Add Android ECH support

android-test-app/build.gradle.kts

@@ -9,7 +9,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.testapp"
 
@@ -18,7 +20,7 @@ android {
 
   defaultConfig {
     minSdk = 21
-    targetSdk = 36
+    targetSdk = 37
     testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
   }
 

android-test/build.gradle.kts

@@ -8,7 +8,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.test"
 
@@ -39,8 +41,24 @@ android {
   }
 
   testOptions {
-    targetSdk = 34
+    targetSdk = 37
     unitTests.isIncludeAndroidResources = true
+
+    // Robolectric 4.17 reflects into JDK internals, which JDK 17+ blocks by default.
+    // https://robolectric.org/getting-started/
+    unitTests.all {
+      it.jvmArgs(
+        "--add-opens=java.base/java.lang=ALL-UNNAMED",
+        "--add-opens=java.base/java.util=ALL-UNNAMED",
+        "--add-opens=java.base/java.io=ALL-UNNAMED",
+        "--add-opens=java.base/java.net=ALL-UNNAMED",
+        "--add-opens=java.base/java.security=ALL-UNNAMED",
+        "--add-opens=java.base/java.text=ALL-UNNAMED",
+        "--add-opens=java.base/jdk.internal.access=ALL-UNNAMED",
+        "--add-opens=java.desktop/java.awt.font=ALL-UNNAMED",
+        "--add-opens=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
+      )
+    }
   }
 
 

android-test/src/androidTest/java/okhttp/android/test/AndroidDnsTest.kt

@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.android.test
+
+import android.os.Build
+import assertk.assertThat
+import assertk.assertions.isEqualTo
+import assertk.assertions.isNotEmpty
+import assertk.assertions.matchesPredicate
+import java.net.InetAddress
+import mockwebserver3.MockResponse
+import mockwebserver3.MockWebServer
+import mockwebserver3.junit5.StartStop
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.android.AndroidDns
+import org.junit.jupiter.api.Assumptions.assumeTrue
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+
+/**
+ * Exercises [AndroidDns] as the resolver behind an [OkHttpClient], without service metadata (ECH).
+ * The requests go to a local [MockWebServer] over `localhost`, so the system resolver is driven but
+ * no external network is required.
+ */
+class AndroidDnsTest {
+  @StartStop
+  private val server = MockWebServer()
+
+  @BeforeEach
+  fun setup() {
+    // AndroidDns is backed by DnsResolver, which is API 29+.
+    assumeTrue(Build.VERSION.SDK_INT >= 29)
+  }
+
+  @Test
+  fun lookupResolvesLocalhostToLoopback() {
+    val addresses = AndroidDns(includeServiceMetadata = false).lookup("localhost")
+
+    assertThat(addresses).isNotEmpty()
+    assertThat(addresses).matchesPredicate { it.all(InetAddress::isLoopbackAddress) }
+  }
+
+  @Test
+  fun getWithAndroidDns() {
+    server.enqueue(MockResponse(body = "hello"))
+
+    val client =
+      OkHttpClient
+        .Builder()
+        .dns(AndroidDns(includeServiceMetadata = false))
+        .build()
+
+    // Force a hostname (not an IP literal) so the request goes through AndroidDns.
+    val url = server.url("/").newBuilder().host("localhost").build()
+
+    client.newCall(Request.Builder().url(url).build()).execute().use { response ->
+      assertThat(response.code).isEqualTo(200)
+      assertThat(response.body.string()).isEqualTo("hello")
+    }
+  }
+}

android-test/src/androidTest/java/okhttp/android/test/EchTest.kt

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.android.test
+
+import assertk.assertThat
+import assertk.assertions.matchesPredicate
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import org.junit.jupiter.api.Tag
+import org.junit.jupiter.api.Test
+
+@Tag("Remote")
+class EchTest {
+  @Test
+  fun testHttpsRequest() {
+    val client: OkHttpClient =
+      OkHttpClient
+        .Builder()
+        .build()
+
+    val cloudflareEchBody =
+      client.sendRequest(Request.Builder().url("https://cloudflare-ech.com/").build()) {
+        it.body.string()
+      }
+    assertThat(cloudflareEchBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val cloudflareBody =
+      client.sendRequest(
+        Request.Builder().url("https://crypto.cloudflare.com/cdn-cgi/trace").build(),
+      ) {
+        it.body.string()
+      }
+    assertThat(cloudflareBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val tlsEchBody =
+      client.sendRequest(Request.Builder().url("https://tls-ech.dev/").build()) {
+        it.body.string()
+      }
+    assertThat(tlsEchBody).matchesPredicate { it.contains("ECH enabled") }
+  }
+
+  private fun <T> OkHttpClient.sendRequest(
+    request: Request,
+    fn: (Response) -> T,
+  ): T {
+    val response = newCall(request).execute()
+
+    return response.use {
+      fn(it)
+    }
+  }
+}

android-test/src/main/AndroidManifest.xml

@@ -4,6 +4,6 @@
   <uses-permission android:name="android.permission.INTERNET" />
   <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
-  <application android:usesCleartextTraffic="true" tools:targetApi="m"/>
+  <application android:usesCleartextTraffic="true" tools:targetApi="m" android:networkSecurityConfig="@xml/network_security_config"/>
 
 </manifest>

android-test/src/main/res/xml/network_security_config.xml

@@ -2,4 +2,13 @@
 <network-security-config>
   <base-config cleartextTrafficPermitted="false">
   </base-config>
+  <domain-config cleartextTrafficPermitted="true">
+    <domain includeSubdomains="false">localhost</domain>
+  </domain-config>
+  <domain-config>
+    <domain includeSubdomains="true">cloudflare-ech.com</domain>
+    <domain includeSubdomains="true">crypto.cloudflare.com</domain>
+    <domain includeSubdomains="true">tls-ech.dev</domain>
+    <domainEncryption mode="opportunistic" />
+  </domain-config>
 </network-security-config>

android-test/src/test/resources/robolectric.properties

@@ -0,0 +1 @@
+sdk=36

gradle/libs.versions.toml

@@ -44,10 +44,10 @@ mockserver-client = "5.15.0"
 mrjar = "0.1.1"
 openjsse = "1.1.14"
 org-bouncycastle = "1.84"
-org-conscrypt = "2.5.2"
+org-conscrypt = "2.6.1"
 org-junit-jupiter = "5.13.4"
 playservices-safetynet = "18.1.0"
-robolectric = "4.16.1"
+robolectric = "4.17-beta-2"
 robolectric-android = "16-robolectric-13921718"
 serialization = "1.11.0"
 shadow-plugin = "9.5.1"

okhttp/api/android/okhttp.api

@@ -1366,3 +1366,11 @@ public abstract class okhttp3/WebSocketListener {
 	public fun onOpen (Lokhttp3/WebSocket;Lokhttp3/Response;)V
 }
 
+public final class okhttp3/android/AndroidDns : okhttp3/Dns {
+	public fun <init> ()V
+	public fun <init> (Landroid/net/DnsResolver;Landroid/net/Network;ZLjava/util/concurrent/Executor;)V
+	public synthetic fun <init> (Landroid/net/DnsResolver;Landroid/net/Network;ZLjava/util/concurrent/Executor;ILkotlin/jvm/internal/DefaultConstructorMarker;)V
+	public fun lookup (Ljava/lang/String;)Ljava/util/List;
+	public fun newCall (Lokhttp3/Dns$Request;)Lokhttp3/Dns$Call;
+}
+

okhttp/build.gradle.kts

@@ -58,7 +58,7 @@ kotlin {
   android {
     namespace = "okhttp.okhttp3"
     compileSdk {
-      version = release(36)
+      version = release(37)
     }
     minSdk = 21