@onekeyfe/react-native-sni-connect 3.0.80 → 3.0.81-alpha.1

package/android/src/main/java/com/sniconnect/SniConnectModule.kt

@@ -13,11 +13,9 @@ import okhttp3.Call
 import okhttp3.Callback
 import okhttp3.ConnectionPool
 import okhttp3.Dispatcher
-import okhttp3.Dns
 import okhttp3.Headers
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.OkHttpClient
-import okhttp3.Protocol
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
@@ -25,7 +23,6 @@ import okhttp3.ResponseBody
 import okio.Buffer
 import java.io.IOException
 import java.io.InterruptedIOException
-import java.net.InetAddress
 import java.net.Proxy
 import java.net.ProxySelector
 import java.net.URI
@@ -37,7 +34,6 @@ import java.util.Locale
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
-import javax.net.ssl.HttpsURLConnection
 import javax.net.ssl.SSLException
 import javax.net.ssl.SSLPeerUnverifiedException
 
@@ -405,24 +401,12 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     synchronized(clientCache) {
       clientCache[key]?.let { return it }
 
-      val client = OkHttpClient.Builder()
-        .dispatcher(sharedDispatcher)
-        .connectionPool(sharedConnectionPool)
-        .proxy(Proxy.NO_PROXY)
-        .protocols(listOf(Protocol.HTTP_1_1))
-        .connectTimeout(0, TimeUnit.MILLISECONDS)
-        .readTimeout(0, TimeUnit.MILLISECONDS)
-        .writeTimeout(0, TimeUnit.MILLISECONDS)
-        .callTimeout(0, TimeUnit.MILLISECONDS)
-        .followRedirects(false)
-        .followSslRedirects(false)
-        // TLS is validated normally: cert chain via the default trust manager and
-        // hostname verification against the REAL hostname (not the pinned IP).
-        .hostnameVerifier { _, session ->
-          HttpsURLConnection.getDefaultHostnameVerifier().verify(config.hostname, session)
-        }
-        .dns(createPinnedDns(config.ip, config.hostname))
-        .build()
+      val client = SniPinnedTransport.createClient(
+        ip = config.ip,
+        hostname = config.hostname,
+        dispatcher = sharedDispatcher,
+        connectionPool = sharedConnectionPool,
+      )
 
       clientCache[key] = client
       SniConnectLogger.info(
@@ -442,29 +426,6 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  private fun createPinnedDns(ip: String, hostname: String): Dns =
-    object : Dns {
-      private val expectedHost = hostname.lowercase(Locale.US)
-      // Resolve the literal IP once up front (validated; never triggers DNS).
-      private val pinnedAddress: InetAddress = SniConnectValidation.literalToInetAddress(ip)
-
-      override fun lookup(requestedHost: String): List<InetAddress> {
-        return if (requestedHost.lowercase(Locale.US) == expectedHost) {
-          listOf(pinnedAddress)
-        } else {
-          SniConnectLogger.warn(
-            SniConnectLogger.event(
-              "sni_pinned_dns_unexpected_host",
-              "expectedHost" to expectedHost,
-              "requestedHostHash" to SniConnectLogger.shortHash(requestedHost.lowercase(Locale.US)),
-              "result" to "fail_closed",
-            ),
-          )
-          throw UnknownHostException("Unexpected host for pinned SNI request: $requestedHost")
-        }
-      }
-    }
-
   /**
    * Build the request. Always `https://<hostname><path>` on the implicit port 443 —
    * `path` has been validated as relative, so scheme/host/port cannot be overridden.

package/android/src/main/java/com/sniconnect/SniPinnedTransport.kt

@@ -0,0 +1,58 @@
+package com.sniconnect
+
+import java.net.InetAddress
+import java.net.Proxy
+import java.net.UnknownHostException
+import java.util.Locale
+import java.util.concurrent.TimeUnit
+import okhttp3.ConnectionPool
+import okhttp3.Dispatcher
+import okhttp3.Dns
+import okhttp3.OkHttpClient
+import okhttp3.Protocol
+import javax.net.ssl.HttpsURLConnection
+
+object SniPinnedTransport {
+  @JvmStatic
+  fun createClient(
+    ip: String,
+    hostname: String,
+    dispatcher: Dispatcher = Dispatcher(),
+    connectionPool: ConnectionPool = ConnectionPool(),
+  ): OkHttpClient {
+    SniConnectValidation.validatePublicIp(ip)
+    SniConnectValidation.validateHostname(hostname)
+    val normalizedHostname = hostname.lowercase(Locale.US)
+    return OkHttpClient.Builder()
+      .dispatcher(dispatcher)
+      .connectionPool(connectionPool)
+      .proxy(Proxy.NO_PROXY)
+      .protocols(listOf(Protocol.HTTP_1_1))
+      .connectTimeout(0, TimeUnit.MILLISECONDS)
+      .readTimeout(0, TimeUnit.MILLISECONDS)
+      .writeTimeout(0, TimeUnit.MILLISECONDS)
+      .callTimeout(0, TimeUnit.MILLISECONDS)
+      .followRedirects(false)
+      .followSslRedirects(false)
+      .hostnameVerifier { _, session ->
+        HttpsURLConnection.getDefaultHostnameVerifier().verify(normalizedHostname, session)
+      }
+      .dns(createPinnedDns(ip, normalizedHostname))
+      .build()
+  }
+
+  private fun createPinnedDns(ip: String, hostname: String): Dns =
+    object : Dns {
+      private val pinnedAddress: InetAddress =
+        SniConnectValidation.literalToInetAddress(ip)
+
+      override fun lookup(requestedHost: String): List<InetAddress> {
+        if (requestedHost.lowercase(Locale.US) == hostname) {
+          return listOf(pinnedAddress)
+        }
+        throw UnknownHostException(
+          "Unexpected host for pinned SNI request: $requestedHost"
+        )
+      }
+    }
+}

package/ios/SniConnectClient.swift

@@ -4,13 +4,13 @@ import UIKit
 import EMASCurl
 
 @objc(SniConnectPinnedDNSResolverBase)
-private class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
+class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
   @objc class func resolveDomain(_ domain: String) -> String? {
     PinnedDNSResolverFactory.resolve(domain: domain, resolverClass: self)
   }
 }
 
-private enum PinnedDNSResolverFactory {
+enum PinnedDNSResolverFactory {
   private static let queue = DispatchQueue(label: "com.onekey.sni.connect.pinned-dns-resolvers")
   private static var nextClassID = 0
   private static let registry = SniConnectPinnedResolverRegistry()
@@ -54,7 +54,7 @@ private enum PinnedDNSResolverFactory {
   }
 }
 
-private final class SniConnectPinnedResolverLease {
+final class SniConnectPinnedResolverLease {
   private let hostname: String
   private let ip: String
   private let queue = DispatchQueue(label: "com.onekey.sni.connect.resolver-lease")
@@ -90,7 +90,7 @@ private final class SniConnectPinnedResolverLease {
   }
 }
 
-private final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDelegate {
+final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDelegate {
   private let hostname: String
   private let ip: String
   private let resolverLease: SniConnectPinnedResolverLease
@@ -334,33 +334,10 @@ final class SniConnectClient {
   }
 
   private static func makeURLSession(for key: SessionKey) throws -> ManagedSession {
-    let configuration = URLSessionConfiguration.default
-    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
-    configuration.urlCache = nil
-    configuration.httpCookieStorage = nil
-    configuration.httpShouldSetCookies = false
-    configuration.connectionProxyDictionary = [:]
-    configuration.shouldUseExtendedBackgroundIdleMode = false
-
-    let curlConfig = EMASCurlConfiguration.default()
-    curlConfig.httpVersion = .HTTP1
-    curlConfig.connectTimeoutInterval = 2.5
-    curlConfig.enableBuiltInGzip = false
-    curlConfig.enableBuiltInRedirection = false
-    curlConfig.cacheEnabled = false
-
-    // Enable full certificate validation for security.
-    // The certificate is validated against the SNI hostname, not the IP, because
-    // the custom DNS resolver only overrides address resolution — libcurl keeps the
-    // original hostname for SNI and certificate CN/SAN matching.
-    curlConfig.certificateValidationEnabled = true
-    curlConfig.domainNameVerificationEnabled = true
-    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
+    let resources = try SniConnectPinnedTransport.makeResources(
       hostname: key.hostname,
       ip: key.ip
     )
-
-    EMASCurlProtocol.install(into: configuration, with: curlConfig)
     SniConnectLog.info(SniConnectLog.event("sni_transport_config", [
       ("hostname", key.hostname),
       ("ipHash", SniConnectLog.shortHash(key.ip)),
@@ -371,15 +348,13 @@ final class SniConnectClient {
       ("followRedirects", false),
       ("cacheEnabled", false),
     ]))
-    let resolverLease = SniConnectPinnedResolverLease(hostname: key.hostname, ip: key.ip)
-    let delegate = SniConnectSessionInvalidationDelegate(
-      hostname: key.hostname,
-      ip: key.ip,
-      resolverLease: resolverLease
-    )
     return ManagedSession(
-      session: URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil),
-      resolverLease: resolverLease
+      session: URLSession(
+        configuration: resources.configuration,
+        delegate: resources.delegate,
+        delegateQueue: nil
+      ),
+      resolverLease: resources.resolverLease
     )
   }
 

package/ios/SniConnectPinnedTransport.swift

@@ -0,0 +1,85 @@
+import Foundation
+import EMASCurl
+
+struct SniConnectPinnedTransportResources {
+  let configuration: URLSessionConfiguration
+  let resolverLease: SniConnectPinnedResolverLease
+  let delegate: SniConnectSessionInvalidationDelegate
+}
+
+public final class SniConnectPinnedSession {
+  public let session: URLSession
+
+  init(resources: SniConnectPinnedTransportResources) {
+    session = URLSession(
+      configuration: resources.configuration,
+      delegate: resources.delegate,
+      delegateQueue: nil
+    )
+  }
+
+  public func close() {
+    session.finishTasksAndInvalidate()
+  }
+
+  deinit {
+    close()
+  }
+}
+
+public enum SniConnectPinnedTransport {
+  static func makeResources(
+    hostname: String,
+    ip: String
+  ) throws -> SniConnectPinnedTransportResources {
+    try SniConnectValidation.validateHostname(hostname)
+    try SniConnectValidation.validatePublicIP(ip)
+
+    let normalizedHostname = hostname.lowercased()
+    let configuration = URLSessionConfiguration.default
+    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+    configuration.urlCache = nil
+    configuration.httpCookieStorage = nil
+    configuration.httpShouldSetCookies = false
+    configuration.connectionProxyDictionary = [:]
+    configuration.shouldUseExtendedBackgroundIdleMode = false
+
+    let curlConfig = EMASCurlConfiguration.default()
+    curlConfig.httpVersion = .HTTP1
+    curlConfig.connectTimeoutInterval = 2.5
+    curlConfig.enableBuiltInGzip = false
+    curlConfig.enableBuiltInRedirection = false
+    curlConfig.cacheEnabled = false
+    curlConfig.certificateValidationEnabled = true
+    curlConfig.domainNameVerificationEnabled = true
+    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
+      hostname: normalizedHostname,
+      ip: ip
+    )
+    EMASCurlProtocol.install(into: configuration, with: curlConfig)
+
+    let resolverLease = SniConnectPinnedResolverLease(
+      hostname: normalizedHostname,
+      ip: ip
+    )
+    let delegate = SniConnectSessionInvalidationDelegate(
+      hostname: normalizedHostname,
+      ip: ip,
+      resolverLease: resolverLease
+    )
+    return SniConnectPinnedTransportResources(
+      configuration: configuration,
+      resolverLease: resolverLease,
+      delegate: delegate
+    )
+  }
+
+  public static func makeSession(
+    hostname: String,
+    ip: String
+  ) throws -> SniConnectPinnedSession {
+    SniConnectPinnedSession(
+      resources: try makeResources(hostname: hostname, ip: ip)
+    )
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-sni-connect",
-  "version": "3.0.80",
+  "version": "3.0.81-alpha.1",
   "description": "A React Native library for SNI-based HTTP requests with DNS caching and request management",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -161,5 +161,6 @@
     "languages": "kotlin-objc",
     "type": "turbo-module",
     "version": "0.54.8"
-  }
+  },
+  "stableVersion": "3.0.80"
 }