@onekeyfe/react-native-sni-connect 3.0.81-alpha.7 → 3.0.81

package/android/src/test/java/com/sniconnect/SniConnectValidationTest.kt

@@ -28,6 +28,18 @@ class SniConnectValidationTest {
     assertEquals("/v1?q=1", SniConnectValidation.normalizePath("v1?q=1"))
   }
 
+  @Test
+  fun canonicalizesEquivalentPublicIpLiterals() {
+    assertEquals(
+      "93.184.216.34",
+      SniConnectValidation.canonicalizePublicIp("093.184.216.034"),
+    )
+    assertEquals(
+      SniConnectValidation.canonicalizePublicIp("2001:4860:4860::8888"),
+      SniConnectValidation.canonicalizePublicIp("2001:4860:4860:0:0:0:0:8888"),
+    )
+  }
+
   @Test
   fun rejectsIpLiteralHostnames() {
     assertValidationFails { SniConnectValidation.validateHostname("93.184.216.34") }
@@ -117,8 +129,10 @@ class SniConnectValidationTest {
 
   @Test
   fun enforcesRequestIdTimeoutAndBodyLimits() {
+    SniConnectValidation.validateRequestId("界".repeat(42))
     assertValidationFails { SniConnectValidation.validateRequestId("") }
     assertValidationFails { SniConnectValidation.validateRequestId("x".repeat(129)) }
+    assertValidationFails { SniConnectValidation.validateRequestId("界".repeat(43)) }
     assertValidationFails { SniConnectValidation.validateRequestId("req\n1") }
     assertValidationFails { SniConnectValidation.validateTimeout(0) }
     assertValidationFails { SniConnectValidation.validateTimeout(120_001) }
@@ -184,32 +198,6 @@ class SniConnectValidationTest {
     SniConnectValidation.validateMethodBody("OPTIONS", null)
   }
 
-  @Test
-  fun requestLimiterEnforcesGlobalAndPerDestinationLimits() {
-    val limiter = SniConnectRequestLimiter(
-      maxActiveRequests = 2,
-      maxActiveRequestsPerPair = 1,
-    )
-
-    val firstToken = limiter.acquire("Example.com", "93.184.216.34")
-    assertValidationFails {
-      limiter.acquire("example.com", "93.184.216.34")
-    }
-
-    val secondToken = limiter.acquire("example.com", "93.184.216.35")
-    assertValidationFails {
-      limiter.acquire("example.net", "93.184.216.36")
-    }
-
-    firstToken.release()
-    val replacementToken = limiter.acquire("example.com", "93.184.216.34")
-    firstToken.release()
-    secondToken.release()
-    replacementToken.release()
-
-    assertTrue(true)
-  }
-
   @Test
   fun classifiesSecurityFailuresAsFailClosedErrorCodes() {
     assertEquals(
@@ -244,6 +232,18 @@ class SniConnectValidationTest {
       "SNI_REQUEST_FAILED",
       classifySniFailureCode(IOException("connection reset")),
     )
+    assertEquals(
+      "SNI_CANCELLED",
+      classifySniResponseFailureCode(IOException("cancelled"), true),
+    )
+    assertEquals(
+      "SNI_REQUEST_TIMEOUT",
+      classifySniResponseFailureCode(SocketTimeoutException("timeout"), false),
+    )
+    assertEquals(
+      "SNI_RESPONSE_FAILED",
+      classifySniResponseFailureCode(IOException("bad body"), false),
+    )
   }
 
   private fun assertValidationFails(block: () -> Unit) {

package/ios/SniConnect.mm

@@ -18,6 +18,9 @@
                    reject:(RCTPromiseRejectBlock)reject;
 - (void)clearDNSCache:(RCTPromiseResolveBlock)resolve
                reject:(RCTPromiseRejectBlock)reject;
+- (void)getDebugSnapshot:(NSDictionary *)target
+                 resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject;
 - (void)isProxyActiveForUrl:(NSString *)url
                     resolve:(RCTPromiseResolveBlock)resolve
                      reject:(RCTPromiseRejectBlock)reject;
@@ -89,6 +92,16 @@ RCT_EXPORT_MODULE(SniConnect)
   [_implementation clearDNSCache:resolve reject:reject];
 }
 
+- (void)getDebugSnapshot:(JS::NativeSniConnect::SniConnectDebugTarget &)target
+                  resolve:(RCTPromiseResolveBlock)resolve
+                   reject:(RCTPromiseRejectBlock)reject {
+  NSDictionary *targetDict = @{
+    @"ip": target.ip() ?: @"",
+    @"hostname": target.hostname() ?: @"",
+  };
+  [_implementation getDebugSnapshot:targetDict resolve:resolve reject:reject];
+}
+
 - (void)isProxyActiveForUrl:(NSString *)url
                     resolve:(RCTPromiseResolveBlock)resolve
                      reject:(RCTPromiseRejectBlock)reject {
@@ -124,6 +137,12 @@ RCT_EXPORT_METHOD(clearDNSCache:(RCTPromiseResolveBlock)resolver
   [_implementation clearDNSCache:resolver reject:rejecter];
 }
 
+RCT_EXPORT_METHOD(getDebugSnapshot:(NSDictionary *)target
+                  resolver:(RCTPromiseResolveBlock)resolver
+                  rejecter:(RCTPromiseRejectBlock)rejecter) {
+  [_implementation getDebugSnapshot:target resolve:resolver reject:rejecter];
+}
+
 RCT_EXPORT_METHOD(isProxyActiveForUrl:(NSString *)url
                   resolver:(RCTPromiseResolveBlock)resolver
                   rejecter:(RCTPromiseRejectBlock)rejecter) {

package/ios/SniConnect.swift

@@ -133,6 +133,35 @@ final class SniConnectImpl: NSObject {
     resolve(["success": true])
   }
 
+  @objc
+  public func getDebugSnapshot(
+    _ target: NSDictionary,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    do {
+      guard let ip = target["ip"] as? String, !ip.isEmpty else {
+        throw SniConnectError.invalidConfig("Missing ip")
+      }
+      guard let hostname = target["hostname"] as? String, !hostname.isEmpty else {
+        throw SniConnectError.invalidConfig("Missing hostname")
+      }
+      try SniConnectValidation.validatePublicIP(ip)
+      try SniConnectValidation.validateHostname(hostname)
+      let snapshot = client.debugSnapshot(hostname: hostname, ip: ip)
+      resolve([
+        "activeRequests": snapshot.activeRequests,
+        "activeRequestsForPair": snapshot.activeRequestsForPair,
+        "pendingRequests": snapshot.pendingRequests,
+        "pendingRequestsForPair": snapshot.pendingRequestsForPair,
+        "activeRequestIdsForPair": snapshot.activeRequestIdsForPair,
+        "pendingRequestIdsForPair": snapshot.pendingRequestIdsForPair,
+      ])
+    } catch {
+      reject("SNI_INVALID_CONFIG", "\(error)", error)
+    }
+  }
+
   @objc
   public func isProxyActiveForUrl(
     _ url: String,

package/ios/SniConnectClient.swift

@@ -4,13 +4,13 @@ import UIKit
 import EMASCurl
 
 @objc(SniConnectPinnedDNSResolverBase)
-class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
+private class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
   @objc class func resolveDomain(_ domain: String) -> String? {
     PinnedDNSResolverFactory.resolve(domain: domain, resolverClass: self)
   }
 }
 
-enum PinnedDNSResolverFactory {
+private enum PinnedDNSResolverFactory {
   private static let queue = DispatchQueue(label: "com.onekey.sni.connect.pinned-dns-resolvers")
   private static var nextClassID = 0
   private static let registry = SniConnectPinnedResolverRegistry()
@@ -54,7 +54,7 @@ enum PinnedDNSResolverFactory {
   }
 }
 
-final class SniConnectPinnedResolverLease {
+private final class SniConnectPinnedResolverLease {
   private let hostname: String
   private let ip: String
   private let queue = DispatchQueue(label: "com.onekey.sni.connect.resolver-lease")
@@ -90,22 +90,15 @@ final class SniConnectPinnedResolverLease {
   }
 }
 
-final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDataDelegate {
+private final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDelegate {
   private let hostname: String
   private let ip: String
   private let resolverLease: SniConnectPinnedResolverLease
-  private weak var forwardingDataDelegate: URLSessionDataDelegate?
-
-  init(
-    hostname: String,
-    ip: String,
-    resolverLease: SniConnectPinnedResolverLease,
-    forwardingDataDelegate: URLSessionDataDelegate? = nil
-  ) {
+
+  init(hostname: String, ip: String, resolverLease: SniConnectPinnedResolverLease) {
     self.hostname = hostname
     self.ip = ip
     self.resolverLease = resolverLease
-    self.forwardingDataDelegate = forwardingDataDelegate
   }
 
   func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
@@ -117,64 +110,6 @@ final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDataDeleg
       ("success", error == nil),
     ]))
   }
-
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    willPerformHTTPRedirection response: HTTPURLResponse,
-    newRequest request: URLRequest,
-    completionHandler: @escaping (URLRequest?) -> Void
-  ) {
-    if let forwardingDataDelegate {
-      forwardingDataDelegate.urlSession?(
-        session,
-        task: task,
-        willPerformHTTPRedirection: response,
-        newRequest: request,
-        completionHandler: completionHandler
-      )
-    } else {
-      completionHandler(nil)
-    }
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive response: URLResponse,
-    completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
-  ) {
-    forwardingDataDelegate?.urlSession?(
-      session,
-      dataTask: dataTask,
-      didReceive: response,
-      completionHandler: completionHandler
-    ) ?? completionHandler(.cancel)
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive data: Data
-  ) {
-    forwardingDataDelegate?.urlSession?(
-      session,
-      dataTask: dataTask,
-      didReceive: data
-    )
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    didCompleteWithError error: Error?
-  ) {
-    forwardingDataDelegate?.urlSession?(
-      session,
-      task: task,
-      didCompleteWithError: error
-    )
-  }
 }
 
 /// Core HTTPS client that enforces IP direct connection with SNI.
@@ -185,7 +120,7 @@ final class SniConnectClient {
   private var activeTasksByToken: [UUID: Task<Response, Error>] = [:]
   private var requestTokensById: [String: UUID] = [:]
   private let tasksQueue = DispatchQueue(label: "com.onekey.sni.connect.tasks", attributes: .concurrent)
-  private let requestLimiter = SniConnectRequestLimiter()
+  private let requestLimiter = SniConnectRequestLimiter.shared
 
   private struct SessionKey: Hashable {
     let hostname: String
@@ -399,10 +334,33 @@ final class SniConnectClient {
   }
 
   private static func makeURLSession(for key: SessionKey) throws -> ManagedSession {
-    let resources = try SniConnectPinnedTransport.makeResources(
+    let configuration = URLSessionConfiguration.default
+    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+    configuration.urlCache = nil
+    configuration.httpCookieStorage = nil
+    configuration.httpShouldSetCookies = false
+    configuration.connectionProxyDictionary = [:]
+    configuration.shouldUseExtendedBackgroundIdleMode = false
+
+    let curlConfig = EMASCurlConfiguration.default()
+    curlConfig.httpVersion = .HTTP1
+    curlConfig.connectTimeoutInterval = 2.5
+    curlConfig.enableBuiltInGzip = false
+    curlConfig.enableBuiltInRedirection = false
+    curlConfig.cacheEnabled = false
+
+    // Enable full certificate validation for security.
+    // The certificate is validated against the SNI hostname, not the IP, because
+    // the custom DNS resolver only overrides address resolution — libcurl keeps the
+    // original hostname for SNI and certificate CN/SAN matching.
+    curlConfig.certificateValidationEnabled = true
+    curlConfig.domainNameVerificationEnabled = true
+    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
       hostname: key.hostname,
       ip: key.ip
     )
+
+    EMASCurlProtocol.install(into: configuration, with: curlConfig)
     SniConnectLog.info(SniConnectLog.event("sni_transport_config", [
       ("hostname", key.hostname),
       ("ipHash", SniConnectLog.shortHash(key.ip)),
@@ -413,13 +371,15 @@ final class SniConnectClient {
       ("followRedirects", false),
       ("cacheEnabled", false),
     ]))
+    let resolverLease = SniConnectPinnedResolverLease(hostname: key.hostname, ip: key.ip)
+    let delegate = SniConnectSessionInvalidationDelegate(
+      hostname: key.hostname,
+      ip: key.ip,
+      resolverLease: resolverLease
+    )
     return ManagedSession(
-      session: URLSession(
-        configuration: resources.configuration,
-        delegate: resources.delegate,
-        delegateQueue: nil
-      ),
-      resolverLease: resources.resolverLease
+      session: URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil),
+      resolverLease: resolverLease
     )
   }
 
@@ -550,6 +510,10 @@ final class SniConnectClient {
     ]))
   }
 
+  func debugSnapshot(hostname: String, ip: String) -> SniConnectRequestLimiter.Snapshot {
+    requestLimiter.snapshot(hostname: hostname, ip: ip)
+  }
+
   /// Cancel a request by ID
   func cancelRequest(requestId: String) -> Bool {
     return tasksQueue.sync(flags: .barrier) { [weak self] in
@@ -656,9 +620,24 @@ final class SniConnectClient {
 
     let requestSlot: SniConnectRequestLimiter.Token
     do {
-      requestSlot = try requestLimiter.acquire(hostname: config.hostname, ip: config.ip)
+      // Admission wait and transport share one total wall-clock deadline.
+      let limiter = requestLimiter
+      let admissionTimeoutMilliseconds =
+        config.effectiveTotalTimeout - Date().timeIntervalSince(startedAt) * 1_000.0
+      guard admissionTimeoutMilliseconds > 0 else {
+        throw SniConnectTimeout.deadlineExceeded
+      }
+      requestSlot = try await SniConnectWallClockDeadline.run(
+        timeoutMilliseconds: admissionTimeoutMilliseconds
+      ) {
+        try await limiter.acquire(
+          hostname: config.hostname,
+          ip: config.ip,
+          requestId: config.requestId
+        )
+      }
     } catch {
-      let sniError = SniConnectError.resourceLimit("\(error)")
+      let sniError = SniConnectError.from(error)
       SniConnectLog.error(SniConnectLog.event("sni_request_result", [
         ("result", "error"),
         ("code", sniError.code),
@@ -676,6 +655,14 @@ final class SniConnectClient {
     defer {
       requestSlot.release()
     }
+    try Task.checkCancellation()
+
+    let queueWaitMilliseconds = SniConnectLog.elapsedMs(since: startedAt)
+    let remainingTimeoutMilliseconds =
+      config.effectiveTotalTimeout - Double(queueWaitMilliseconds)
+    guard remainingTimeoutMilliseconds > 0 else {
+      throw SniConnectError.requestTimeout
+    }
 
     let url = try Self.buildURL(hostname: config.hostname, normalizedPath: normalizedPath)
 
@@ -683,8 +670,9 @@ final class SniConnectClient {
     mutableRequest.httpMethod = method
 
     // Convert milliseconds to seconds for timeout values
-    let totalTimeoutSeconds = config.effectiveTotalTimeout / 1000.0
-    let connectTimeoutSeconds = config.effectiveConnectTimeout / 1000.0
+    let totalTimeoutSeconds = remainingTimeoutMilliseconds / 1000.0
+    let connectTimeoutSeconds =
+      min(config.effectiveConnectTimeout, remainingTimeoutMilliseconds) / 1000.0
 
     // URLRequest.timeoutInterval is not a full request deadline. Keep it aligned
     // with the caller timeout as a transport guard; the wall-clock deadline below
@@ -714,12 +702,15 @@ final class SniConnectClient {
       ("method", method),
       ("timeoutMs", Int(config.effectiveTotalTimeout)),
       ("connectTimeoutMs", Int(config.effectiveConnectTimeout)),
+      ("queueWaitMs", queueWaitMilliseconds),
       ("headerCount", normalizedHeaders.count),
       ("bodyBytes", config.body?.data(using: .utf8)?.count ?? 0),
     ]))
 
     do {
-      return try await SniConnectWallClockDeadline.run(timeoutMilliseconds: config.effectiveTotalTimeout) {
+      return try await SniConnectWallClockDeadline.run(
+        timeoutMilliseconds: remainingTimeoutMilliseconds
+      ) {
         let lease = try await self.sessionLease(for: config)
         defer {
           self.releaseSessionLease(lease)