@onekeyfe/react-native-sni-connect 3.0.85 → 3.0.87

package/android/src/main/java/com/sniconnect/SniConnectRequestAdmission.kt

@@ -0,0 +1,276 @@
+package com.sniconnect
+
+import java.util.ArrayDeque
+import java.util.Locale
+import java.util.concurrent.ScheduledExecutorService
+import java.util.concurrent.ScheduledFuture
+import java.util.concurrent.ScheduledThreadPoolExecutor
+import java.util.concurrent.TimeUnit
+
+internal data class SniConnectAdmissionSnapshot(
+  val activeRequests: Int,
+  val activeRequestsForPair: Int,
+  val pendingRequests: Int,
+  val pendingRequestsForPair: Int,
+  val activeRequestIdsForPair: List<String> = emptyList(),
+  val pendingRequestIdsForPair: List<String> = emptyList(),
+)
+
+internal class SniConnectRequestAdmission(
+  private val maxActiveRequests: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS,
+  private val maxActiveRequestsPerPair: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS_PER_PAIR,
+  private val maxPendingRequests: Int = SniConnectValidation.MAX_PENDING_REQUESTS,
+  private val scheduler: ScheduledExecutorService = createAdmissionScheduler(),
+  private val nanoTime: () -> Long = System::nanoTime,
+) {
+  internal data class PairKey(
+    val hostname: String,
+    val ip: String,
+  )
+
+  internal enum class State {
+    CREATED,
+    PENDING,
+    ACTIVE,
+    TERMINAL,
+  }
+
+  private data class Dispatch(
+    val ticket: Ticket,
+    val remainingTimeoutMillis: Long?,
+  )
+
+  inner class Ticket internal constructor(
+    internal val pair: PairKey,
+    internal val requestId: String?,
+    internal val deadlineNanos: Long,
+    internal val onAdmitted: (remainingTimeoutMillis: Long) -> Unit,
+    internal val onPendingFailure: (code: String, message: String) -> Unit,
+  ) {
+    internal var state = State.CREATED
+    internal var timeoutFuture: ScheduledFuture<*>? = null
+
+    fun submit() {
+      this@SniConnectRequestAdmission.submit(this)
+    }
+
+    fun cancelPending(): Boolean =
+      this@SniConnectRequestAdmission.cancelPending(this)
+
+    fun release() {
+      this@SniConnectRequestAdmission.release(this)
+    }
+  }
+
+  private val lock = Any()
+  private var activeRequests = 0
+  private val activeRequestsByPair = mutableMapOf<PairKey, Int>()
+  private val activeTickets = mutableSetOf<Ticket>()
+  private val pendingRequests = ArrayDeque<Ticket>()
+
+  fun createTicket(
+    hostname: String,
+    ip: String,
+    requestId: String? = null,
+    timeoutMillis: Long,
+    onAdmitted: (remainingTimeoutMillis: Long) -> Unit,
+    onPendingFailure: (code: String, message: String) -> Unit,
+  ): Ticket = Ticket(
+    pair = pairKey(hostname, ip),
+    requestId = requestId?.takeIf { it.isNotEmpty() },
+    deadlineNanos = nanoTime() + TimeUnit.MILLISECONDS.toNanos(timeoutMillis),
+    onAdmitted = onAdmitted,
+    onPendingFailure = onPendingFailure,
+  )
+
+  fun snapshot(hostname: String, ip: String): SniConnectAdmissionSnapshot {
+    val pair = pairKey(hostname, ip)
+    return synchronized(lock) {
+      val activeForPair = activeTickets.filter { ticket -> ticket.pair == pair }
+      val pendingForPair = pendingRequests.filter { ticket -> ticket.pair == pair }
+      SniConnectAdmissionSnapshot(
+        activeRequests = activeRequests,
+        activeRequestsForPair = activeForPair.size,
+        pendingRequests = pendingRequests.size,
+        pendingRequestsForPair = pendingForPair.size,
+        activeRequestIdsForPair = activeForPair.mapNotNull { ticket -> ticket.requestId }.sorted(),
+        pendingRequestIdsForPair = pendingForPair.mapNotNull { ticket -> ticket.requestId }.sorted(),
+      )
+    }
+  }
+
+  internal fun shutdownForTests() {
+    scheduler.shutdownNow()
+  }
+
+  private fun submit(ticket: Ticket) {
+    var remainingTimeoutMillis: Long? = null
+    var timedOut = false
+    synchronized(lock) {
+      // A runtime can cancel immediately after registering the handle but
+      // before submit() reaches this lock. Cancellation already settled the
+      // ticket, so submission becomes an idempotent no-op.
+      if (ticket.state == State.TERMINAL) return
+      check(ticket.state == State.CREATED) { "Admission ticket already submitted" }
+      if (ticket.deadlineNanos <= nanoTime()) {
+        ticket.state = State.TERMINAL
+        timedOut = true
+      } else if (canActivateLocked(ticket.pair)) {
+        activateLocked(ticket)
+        remainingTimeoutMillis = remainingMillis(ticket.deadlineNanos)
+      } else {
+        if (pendingRequests.size >= maxPendingRequests) {
+          ticket.state = State.TERMINAL
+          throw SniConnectValidation.ValidationException("Too many pending SNI requests")
+        }
+        ticket.state = State.PENDING
+        pendingRequests.addLast(ticket)
+        val delayNanos = (ticket.deadlineNanos - nanoTime()).coerceAtLeast(0L)
+        ticket.timeoutFuture = scheduler.schedule(
+          { timeoutPending(ticket) },
+          delayNanos,
+          TimeUnit.NANOSECONDS,
+        )
+      }
+    }
+
+    if (timedOut) {
+      ticket.onPendingFailure(
+        "SNI_REQUEST_TIMEOUT",
+        "Request timed out while waiting for admission",
+      )
+    } else {
+      remainingTimeoutMillis?.let(ticket.onAdmitted)
+    }
+  }
+
+  private fun cancelPending(ticket: Ticket): Boolean {
+    val cancelled = synchronized(lock) {
+      when (ticket.state) {
+        State.CREATED -> {
+          ticket.state = State.TERMINAL
+          true
+        }
+        State.PENDING -> {
+          pendingRequests.remove(ticket)
+          ticket.timeoutFuture?.cancel(false)
+          ticket.timeoutFuture = null
+          ticket.state = State.TERMINAL
+          true
+        }
+        State.ACTIVE, State.TERMINAL -> false
+      }
+    }
+    if (cancelled) {
+      ticket.onPendingFailure("SNI_CANCELLED", "Request cancelled")
+    }
+    return cancelled
+  }
+
+  private fun timeoutPending(ticket: Ticket) {
+    val timedOut = synchronized(lock) {
+      if (ticket.state != State.PENDING) {
+        false
+      } else {
+        pendingRequests.remove(ticket)
+        ticket.timeoutFuture = null
+        ticket.state = State.TERMINAL
+        true
+      }
+    }
+    if (timedOut) {
+      ticket.onPendingFailure(
+        "SNI_REQUEST_TIMEOUT",
+        "Request timed out while waiting for admission",
+      )
+    }
+  }
+
+  private fun release(ticket: Ticket) {
+    val admissions = synchronized(lock) {
+      if (ticket.state != State.ACTIVE) return
+      ticket.state = State.TERMINAL
+      activeTickets.remove(ticket)
+      activeRequests -= 1
+      decrementPairLocked(ticket.pair)
+      collectAdmissionsLocked()
+    }
+    admissions.forEach { dispatch ->
+      val timeoutMillis = dispatch.remainingTimeoutMillis
+      if (timeoutMillis == null) {
+        dispatch.ticket.onPendingFailure(
+          "SNI_REQUEST_TIMEOUT",
+          "Request timed out while waiting for admission",
+        )
+      } else {
+        dispatch.ticket.onAdmitted(timeoutMillis)
+      }
+    }
+  }
+
+  private fun collectAdmissionsLocked(): List<Dispatch> {
+    val admissions = mutableListOf<Dispatch>()
+    while (activeRequests < maxActiveRequests) {
+      val iterator = pendingRequests.iterator()
+      var next: Ticket? = null
+      while (iterator.hasNext()) {
+        val candidate = iterator.next()
+        if (canActivateLocked(candidate.pair)) {
+          iterator.remove()
+          next = candidate
+          break
+        }
+      }
+      val ticket = next ?: break
+      ticket.timeoutFuture?.cancel(false)
+      ticket.timeoutFuture = null
+      if (ticket.deadlineNanos <= nanoTime()) {
+        ticket.state = State.TERMINAL
+        admissions += Dispatch(ticket, null)
+      } else {
+        activateLocked(ticket)
+        admissions += Dispatch(ticket, remainingMillis(ticket.deadlineNanos))
+      }
+    }
+    return admissions
+  }
+
+  private fun canActivateLocked(pair: PairKey): Boolean =
+    activeRequests < maxActiveRequests &&
+      (activeRequestsByPair[pair] ?: 0) < maxActiveRequestsPerPair
+
+  private fun pairKey(hostname: String, ip: String): PairKey = PairKey(
+    hostname = hostname.lowercase(Locale.US),
+    ip = SniConnectValidation.canonicalizePublicIp(ip),
+  )
+
+  private fun activateLocked(ticket: Ticket) {
+    ticket.state = State.ACTIVE
+    activeTickets.add(ticket)
+    activeRequests += 1
+    activeRequestsByPair[ticket.pair] = (activeRequestsByPair[ticket.pair] ?: 0) + 1
+  }
+
+  private fun decrementPairLocked(pair: PairKey) {
+    val pairCount = activeRequestsByPair[pair] ?: return
+    if (pairCount == 1) {
+      activeRequestsByPair.remove(pair)
+    } else {
+      activeRequestsByPair[pair] = pairCount - 1
+    }
+  }
+
+  private fun remainingMillis(deadlineNanos: Long): Long {
+    val remainingNanos = (deadlineNanos - nanoTime()).coerceAtLeast(1L)
+    return ((remainingNanos + 999_999L) / 1_000_000L).coerceAtLeast(1L)
+  }
+
+  private companion object {
+    fun createAdmissionScheduler(): ScheduledExecutorService =
+      ScheduledThreadPoolExecutor(1) { runnable ->
+        Thread(runnable, "SniConnectAdmission").apply { isDaemon = true }
+      }.apply {
+        removeOnCancelPolicy = true
+      }
+  }
+}

package/android/src/main/java/com/sniconnect/SniConnectValidation.kt

@@ -4,7 +4,6 @@ import java.net.Inet6Address
 import java.net.InetAddress
 import java.nio.charset.StandardCharsets
 import java.util.Locale
-import java.util.concurrent.atomic.AtomicBoolean
 
 /**
  * Boundary validation/normalization for SNI request inputs.
@@ -29,6 +28,7 @@ internal object SniConnectValidation {
   const val MAX_TOTAL_HEADER_BYTES = 32 * 1024
   const val MAX_ACTIVE_REQUESTS = 64
   const val MAX_ACTIVE_REQUESTS_PER_PAIR = 16
+  const val MAX_PENDING_REQUESTS = 256
 
   private val ALLOWED_METHODS =
     setOf("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS")
@@ -205,8 +205,12 @@ internal object SniConnectValidation {
     ) {
       throw ValidationException("Invalid IP: $ip")
     }
-    val octets = IPV4_REGEX.matchEntire(ip)?.groupValues?.drop(1)?.map { it.toInt() }
-    if (octets != null) {
+    val octetStrings = IPV4_REGEX.matchEntire(ip)?.groupValues?.drop(1)
+    if (octetStrings != null) {
+      if (octetStrings.any { it.length > 1 && it.startsWith('0') }) {
+        throw ValidationException("Invalid IP: $ip")
+      }
+      val octets = octetStrings.map { it.toInt() }
       if (octets.any { it > 255 }) throw ValidationException("Invalid IP: $ip")
       if (isForbiddenIpv4(octets)) throw ValidationException("Forbidden IP: $ip")
       return
@@ -225,6 +229,11 @@ internal object SniConnectValidation {
     throw ValidationException("Invalid IP: $ip")
   }
 
+  fun canonicalizePublicIp(ip: String): String {
+    validatePublicIp(ip)
+    return literalToInetAddress(ip).hostAddress
+  }
+
   private fun isForbiddenIpv4(o: List<Int>): Boolean {
     val a = o[0]; val b = o[1]; val c = o[2]; val d = o[3]
     return when {
@@ -313,78 +322,3 @@ internal object SniConnectValidation {
     return InetAddress.getByName(ip) // safe: already validated as an IPv6 literal
   }
 }
-
-internal class SniConnectRequestLimiter(
-  private val maxActiveRequests: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS,
-  private val maxActiveRequestsPerPair: Int = SniConnectValidation.MAX_ACTIVE_REQUESTS_PER_PAIR,
-) {
-  private val lock = Any()
-  private var activeRequests = 0
-  private val activeRequestsByPair = mutableMapOf<String, Int>()
-
-  fun acquire(hostname: String, ip: String): Token {
-    val key = pairKey(hostname, ip)
-    synchronized(lock) {
-      if (activeRequests >= maxActiveRequests) {
-        SniConnectLogger.warn(
-          SniConnectLogger.event(
-            "sni_resource_limit",
-            "activeCount" to activeRequests,
-            "pairCount" to (activeRequestsByPair[key] ?: 0),
-            "limit" to maxActiveRequests,
-            "reason" to "max_active_requests",
-            "hostname" to hostname.lowercase(Locale.US),
-            "ipHash" to SniConnectLogger.shortHash(ip),
-          ),
-        )
-        throw SniConnectValidation.ValidationException("Too many active SNI requests")
-      }
-      val pairCount = activeRequestsByPair[key] ?: 0
-      if (pairCount >= maxActiveRequestsPerPair) {
-        SniConnectLogger.warn(
-          SniConnectLogger.event(
-            "sni_resource_limit",
-            "activeCount" to activeRequests,
-            "pairCount" to pairCount,
-            "limit" to maxActiveRequestsPerPair,
-            "reason" to "max_active_requests_per_pair",
-            "hostname" to hostname.lowercase(Locale.US),
-            "ipHash" to SniConnectLogger.shortHash(ip),
-          ),
-        )
-        throw SniConnectValidation.ValidationException("Too many active SNI requests for destination")
-      }
-      activeRequests += 1
-      activeRequestsByPair[key] = pairCount + 1
-    }
-    return Token(this, key)
-  }
-
-  private fun release(key: String) {
-    synchronized(lock) {
-      activeRequests = (activeRequests - 1).coerceAtLeast(0)
-      val pairCount = activeRequestsByPair[key] ?: return
-      if (pairCount <= 1) {
-        activeRequestsByPair.remove(key)
-      } else {
-        activeRequestsByPair[key] = pairCount - 1
-      }
-    }
-  }
-
-  private fun pairKey(hostname: String, ip: String): String =
-    "${hostname.lowercase(Locale.US)}|$ip"
-
-  class Token internal constructor(
-    private val limiter: SniConnectRequestLimiter,
-    private val key: String,
-  ) {
-    private val released = AtomicBoolean(false)
-
-    fun release() {
-      if (released.compareAndSet(false, true)) {
-        limiter.release(key)
-      }
-    }
-  }
-}

package/android/src/test/java/com/sniconnect/SniConnectRequestAdmissionTest.kt

@@ -0,0 +1,309 @@
+package com.sniconnect
+
+import java.util.Collections
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SniConnectRequestAdmissionTest {
+  @Test
+  fun twentySamePairRequestsProduceSixteenActiveAndFourPending() {
+    val admission = SniConnectRequestAdmission()
+    val admitted = mutableListOf<String>()
+    val failures = mutableListOf<Pair<String, String>>()
+    try {
+      val tickets = (0 until 20).map { index ->
+        val requestId = "req-${index.toString().padStart(2, '0')}"
+        admission.createTicket(
+          hostname = "Example.com",
+          ip = if (index % 2 == 0) {
+            "2001:4860:4860::8888"
+          } else {
+            "2001:4860:4860:0:0:0:0:8888"
+          },
+          requestId = requestId,
+          timeoutMillis = 10_000,
+          onAdmitted = { admitted += requestId },
+          onPendingFailure = { code, message -> failures += code to message },
+        ).also { it.submit() }
+      }
+
+      assertEquals((0 until 16).map { "req-${it.toString().padStart(2, '0')}" }, admitted)
+      assertEquals(
+        SniConnectAdmissionSnapshot(
+          activeRequests = 16,
+          activeRequestsForPair = 16,
+          pendingRequests = 4,
+          pendingRequestsForPair = 4,
+          activeRequestIdsForPair = (0 until 16).map { "req-${it.toString().padStart(2, '0')}" },
+          pendingRequestIdsForPair = (16 until 20).map { "req-${it.toString().padStart(2, '0')}" },
+        ),
+        admission.snapshot("EXAMPLE.COM", "2001:4860:4860::8888"),
+      )
+
+      tickets.drop(16).forEach { pending -> assertTrue(pending.cancelPending()) }
+      assertEquals(4, failures.size)
+      assertTrue(failures.all { it.first == "SNI_CANCELLED" })
+      assertEquals(
+        0,
+        admission.snapshot("example.com", "2001:4860:4860:0:0:0:0:8888").pendingRequests,
+      )
+
+      tickets.take(16).forEach { active -> active.release() }
+      assertEquals(
+        SniConnectAdmissionSnapshot(0, 0, 0, 0),
+        admission.snapshot("example.com", "2001:4860:4860::8888"),
+      )
+
+      val recovery = ticket(admission, "example.com", "2001:4860:4860::8888")
+      recovery.submit()
+      assertEquals(
+        1,
+        admission.snapshot("example.com", "2001:4860:4860::8888").activeRequests,
+      )
+      recovery.release()
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun queuesAtGlobalLimitAndDispatchesAfterRelease() {
+    val admission = admission(maxActive = 2, maxPerPair = 2)
+    val admitted = mutableListOf<String>()
+    try {
+      val first = submit(admission, "first", "one.example", "93.184.216.34", admitted)
+      val second = submit(admission, "second", "two.example", "93.184.216.35", admitted)
+      val pending = submit(admission, "pending", "three.example", "93.184.216.36", admitted)
+
+      assertEquals(listOf("first", "second"), admitted)
+      assertEquals(2, admission.snapshot("three.example", "93.184.216.36").activeRequests)
+      assertEquals(1, admission.snapshot("three.example", "93.184.216.36").pendingRequests)
+
+      first.release()
+      assertEquals(listOf("first", "second", "pending"), admitted)
+      first.release()
+      second.release()
+      pending.release()
+      assertEquals(0, admission.snapshot("three.example", "93.184.216.36").activeRequests)
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun sameHostnameDifferentIpsHaveIndependentPairLimits() {
+    val admission = admission(maxActive = 4, maxPerPair = 2)
+    val admitted = mutableListOf<String>()
+    try {
+      val firstA = submit(admission, "a1", "Example.com", "93.184.216.34", admitted)
+      val secondA = submit(admission, "a2", "example.com", "93.184.216.34", admitted)
+      val pendingA = submit(admission, "a3", "example.com", "93.184.216.34", admitted)
+      val firstB = submit(admission, "b1", "example.com", "93.184.216.35", admitted)
+      val secondB = submit(admission, "b2", "example.com", "93.184.216.35", admitted)
+
+      assertEquals(listOf("a1", "a2", "b1", "b2"), admitted)
+      assertEquals(
+        SniConnectAdmissionSnapshot(
+          activeRequests = 4,
+          activeRequestsForPair = 2,
+          pendingRequests = 1,
+          pendingRequestsForPair = 1,
+          activeRequestIdsForPair = listOf("a1", "a2"),
+          pendingRequestIdsForPair = listOf("a3"),
+        ),
+        admission.snapshot("EXAMPLE.COM", "93.184.216.34"),
+      )
+
+      firstA.release()
+      assertEquals(listOf("a1", "a2", "b1", "b2", "a3"), admitted)
+      secondA.release()
+      pendingA.release()
+      firstB.release()
+      secondB.release()
+      assertEquals(
+        SniConnectAdmissionSnapshot(0, 0, 0, 0),
+        admission.snapshot("example.com", "93.184.216.34"),
+      )
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun rejectsTheTwoHundredFiftySeventhPendingRequest() {
+    val admission = admission(maxActive = 1, maxPerPair = 1, maxPending = 256)
+    try {
+      val active = ticket(admission, "example.com", "93.184.216.34").also { it.submit() }
+      val pending = (0 until 256).map {
+        ticket(admission, "example.com", "93.184.216.34").also { request -> request.submit() }
+      }
+      val overflow = ticket(admission, "example.com", "93.184.216.34")
+
+      assertValidationFails { overflow.submit() }
+      assertEquals(256, admission.snapshot("example.com", "93.184.216.34").pendingRequests)
+
+      pending.forEach { request -> assertTrue(request.cancelPending()) }
+      active.release()
+      assertEquals(
+        SniConnectAdmissionSnapshot(0, 0, 0, 0),
+        admission.snapshot("example.com", "93.184.216.34"),
+      )
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun cancellingPendingRequestRemovesItAndSettlesImmediately() {
+    val admission = admission(maxActive = 1, maxPerPair = 1)
+    val failures = mutableListOf<Pair<String, String>>()
+    try {
+      val active = ticket(admission, "example.com", "93.184.216.34").also { it.submit() }
+      val pending = admission.createTicket(
+        hostname = "example.com",
+        ip = "93.184.216.34",
+        timeoutMillis = 10_000,
+        onAdmitted = { throw AssertionError("Cancelled request must not be admitted") },
+        onPendingFailure = { code, message -> failures += code to message },
+      ).also { it.submit() }
+
+      assertTrue(pending.cancelPending())
+      assertEquals(listOf("SNI_CANCELLED" to "Request cancelled"), failures)
+      assertEquals(0, admission.snapshot("example.com", "93.184.216.34").pendingRequests)
+      assertFalse(pending.cancelPending())
+      active.release()
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun cancellationBeforeSubmitSettlesOnceAndSubmitBecomesNoOp() {
+    val admission = admission(maxActive = 1, maxPerPair = 1)
+    val failures = mutableListOf<String>()
+    try {
+      val request = admission.createTicket(
+        hostname = "example.com",
+        ip = "93.184.216.34",
+        timeoutMillis = 10_000,
+        onAdmitted = { throw AssertionError("Cancelled request must not be admitted") },
+        onPendingFailure = { code, _ -> failures += code },
+      )
+
+      assertTrue(request.cancelPending())
+      request.submit()
+      assertEquals(listOf("SNI_CANCELLED"), failures)
+      assertEquals(
+        SniConnectAdmissionSnapshot(0, 0, 0, 0),
+        admission.snapshot("example.com", "93.184.216.34"),
+      )
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun timeoutIncludesTimeSpentWaitingForAdmission() {
+    val admission = admission(maxActive = 1, maxPerPair = 1)
+    val timedOut = CountDownLatch(1)
+    val failureCodes = Collections.synchronizedList(mutableListOf<String>())
+    try {
+      val active = ticket(admission, "example.com", "93.184.216.34").also { it.submit() }
+      admission.createTicket(
+        hostname = "example.com",
+        ip = "93.184.216.34",
+        timeoutMillis = 40,
+        onAdmitted = { throw AssertionError("Timed-out request must not be admitted") },
+        onPendingFailure = { code, _ ->
+          failureCodes += code
+          timedOut.countDown()
+        },
+      ).submit()
+
+      assertTrue(timedOut.await(2, TimeUnit.SECONDS))
+      assertEquals(listOf("SNI_REQUEST_TIMEOUT"), failureCodes.toList())
+      assertEquals(0, admission.snapshot("example.com", "93.184.216.34").pendingRequests)
+      active.release()
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  @Test
+  fun admittedRequestReceivesOnlyTheRemainingTimeout() {
+    var nowNanos = 0L
+    val admission = admission(
+      maxActive = 1,
+      maxPerPair = 1,
+      nanoTime = { nowNanos },
+    )
+    val remainingTimeouts = mutableListOf<Long>()
+    try {
+      val active = ticket(admission, "example.com", "93.184.216.34").also { it.submit() }
+      val pending = admission.createTicket(
+        hostname = "example.com",
+        ip = "93.184.216.34",
+        timeoutMillis = 1_000,
+        onAdmitted = { remainingTimeout -> remainingTimeouts += remainingTimeout },
+        onPendingFailure = { code, _ -> throw AssertionError("Unexpected failure: $code") },
+      ).also { it.submit() }
+
+      nowNanos = TimeUnit.MILLISECONDS.toNanos(250)
+      active.release()
+
+      assertEquals(listOf(750L), remainingTimeouts)
+      pending.release()
+    } finally {
+      admission.shutdownForTests()
+    }
+  }
+
+  private fun admission(
+    maxActive: Int,
+    maxPerPair: Int,
+    maxPending: Int = 10,
+    nanoTime: () -> Long = System::nanoTime,
+  ) = SniConnectRequestAdmission(
+    maxActiveRequests = maxActive,
+    maxActiveRequestsPerPair = maxPerPair,
+    maxPendingRequests = maxPending,
+    nanoTime = nanoTime,
+  )
+
+  private fun submit(
+    admission: SniConnectRequestAdmission,
+    id: String,
+    hostname: String,
+    ip: String,
+    admitted: MutableList<String>,
+  ): SniConnectRequestAdmission.Ticket =
+    ticket(admission, hostname, ip, requestId = id, onAdmitted = { admitted += id }).also { it.submit() }
+
+  private fun ticket(
+    admission: SniConnectRequestAdmission,
+    hostname: String,
+    ip: String,
+    requestId: String? = null,
+    onAdmitted: (Long) -> Unit = {},
+  ): SniConnectRequestAdmission.Ticket = admission.createTicket(
+    hostname = hostname,
+    ip = ip,
+    requestId = requestId,
+    timeoutMillis = 60_000,
+    onAdmitted = onAdmitted,
+    onPendingFailure = { _, _ -> },
+  )
+
+  private fun assertValidationFails(block: () -> Unit) {
+    try {
+      block()
+    } catch (_: SniConnectValidation.ValidationException) {
+      return
+    }
+    throw AssertionError("Expected SNI validation failure")
+  }
+}