@onekeyfe/react-native-sni-connect 3.0.81 → 3.0.85

package/README.md

@@ -38,7 +38,6 @@ import {
   cancelRequest,
   cancelAllRequests,
   clearDNSCache,
-  getDebugSnapshot,
   isProxyActiveForUrl,
 } from '@onekeyfe/react-native-sni-connect';
 
@@ -67,12 +66,6 @@ await cancelAllRequests();
 
 // Drop pinned-IP connections / cached clients
 await clearDNSCache();
-
-// Diagnostics for one validated hostname/IP pair
-const snapshot = await getDebugSnapshot({
-  hostname: 'example.com',
-  ip: '93.184.216.34',
-});
 ```
 
 `multiValueHeaders` preserves repeated response headers when the native transport

package/android/src/main/java/com/sniconnect/SniConnectModule.kt

@@ -13,11 +13,9 @@ import okhttp3.Call
 import okhttp3.Callback
 import okhttp3.ConnectionPool
 import okhttp3.Dispatcher
-import okhttp3.Dns
 import okhttp3.Headers
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.OkHttpClient
-import okhttp3.Protocol
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
@@ -25,7 +23,6 @@ import okhttp3.ResponseBody
 import okio.Buffer
 import java.io.IOException
 import java.io.InterruptedIOException
-import java.net.InetAddress
 import java.net.Proxy
 import java.net.ProxySelector
 import java.net.URI
@@ -37,7 +34,6 @@ import java.util.Locale
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
-import javax.net.ssl.HttpsURLConnection
 import javax.net.ssl.SSLException
 import javax.net.ssl.SSLPeerUnverifiedException
 
@@ -61,15 +57,6 @@ internal fun classifySniFailureCode(error: Throwable): String {
   return "SNI_REQUEST_FAILED"
 }
 
-internal fun classifySniResponseFailureCode(
-  error: Throwable,
-  explicitlyCancelled: Boolean,
-): String = when {
-  explicitlyCancelled -> "SNI_CANCELLED"
-  hasCause(error, InterruptedIOException::class.java) -> "SNI_REQUEST_TIMEOUT"
-  else -> "SNI_RESPONSE_FAILED"
-}
-
 private fun hasCause(error: Throwable, type: Class<out Throwable>): Boolean {
   var current: Throwable? = error
   while (current != null) {
@@ -90,12 +77,12 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     // from JS-controlled host/IP pairs (e.g. speed-testing many endpoints).
     private const val MAX_CLIENTS = 32
 
-    // Native resources are process-shared across the main and background RN runtimes.
+    // A single dispatcher + connection pool shared across all cached clients so we
+    // don't spawn a thread pool / connection pool per (hostname, ip) pair.
     private val sharedDispatcher = Dispatcher().apply {
-      maxRequests = SniConnectValidation.MAX_ACTIVE_REQUESTS
-      maxRequestsPerHost = SniConnectValidation.MAX_ACTIVE_REQUESTS
+      maxRequests = 64
+      maxRequestsPerHost = 64
     }
-    private val sharedAdmission = SniConnectRequestAdmission()
     private val sharedConnectionPool = ConnectionPool()
   }
 
@@ -133,33 +120,10 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  private class ManagedRequest(
-    val call: Call,
-    val settled: AtomicBoolean,
-  ) {
-    lateinit var admissionTicket: SniConnectRequestAdmission.Ticket
-    private val explicitlyCancelled = AtomicBoolean(false)
-
-    fun cancel() {
-      explicitlyCancelled.set(true)
-      if (!admissionTicket.cancelPending()) {
-        call.cancel()
-      }
-    }
-
-    fun release() {
-      admissionTicket.release()
-    }
-
-    fun wasExplicitlyCancelled(): Boolean = explicitlyCancelled.get()
-  }
-
-  // Cancellation ownership is per module, so cancelAllRequests only affects its RN runtime.
-  private val activeCalls = ConcurrentHashMap<String, ManagedRequest>()
-  private val allActiveCalls = Collections.newSetFromMap(
-    ConcurrentHashMap<ManagedRequest, Boolean>(),
-  )
+  private val activeCalls = ConcurrentHashMap<String, Call>()
+  private val allActiveCalls = Collections.newSetFromMap(ConcurrentHashMap<Call, Boolean>())
   private val activeCallsLock = Any()
+  private val requestLimiter = SniConnectRequestLimiter()
 
   override fun getName(): String = NAME
 
@@ -183,11 +147,11 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
   @ReactMethod
   override fun cancelRequest(requestId: String, promise: Promise) {
-    val request = synchronized(activeCallsLock) {
+    val call = synchronized(activeCallsLock) {
       activeCalls.remove(requestId)
     }
-    if (request != null) {
-      request.cancel()
+    if (call != null) {
+      call.cancel()
       SniConnectLogger.info(
         SniConnectLogger.event(
           "sni_cancel",
@@ -210,17 +174,17 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
   @ReactMethod
   override fun cancelAllRequests(promise: Promise) {
-    val requests = synchronized(activeCallsLock) {
+    val calls = synchronized(activeCallsLock) {
       val snapshot = allActiveCalls.toList()
       activeCalls.clear()
       allActiveCalls.clear()
       snapshot
     }
-    requests.forEach { request -> request.cancel() }
+    calls.forEach { call -> call.cancel() }
     SniConnectLogger.info(
       SniConnectLogger.event(
         "sni_cancel_all",
-        "cancelledCount" to requests.size,
+        "cancelledCount" to calls.size,
         "success" to true,
       ),
     )
@@ -244,29 +208,6 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
   }
 
-  @ReactMethod
-  override fun getDebugSnapshot(target: ReadableMap, promise: Promise) {
-    try {
-      val ip = target.getString("ip") ?: throw IllegalArgumentException("ip is required")
-      val hostname = target.getString("hostname")
-        ?: throw IllegalArgumentException("hostname is required")
-      val canonicalIp = SniConnectValidation.canonicalizePublicIp(ip)
-      SniConnectValidation.validateHostname(hostname)
-      val snapshot = sharedAdmission.snapshot(hostname, canonicalIp)
-
-      promise.resolve(Arguments.createMap().apply {
-        putInt("activeRequests", snapshot.activeRequests)
-        putInt("activeRequestsForPair", snapshot.activeRequestsForPair)
-        putInt("pendingRequests", snapshot.pendingRequests)
-        putInt("pendingRequestsForPair", snapshot.pendingRequestsForPair)
-        putArray("activeRequestIdsForPair", snapshot.activeRequestIdsForPair.toWritableArray())
-        putArray("pendingRequestIdsForPair", snapshot.pendingRequestIdsForPair.toWritableArray())
-      })
-    } catch (error: Exception) {
-      promise.reject("SNI_INVALID_CONFIG", error.message, error)
-    }
-  }
-
   @ReactMethod
   override fun isProxyActiveForUrl(url: String, promise: Promise) {
     try {
@@ -278,14 +219,19 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
   private fun performRequest(config: RequestConfig, promise: Promise) {
     val startedAtMs = android.os.SystemClock.elapsedRealtime()
-    val startedAtNanos = System.nanoTime()
-    var registeredRequest: ManagedRequest? = null
+    var requestSlot: SniConnectRequestLimiter.Token? = null
+    var registeredCall: Call? = null
     try {
+      requestSlot = requestLimiter.acquire(config.hostname, config.ip)
       val client = getOrCreateClient(config)
       val request = buildRequest(config)
       val call = client.newCall(request)
-      val settled = AtomicBoolean(false)
-      lateinit var managedRequest: ManagedRequest
+
+      // Apply per-request timeout
+      call.timeout().timeout(config.timeoutMillis, TimeUnit.MILLISECONDS)
+
+      registerCall(config.requestId, call)
+      registeredCall = call
 
       SniConnectLogger.info(
         SniConnectLogger.event(
@@ -301,13 +247,16 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
         ),
       )
 
-      val callback = object : Callback {
+      // Guard against double-settling the promise (RN hard-crashes otherwise).
+      val settled = AtomicBoolean(false)
+
+      call.enqueue(object : Callback {
         override fun onFailure(call: Call, e: IOException) {
-          unregisterRequest(config.requestId, managedRequest)
-          managedRequest.release()
+          unregisterCall(config.requestId, call)
+          requestSlot?.release()
           if (!settled.compareAndSet(false, true)) return
 
-          if (managedRequest.wasExplicitlyCancelled()) {
+          if (call.isCanceled()) {
             promise.reject("SNI_CANCELLED", "Request cancelled", null)
           } else {
             val code = classifySniFailureCode(e)
@@ -361,29 +310,17 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
                   SniConnectLogger.info(resultLog)
                 }
                 if (settled.compareAndSet(false, true)) {
-                  if (managedRequest.wasExplicitlyCancelled()) {
-                    promise.reject("SNI_CANCELLED", "Request cancelled", null)
-                  } else {
-                    promise.resolve(result)
-                  }
+                  promise.resolve(result)
                 }
               }
             }
           } catch (error: Exception) {
             if (!settled.compareAndSet(false, true)) return
-            val code = classifySniResponseFailureCode(
-              error,
-              managedRequest.wasExplicitlyCancelled(),
-            )
-            if (code == "SNI_CANCELLED") {
-              promise.reject(code, "Request cancelled", null)
-              return
-            }
             SniConnectLogger.error(
               SniConnectLogger.event(
                 "sni_request_result",
                 "result" to "error",
-                "code" to code,
+                "code" to "SNI_RESPONSE_FAILED",
                 "nativeErrorClass" to error.javaClass.simpleName,
                 "requestIdHash" to SniConnectLogger.shortHash(config.requestId),
                 "hostname" to config.hostname.lowercase(Locale.US),
@@ -394,57 +331,22 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
                 "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
               ),
             )
-            promise.reject(code, error.message, error)
+            promise.reject("SNI_RESPONSE_FAILED", error.message, error)
           } finally {
-            unregisterRequest(config.requestId, managedRequest)
-            managedRequest.release()
+            unregisterCall(config.requestId, call)
+            requestSlot?.release()
           }
         }
-      }
-
-      val timeoutBeforeAdmission = remainingTimeoutMillis(
-        config.timeoutMillis,
-        startedAtNanos,
-      )
-      val admissionTicket = sharedAdmission.createTicket(
-        hostname = config.hostname,
-        ip = config.ip,
-        requestId = config.requestId,
-        timeoutMillis = timeoutBeforeAdmission,
-        onAdmitted = { remainingTimeoutMillis ->
-          try {
-            call.timeout().timeout(remainingTimeoutMillis, TimeUnit.MILLISECONDS)
-            call.enqueue(callback)
-          } catch (error: Exception) {
-            unregisterRequest(config.requestId, managedRequest)
-            managedRequest.release()
-            if (settled.compareAndSet(false, true)) {
-              promise.reject("SNI_REQUEST_FAILED", error.message, error)
-            }
-          }
-        },
-        onPendingFailure = { code, message ->
-          unregisterRequest(config.requestId, managedRequest)
-          if (settled.compareAndSet(false, true)) {
-            promise.reject(code, message, null)
-          }
-        },
-      )
-      managedRequest = ManagedRequest(call, settled).apply {
-        this.admissionTicket = admissionTicket
-      }
-      registerRequest(config.requestId, managedRequest)
-      registeredRequest = managedRequest
-      admissionTicket.submit()
+      })
     } catch (error: Exception) {
-      registeredRequest?.let { request ->
-        unregisterRequest(config.requestId, request)
-        request.release()
+      registeredCall?.let { call ->
+        unregisterCall(config.requestId, call)
       }
-      val code = when {
-        error is SniConnectValidation.ValidationException -> "SNI_RESOURCE_LIMIT"
-        hasCause(error, InterruptedIOException::class.java) -> "SNI_REQUEST_TIMEOUT"
-        else -> "SNI_REQUEST_FAILED"
+      requestSlot?.release()
+      val code = if (error is SniConnectValidation.ValidationException) {
+        "SNI_RESOURCE_LIMIT"
+      } else {
+        "SNI_REQUEST_FAILED"
       }
       SniConnectLogger.error(
         SniConnectLogger.event(
@@ -461,21 +363,18 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
           "elapsedMs" to SniConnectLogger.elapsedMs(startedAtMs),
         ),
       )
-      val shouldReject = registeredRequest?.settled?.compareAndSet(false, true) ?: true
-      if (shouldReject) {
-        promise.reject(code, error.message, error)
-      }
+      promise.reject(code, error.message, error)
     }
   }
 
-  private fun registerRequest(requestId: String?, request: ManagedRequest) {
-    val previousRequest = synchronized(activeCallsLock) {
-      val previous = requestId?.let { activeCalls.put(it, request) }
-      allActiveCalls.add(request)
+  private fun registerCall(requestId: String?, call: Call) {
+    val previousCall = synchronized(activeCallsLock) {
+      val previous = requestId?.let { activeCalls.put(it, call) }
+      allActiveCalls.add(call)
       previous
     }
-    if (previousRequest != null && previousRequest != request) {
-      previousRequest.cancel()
+    if (previousCall != null && previousCall != call) {
+      previousCall.cancel()
       SniConnectLogger.warn(
         SniConnectLogger.event(
           "sni_duplicate_request_id",
@@ -486,52 +385,28 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  private fun unregisterRequest(requestId: String?, request: ManagedRequest) {
+  private fun unregisterCall(requestId: String?, call: Call) {
     synchronized(activeCallsLock) {
       if (requestId != null) {
-        activeCalls.remove(requestId, request)
+        activeCalls.remove(requestId, call)
       }
-      allActiveCalls.remove(request)
+      allActiveCalls.remove(call)
     }
   }
 
-  private fun remainingTimeoutMillis(totalTimeoutMillis: Long, startedAtNanos: Long): Long {
-    val elapsedNanos = (System.nanoTime() - startedAtNanos).coerceAtLeast(0L)
-    val remainingNanos = TimeUnit.MILLISECONDS.toNanos(totalTimeoutMillis) - elapsedNanos
-    if (remainingNanos <= 0L) {
-      throw java.net.SocketTimeoutException("Request timed out before admission")
-    }
-    return ((remainingNanos + 999_999L) / 1_000_000L).coerceAtLeast(1L)
-  }
-
   private fun getOrCreateClient(config: RequestConfig): OkHttpClient {
     val normalizedHost = config.hostname.lowercase(Locale.US)
-    val key = ClientKey(
-      normalizedHost,
-      SniConnectValidation.canonicalizePublicIp(config.ip),
-    )
+    val key = ClientKey(normalizedHost, config.ip)
 
     synchronized(clientCache) {
       clientCache[key]?.let { return it }
 
-      val client = OkHttpClient.Builder()
-        .dispatcher(sharedDispatcher)
-        .connectionPool(sharedConnectionPool)
-        .proxy(Proxy.NO_PROXY)
-        .protocols(listOf(Protocol.HTTP_1_1))
-        .connectTimeout(0, TimeUnit.MILLISECONDS)
-        .readTimeout(0, TimeUnit.MILLISECONDS)
-        .writeTimeout(0, TimeUnit.MILLISECONDS)
-        .callTimeout(0, TimeUnit.MILLISECONDS)
-        .followRedirects(false)
-        .followSslRedirects(false)
-        // TLS is validated normally: cert chain via the default trust manager and
-        // hostname verification against the REAL hostname (not the pinned IP).
-        .hostnameVerifier { _, session ->
-          HttpsURLConnection.getDefaultHostnameVerifier().verify(config.hostname, session)
-        }
-        .dns(createPinnedDns(key.ip, config.hostname))
-        .build()
+      val client = SniPinnedTransport.createClient(
+        ip = config.ip,
+        hostname = config.hostname,
+        dispatcher = sharedDispatcher,
+        connectionPool = sharedConnectionPool,
+      )
 
       clientCache[key] = client
       SniConnectLogger.info(
@@ -551,29 +426,6 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  private fun createPinnedDns(ip: String, hostname: String): Dns =
-    object : Dns {
-      private val expectedHost = hostname.lowercase(Locale.US)
-      // Resolve the literal IP once up front (validated; never triggers DNS).
-      private val pinnedAddress: InetAddress = SniConnectValidation.literalToInetAddress(ip)
-
-      override fun lookup(requestedHost: String): List<InetAddress> {
-        return if (requestedHost.lowercase(Locale.US) == expectedHost) {
-          listOf(pinnedAddress)
-        } else {
-          SniConnectLogger.warn(
-            SniConnectLogger.event(
-              "sni_pinned_dns_unexpected_host",
-              "expectedHost" to expectedHost,
-              "requestedHostHash" to SniConnectLogger.shortHash(requestedHost.lowercase(Locale.US)),
-              "result" to "fail_closed",
-            ),
-          )
-          throw UnknownHostException("Unexpected host for pinned SNI request: $requestedHost")
-        }
-      }
-    }
-
   /**
    * Build the request. Always `https://<hostname><path>` on the implicit port 443 —
    * `path` has been validated as relative, so scheme/host/port cannot be overridden.
@@ -671,10 +523,6 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
   }
 
-  private fun List<String>.toWritableArray() = Arguments.createArray().apply {
-    forEach { value -> pushString(value) }
-  }
-
   private fun ReadableMap.toRequestConfig(): RequestConfig {
     val rawHeadersMap = if (hasKey("headers") && !isNull("headers")) {
       getMap("headers")?.toHashMap()
@@ -692,7 +540,7 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
     val requestId = if (hasKey("requestId") && !isNull("requestId")) getString("requestId") else null
 
-    val rawIp = getString("ip") ?: throw IllegalArgumentException("ip is required")
+    val ip = getString("ip") ?: throw IllegalArgumentException("ip is required")
     val hostname = getString("hostname") ?: throw IllegalArgumentException("hostname is required")
     val method = getString("method") ?: "GET"
     val path = getString("path") ?: "/"
@@ -700,7 +548,7 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
     // Validate every caller-controlled field at the boundary.
     SniConnectValidation.validateRequestId(requestId)
-    val ip = SniConnectValidation.canonicalizePublicIp(rawIp)
+    SniConnectValidation.validatePublicIp(ip)
     SniConnectValidation.validateHostname(hostname)
     val headersMap = SniConnectValidation.normalizeHeaders(rawHeadersMap)
     val normalizedMethod = SniConnectValidation.normalizeMethod(method)

package/android/src/main/java/com/sniconnect/SniConnectValidation.kt

@@ -4,6 +4,7 @@ import java.net.Inet6Address
 import java.net.InetAddress
 import java.nio.charset.StandardCharsets
 import java.util.Locale
+import java.util.concurrent.atomic.AtomicBoolean
 
 /**
  * Boundary validation/normalization for SNI request inputs.
@@ -28,7 +29,6 @@ internal object SniConnectValidation {
   const val MAX_TOTAL_HEADER_BYTES = 32 * 1024
   const val MAX_ACTIVE_REQUESTS = 64
   const val MAX_ACTIVE_REQUESTS_PER_PAIR = 16
-  const val MAX_PENDING_REQUESTS = 256
 
   private val ALLOWED_METHODS =
     setOf("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS")
@@ -225,11 +225,6 @@ internal object SniConnectValidation {
     throw ValidationException("Invalid IP: $ip")
   }
 
-  fun canonicalizePublicIp(ip: String): String {
-    validatePublicIp(ip)
-    return literalToInetAddress(ip).hostAddress
-  }
-
   private fun isForbiddenIpv4(o: List<Int>): Boolean {
     val a = o[0]; val b = o[1]; val c = o[2]; val d = o[3]
     return when {
@@ -318,3 +313,78 @@ internal object SniConnectValidation {
     return InetAddress.getByName(ip) // safe: already validated as an IPv6 literal
   }
 }
+
+internal class SniConnectRequestLimiter(
+  private val maxActiveRequests: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS,
+  private val maxActiveRequestsPerPair: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS_PER_PAIR,
+) {
+  private val lock = Any()
+  private var activeRequests = 0
+  private val activeRequestsByPair = mutableMapOf<String, Int>()
+
+  fun acquire(hostname: String, ip: String): Token {
+    val key = pairKey(hostname, ip)
+    synchronized(lock) {
+      if (activeRequests >= maxActiveRequests) {
+        SniConnectLogger.warn(
+          SniConnectLogger.event(
+            "sni_resource_limit",
+            "activeCount" to activeRequests,
+            "pairCount" to (activeRequestsByPair[key] ?: 0),
+            "limit" to maxActiveRequests,
+            "reason" to "max_active_requests",
+            "hostname" to hostname.lowercase(Locale.US),
+            "ipHash" to SniConnectLogger.shortHash(ip),
+          ),
+        )
+        throw SniConnectValidation.ValidationException("Too many active SNI requests")
+      }
+      val pairCount = activeRequestsByPair[key] ?: 0
+      if (pairCount >= maxActiveRequestsPerPair) {
+        SniConnectLogger.warn(
+          SniConnectLogger.event(
+            "sni_resource_limit",
+            "activeCount" to activeRequests,
+            "pairCount" to pairCount,
+            "limit" to maxActiveRequestsPerPair,
+            "reason" to "max_active_requests_per_pair",
+            "hostname" to hostname.lowercase(Locale.US),
+            "ipHash" to SniConnectLogger.shortHash(ip),
+          ),
+        )
+        throw SniConnectValidation.ValidationException("Too many active SNI requests for destination")
+      }
+      activeRequests += 1
+      activeRequestsByPair[key] = pairCount + 1
+    }
+    return Token(this, key)
+  }
+
+  private fun release(key: String) {
+    synchronized(lock) {
+      activeRequests = (activeRequests - 1).coerceAtLeast(0)
+      val pairCount = activeRequestsByPair[key] ?: return
+      if (pairCount <= 1) {
+        activeRequestsByPair.remove(key)
+      } else {
+        activeRequestsByPair[key] = pairCount - 1
+      }
+    }
+  }
+
+  private fun pairKey(hostname: String, ip: String): String =
+    "${hostname.lowercase(Locale.US)}|$ip"
+
+  class Token internal constructor(
+    private val limiter: SniConnectRequestLimiter,
+    private val key: String,
+  ) {
+    private val released = AtomicBoolean(false)
+
+    fun release() {
+      if (released.compareAndSet(false, true)) {
+        limiter.release(key)
+      }
+    }
+  }
+}

package/android/src/main/java/com/sniconnect/SniPinnedTransport.kt

@@ -0,0 +1,58 @@
+package com.sniconnect
+
+import java.net.InetAddress
+import java.net.Proxy
+import java.net.UnknownHostException
+import java.util.Locale
+import java.util.concurrent.TimeUnit
+import okhttp3.ConnectionPool
+import okhttp3.Dispatcher
+import okhttp3.Dns
+import okhttp3.OkHttpClient
+import okhttp3.Protocol
+import javax.net.ssl.HttpsURLConnection
+
+object SniPinnedTransport {
+  @JvmStatic
+  fun createClient(
+    ip: String,
+    hostname: String,
+    dispatcher: Dispatcher = Dispatcher(),
+    connectionPool: ConnectionPool = ConnectionPool(),
+  ): OkHttpClient {
+    SniConnectValidation.validatePublicIp(ip)
+    SniConnectValidation.validateHostname(hostname)
+    val normalizedHostname = hostname.lowercase(Locale.US)
+    return OkHttpClient.Builder()
+      .dispatcher(dispatcher)
+      .connectionPool(connectionPool)
+      .proxy(Proxy.NO_PROXY)
+      .protocols(listOf(Protocol.HTTP_1_1))
+      .connectTimeout(0, TimeUnit.MILLISECONDS)
+      .readTimeout(0, TimeUnit.MILLISECONDS)
+      .writeTimeout(0, TimeUnit.MILLISECONDS)
+      .callTimeout(0, TimeUnit.MILLISECONDS)
+      .followRedirects(false)
+      .followSslRedirects(false)
+      .hostnameVerifier { _, session ->
+        HttpsURLConnection.getDefaultHostnameVerifier().verify(normalizedHostname, session)
+      }
+      .dns(createPinnedDns(ip, normalizedHostname))
+      .build()
+  }
+
+  private fun createPinnedDns(ip: String, hostname: String): Dns =
+    object : Dns {
+      private val pinnedAddress: InetAddress =
+        SniConnectValidation.literalToInetAddress(ip)
+
+      override fun lookup(requestedHost: String): List<InetAddress> {
+        if (requestedHost.lowercase(Locale.US) == hostname) {
+          return listOf(pinnedAddress)
+        }
+        throw UnknownHostException(
+          "Unexpected host for pinned SNI request: $requestedHost"
+        )
+      }
+    }
+}