@onekeyfe/react-native-sni-connect 3.0.81 → 3.0.82

package/android/src/test/java/com/sniconnect/SniConnectValidationTest.kt

@@ -28,18 +28,6 @@ class SniConnectValidationTest {
     assertEquals("/v1?q=1", SniConnectValidation.normalizePath("v1?q=1"))
   }
 
-  @Test
-  fun canonicalizesEquivalentPublicIpLiterals() {
-    assertEquals(
-      "93.184.216.34",
-      SniConnectValidation.canonicalizePublicIp("093.184.216.034"),
-    )
-    assertEquals(
-      SniConnectValidation.canonicalizePublicIp("2001:4860:4860::8888"),
-      SniConnectValidation.canonicalizePublicIp("2001:4860:4860:0:0:0:0:8888"),
-    )
-  }
-
   @Test
   fun rejectsIpLiteralHostnames() {
     assertValidationFails { SniConnectValidation.validateHostname("93.184.216.34") }
@@ -129,10 +117,8 @@ class SniConnectValidationTest {
 
   @Test
   fun enforcesRequestIdTimeoutAndBodyLimits() {
-    SniConnectValidation.validateRequestId("界".repeat(42))
     assertValidationFails { SniConnectValidation.validateRequestId("") }
     assertValidationFails { SniConnectValidation.validateRequestId("x".repeat(129)) }
-    assertValidationFails { SniConnectValidation.validateRequestId("界".repeat(43)) }
     assertValidationFails { SniConnectValidation.validateRequestId("req\n1") }
     assertValidationFails { SniConnectValidation.validateTimeout(0) }
     assertValidationFails { SniConnectValidation.validateTimeout(120_001) }
@@ -198,6 +184,32 @@ class SniConnectValidationTest {
     SniConnectValidation.validateMethodBody("OPTIONS", null)
   }
 
+  @Test
+  fun requestLimiterEnforcesGlobalAndPerDestinationLimits() {
+    val limiter = SniConnectRequestLimiter(
+      maxActiveRequests = 2,
+      maxActiveRequestsPerPair = 1,
+    )
+
+    val firstToken = limiter.acquire("Example.com", "93.184.216.34")
+    assertValidationFails {
+      limiter.acquire("example.com", "93.184.216.34")
+    }
+
+    val secondToken = limiter.acquire("example.com", "93.184.216.35")
+    assertValidationFails {
+      limiter.acquire("example.net", "93.184.216.36")
+    }
+
+    firstToken.release()
+    val replacementToken = limiter.acquire("example.com", "93.184.216.34")
+    firstToken.release()
+    secondToken.release()
+    replacementToken.release()
+
+    assertTrue(true)
+  }
+
   @Test
   fun classifiesSecurityFailuresAsFailClosedErrorCodes() {
     assertEquals(
@@ -232,18 +244,6 @@ class SniConnectValidationTest {
       "SNI_REQUEST_FAILED",
       classifySniFailureCode(IOException("connection reset")),
     )
-    assertEquals(
-      "SNI_CANCELLED",
-      classifySniResponseFailureCode(IOException("cancelled"), true),
-    )
-    assertEquals(
-      "SNI_REQUEST_TIMEOUT",
-      classifySniResponseFailureCode(SocketTimeoutException("timeout"), false),
-    )
-    assertEquals(
-      "SNI_RESPONSE_FAILED",
-      classifySniResponseFailureCode(IOException("bad body"), false),
-    )
   }
 
   private fun assertValidationFails(block: () -> Unit) {

package/ios/SniConnect.mm

@@ -18,9 +18,6 @@
                    reject:(RCTPromiseRejectBlock)reject;
 - (void)clearDNSCache:(RCTPromiseResolveBlock)resolve
                reject:(RCTPromiseRejectBlock)reject;
-- (void)getDebugSnapshot:(NSDictionary *)target
-                 resolve:(RCTPromiseResolveBlock)resolve
-                  reject:(RCTPromiseRejectBlock)reject;
 - (void)isProxyActiveForUrl:(NSString *)url
                     resolve:(RCTPromiseResolveBlock)resolve
                      reject:(RCTPromiseRejectBlock)reject;
@@ -92,16 +89,6 @@ RCT_EXPORT_MODULE(SniConnect)
   [_implementation clearDNSCache:resolve reject:reject];
 }
 
-- (void)getDebugSnapshot:(JS::NativeSniConnect::SniConnectDebugTarget &)target
-                  resolve:(RCTPromiseResolveBlock)resolve
-                   reject:(RCTPromiseRejectBlock)reject {
-  NSDictionary *targetDict = @{
-    @"ip": target.ip() ?: @"",
-    @"hostname": target.hostname() ?: @"",
-  };
-  [_implementation getDebugSnapshot:targetDict resolve:resolve reject:reject];
-}
-
 - (void)isProxyActiveForUrl:(NSString *)url
                     resolve:(RCTPromiseResolveBlock)resolve
                      reject:(RCTPromiseRejectBlock)reject {
@@ -137,12 +124,6 @@ RCT_EXPORT_METHOD(clearDNSCache:(RCTPromiseResolveBlock)resolver
   [_implementation clearDNSCache:resolver reject:rejecter];
 }
 
-RCT_EXPORT_METHOD(getDebugSnapshot:(NSDictionary *)target
-                  resolver:(RCTPromiseResolveBlock)resolver
-                  rejecter:(RCTPromiseRejectBlock)rejecter) {
-  [_implementation getDebugSnapshot:target resolve:resolver reject:rejecter];
-}
-
 RCT_EXPORT_METHOD(isProxyActiveForUrl:(NSString *)url
                   resolver:(RCTPromiseResolveBlock)resolver
                   rejecter:(RCTPromiseRejectBlock)rejecter) {

package/ios/SniConnect.swift

@@ -133,35 +133,6 @@ final class SniConnectImpl: NSObject {
     resolve(["success": true])
   }
 
-  @objc
-  public func getDebugSnapshot(
-    _ target: NSDictionary,
-    resolve: @escaping RCTPromiseResolveBlock,
-    reject: @escaping RCTPromiseRejectBlock
-  ) {
-    do {
-      guard let ip = target["ip"] as? String, !ip.isEmpty else {
-        throw SniConnectError.invalidConfig("Missing ip")
-      }
-      guard let hostname = target["hostname"] as? String, !hostname.isEmpty else {
-        throw SniConnectError.invalidConfig("Missing hostname")
-      }
-      try SniConnectValidation.validatePublicIP(ip)
-      try SniConnectValidation.validateHostname(hostname)
-      let snapshot = client.debugSnapshot(hostname: hostname, ip: ip)
-      resolve([
-        "activeRequests": snapshot.activeRequests,
-        "activeRequestsForPair": snapshot.activeRequestsForPair,
-        "pendingRequests": snapshot.pendingRequests,
-        "pendingRequestsForPair": snapshot.pendingRequestsForPair,
-        "activeRequestIdsForPair": snapshot.activeRequestIdsForPair,
-        "pendingRequestIdsForPair": snapshot.pendingRequestIdsForPair,
-      ])
-    } catch {
-      reject("SNI_INVALID_CONFIG", "\(error)", error)
-    }
-  }
-
   @objc
   public func isProxyActiveForUrl(
     _ url: String,

package/ios/SniConnectClient.swift

@@ -4,13 +4,13 @@ import UIKit
 import EMASCurl
 
 @objc(SniConnectPinnedDNSResolverBase)
-private class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
+class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
   @objc class func resolveDomain(_ domain: String) -> String? {
     PinnedDNSResolverFactory.resolve(domain: domain, resolverClass: self)
   }
 }
 
-private enum PinnedDNSResolverFactory {
+enum PinnedDNSResolverFactory {
   private static let queue = DispatchQueue(label: "com.onekey.sni.connect.pinned-dns-resolvers")
   private static var nextClassID = 0
   private static let registry = SniConnectPinnedResolverRegistry()
@@ -54,7 +54,7 @@ private enum PinnedDNSResolverFactory {
   }
 }
 
-private final class SniConnectPinnedResolverLease {
+final class SniConnectPinnedResolverLease {
   private let hostname: String
   private let ip: String
   private let queue = DispatchQueue(label: "com.onekey.sni.connect.resolver-lease")
@@ -90,15 +90,22 @@ private final class SniConnectPinnedResolverLease {
   }
 }
 
-private final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDelegate {
+final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDataDelegate {
   private let hostname: String
   private let ip: String
   private let resolverLease: SniConnectPinnedResolverLease
-
-  init(hostname: String, ip: String, resolverLease: SniConnectPinnedResolverLease) {
+  private weak var forwardingDataDelegate: URLSessionDataDelegate?
+
+  init(
+    hostname: String,
+    ip: String,
+    resolverLease: SniConnectPinnedResolverLease,
+    forwardingDataDelegate: URLSessionDataDelegate? = nil
+  ) {
     self.hostname = hostname
     self.ip = ip
     self.resolverLease = resolverLease
+    self.forwardingDataDelegate = forwardingDataDelegate
   }
 
   func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
@@ -110,6 +117,66 @@ private final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionD
       ("success", error == nil),
     ]))
   }
+
+  func urlSession(
+    _ session: URLSession,
+    task: URLSessionTask,
+    willPerformHTTPRedirection response: HTTPURLResponse,
+    newRequest request: URLRequest,
+    completionHandler: @escaping (URLRequest?) -> Void
+  ) {
+    if let forwardingDataDelegate {
+      forwardingDataDelegate.urlSession?(
+        session,
+        task: task,
+        willPerformHTTPRedirection: response,
+        newRequest: request,
+        completionHandler: completionHandler
+      )
+    } else {
+      completionHandler(nil)
+    }
+  }
+
+  func urlSession(
+    _ session: URLSession,
+    dataTask: URLSessionDataTask,
+    didReceive response: URLResponse,
+    completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
+  ) {
+    forwardingDataDelegate?.urlSession?(
+      session,
+      dataTask: dataTask,
+      didReceive: response,
+      completionHandler: completionHandler
+    ) ?? completionHandler(
+      SniConnectSessionDelegatePolicy.responseDispositionWithoutForwardingDelegate
+    )
+  }
+
+  func urlSession(
+    _ session: URLSession,
+    dataTask: URLSessionDataTask,
+    didReceive data: Data
+  ) {
+    forwardingDataDelegate?.urlSession?(
+      session,
+      dataTask: dataTask,
+      didReceive: data
+    )
+  }
+
+  func urlSession(
+    _ session: URLSession,
+    task: URLSessionTask,
+    didCompleteWithError error: Error?
+  ) {
+    forwardingDataDelegate?.urlSession?(
+      session,
+      task: task,
+      didCompleteWithError: error
+    )
+  }
 }
 
 /// Core HTTPS client that enforces IP direct connection with SNI.
@@ -120,7 +187,7 @@ final class SniConnectClient {
   private var activeTasksByToken: [UUID: Task<Response, Error>] = [:]
   private var requestTokensById: [String: UUID] = [:]
   private let tasksQueue = DispatchQueue(label: "com.onekey.sni.connect.tasks", attributes: .concurrent)
-  private let requestLimiter = SniConnectRequestLimiter.shared
+  private let requestLimiter = SniConnectRequestLimiter()
 
   private struct SessionKey: Hashable {
     let hostname: String
@@ -334,33 +401,10 @@ final class SniConnectClient {
   }
 
   private static func makeURLSession(for key: SessionKey) throws -> ManagedSession {
-    let configuration = URLSessionConfiguration.default
-    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
-    configuration.urlCache = nil
-    configuration.httpCookieStorage = nil
-    configuration.httpShouldSetCookies = false
-    configuration.connectionProxyDictionary = [:]
-    configuration.shouldUseExtendedBackgroundIdleMode = false
-
-    let curlConfig = EMASCurlConfiguration.default()
-    curlConfig.httpVersion = .HTTP1
-    curlConfig.connectTimeoutInterval = 2.5
-    curlConfig.enableBuiltInGzip = false
-    curlConfig.enableBuiltInRedirection = false
-    curlConfig.cacheEnabled = false
-
-    // Enable full certificate validation for security.
-    // The certificate is validated against the SNI hostname, not the IP, because
-    // the custom DNS resolver only overrides address resolution — libcurl keeps the
-    // original hostname for SNI and certificate CN/SAN matching.
-    curlConfig.certificateValidationEnabled = true
-    curlConfig.domainNameVerificationEnabled = true
-    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
+    let resources = try SniConnectPinnedTransport.makeResources(
       hostname: key.hostname,
       ip: key.ip
     )
-
-    EMASCurlProtocol.install(into: configuration, with: curlConfig)
     SniConnectLog.info(SniConnectLog.event("sni_transport_config", [
       ("hostname", key.hostname),
       ("ipHash", SniConnectLog.shortHash(key.ip)),
@@ -371,15 +415,13 @@ final class SniConnectClient {
       ("followRedirects", false),
       ("cacheEnabled", false),
     ]))
-    let resolverLease = SniConnectPinnedResolverLease(hostname: key.hostname, ip: key.ip)
-    let delegate = SniConnectSessionInvalidationDelegate(
-      hostname: key.hostname,
-      ip: key.ip,
-      resolverLease: resolverLease
-    )
     return ManagedSession(
-      session: URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil),
-      resolverLease: resolverLease
+      session: URLSession(
+        configuration: resources.configuration,
+        delegate: resources.delegate,
+        delegateQueue: nil
+      ),
+      resolverLease: resources.resolverLease
     )
   }
 
@@ -510,10 +552,6 @@ final class SniConnectClient {
     ]))
   }
 
-  func debugSnapshot(hostname: String, ip: String) -> SniConnectRequestLimiter.Snapshot {
-    requestLimiter.snapshot(hostname: hostname, ip: ip)
-  }
-
   /// Cancel a request by ID
   func cancelRequest(requestId: String) -> Bool {
     return tasksQueue.sync(flags: .barrier) { [weak self] in
@@ -620,24 +658,9 @@ final class SniConnectClient {
 
     let requestSlot: SniConnectRequestLimiter.Token
     do {
-      // Admission wait and transport share one total wall-clock deadline.
-      let limiter = requestLimiter
-      let admissionTimeoutMilliseconds =
-        config.effectiveTotalTimeout - Date().timeIntervalSince(startedAt) * 1_000.0
-      guard admissionTimeoutMilliseconds > 0 else {
-        throw SniConnectTimeout.deadlineExceeded
-      }
-      requestSlot = try await SniConnectWallClockDeadline.run(
-        timeoutMilliseconds: admissionTimeoutMilliseconds
-      ) {
-        try await limiter.acquire(
-          hostname: config.hostname,
-          ip: config.ip,
-          requestId: config.requestId
-        )
-      }
+      requestSlot = try requestLimiter.acquire(hostname: config.hostname, ip: config.ip)
     } catch {
-      let sniError = SniConnectError.from(error)
+      let sniError = SniConnectError.resourceLimit("\(error)")
       SniConnectLog.error(SniConnectLog.event("sni_request_result", [
         ("result", "error"),
         ("code", sniError.code),
@@ -655,14 +678,6 @@ final class SniConnectClient {
     defer {
       requestSlot.release()
     }
-    try Task.checkCancellation()
-
-    let queueWaitMilliseconds = SniConnectLog.elapsedMs(since: startedAt)
-    let remainingTimeoutMilliseconds =
-      config.effectiveTotalTimeout - Double(queueWaitMilliseconds)
-    guard remainingTimeoutMilliseconds > 0 else {
-      throw SniConnectError.requestTimeout
-    }
 
     let url = try Self.buildURL(hostname: config.hostname, normalizedPath: normalizedPath)
 
@@ -670,9 +685,8 @@ final class SniConnectClient {
     mutableRequest.httpMethod = method
 
     // Convert milliseconds to seconds for timeout values
-    let totalTimeoutSeconds = remainingTimeoutMilliseconds / 1000.0
-    let connectTimeoutSeconds =
-      min(config.effectiveConnectTimeout, remainingTimeoutMilliseconds) / 1000.0
+    let totalTimeoutSeconds = config.effectiveTotalTimeout / 1000.0
+    let connectTimeoutSeconds = config.effectiveConnectTimeout / 1000.0
 
     // URLRequest.timeoutInterval is not a full request deadline. Keep it aligned
     // with the caller timeout as a transport guard; the wall-clock deadline below
@@ -702,15 +716,12 @@ final class SniConnectClient {
       ("method", method),
       ("timeoutMs", Int(config.effectiveTotalTimeout)),
       ("connectTimeoutMs", Int(config.effectiveConnectTimeout)),
-      ("queueWaitMs", queueWaitMilliseconds),
       ("headerCount", normalizedHeaders.count),
       ("bodyBytes", config.body?.data(using: .utf8)?.count ?? 0),
     ]))
 
     do {
-      return try await SniConnectWallClockDeadline.run(
-        timeoutMilliseconds: remainingTimeoutMilliseconds
-      ) {
+      return try await SniConnectWallClockDeadline.run(timeoutMilliseconds: config.effectiveTotalTimeout) {
         let lease = try await self.sessionLease(for: config)
         defer {
           self.releaseSessionLease(lease)

package/ios/SniConnectCore.swift

@@ -1,5 +1,9 @@
 import Foundation
 
+enum SniConnectSessionDelegatePolicy {
+  static let responseDispositionWithoutForwardingDelegate: URLSession.ResponseDisposition = .allow
+}
+
 enum SniConnectCoreDiagnostics {
   static var warnSink: ((String) -> Void)?
 

package/ios/SniConnectPinnedTransport.swift

@@ -0,0 +1,92 @@
+import Foundation
+import EMASCurl
+
+struct SniConnectPinnedTransportResources {
+  let configuration: URLSessionConfiguration
+  let resolverLease: SniConnectPinnedResolverLease
+  let delegate: SniConnectSessionInvalidationDelegate
+}
+
+public final class SniConnectPinnedSession {
+  public let session: URLSession
+
+  init(resources: SniConnectPinnedTransportResources) {
+    session = URLSession(
+      configuration: resources.configuration,
+      delegate: resources.delegate,
+      delegateQueue: nil
+    )
+  }
+
+  public func close() {
+    session.finishTasksAndInvalidate()
+  }
+
+  deinit {
+    close()
+  }
+}
+
+public enum SniConnectPinnedTransport {
+  static func makeResources(
+    hostname: String,
+    ip: String,
+    dataDelegate: URLSessionDataDelegate? = nil
+  ) throws -> SniConnectPinnedTransportResources {
+    try SniConnectValidation.validateHostname(hostname)
+    try SniConnectValidation.validatePublicIP(ip)
+
+    let normalizedHostname = hostname.lowercased()
+    let configuration = URLSessionConfiguration.default
+    configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+    configuration.urlCache = nil
+    configuration.httpCookieStorage = nil
+    configuration.httpShouldSetCookies = false
+    configuration.connectionProxyDictionary = [:]
+    configuration.shouldUseExtendedBackgroundIdleMode = false
+
+    let curlConfig = EMASCurlConfiguration.default()
+    curlConfig.httpVersion = .HTTP1
+    curlConfig.connectTimeoutInterval = 2.5
+    curlConfig.enableBuiltInGzip = false
+    curlConfig.enableBuiltInRedirection = false
+    curlConfig.cacheEnabled = false
+    curlConfig.certificateValidationEnabled = true
+    curlConfig.domainNameVerificationEnabled = true
+    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
+      hostname: normalizedHostname,
+      ip: ip
+    )
+    EMASCurlProtocol.install(into: configuration, with: curlConfig)
+
+    let resolverLease = SniConnectPinnedResolverLease(
+      hostname: normalizedHostname,
+      ip: ip
+    )
+    let delegate = SniConnectSessionInvalidationDelegate(
+      hostname: normalizedHostname,
+      ip: ip,
+      resolverLease: resolverLease,
+      forwardingDataDelegate: dataDelegate
+    )
+    return SniConnectPinnedTransportResources(
+      configuration: configuration,
+      resolverLease: resolverLease,
+      delegate: delegate
+    )
+  }
+
+  public static func makeSession(
+    hostname: String,
+    ip: String,
+    dataDelegate: URLSessionDataDelegate? = nil
+  ) throws -> SniConnectPinnedSession {
+    SniConnectPinnedSession(
+      resources: try makeResources(
+        hostname: hostname,
+        ip: ip,
+        dataDelegate: dataDelegate
+      )
+    )
+  }
+}