Testing ech

android-test-app/build.gradle.kts

@@ -1,15 +1,14 @@
 @file:Suppress("UnstableApiUsage")
 
-import okhttp3.buildsupport.testJavaVersion
-
-
 plugins {
   id("okhttp.base-conventions")
   id("com.android.application")
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.testapp"
 
@@ -18,7 +17,7 @@ android {
 
   defaultConfig {
     minSdk = 21
-    targetSdk = 36
+    targetSdk = 37
     testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
   }
 

android-test/build.gradle.kts

@@ -7,7 +7,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.test"
 
@@ -38,7 +40,7 @@ android {
   }
 
   testOptions {
-    targetSdk = 34
+    targetSdk = 37
     unitTests.isIncludeAndroidResources = true
   }
 
@@ -59,6 +61,7 @@ dependencies {
   implementation(libs.playservices.safetynet)
   "friendsImplementation"(projects.okhttp)
   "friendsImplementation"(projects.okhttpDnsoverhttps)
+  implementation(libs.androidx.activity)
 
   testImplementation(projects.okhttp)
   testImplementation(libs.junit)
@@ -96,7 +99,6 @@ dependencies {
   androidTestImplementation(libs.androidx.espresso.core)
   androidTestImplementation(libs.http.client5)
   androidTestImplementation(libs.kotlin.test.common)
-  androidTestImplementation(libs.kotlin.test.junit)
   androidTestImplementation(libs.square.moshi)
   androidTestImplementation(libs.square.moshi.kotlin)
   androidTestImplementation(libs.square.okio.fakefilesystem)

android-test/src/androidTest/java/okhttp/android/test/EchTest.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.android.test
+
+import assertk.assertThat
+import assertk.assertions.isNotNull
+import assertk.assertions.matchesPredicate
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import org.junit.jupiter.api.Test
+
+class EchTest {
+
+  @Test
+  fun testHttpsRequest() {
+    val client: OkHttpClient =
+      OkHttpClient
+        .Builder()
+        .build()
+
+    val cloudflareEchBody =
+      client.sendRequest(Request.Builder().url("https://cloudflare-ech.com/").build()) {
+        it.body.string()
+      }
+    assertThat(cloudflareEchBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val cloudflareBody = client.sendRequest(
+      Request.Builder().url("https://crypto.cloudflare.com/cdn-cgi/trace").build()
+    ) {
+      it.body.string()
+    }
+    assertThat(cloudflareBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val tlsEchBody = client.sendRequest(Request.Builder().url("https://tls-ech.dev/").build()) {
+      it.body.string()
+    }
+    assertThat(tlsEchBody).matchesPredicate { it.contains("ECH enabled") }
+  }
+
+  private fun <T> OkHttpClient.sendRequest(request: Request, fn: (Response) -> T): T {
+    val response = newCall(request).execute()
+
+    assertThat(response.handshake?.echConfig).isNotNull()
+
+    return response.use {
+      fn(it)
+    }
+  }
+}

android-test/src/main/AndroidManifest.xml

@@ -4,6 +4,6 @@
   <uses-permission android:name="android.permission.INTERNET" />
   <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
-  <application android:usesCleartextTraffic="true" tools:targetApi="m"/>
+  <application android:usesCleartextTraffic="true" tools:targetApi="m" android:networkSecurityConfig="@xml/network_security_config"/>
 
 </manifest>

android-test/src/main/res/xml/network_security_config.xml

@@ -2,4 +2,10 @@
 <network-security-config>
   <base-config cleartextTrafficPermitted="false">
   </base-config>
-</network-security-config>
+  <domain-config>
+    <domain includeSubdomains="true">cloudflare-ech.com</domain>
+    <domain includeSubdomains="true">crypto.cloudflare.com</domain>
+    <domain includeSubdomains="true">tls-ech.dev</domain>
+    <domainEncryption mode="opportunistic"/>
+  </domain-config>
+</network-security-config>

android-test/src/test/kotlin/okhttp/android/test/AndroidSocketAdapterTest.kt

@@ -58,7 +58,12 @@ class AndroidSocketAdapterTest(
     val sslSocket = socketFactory.createSocket() as SSLSocket
     assertTrue(adapter.matchesSocket(sslSocket))
 
-    adapter.configureTlsExtensions(sslSocket, null, listOf(HTTP_2, HTTP_1_1))
+    adapter.configureTlsExtensions(
+      call = null,
+      sslSocket = sslSocket,
+      hostname = null,
+      protocols = listOf(HTTP_2, HTTP_1_1)
+    )
     // not connected
     assertNull(adapter.getSelectedProtocol(sslSocket))
   }
@@ -89,7 +94,12 @@ class AndroidSocketAdapterTest(
       object : DelegatingSSLSocket(context.socketFactory.createSocket() as SSLSocket) {}
     assertFalse(adapter.matchesSocket(sslSocket))
 
-    adapter.configureTlsExtensions(sslSocket, null, listOf(HTTP_2, HTTP_1_1))
+    adapter.configureTlsExtensions(
+      call = null,
+      sslSocket = sslSocket,
+      hostname = null,
+      protocols = listOf(HTTP_2, HTTP_1_1)
+    )
     // not connected
     assertNull(adapter.getSelectedProtocol(sslSocket))
   }

build-logic/src/main/kotlin/okhttp.jvm-conventions.gradle.kts

@@ -41,7 +41,6 @@ tasks.withType<KotlinCompile> {
   compilerOptions {
     jvmTarget.set(JvmTarget.JVM_1_8)
     freeCompilerArgs.addAll(
-      "-Xjvm-default=all",
       "-Xexpect-actual-classes",
     )
   }

gradle.properties

@@ -25,3 +25,5 @@ org.gradle.jvmargs=-Dfile.encoding=UTF-8
 # AGP 9.0 Settings
 android.builtInKotlin=true
 android.newDsl=true
+
+android.suppressUnsupportedCompileSdk=CANARY

gradle/libs.versions.toml

@@ -1,8 +1,8 @@
 [versions]
-agp = "9.1.0"
+agp = "9.2.0-alpha07"
 amazon-corretto = "2.5.0"
 android-junit5 = "2.0.1"
-androidx-activity = "1.11.0"
+androidx-activity = "1.13.0"
 androidx-annotation = "1.9.1"
 androidx-espresso-core = "3.7.0"
 androidx-junit = "1.3.0"
@@ -13,7 +13,7 @@ assertk = "0.28.1"
 binary-compatibility-validator = "0.18.1"
 bnd = "7.2.3"
 brotli-dec = "0.1.2"
-burst = "2.10.2"
+burst = "2.12.1"
 checkstyle = "13.4.0"
 clikt = "5.1.0"
 extra-java-module-info = "1.14"
@@ -35,7 +35,7 @@ jsoup = "1.22.1"
 junit-pioneer = "1.9.1"
 junit-platform = "1.14.3"
 junit4 = "4.13.2"
-kotlin = "2.2.21"
+kotlin = "2.3.20"
 ksp = "2.3.6"
 lint-gradle = "1.0.0-alpha05"
 maven-publish = "0.36.0"

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.0-rc-1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

mockwebserver-deprecated/build.gradle.kts

@@ -17,5 +17,4 @@ dependencies {
   testImplementation(projects.okhttpTestingSupport)
   testImplementation(projects.okhttpTls)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
 }

mockwebserver-junit5/build.gradle.kts

@@ -15,7 +15,6 @@ dependencies {
   compileOnly(libs.animalsniffer.annotations)
 
   testRuntimeOnly(libs.junit.jupiter.engine)
-  testImplementation(libs.kotlin.junit5)
   testImplementation(projects.okhttpTestingSupport)
   testImplementation(libs.assertk)
 }

mockwebserver/build.gradle.kts

@@ -16,7 +16,6 @@ dependencies {
   testImplementation(projects.mockwebserver3Junit5)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testImplementation(libs.assertk)
 }
 

mockwebserver/src/main/kotlin/mockwebserver3/MockWebServer.kt

@@ -473,7 +473,12 @@ public class MockWebServer : Closeable {
           openClientSockets.add(sslSocket)
 
           if (protocolNegotiationEnabled) {
-            Platform.get().configureTlsExtensions(sslSocket, null, protocols)
+            Platform.get().configureTlsExtensions(
+              call = null,
+              sslSocket = sslSocket,
+              hostname = null,
+              protocols = protocols,
+            )
           }
 
           sslSocket.startHandshake()

mockwebserver/src/test/java/mockwebserver3/internal/http2/Http2Server.kt

@@ -82,7 +82,12 @@ class Http2Server(
         true,
       ) as SSLSocket
     sslSocket.useClientMode = false
-    Platform.get().configureTlsExtensions(sslSocket, null, listOf(Protocol.HTTP_2))
+    Platform.get().configureTlsExtensions(
+      call = null,
+      sslSocket = sslSocket,
+      hostname = null,
+      protocols = listOf(Protocol.HTTP_2),
+    )
     sslSocket.startHandshake()
     return sslSocket
   }

native-image-tests/build.gradle.kts

@@ -39,7 +39,6 @@ dependencies {
   testImplementation(projects.mockwebserver3Junit5)
   testImplementation(libs.assertk)
   testRuntimeOnly(libs.junit.jupiter.engine)
-  testImplementation(libs.kotlin.junit5)
   testImplementation(libs.junit.jupiter.params)
 }
 

okhttp-brotli/build.gradle.kts

@@ -21,6 +21,5 @@ dependencies {
   testImplementation(libs.conscrypt.openjdk)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testImplementation(libs.assertk)
 }

okhttp-coroutines/build.gradle.kts

@@ -21,7 +21,6 @@ dependencies {
 
   testImplementation(libs.kotlin.test.annotations)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testApi(libs.assertk)
   testImplementation(projects.okhttpTestingSupport)
   testImplementation(libs.kotlinx.coroutines.test)

okhttp-dnsoverhttps/build.gradle.kts

@@ -23,5 +23,4 @@ dependencies {
   testImplementation(libs.conscrypt.openjdk)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
 }

okhttp-osgi-tests/build.gradle.kts

@@ -19,7 +19,6 @@ dependencies {
   testImplementation(projects.okhttpTestingSupport)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testImplementation(libs.assertk)
 
   testImplementation(libs.aqute.resolve)

okhttp-testing-support/build.gradle.kts

@@ -43,7 +43,6 @@ dependencies {
   compileOnly(libs.robolectric.android)
 
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
 }
 
 animalsniffer {

okhttp-tls/build.gradle.kts

@@ -22,7 +22,6 @@ dependencies {
   testImplementation(projects.mockwebserver3Junit5)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testImplementation(libs.assertk)
 }
 

okhttp-zstd/build.gradle.kts

@@ -19,6 +19,5 @@ dependencies {
   testImplementation(projects.okhttpBrotli)
   testImplementation(projects.okhttpTestingSupport)
   testImplementation(libs.kotlin.test.common)
-  testImplementation(libs.kotlin.test.junit)
   testImplementation(libs.assertk)
 }