@onekeyfe/react-native-sni-connect 3.0.71 → 3.0.73

package/android/src/main/java/com/sniconnect/SniConnectModule.kt

@@ -1,5 +1,7 @@
 package com.sniconnect
 
+import android.content.Context
+import android.net.ConnectivityManager
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
@@ -15,20 +17,59 @@ import okhttp3.Dns
 import okhttp3.Headers
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.OkHttpClient
+import okhttp3.Protocol
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
 import okhttp3.ResponseBody
+import okio.Buffer
 import java.io.IOException
+import java.io.InterruptedIOException
 import java.net.InetAddress
+import java.net.Proxy
+import java.net.ProxySelector
+import java.net.URI
+import java.net.UnknownHostException
+import java.nio.charset.StandardCharsets
+import java.security.cert.CertificateException
+import java.util.Collections
 import java.util.Locale
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
 import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLException
+import javax.net.ssl.SSLPeerUnverifiedException
 
 private const val TAG = "SniConnect"
 
+internal fun classifySniFailureCode(error: Throwable): String {
+  if (hasCause(error, SSLPeerUnverifiedException::class.java) ||
+    hasCause(error, CertificateException::class.java)
+  ) {
+    return "SNI_CERT_FAILED"
+  }
+  if (hasCause(error, UnknownHostException::class.java)) {
+    return "SNI_SECURITY_POLICY_FAILED"
+  }
+  if (hasCause(error, InterruptedIOException::class.java)) {
+    return "SNI_REQUEST_TIMEOUT"
+  }
+  if (hasCause(error, SSLException::class.java)) {
+    return "SNI_TLS_FAILED"
+  }
+  return "SNI_REQUEST_FAILED"
+}
+
+private fun hasCause(error: Throwable, type: Class<out Throwable>): Boolean {
+  var current: Throwable? = error
+  while (current != null) {
+    if (type.isInstance(current)) return true
+    current = current.cause
+  }
+  return false
+}
+
 @ReactModule(name = SniConnectModule.NAME)
 class SniConnectModule(reactContext: ReactApplicationContext) :
   NativeSniConnectSpec(reactContext) {
@@ -42,7 +83,10 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
     // A single dispatcher + connection pool shared across all cached clients so we
     // don't spawn a thread pool / connection pool per (hostname, ip) pair.
-    private val sharedDispatcher = Dispatcher()
+    private val sharedDispatcher = Dispatcher().apply {
+      maxRequests = 64
+      maxRequestsPerHost = 64
+    }
     private val sharedConnectionPool = ConnectionPool()
   }
 
@@ -63,11 +107,27 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
   // LinkedHashMap is not thread-safe.
   private val clientCache = object : LinkedHashMap<ClientKey, OkHttpClient>(16, 0.75f, true) {
     override fun removeEldestEntry(eldest: MutableMap.MutableEntry<ClientKey, OkHttpClient>): Boolean {
-      return size > MAX_CLIENTS
+      val shouldEvict = size > MAX_CLIENTS
+      if (shouldEvict) {
+        SniConnectLogger.info(
+          SniConnectLogger.event(
+            "sni_cache_evict",
+            "hostname" to eldest.key.hostname,
+            "ipHash" to SniConnectLogger.shortHash(eldest.key.ip),
+            "cacheSize" to size,
+            "limit" to MAX_CLIENTS,
+            "reason" to "max_cached_clients",
+          ),
+        )
+      }
+      return shouldEvict
     }
   }
 
   private val activeCalls = ConcurrentHashMap<String, Call>()
+  private val allActiveCalls = Collections.newSetFromMap(ConcurrentHashMap<Call, Boolean>())
+  private val activeCallsLock = Any()
+  private val requestLimiter = SniConnectRequestLimiter()
 
   override fun getName(): String = NAME
 
@@ -76,29 +136,62 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
       val requestConfig = config.toRequestConfig()
       performRequest(requestConfig, promise)
     } catch (error: Exception) {
-      SniConnectLogger.error("Config parsing failed: ${error.message}")
+      SniConnectLogger.error(
+        SniConnectLogger.event(
+          "sni_request_result",
+          "result" to "error",
+          "code" to "SNI_INVALID_CONFIG",
+          "nativeErrorClass" to error.javaClass.simpleName,
+          "stage" to "parse_config",
+        ),
+      )
       promise.reject("SNI_INVALID_CONFIG", error.message, error)
     }
   }
 
   @ReactMethod
   override fun cancelRequest(requestId: String, promise: Promise) {
-    val call = activeCalls.remove(requestId)
+    val call = synchronized(activeCallsLock) {
+      activeCalls.remove(requestId)
+    }
     if (call != null) {
       call.cancel()
-      SniConnectLogger.info("Cancelled request: $requestId")
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "sni_cancel",
+          "requestIdHash" to SniConnectLogger.shortHash(requestId),
+          "success" to true,
+        ),
+      )
       promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
     } else {
+      SniConnectLogger.warn(
+        SniConnectLogger.event(
+          "sni_cancel",
+          "requestIdHash" to SniConnectLogger.shortHash(requestId),
+          "success" to false,
+        ),
+      )
       promise.resolve(Arguments.createMap().apply { putBoolean("success", false) })
     }
   }
 
   @ReactMethod
   override fun cancelAllRequests(promise: Promise) {
-    val count = activeCalls.size
-    activeCalls.forEach { (_, call) -> call.cancel() }
-    activeCalls.clear()
-    SniConnectLogger.info("Cancelled $count active requests")
+    val calls = synchronized(activeCallsLock) {
+      val snapshot = allActiveCalls.toList()
+      activeCalls.clear()
+      allActiveCalls.clear()
+      snapshot
+    }
+    calls.forEach { call -> call.cancel() }
+    SniConnectLogger.info(
+      SniConnectLogger.event(
+        "sni_cancel_all",
+        "cancelledCount" to calls.size,
+        "success" to true,
+      ),
+    )
     promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
   }
 
@@ -109,12 +202,31 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
     // Drop pinned-IP connections from the shared pool.
     sharedConnectionPool.evictAll()
-    SniConnectLogger.info("DNS cache cleared")
+    SniConnectLogger.info(
+      SniConnectLogger.event(
+        "sni_lifecycle",
+        "action" to "clear_dns_cache",
+        "success" to true,
+      ),
+    )
     promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
   }
 
+  @ReactMethod
+  override fun isProxyActiveForUrl(url: String, promise: Promise) {
+    try {
+      promise.resolve(isProxyActiveForUrl(url))
+    } catch (error: Exception) {
+      promise.reject("SNI_INVALID_URL", error.message, error)
+    }
+  }
+
   private fun performRequest(config: RequestConfig, promise: Promise) {
+    val startedAtMs = android.os.SystemClock.elapsedRealtime()
+    var requestSlot: SniConnectRequestLimiter.Token? = null
+    var registeredCall: Call? = null
     try {
+      requestSlot = requestLimiter.acquire(config.hostname, config.ip)
       val client = getOrCreateClient(config)
       val request = buildRequest(config)
       val call = client.newCall(request)
@@ -122,59 +234,167 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
       // Apply per-request timeout
       call.timeout().timeout(config.timeoutMillis, TimeUnit.MILLISECONDS)
 
-      // Register the call if requestId is provided
-      config.requestId?.let { requestId ->
-        activeCalls[requestId] = call
-      }
+      registerCall(config.requestId, call)
+      registeredCall = call
+
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "sni_request_start",
+          "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
+          "hostname" to config.hostname.lowercase(Locale.US),
+          "ipHash" to SniConnectLogger.shortHash(config.ip),
+          "ipFamily" to SniConnectLogger.ipFamily(config.ip),
+          "method" to config.method,
+          "timeoutMs" to config.timeoutMillis,
+          "headerCount" to config.headers.size,
+          "bodyBytes" to (config.body?.toByteArray(StandardCharsets.UTF_8)?.size ?: 0),
+        ),
+      )
 
       // Guard against double-settling the promise (RN hard-crashes otherwise).
       val settled = AtomicBoolean(false)
 
       call.enqueue(object : Callback {
         override fun onFailure(call: Call, e: IOException) {
-          config.requestId?.let { activeCalls.remove(it) }
+          unregisterCall(config.requestId, call)
+          requestSlot?.release()
           if (!settled.compareAndSet(false, true)) return
 
           if (call.isCanceled()) {
             promise.reject("SNI_CANCELLED", "Request cancelled", null)
           } else {
-            SniConnectLogger.error("Request failed: ${e.message}")
-            promise.reject("SNI_REQUEST_FAILED", e.message, e)
+            val code = classifySniFailureCode(e)
+            SniConnectLogger.error(
+              SniConnectLogger.event(
+                "sni_request_result",
+                "result" to "error",
+                "code" to code,
+                "nativeErrorClass" to e.javaClass.simpleName,
+                "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
+                "hostname" to config.hostname.lowercase(Locale.US),
+                "ipHash" to SniConnectLogger.shortHash(config.ip),
+                "ipFamily" to SniConnectLogger.ipFamily(config.ip),
+                "method" to config.method,
+                "timeoutMs" to config.timeoutMillis,
+                "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+              ),
+            )
+            promise.reject(code, e.message, e)
           }
         }
 
         override fun onResponse(call: Call, response: Response) {
-          config.requestId?.let { activeCalls.remove(it) }
-
-          val result: WritableMap = try {
-            response.use {
-              val bodyString = response.body.safeString()
-              val headerMap = headersToMap(response.headers)
+          try {
+            response.use { currentResponse ->
+              val bodyString = currentResponse.body.safeString()
+              val headerMaps = headersToMaps(currentResponse.headers)
+              val resultLog = SniConnectLogger.event(
+                "sni_request_result",
+                "result" to "response",
+                "status" to currentResponse.code,
+                "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
+                "hostname" to config.hostname.lowercase(Locale.US),
+                "ipHash" to SniConnectLogger.shortHash(config.ip),
+                "ipFamily" to SniConnectLogger.ipFamily(config.ip),
+                "method" to config.method,
+                "timeoutMs" to config.timeoutMillis,
+                "responseBytes" to bodyString.toByteArray(StandardCharsets.UTF_8).size,
+                "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+              )
               Arguments.createMap().apply {
                 putString("data", bodyString)
-                putInt("status", response.code)
-                putString("statusText", response.message)
-                putMap("headers", headerMap.toWritableMap())
+                putInt("status", currentResponse.code)
+                putString("statusText", currentResponse.message)
+                putMap("headers", headerMaps.singleValueHeaders.toWritableMap())
+                putMap("multiValueHeaders", headerMaps.multiValueHeaders.toWritableArrayMap())
+              }.also { result ->
+                if (currentResponse.code >= 400) {
+                  SniConnectLogger.warn(resultLog)
+                } else {
+                  SniConnectLogger.info(resultLog)
+                }
+                if (settled.compareAndSet(false, true)) {
+                  promise.resolve(result)
+                }
               }
             }
           } catch (error: Exception) {
             if (!settled.compareAndSet(false, true)) return
-            SniConnectLogger.error("Response processing failed: ${error.message}")
+            SniConnectLogger.error(
+              SniConnectLogger.event(
+                "sni_request_result",
+                "result" to "error",
+                "code" to "SNI_RESPONSE_FAILED",
+                "nativeErrorClass" to error.javaClass.simpleName,
+                "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
+                "hostname" to config.hostname.lowercase(Locale.US),
+                "ipHash" to SniConnectLogger.shortHash(config.ip),
+                "ipFamily" to SniConnectLogger.ipFamily(config.ip),
+                "method" to config.method,
+                "timeoutMs" to config.timeoutMillis,
+                "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+              ),
+            )
             promise.reject("SNI_RESPONSE_FAILED", error.message, error)
-            return
-          }
-
-          if (response.code >= 400) {
-            SniConnectLogger.warn("HTTP ${response.code} for ${config.hostname}")
-          }
-          if (settled.compareAndSet(false, true)) {
-            promise.resolve(result)
+          } finally {
+            unregisterCall(config.requestId, call)
+            requestSlot?.release()
           }
         }
       })
     } catch (error: Exception) {
-      SniConnectLogger.error("Request setup failed: ${error.message}")
-      promise.reject("SNI_REQUEST_FAILED", error.message, error)
+      registeredCall?.let { call ->
+        unregisterCall(config.requestId, call)
+      }
+      requestSlot?.release()
+      val code = if (error is SniConnectValidation.ValidationException) {
+        "SNI_RESOURCE_LIMIT"
+      } else {
+        "SNI_REQUEST_FAILED"
+      }
+      SniConnectLogger.error(
+        SniConnectLogger.event(
+          "sni_request_result",
+          "result" to "error",
+          "code" to code,
+          "nativeErrorClass" to error.javaClass.simpleName,
+          "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
+          "hostname" to config.hostname.lowercase(Locale.US),
+          "ipHash" to SniConnectLogger.shortHash(config.ip),
+          "ipFamily" to SniConnectLogger.ipFamily(config.ip),
+          "method" to config.method,
+          "timeoutMs" to config.timeoutMillis,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      promise.reject(code, error.message, error)
+    }
+  }
+
+  private fun registerCall(requestId: String?, call: Call) {
+    val previousCall = synchronized(activeCallsLock) {
+      val previous = requestId?.let { activeCalls.put(it, call) }
+      allActiveCalls.add(call)
+      previous
+    }
+    if (previousCall != null && previousCall != call) {
+      previousCall.cancel()
+      SniConnectLogger.warn(
+        SniConnectLogger.event(
+          "sni_duplicate_request_id",
+          "requestIdHash" to SniConnectLogger.shortHash(requestId),
+          "action" to "cancel_previous",
+        ),
+      )
+    }
+  }
+
+  private fun unregisterCall(requestId: String?, call: Call) {
+    synchronized(activeCallsLock) {
+      if (requestId != null) {
+        activeCalls.remove(requestId, call)
+      }
+      allActiveCalls.remove(call)
     }
   }
 
@@ -185,16 +405,17 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     synchronized(clientCache) {
       clientCache[key]?.let { return it }
 
-      // 60s defaults at the client level; the real deadline is the per-call timeout.
-      val defaultTimeout = 60_000L
-
       val client = OkHttpClient.Builder()
         .dispatcher(sharedDispatcher)
         .connectionPool(sharedConnectionPool)
-        .connectTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
-        .readTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
-        .writeTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
+        .proxy(Proxy.NO_PROXY)
+        .protocols(listOf(Protocol.HTTP_1_1))
+        .connectTimeout(0, TimeUnit.MILLISECONDS)
+        .readTimeout(0, TimeUnit.MILLISECONDS)
+        .writeTimeout(0, TimeUnit.MILLISECONDS)
         .callTimeout(0, TimeUnit.MILLISECONDS)
+        .followRedirects(false)
+        .followSslRedirects(false)
         // TLS is validated normally: cert chain via the default trust manager and
         // hostname verification against the REAL hostname (not the pinned IP).
         .hostnameVerifier { _, session ->
@@ -204,6 +425,19 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
         .build()
 
       clientCache[key] = client
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "sni_transport_config",
+          "hostname" to key.hostname,
+          "ipHash" to SniConnectLogger.shortHash(key.ip),
+          "ipFamily" to SniConnectLogger.ipFamily(key.ip),
+          "proxyMode" to "no_proxy",
+          "pinnedResolver" to true,
+          "protocol" to "http1",
+          "followRedirects" to false,
+          "cacheSize" to clientCache.size,
+        ),
+      )
       return client
     }
   }
@@ -218,7 +452,15 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
         return if (requestedHost.lowercase(Locale.US) == expectedHost) {
           listOf(pinnedAddress)
         } else {
-          Dns.SYSTEM.lookup(requestedHost)
+          SniConnectLogger.warn(
+            SniConnectLogger.event(
+              "sni_pinned_dns_unexpected_host",
+              "expectedHost" to expectedHost,
+              "requestedHostHash" to SniConnectLogger.shortHash(requestedHost.lowercase(Locale.US)),
+              "result" to "fail_closed",
+            ),
+          )
+          throw UnknownHostException("Unexpected host for pinned SNI request: $requestedHost")
         }
       }
     }
@@ -232,30 +474,35 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     val builder = Request.Builder().url(url)
 
     config.headers.forEach { (key, value) ->
-      if (!key.equals("host", ignoreCase = true)) {
-        builder.addHeader(key, value)
-      }
+      builder.addHeader(key, value)
     }
     builder.header("Host", config.hostname)
+    builder.header("Accept-Encoding", "identity")
 
     val method = config.method
-    val bodyContent = config.body ?: ""
-    val mediaType = config.headers.entries
-      .firstOrNull { it.key.equals("Content-Type", ignoreCase = true) }
-      ?.value
-      ?.toMediaTypeOrNull()
-      ?: "application/json; charset=utf-8".toMediaTypeOrNull()
+    val requestBody = config.body?.let { bodyContent ->
+      val mediaType = config.headers.entries
+        .firstOrNull { it.key.equals("Content-Type", ignoreCase = true) }
+        ?.value
+        ?.toMediaTypeOrNull()
+      bodyContent.toRequestBody(mediaType)
+    }
 
     when (method) {
       "GET" -> builder.get()
       "HEAD" -> builder.head()
+      "DELETE" -> {
+        if (requestBody == null) {
+          builder.delete()
+        } else {
+          builder.delete(requestBody)
+        }
+      }
       else -> {
-        val requestBody = bodyContent.toRequestBody(mediaType)
         when (method) {
-          "POST" -> builder.post(requestBody)
-          "PUT" -> builder.put(requestBody)
-          "PATCH" -> builder.patch(requestBody)
-          "DELETE" -> builder.delete(requestBody)
+          "POST" -> builder.post(requireNotNull(requestBody))
+          "PUT" -> builder.put(requireNotNull(requestBody))
+          "PATCH" -> builder.patch(requireNotNull(requestBody))
           else -> builder.method(method, requestBody)
         }
       }
@@ -267,18 +514,36 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
   private fun ResponseBody?.safeString(): String {
     if (this == null) return ""
     return try {
-      this.string()
+      val source = source()
+      val buffer = Buffer()
+      var totalBytes = 0L
+      while (true) {
+        val read = source.read(buffer, 8 * 1024)
+        if (read == -1L) break
+        totalBytes += read
+        if (totalBytes > SniConnectValidation.MAX_RESPONSE_BODY_BYTES) {
+          throw IOException("Response body too large")
+        }
+      }
+      val charset = contentType()?.charset(StandardCharsets.UTF_8) ?: StandardCharsets.UTF_8
+      buffer.readString(charset)
     } catch (error: IOException) {
       throw IOException("Failed to read response body", error)
     }
   }
 
-  private fun headersToMap(headers: Headers): Map<String, String> {
-    val map = mutableMapOf<String, String>()
-    for (name in headers.names()) {
-      map[name] = headers[name] ?: ""
+  private fun headersToMaps(headers: Headers): HeaderMaps {
+    val singleValueHeaders = linkedMapOf<String, String>()
+    val multiValueHeaders = linkedMapOf<String, MutableList<String>>()
+
+    for (index in 0 until headers.size) {
+      val name = headers.name(index).lowercase(Locale.US)
+      val value = headers.value(index)
+      singleValueHeaders[name] = value
+      multiValueHeaders.getOrPut(name) { mutableListOf() }.add(value)
     }
-    return map
+
+    return HeaderMaps(singleValueHeaders, multiValueHeaders)
   }
 
   private fun Map<String, String>.toWritableMap(): WritableMap {
@@ -287,8 +552,18 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
+  private fun Map<String, List<String>>.toWritableArrayMap(): WritableMap {
+    return Arguments.createMap().apply {
+      forEach { (key, values) ->
+        val array = Arguments.createArray()
+        values.forEach { value -> array.pushString(value) }
+        putArray(key, array)
+      }
+    }
+  }
+
   private fun ReadableMap.toRequestConfig(): RequestConfig {
-    val headersMap = if (hasKey("headers") && !isNull("headers")) {
+    val rawHeadersMap = if (hasKey("headers") && !isNull("headers")) {
       getMap("headers")?.toHashMap()
         ?.mapValues { (_, value) -> value?.toString() ?: "" }
         ?: emptyMap()
@@ -297,7 +572,7 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
 
     val timeoutMillis = if (hasKey("timeout") && !isNull("timeout")) {
-      getDouble("timeout").toLong().coerceAtLeast(1L)
+      SniConnectValidation.parseTimeoutMillis(getDouble("timeout"))
     } else {
       30_000L
     }
@@ -308,13 +583,18 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     val hostname = getString("hostname") ?: throw IllegalArgumentException("hostname is required")
     val method = getString("method") ?: "GET"
     val path = getString("path") ?: "/"
+    val body = if (hasKey("body") && !isNull("body")) getString("body") else null
 
     // Validate every caller-controlled field at the boundary.
+    SniConnectValidation.validateRequestId(requestId)
     SniConnectValidation.validatePublicIp(ip)
     SniConnectValidation.validateHostname(hostname)
-    SniConnectValidation.validateHeaders(headersMap)
+    val headersMap = SniConnectValidation.normalizeHeaders(rawHeadersMap)
     val normalizedMethod = SniConnectValidation.normalizeMethod(method)
     val normalizedPath = SniConnectValidation.normalizePath(path)
+    SniConnectValidation.validateTimeout(timeoutMillis)
+    SniConnectValidation.validateBody(body)
+    SniConnectValidation.validateMethodBody(normalizedMethod, body)
 
     return RequestConfig(
       requestId = requestId,
@@ -323,7 +603,7 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
       method = normalizedMethod,
       path = normalizedPath,
       headers = headersMap,
-      body = if (hasKey("body") && !isNull("body")) getString("body") else null,
+      body = body,
       timeoutMillis = timeoutMillis,
     )
   }
@@ -338,4 +618,164 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     val body: String?,
     val timeoutMillis: Long,
   )
+
+  private data class HeaderMaps(
+    val singleValueHeaders: Map<String, String>,
+    val multiValueHeaders: Map<String, List<String>>,
+  )
+
+  private fun isProxyActiveForUrl(url: String): Boolean {
+    val startedAtMs = android.os.SystemClock.elapsedRealtime()
+    val uri = try {
+      URI(url)
+    } catch (error: Exception) {
+      SniConnectLogger.warn(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to "unknown",
+          "host" to "unknown",
+          "result" to "invalid_url",
+          "source" to "validation",
+          "proxyTypeCount" to 0,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      throw error
+    }
+    val scheme = uri.scheme?.lowercase(Locale.US)
+      ?: run {
+        SniConnectLogger.warn(
+          SniConnectLogger.event(
+            "proxy_preflight",
+            "platform" to "android",
+            "scheme" to "unknown",
+            "host" to "unknown",
+            "result" to "invalid_url",
+            "source" to "validation",
+            "proxyTypeCount" to 0,
+            "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+          ),
+        )
+        throw IllegalArgumentException("URL must include a scheme")
+      }
+    if (scheme != "http" && scheme != "https") {
+      SniConnectLogger.warn(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to scheme,
+          "host" to "unknown",
+          "result" to "invalid_url",
+          "source" to "validation",
+          "proxyTypeCount" to 0,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      throw IllegalArgumentException("Only http and https URLs are supported")
+    }
+    val host = uri.host
+    if (host.isNullOrBlank()) {
+      SniConnectLogger.warn(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to scheme,
+          "host" to "unknown",
+          "result" to "invalid_url",
+          "source" to "validation",
+          "proxyTypeCount" to 0,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      throw IllegalArgumentException("URL must include a host")
+    }
+
+    val selector = ProxySelector.getDefault()
+    val selectorProxies = selector?.select(uri).orEmpty()
+    val selectorHasProxy = selectorProxies.any { proxy ->
+      proxy != Proxy.NO_PROXY && proxy.type() != Proxy.Type.DIRECT
+    }
+    if (selectorHasProxy) {
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to scheme,
+          "host" to host,
+          "result" to true,
+          "source" to "ProxySelector",
+          "proxyTypeCount" to selectorProxies.map { proxy -> proxy.type().name }.toSet().size,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      return true
+    }
+
+    val connectivityManager = reactApplicationContext.getSystemService(Context.CONNECTIVITY_SERVICE)
+      as? ConnectivityManager
+      ?: run {
+        SniConnectLogger.info(
+          SniConnectLogger.event(
+            "proxy_preflight",
+            "platform" to "android",
+            "scheme" to scheme,
+            "host" to host,
+            "result" to false,
+            "source" to "none",
+            "proxyTypeCount" to selectorProxies.size,
+            "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+          ),
+        )
+        return false
+      }
+    val activeNetworkProxy = connectivityManager.activeNetwork
+      ?.let { network -> connectivityManager.getLinkProperties(network)?.httpProxy }
+    if (activeNetworkProxy?.host?.isNotBlank() == true && activeNetworkProxy.port > 0) {
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to scheme,
+          "host" to host,
+          "result" to true,
+          "source" to "LinkProperties",
+          "proxyTypeCount" to selectorProxies.size,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      return true
+    }
+
+    val defaultProxy = connectivityManager.defaultProxy
+    if (defaultProxy?.host?.isNotBlank() == true && defaultProxy.port > 0) {
+      SniConnectLogger.info(
+        SniConnectLogger.event(
+          "proxy_preflight",
+          "platform" to "android",
+          "scheme" to scheme,
+          "host" to host,
+          "result" to true,
+          "source" to "defaultProxy",
+          "proxyTypeCount" to selectorProxies.size,
+          "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+        ),
+      )
+      return true
+    }
+
+    SniConnectLogger.info(
+      SniConnectLogger.event(
+        "proxy_preflight",
+        "platform" to "android",
+        "scheme" to scheme,
+        "host" to host,
+        "result" to false,
+        "source" to "none",
+        "proxyTypeCount" to selectorProxies.size,
+        "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
+      ),
+    )
+    return false
+  }
 }