread android-test/src/androidTest/java/okhttp/android/test/OkHttpTest.kt Outdated

yschimke commented Jun 25, 2026

View reviewed changes

Comment thread android-test/build.gradle.kts

claude added 2 commits June 27, 2026 20:45

yschimke force-pushed the testing_ech branch from 92e8e2c to c1b543f Compare June 27, 2026 20:46

AndroidAsyncDns: note the executor is only for callback handoff

5009e7d

Uh oh!

Conversation

yschimke commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

ardakazanci commented May 24, 2026

Uh oh!

swankjesse left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

yschimke commented Mar 19, 2026 •

edited

Loading