@onekeyfe/react-native-sni-connect 3.0.70 → 3.0.72

package/android/src/main/java/com/sniconnect/SniConnectValidation.kt

@@ -2,7 +2,9 @@ package com.sniconnect
 
 import java.net.Inet6Address
 import java.net.InetAddress
+import java.nio.charset.StandardCharsets
 import java.util.Locale
+import java.util.concurrent.atomic.AtomicBoolean
 
 /**
  * Boundary validation/normalization for SNI request inputs.
@@ -16,16 +18,86 @@ internal object SniConnectValidation {
 
   class ValidationException(message: String) : IllegalArgumentException(message)
 
+  const val MAX_REQUEST_ID_BYTES = 128
+  const val MAX_TIMEOUT_MILLIS = 120_000L
+  const val MAX_PATH_BYTES = 8 * 1024
+  const val MAX_REQUEST_BODY_BYTES = 1024 * 1024
+  const val MAX_RESPONSE_BODY_BYTES = 10 * 1024 * 1024L
+  const val MAX_HEADER_COUNT = 64
+  const val MAX_HEADER_NAME_BYTES = 128
+  const val MAX_HEADER_VALUE_BYTES = 8 * 1024
+  const val MAX_TOTAL_HEADER_BYTES = 32 * 1024
+  const val MAX_ACTIVE_REQUESTS = 64
+  const val MAX_ACTIVE_REQUESTS_PER_PAIR = 16
+
   private val ALLOWED_METHODS =
     setOf("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS")
 
+  private val MODULE_OWNED_HEADERS = setOf(
+    "host",
+    "content-length",
+    "accept-encoding",
+    "x-emascurl-config-id",
+  )
+  private val UNSAFE_HEADERS = setOf(
+    "connection",
+    "keep-alive",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "expect",
+  )
+
   private val HOSTNAME_REGEX = Regex(
     "^(?=.{1,253}\$)([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*\$"
   )
   private val IPV4_REGEX = Regex("^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\$")
   private val SCHEME_REGEX = Regex("^[A-Za-z][A-Za-z0-9+.-]*:")
+  private val HEADER_TOKEN_REGEX = Regex("^[!#$%&'*+.^_`|~0-9A-Za-z-]+\$")
+
+  fun validateRequestId(requestId: String?) {
+    if (requestId == null) return
+    if (requestId.isEmpty() || containsControlChars(requestId) || byteSize(requestId) > MAX_REQUEST_ID_BYTES) {
+      throw ValidationException("Invalid requestId")
+    }
+  }
+
+  fun validateTimeout(timeoutMillis: Long) {
+    if (timeoutMillis < 1L || timeoutMillis > MAX_TIMEOUT_MILLIS) {
+      throw ValidationException("Invalid timeout: $timeoutMillis")
+    }
+  }
+
+  fun parseTimeoutMillis(rawTimeoutMillis: Double): Long {
+    if (!rawTimeoutMillis.isFinite() ||
+      rawTimeoutMillis < 1.0 ||
+      rawTimeoutMillis > MAX_TIMEOUT_MILLIS.toDouble()
+    ) {
+      throw ValidationException("Invalid timeout: $rawTimeoutMillis")
+    }
+    return rawTimeoutMillis.toLong()
+  }
+
+  fun validateBody(body: String?) {
+    if (body != null && byteSize(body) > MAX_REQUEST_BODY_BYTES) {
+      throw ValidationException("Request body too large")
+    }
+  }
+
+  fun validateMethodBody(method: String, body: String?) {
+    if ((method == "GET" || method == "HEAD") && body != null) {
+      throw ValidationException("Body not allowed for method: $method")
+    }
+    if ((method == "POST" || method == "PUT" || method == "PATCH") && body == null) {
+      throw ValidationException("Body required for method: $method")
+    }
+  }
 
   fun normalizeMethod(method: String): String {
+    if (containsControlChars(method)) {
+      throw ValidationException("Invalid method: $method")
+    }
     val upper = method.trim().uppercase(Locale.US)
     if (upper !in ALLOWED_METHODS) {
       throw ValidationException("Invalid method: $method")
@@ -34,7 +106,12 @@ internal object SniConnectValidation {
   }
 
   fun validateHostname(hostname: String) {
-    if (hostname.isEmpty() || hostname.length > 253 || !HOSTNAME_REGEX.matches(hostname)) {
+    if (
+      hostname.isEmpty() ||
+      hostname.length > 253 ||
+      !HOSTNAME_REGEX.matches(hostname) ||
+      isIpLiteral(hostname)
+    ) {
       throw ValidationException("Invalid hostname: $hostname")
     }
   }
@@ -45,6 +122,9 @@ internal object SniConnectValidation {
     if (containsControlChars(trimmed)) {
       throw ValidationException("Invalid path")
     }
+    if (byteSize(trimmed) > MAX_PATH_BYTES) {
+      throw ValidationException("Path too large")
+    }
     if (trimmed.contains("://") || trimmed.startsWith("//") || SCHEME_REGEX.containsMatchIn(trimmed.take(64).substringBefore('/'))) {
       throw ValidationException("Invalid path: absolute URLs are not allowed")
     }
@@ -53,22 +133,78 @@ internal object SniConnectValidation {
   }
 
   fun validateHeaders(headers: Map<String, String>) {
+    normalizeHeaders(headers)
+  }
+
+  fun normalizeHeaders(headers: Map<String, String>): Map<String, String> {
+    if (headers.size > MAX_HEADER_COUNT) {
+      throw ValidationException("Too many headers")
+    }
+
+    var totalBytes = 0
+    val normalizedHeaders = linkedMapOf<String, String>()
     for ((key, value) in headers) {
-      if (key.isEmpty() || containsControlChars(key) || containsControlChars(value)) {
+      val keyBytes = byteSize(key)
+      val valueBytes = byteSize(value)
+      totalBytes += keyBytes + valueBytes
+
+      if (
+        key.isEmpty() ||
+        containsControlChars(key) ||
+        containsControlChars(value) ||
+        keyBytes > MAX_HEADER_NAME_BYTES ||
+        valueBytes > MAX_HEADER_VALUE_BYTES ||
+        !HEADER_TOKEN_REGEX.matches(key)
+      ) {
         throw ValidationException("Invalid header: $key")
       }
+
+      val lowerKey = key.lowercase(Locale.US)
+      if (lowerKey.startsWith(":") || lowerKey.startsWith("proxy-") || lowerKey in UNSAFE_HEADERS) {
+        throw ValidationException("Unsafe header: $key")
+      }
+      if (lowerKey in MODULE_OWNED_HEADERS) {
+        continue
+      }
+      normalizedHeaders[key] = value
+    }
+    if (totalBytes > MAX_TOTAL_HEADER_BYTES) {
+      throw ValidationException("Headers too large")
     }
+    return normalizedHeaders
   }
 
   private fun containsControlChars(s: String): Boolean =
     s.any { it.code < 0x20 || it.code == 0x7F }
 
+  private fun byteSize(s: String): Int = s.toByteArray(StandardCharsets.UTF_8).size
+
+  private fun isIpLiteral(value: String): Boolean {
+    val octets = IPV4_REGEX.matchEntire(value)?.groupValues?.drop(1)?.map { it.toInt() }
+    if (octets != null && octets.all { it <= 255 }) return true
+    if (!value.contains(':')) return false
+    return try {
+      InetAddress.getByName(value) is Inet6Address
+    } catch (_: Exception) {
+      false
+    }
+  }
+
   /**
    * Validate `ip` is a literal IPv4/IPv6 address (never a hostname) routing to a
    * public/global-unicast destination. Rejects loopback, private, link-local
    * (incl. 169.254.169.254 metadata), CGNAT, multicast and reserved ranges.
    */
   fun validatePublicIp(ip: String) {
+    if (
+      ip.isEmpty() ||
+      ip.trim() != ip ||
+      ip.contains('[') ||
+      ip.contains(']') ||
+      ip.contains('%')
+    ) {
+      throw ValidationException("Invalid IP: $ip")
+    }
     val octets = IPV4_REGEX.matchEntire(ip)?.groupValues?.drop(1)?.map { it.toInt() }
     if (octets != null) {
       if (octets.any { it > 255 }) throw ValidationException("Invalid IP: $ip")
@@ -117,22 +253,57 @@ internal object SniConnectValidation {
     }
     val bytes = addr.address
     // Unique local fc00::/7
-    if ((bytes[0].toInt() and 0xFE) == 0xFC) return true
+    if ((u(bytes[0]) and 0xFE) == 0xFC) return true
+    // Discard-only 100::/64
+    if (u(bytes[0]) == 0x01 && u(bytes[1]) == 0x00 && (2..7).all { u(bytes[it]) == 0 }) return true
+    // IETF protocol assignments that should not be accepted as public endpoints.
+    if (u(bytes[0]) == 0x20 && u(bytes[1]) == 0x01) {
+      if (u(bytes[2]) == 0x00 && u(bytes[3]) == 0x00) return true // 2001::/32 Teredo
+      if (u(bytes[2]) == 0x00 && (u(bytes[3]) and 0xF0) == 0x10) return true // 2001:10::/28 ORCHID
+      if (u(bytes[2]) == 0x00 && u(bytes[3]) == 0x02) return true // 2001:2::/48 benchmarking
+      if (u(bytes[2]) == 0x0D && u(bytes[3]) == 0xB8) return true // 2001:db8::/32 docs
+    }
+    // 6to4 embeds an IPv4 route target and is deprecated; reject it outright.
+    if (u(bytes[0]) == 0x20 && u(bytes[1]) == 0x02) return true // 2002::/16
+    // NAT64 well-known prefix. Allow only when the embedded IPv4 is public.
+    if (isNat64WellKnown(bytes)) return isForbiddenIpv4(embeddedIpv4(bytes, 12))
+    // NAT64 local-use prefix can route through operator-specific private policy.
+    if (isNat64LocalUse(bytes)) return true
+    // Deprecated IPv4-compatible IPv6 addresses.
+    if (isIpv4Compatible(bytes)) return true
     // IPv4-mapped ::ffff:a.b.c.d — validate the embedded IPv4
-    val mappedPrefixZero = (0..9).all { bytes[it].toInt() == 0 }
-    if (mappedPrefixZero && (bytes[10].toInt() and 0xFF) == 0xFF && (bytes[11].toInt() and 0xFF) == 0xFF) {
-      return isForbiddenIpv4(
-        listOf(
-          bytes[12].toInt() and 0xFF,
-          bytes[13].toInt() and 0xFF,
-          bytes[14].toInt() and 0xFF,
-          bytes[15].toInt() and 0xFF,
-        )
-      )
+    if (isIpv4Mapped(bytes)) {
+      return isForbiddenIpv4(embeddedIpv4(bytes, 12))
     }
     return false
   }
 
+  private fun u(byte: Byte): Int = byte.toInt() and 0xFF
+
+  private fun embeddedIpv4(bytes: ByteArray, offset: Int): List<Int> =
+    listOf(u(bytes[offset]), u(bytes[offset + 1]), u(bytes[offset + 2]), u(bytes[offset + 3]))
+
+  private fun isIpv4Mapped(bytes: ByteArray): Boolean =
+    (0..9).all { u(bytes[it]) == 0 } && u(bytes[10]) == 0xFF && u(bytes[11]) == 0xFF
+
+  private fun isIpv4Compatible(bytes: ByteArray): Boolean =
+    (0..11).all { u(bytes[it]) == 0 }
+
+  private fun isNat64WellKnown(bytes: ByteArray): Boolean =
+    u(bytes[0]) == 0x00 &&
+      u(bytes[1]) == 0x64 &&
+      u(bytes[2]) == 0xFF &&
+      u(bytes[3]) == 0x9B &&
+      (4..11).all { u(bytes[it]) == 0 }
+
+  private fun isNat64LocalUse(bytes: ByteArray): Boolean =
+    u(bytes[0]) == 0x00 &&
+      u(bytes[1]) == 0x64 &&
+      u(bytes[2]) == 0xFF &&
+      u(bytes[3]) == 0x9B &&
+      u(bytes[4]) == 0x00 &&
+      u(bytes[5]) == 0x01
+
   /** Parse a validated IPv4/IPv6 literal into an InetAddress without DNS resolution. */
   fun literalToInetAddress(ip: String): InetAddress {
     val octets = IPV4_REGEX.matchEntire(ip)?.groupValues?.drop(1)?.map { it.toInt().toByte() }
@@ -142,3 +313,78 @@ internal object SniConnectValidation {
     return InetAddress.getByName(ip) // safe: already validated as an IPv6 literal
   }
 }
+
+internal class SniConnectRequestLimiter(
+  private val maxActiveRequests: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS,
+  private val maxActiveRequestsPerPair: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS_PER_PAIR,
+) {
+  private val lock = Any()
+  private var activeRequests = 0
+  private val activeRequestsByPair = mutableMapOf<String, Int>()
+
+  fun acquire(hostname: String, ip: String): Token {
+    val key = pairKey(hostname, ip)
+    synchronized(lock) {
+      if (activeRequests >= maxActiveRequests) {
+        SniConnectLogger.warn(
+          SniConnectLogger.event(
+            "sni_resource_limit",
+            "activeCount" to activeRequests,
+            "pairCount" to (activeRequestsByPair[key] ?: 0),
+            "limit" to maxActiveRequests,
+            "reason" to "max_active_requests",
+            "hostname" to hostname.lowercase(Locale.US),
+            "ipHash" to SniConnectLogger.shortHash(ip),
+          ),
+        )
+        throw SniConnectValidation.ValidationException("Too many active SNI requests")
+      }
+      val pairCount = activeRequestsByPair[key] ?: 0
+      if (pairCount >= maxActiveRequestsPerPair) {
+        SniConnectLogger.warn(
+          SniConnectLogger.event(
+            "sni_resource_limit",
+            "activeCount" to activeRequests,
+            "pairCount" to pairCount,
+            "limit" to maxActiveRequestsPerPair,
+            "reason" to "max_active_requests_per_pair",
+            "hostname" to hostname.lowercase(Locale.US),
+            "ipHash" to SniConnectLogger.shortHash(ip),
+          ),
+        )
+        throw SniConnectValidation.ValidationException("Too many active SNI requests for destination")
+      }
+      activeRequests += 1
+      activeRequestsByPair[key] = pairCount + 1
+    }
+    return Token(this, key)
+  }
+
+  private fun release(key: String) {
+    synchronized(lock) {
+      activeRequests = (activeRequests - 1).coerceAtLeast(0)
+      val pairCount = activeRequestsByPair[key] ?: return
+      if (pairCount <= 1) {
+        activeRequestsByPair.remove(key)
+      } else {
+        activeRequestsByPair[key] = pairCount - 1
+      }
+    }
+  }
+
+  private fun pairKey(hostname: String, ip: String): String =
+    "${hostname.lowercase(Locale.US)}|$ip"
+
+  class Token internal constructor(
+    private val limiter: SniConnectRequestLimiter,
+    private val key: String,
+  ) {
+    private val released = AtomicBoolean(false)
+
+    fun release() {
+      if (released.compareAndSet(false, true)) {
+        limiter.release(key)
+      }
+    }
+  }
+}

package/android/src/test/java/com/sniconnect/SniConnectValidationTest.kt

@@ -0,0 +1,257 @@
+package com.sniconnect
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.IOException
+import java.io.InterruptedIOException
+import java.net.SocketTimeoutException
+import java.net.UnknownHostException
+import java.security.cert.CertificateException
+import javax.net.ssl.SSLHandshakeException
+import javax.net.ssl.SSLPeerUnverifiedException
+
+class SniConnectValidationTest {
+
+  @Test
+  fun acceptsValidRequestBoundaryValues() {
+    SniConnectValidation.validateRequestId("req-1")
+    SniConnectValidation.validateTimeout(120_000)
+    SniConnectValidation.validateBody("a".repeat(1024 * 1024))
+    SniConnectValidation.validatePublicIp("93.184.216.34")
+    SniConnectValidation.validatePublicIp("2001:4860:4860::8888")
+    SniConnectValidation.validateHostname("api.example.com")
+
+    assertEquals("GET", SniConnectValidation.normalizeMethod(" get "))
+    assertEquals("/", SniConnectValidation.normalizePath(""))
+    assertEquals("/v1?q=1", SniConnectValidation.normalizePath("v1?q=1"))
+  }
+
+  @Test
+  fun rejectsIpLiteralHostnames() {
+    assertValidationFails { SniConnectValidation.validateHostname("93.184.216.34") }
+    assertValidationFails { SniConnectValidation.validateHostname("2001:4860:4860::8888") }
+  }
+
+  @Test
+  fun rejectsMalformedHostnames() {
+    listOf(
+      "",
+      "-example.com",
+      "example-.com",
+      "example..com",
+      "bad_host.example",
+      "https://example.com",
+      "example.com:443",
+      "${"a".repeat(64)}.example.com",
+      "${"a".repeat(250)}.com",
+    ).forEach { hostname ->
+      assertValidationFails { SniConnectValidation.validateHostname(hostname) }
+    }
+  }
+
+  @Test
+  fun rejectsUnsafeIpv4Destinations() {
+    listOf(
+      "example.com",
+      "93.184.216.34:443",
+      " 93.184.216.34",
+      "10.0.0.1",
+      "127.0.0.1",
+      "100.64.0.1",
+      "169.254.169.254",
+      "172.16.0.1",
+      "192.168.1.1",
+      "192.0.2.1",
+      "198.18.0.1",
+      "198.51.100.1",
+      "203.0.113.1",
+      "224.0.0.1",
+      "255.255.255.255",
+    ).forEach { ip ->
+      assertValidationFails { SniConnectValidation.validatePublicIp(ip) }
+    }
+  }
+
+  @Test
+  fun rejectsUnsafeIpv6DestinationsAndTransitionForms() {
+    listOf(
+      "::",
+      "::1",
+      "fe80::1",
+      "fc00::1",
+      "ff00::1",
+      "100::1",
+      "2001::1",
+      "2001:2::1",
+      "2001:db8::1",
+      "2002:0a00:0001::1",
+      "::ffff:10.0.0.1",
+      "64:ff9b::10.0.0.1",
+      "64:ff9b:1::1",
+      "2001:4860:4860::8888%en0",
+      "[2001:4860:4860::8888]",
+    ).forEach { ip ->
+      assertValidationFails { SniConnectValidation.validatePublicIp(ip) }
+    }
+  }
+
+  @Test
+  fun rejectsUnsupportedMethodsAndUnsafePaths() {
+    listOf("TRACE", "CONNECT", "", "GET\n").forEach { method ->
+      assertValidationFails { SniConnectValidation.normalizeMethod(method) }
+    }
+
+    listOf(
+      "https://example.com",
+      "http://example.com",
+      "//example.com/path",
+      "javascript:alert(1)",
+      "/path\nInjected: yes",
+      "/${"a".repeat(8192)}",
+    ).forEach { path ->
+      assertValidationFails { SniConnectValidation.normalizePath(path) }
+    }
+  }
+
+  @Test
+  fun enforcesRequestIdTimeoutAndBodyLimits() {
+    assertValidationFails { SniConnectValidation.validateRequestId("") }
+    assertValidationFails { SniConnectValidation.validateRequestId("x".repeat(129)) }
+    assertValidationFails { SniConnectValidation.validateRequestId("req\n1") }
+    assertValidationFails { SniConnectValidation.validateTimeout(0) }
+    assertValidationFails { SniConnectValidation.validateTimeout(120_001) }
+    assertEquals(1L, SniConnectValidation.parseTimeoutMillis(1.0))
+    assertEquals(120_000L, SniConnectValidation.parseTimeoutMillis(120_000.0))
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(Double.NaN) }
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(Double.POSITIVE_INFINITY) }
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(Double.NEGATIVE_INFINITY) }
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(0.0) }
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(0.5) }
+    assertValidationFails { SniConnectValidation.parseTimeoutMillis(120_000.1) }
+    assertValidationFails { SniConnectValidation.validateBody("a".repeat(1024 * 1024 + 1)) }
+  }
+
+  @Test
+  fun filtersModuleOwnedHeadersAndRejectsUnsafeHeaders() {
+    val normalized = SniConnectValidation.normalizeHeaders(
+      mapOf(
+        "Host" to "evil.example",
+        "Content-Length" to "9999",
+        "Accept-Encoding" to "gzip",
+        "x-emascurl-config-id" to "evil",
+        "X-Test" to "ok",
+      )
+    )
+
+    assertFalse(normalized.keys.any { it.equals("host", ignoreCase = true) })
+    assertFalse(normalized.keys.any { it.equals("content-length", ignoreCase = true) })
+    assertFalse(normalized.keys.any { it.equals("accept-encoding", ignoreCase = true) })
+    assertEquals("ok", normalized["X-Test"])
+
+    listOf(
+      mapOf("Connection" to "close"),
+      mapOf("Proxy-Authorization" to "secret"),
+      mapOf("Transfer-Encoding" to "chunked"),
+      mapOf("Expect" to "100-continue"),
+      mapOf(":authority" to "evil.example"),
+      mapOf("Bad Header" to "x"),
+      mapOf("X-Test" to "line\nbreak"),
+      mapOf("X-Test" to "x".repeat(8 * 1024 + 1)),
+    ).forEach { headers ->
+      assertValidationFails { SniConnectValidation.normalizeHeaders(headers) }
+    }
+
+    assertValidationFails {
+      SniConnectValidation.normalizeHeaders((0..64).associate { "X-$it" to "v" })
+    }
+    assertValidationFails {
+      SniConnectValidation.normalizeHeaders((0..4).associate { "X-$it" to "x".repeat(7 * 1024) })
+    }
+  }
+
+  @Test
+  fun rejectsAmbiguousMethodBodyCombinations() {
+    assertValidationFails { SniConnectValidation.validateMethodBody("GET", "") }
+    assertValidationFails { SniConnectValidation.validateMethodBody("HEAD", "payload") }
+    assertValidationFails { SniConnectValidation.validateMethodBody("POST", null) }
+    assertValidationFails { SniConnectValidation.validateMethodBody("PUT", null) }
+    assertValidationFails { SniConnectValidation.validateMethodBody("PATCH", null) }
+
+    SniConnectValidation.validateMethodBody("POST", "")
+    SniConnectValidation.validateMethodBody("DELETE", null)
+    SniConnectValidation.validateMethodBody("OPTIONS", null)
+  }
+
+  @Test
+  fun requestLimiterEnforcesGlobalAndPerDestinationLimits() {
+    val limiter = SniConnectRequestLimiter(
+      maxActiveRequests = 2,
+      maxActiveRequestsPerPair = 1,
+    )
+
+    val firstToken = limiter.acquire("Example.com", "93.184.216.34")
+    assertValidationFails {
+      limiter.acquire("example.com", "93.184.216.34")
+    }
+
+    val secondToken = limiter.acquire("example.com", "93.184.216.35")
+    assertValidationFails {
+      limiter.acquire("example.net", "93.184.216.36")
+    }
+
+    firstToken.release()
+    val replacementToken = limiter.acquire("example.com", "93.184.216.34")
+    firstToken.release()
+    secondToken.release()
+    replacementToken.release()
+
+    assertTrue(true)
+  }
+
+  @Test
+  fun classifiesSecurityFailuresAsFailClosedErrorCodes() {
+    assertEquals(
+      "SNI_CERT_FAILED",
+      classifySniFailureCode(SSLPeerUnverifiedException("hostname mismatch")),
+    )
+    assertEquals(
+      "SNI_CERT_FAILED",
+      classifySniFailureCode(SSLHandshakeException("bad cert").apply {
+        initCause(CertificateException("expired"))
+      }),
+    )
+    assertEquals(
+      "SNI_TLS_FAILED",
+      classifySniFailureCode(SSLHandshakeException("handshake failed")),
+    )
+    assertEquals(
+      "SNI_SECURITY_POLICY_FAILED",
+      classifySniFailureCode(UnknownHostException("Unexpected host for pinned SNI request")),
+    )
+    assertEquals(
+      "SNI_REQUEST_TIMEOUT",
+      classifySniFailureCode(SocketTimeoutException("timeout")),
+    )
+    assertEquals(
+      "SNI_REQUEST_TIMEOUT",
+      classifySniFailureCode(IOException("call timeout").apply {
+        initCause(InterruptedIOException("timeout"))
+      }),
+    )
+    assertEquals(
+      "SNI_REQUEST_FAILED",
+      classifySniFailureCode(IOException("connection reset")),
+    )
+  }
+
+  private fun assertValidationFails(block: () -> Unit) {
+    try {
+      block()
+    } catch (_: SniConnectValidation.ValidationException) {
+      return
+    }
+    throw AssertionError("Expected SNI validation failure")
+  }
+}

package/ios/SniConnect.mm

@@ -18,6 +18,9 @@
                    reject:(RCTPromiseRejectBlock)reject;
 - (void)clearDNSCache:(RCTPromiseResolveBlock)resolve
                reject:(RCTPromiseRejectBlock)reject;
+- (void)isProxyActiveForUrl:(NSString *)url
+                    resolve:(RCTPromiseResolveBlock)resolve
+                     reject:(RCTPromiseRejectBlock)reject;
 @end
 
 @interface SniConnect : NSObject
@@ -86,6 +89,12 @@ RCT_EXPORT_MODULE(SniConnect)
   [_implementation clearDNSCache:resolve reject:reject];
 }
 
+- (void)isProxyActiveForUrl:(NSString *)url
+                    resolve:(RCTPromiseResolveBlock)resolve
+                     reject:(RCTPromiseRejectBlock)reject {
+  [_implementation isProxyActiveForUrl:url resolve:resolve reject:reject];
+}
+
 - (std::shared_ptr<facebook::react::TurboModule>)getTurboModule:
     (const facebook::react::ObjCTurboModule::InitParams &)params
 {
@@ -114,6 +123,12 @@ RCT_EXPORT_METHOD(clearDNSCache:(RCTPromiseResolveBlock)resolver
                   rejecter:(RCTPromiseRejectBlock)rejecter) {
   [_implementation clearDNSCache:resolver reject:rejecter];
 }
+
+RCT_EXPORT_METHOD(isProxyActiveForUrl:(NSString *)url
+                  resolver:(RCTPromiseResolveBlock)resolver
+                  rejecter:(RCTPromiseRejectBlock)rejecter) {
+  [_implementation isProxyActiveForUrl:url resolve:resolver reject:rejecter];
+}
 #endif
 
 @end