Add Android ECH support by yschimke · Pull Request #9573 · lysine-dev/okhttp

yschimke · 2026-07-21T19:56:23Z

Initial version before dealing with NetworkSecurityPolicy,

instead just activated by developer using AndroidDns, and a server having HTTPS records with ECH.

yschimke · 2026-07-21T19:59:34Z

@swankjesse my biggest question is how to deal with NetworkSecurityPolicy for both
a) activation - is that AndroidDns? is that just whether to include for a specific host
b) error handling / fallback

I previously ended up with EchModes (disabled, strict and so on) read from the policy

https://github.com/lysine-dev/okhttp/pull/9383/changes#diff-62659f553c144abdf5c3d578b9d14e96bf069b4ef9e7f93549b04ff38e4fcbc9

swankjesse

THIS IS IT

swankjesse · 2026-07-21T20:23:42Z

+    private val network: Network? = null,
+    /**
+     * True to also query the `HTTPS` record for service metadata such as ECH. Set this to false to
+     * save a query when only IP addresses are needed.


I wonder if there’s a way to phrase this documentation to encourage people to keep it on.

‘Set this to false to omit the service metadata query. This will disable privacy features in the HTTPS call.’

I think maybe we end up defaulting to the networkSecurityConfig, but let developers opt-out, or opt-in.

For now, likely opt-in while we confirm it works.

~~GREASE means it should never cause failures just by being enabled.~~

I'll ask tomorrow if that mode still exists.

Yep, I'll update the wording. But also think if we want this we should make AndroidDns the default on API 37+ and when network security policy isn't globally disabled?

I think effectively the modes are (potentially per host)

UNSPECIFIED
DISABLED
ENABLED

So maybe that default once we are confident is the right option?

BTW if we ignore or override the NSP, Conscrypt still checks it.

https://cs.android.com/android/platform/superproject/+/android-latest-release:external/conscrypt/common/src/main/java/org/conscrypt/NativeSsl.java;l=569?q=enableEchBasedOnPolicy

swankjesse · 2026-07-21T20:46:02Z

I previously ended up with EchModes (disabled, strict and so on) read from the policy

My preference is we assume DNS is where this should be configured. If there’s a ECH parameter on the TYPE_HTTPS record we should use it, and if there isn’t then we should assume the site operators don‘t care.

Configuring it on the client is too difficult for large organizations, because the team that ships services and apps is far detached from the team that manages DNS and HTTPS.

yschimke · 2026-07-21T21:29:42Z

I previously ended up with EchModes (disabled, strict and so on) read from the policy

My preference is we assume DNS is where this should be configured. If there’s a ECH parameter on the TYPE_HTTPS record we should use it, and if there isn’t then we should assume the site operators don‘t care.

Configuring it on the client is too difficult for large organizations, because the team that ships services and apps is far detached from the team that manages DNS and HTTPS.

But there is a developer API that we should honour.

https://developer.android.com/privacy-and-security/security-config#EncryptedClientHelloSummary

yschimke · 2026-07-21T22:34:00Z

Still tests to go

yschimke · 2026-07-22T09:45:55Z

Need to put this catch back

emulator-5554 - 17 Tests 34/29 completed. (5 skipped) (1 failed)
Tests on emulator-5554 - 17 failed: There was 1 failure(s).
Finished 34 tests on emulator-5554 - 17
Execute okhttp.android.test.OkHttpTest.testUnderscoreRequest: FAILED
The input does not conform to the STD 3 ASCII rules. line: java.lang.IllegalArgumentException: Invalid input to toASCII: example_underscore_123.s3.amazonaws.com
at java.net.IDN.toASCII(IDN.java:115)
at javax.net.ssl.SNIHostName.<init>(SNIHostName.java:99)
at com.android.org.conscrypt.Platform.getSSLParameters(Platform.java:269)
at com.android.org.conscrypt.ConscryptEngine.getSSLParameters(ConscryptEngine.java:425)
at com.android.org.conscrypt.ConscryptEngineSocket.getSSLParameters(ConscryptEngineSocket.java:193)
at okhttp3.internal.platform.android.Android17SocketAdapter.configureTlsExtensions(Android17SocketAdapter.kt:63)
at okhttp3.internal.platform.Android10Platform.configureTlsExtensions(Android10Platform.kt:86)
at okhttp3.internal.connection.ConnectPlan.connectTls(ConnectPlan.kt:349)

swankjesse · 2026-07-22T10:30:25Z

Where does Android implement the policy in that XML file? Presumably we act as if it's always enabled, and the XML config overrides our preferences?

yschimke · 2026-07-22T10:39:40Z

Where does Android implement the policy in that XML file? Presumably we act as if it's always enabled, and the XML config overrides our preferences?

But then we do extra work fetching ECH records that won't be used.

But I think the test is that we do the correct, secure, optimal thing with DnsOverHttps enabled? So it can't be inside AndroidDns then?

Not sure where exactly - one of these

https://cs.android.com/android/platform/superproject/+/android-latest-release:external/conscrypt/repackaged/platform/src/main/java/com/android/org/conscrypt/ConscryptNetworkSecurityPolicy.java

https://cs.android.com/android/platform/superproject/+/android-latest-release:external/conscrypt/nsc/src/android/security/NetworkSecurityPolicy.java

cc @swankjesse not sure if you see non threaded comments.

Adds AndroidDns, backed by the system resolver and Android's DnsResolver for HTTPS/ECH records, driving okhttp's StateMachineDnsCall as a transport. Adds Android17SocketAdapter for platform ALPN/session-ticket/ECH setup on API 37+. Pins Robolectric android-test to SDK 36.

swankjesse · 2026-07-24T13:23:27Z

+ * [Network.getAllByName] when a [network] is set. Internally this drives OkHttp's
+ * [StateMachineDnsCall] through a private transport: a single `A` query stands in for the blocking
+ * address lookup (which returns both address families), plus an optional `HTTPS` query for service
+ * metadata such as ECH.


swankjesse · 2026-07-24T13:24:56Z

+       *
+       * `WrongConstant` is suppressed because okhttp's [TYPE_HTTPS] is the DNS wire value (65), the
+       * same as the platform's `DnsResolver.TYPE_HTTPS`. We use ours so the query stays valid on
+       * API 29+; `DnsResolver.TYPE_HTTPS` was only added in API 37.


swankjesse approved these changes Jul 21, 2026

View reviewed changes

yschimke force-pushed the AndroidDns branch from b114f46 to 89af920 Compare July 21, 2026 22:33

yschimke commented Jul 22, 2026

View reviewed changes

Comment thread okhttp/src/androidMain/kotlin/okhttp3/android/AndroidDns.kt Outdated

yschimke force-pushed the AndroidDns branch from 632f065 to 6eeb551 Compare July 24, 2026 07:28

add test

c520a1d

yschimke marked this pull request as ready for review July 24, 2026 08:23

yschimke added 4 commits July 24, 2026 10:03

cleanup

8f21cf8

avoid leaking trasports

0a48a18

bump conscrypt

1a3d3de

fixes

6903e1f

yschimke merged commit fb13116 into lysine-dev:master Jul 24, 2026
63 of 65 checks passed

swankjesse reviewed Jul 24, 2026

View reviewed changes

Uh oh!

Conversation

yschimke commented Jul 21, 2026

Uh oh!

yschimke commented Jul 21, 2026

Uh oh!

swankjesse left a comment

Choose a reason for hiding this comment

Uh oh!

swankjesse Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

yschimke Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yschimke Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

yschimke Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

yschimke Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

swankjesse commented Jul 21, 2026

Uh oh!

yschimke commented Jul 21, 2026

Uh oh!

yschimke commented Jul 21, 2026

Uh oh!

yschimke commented Jul 22, 2026

Uh oh!

swankjesse commented Jul 22, 2026

Uh oh!

yschimke commented Jul 22, 2026

Uh oh!

Uh oh!

Uh oh!

swankjesse Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

swankjesse Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

yschimke Jul 21, 2026 •

edited

Loading