Add Android ECH support

android-test-app/build.gradle.kts

@@ -9,7 +9,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.testapp"
 
@@ -18,7 +20,7 @@ android {
 
   defaultConfig {
     minSdk = 21
-    targetSdk = 36
+    targetSdk = 37
     testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
   }
 

android-test/build.gradle.kts

@@ -8,7 +8,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.test"
 
@@ -39,8 +41,24 @@ android {
   }
 
   testOptions {
-    targetSdk = 34
+    targetSdk = 37
     unitTests.isIncludeAndroidResources = true
+
+    // Robolectric 4.17 reflects into JDK internals, which JDK 17+ blocks by default.
+    // https://robolectric.org/getting-started/
+    unitTests.all {
+      it.jvmArgs(
+        "--add-opens=java.base/java.lang=ALL-UNNAMED",
+        "--add-opens=java.base/java.util=ALL-UNNAMED",
+        "--add-opens=java.base/java.io=ALL-UNNAMED",
+        "--add-opens=java.base/java.net=ALL-UNNAMED",
+        "--add-opens=java.base/java.security=ALL-UNNAMED",
+        "--add-opens=java.base/java.text=ALL-UNNAMED",
+        "--add-opens=java.base/jdk.internal.access=ALL-UNNAMED",
+        "--add-opens=java.desktop/java.awt.font=ALL-UNNAMED",
+        "--add-opens=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
+      )
+    }
   }
 
 

android-test/src/test/resources/robolectric.properties

@@ -0,0 +1 @@
+sdk=36

gradle/libs.versions.toml

@@ -47,7 +47,7 @@ org-bouncycastle = "1.84"
 org-conscrypt = "2.5.2"
 org-junit-jupiter = "5.13.4"
 playservices-safetynet = "18.1.0"
-robolectric = "4.16.1"
+robolectric = "4.17-beta-2"
 robolectric-android = "16-robolectric-13921718"
 serialization = "1.11.0"
 shadow-plugin = "9.5.1"

okhttp-dnsoverhttps/src/main/kotlin/okhttp3/dnsoverhttps/internal/-DnsOverHttpsCall.kt

@@ -31,6 +31,7 @@ import okhttp3.Response
 import okhttp3.dnsoverhttps.DnsOverHttps.Companion.DNS_MESSAGE
 import okhttp3.dnsoverhttps.DnsOverHttps.Companion.MAX_RESPONSE_SIZE
 import okhttp3.internal.OkHttpInternalApi
+import okhttp3.internal.dns.DnsCallStateMachine
 import okhttp3.internal.dns.DnsMessage
 import okhttp3.internal.dns.DnsMessageReader
 import okhttp3.internal.platform.Platform

okhttp/build.gradle.kts

@@ -58,7 +58,7 @@ kotlin {
   android {
     namespace = "okhttp.okhttp3"
     compileSdk {
-      version = release(36)
+      version = release(37)
     }
     minSdk = 21
 

okhttp/src/androidMain/kotlin/okhttp3/android/AndroidDns.kt

@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp3.android
+
+import android.net.DnsResolver
+import android.net.Network
+import android.os.CancellationSignal
+import androidx.annotation.RequiresApi
+import java.io.IOException
+import java.net.InetAddress
+import java.net.UnknownHostException
+import java.util.concurrent.Executor
+import java.util.concurrent.atomic.AtomicBoolean
+import okhttp3.Dns
+import okhttp3.internal.SuppressSignatureCheck
+import okhttp3.internal.concurrent.Task
+import okhttp3.internal.concurrent.TaskRunner
+import okhttp3.internal.dns.DnsCallStateMachine
+import okhttp3.internal.dns.DnsMessage
+import okhttp3.internal.dns.DnsMessageReader
+import okhttp3.internal.dns.TYPE_A
+import okhttp3.internal.dns.TYPE_HTTPS
+import okhttp3.internal.dns.execute
+import okio.Buffer
+
+/**
+ * A [Dns] backed by Android's system resolver, with ECH support from Android's [DnsResolver].
+ *
+ * IP addresses come from the system resolver — [InetAddress.getAllByName], or
+ * [Network.getAllByName] when a [network] is set.
+ */
+@RequiresApi(29)
+@SuppressSignatureCheck
+class AndroidDns
+  @JvmOverloads
+  constructor(
+    private val dnsResolver: DnsResolver = DnsResolver.getInstance(),
+    private val network: Network? = null,
+    /**
+     * True to also query the `HTTPS` record for service metadata such as ECH. Set this to false to
+     * save a query when only IP addresses are needed.
+     */
+    private val includeServiceMetadata: Boolean = true,
+    // Runs inline; the executor only hands off DnsResolver's callbacks.
+    private val executor: Executor = Executor { it.run() },
+  ) : Dns {
+    /**
+     * Resolves addresses only, for callers using the legacy blocking API. [Dns] cannot carry
+     * HTTPS/ECH metadata, so this skips that query rather than paying for it and discarding it.
+     */
+    override fun lookup(hostname: String): List<InetAddress> =
+      AndroidDnsCall(Dns.Request(hostname), includeServiceMetadata = false)
+        .execute()
+        .filterIsInstance<Dns.Record.IpAddress>()
+        .map { it.address }
+
+    override fun newCall(request: Dns.Request): Dns.Call = AndroidDnsCall(request, includeServiceMetadata = includeServiceMetadata)
+
+    private inner class AndroidDnsCall(
+      override val request: Dns.Request,
+      includeServiceMetadata: Boolean,
+    ) : Dns.Call,
+      DnsCallStateMachine.Transport<AndroidDnsCall.Query> {
+      private val stateMachine =
+        DnsCallStateMachine(
+          transport = this,
+          call = this,
+          canceledException = null,
+          // A single `A` query to represent the blocking InetAddress call for both.
+          includeIPv6 = false,
+          includeServiceMetadata = includeServiceMetadata,
+        )
+
+      override fun enqueue(callback: Dns.Callback) {
+        stateMachine.start(callback)
+      }
+
+      override fun cancel() {
+        stateMachine.cancel()
+      }
+
+      override fun isCanceled(): Boolean = stateMachine.canceled
+
+      override fun newQuery(dnsMessage: DnsMessage) = Query(dnsMessage)
+
+      override fun enqueue(query: Query) {
+        when (query.type) {
+          TYPE_A -> resolveAddresses(query)
+          else -> queryServiceMetadata(query)
+        }
+      }
+
+      /**
+       * Cancels a query. The system resolver doesn't call back once canceled, so this completes the
+       * query itself to keep the state machine from stalling.
+       */
+      override fun cancel(query: Query) {
+        query.cancellationSignal?.cancel()
+        query.complete { stateMachine.onQueryFailure(query, IOException("canceled")) }
+      }
+
+      /**
+       * Resolves IP addresses through the system resolver. This is a blocking call, so it runs on a
+       * [TaskRunner] thread. When canceled, it still runs to completion but its result is discarded.
+       */
+      private fun resolveAddresses(query: Query) {
+        TaskRunner.INSTANCE.newQueue().schedule(
+          object : Task("${request.hostname} address lookup", cancelable = false) {
+            override fun runOnce(): Long {
+              try {
+                val addresses =
+                  when (network) {
+                    null -> InetAddress.getAllByName(request.hostname)
+                    else -> network.getAllByName(request.hostname)
+                  }
+                val records = addresses.map { Dns.Record.IpAddress(request.hostname, it) }
+                query.complete { stateMachine.onQueryRecords(query, records) }
+              } catch (e: UnknownHostException) {
+                query.complete { stateMachine.onQueryFailure(query, e) }
+              }
+              return -1L
+            }
+          },
+        )
+      }
+
+      /**
+       * Asks [DnsResolver] for the `HTTPS` record. The platform has no typed API for this below
+       * API 36, so we request the raw message and decode it with OkHttp's own [DnsMessageReader] —
+       * the same decoder `DnsOverHttps` uses.
+       *
+       * Failures are reported to the [Dns.Callback] rather than swallowed, so callers can tell an
+       * absent `HTTPS` record from a query that errored. Note that any addresses already resolved
+       * are still delivered first.
+       */
+      @Suppress("ktlint:standard:comment-wrapping")
+      private fun queryServiceMetadata(query: Query) {
+        val queryCallback =
+          object : DnsResolver.Callback<ByteArray> {
+            override fun onAnswer(
+              answer: ByteArray,
+              rcode: Int,
+            ) {
+              val message =
+                try {
+                  DnsMessageReader(Buffer().write(answer)).read()
+                } catch (e: IOException) {
+                  return query.complete { stateMachine.onQueryFailure(query, e) }
+                }
+
+              // The state machine turns a non-success rcode into a failure of its own.
+              query.complete { stateMachine.onQueryResponse(query, message) }
+            }
+
+            override fun onError(e: DnsResolver.DnsException) {
+              query.complete {
+                stateMachine.onQueryFailure(
+                  query,
+                  IOException("HTTPS query failed with code ${e.code}", e),
+                )
+              }
+            }
+          }
+
+        try {
+          dnsResolver.rawQuery(
+            /* network = */ network,
+            /* domain = */ request.hostname,
+            /* nsClass = */ DnsResolver.CLASS_IN,
+            /* nsType = */ TYPE_HTTPS,
+            /* flags = */ DnsResolver.FLAG_EMPTY,
+            /* executor = */ executor,
+            /* cancellationSignal = */ query.cancellationSignal,
+            /* callback = */ queryCallback,
+          )
+        } catch (e: SecurityException) {
+          // The app lacks INTERNET permission, or network policy forbids the query. The callback
+          // won't run, so complete the query here or the state machine never terminates.
+          query.complete { stateMachine.onQueryFailure(query, IOException(e)) }
+        }
+      }
+
+      /** One outstanding query. Each completes the state machine's query at most once. */
+      inner class Query(
+        dnsMessage: DnsMessage,
+      ) {
+        val type: Int = dnsMessage.questions.single().type
+
+        /** Only the `HTTPS` query reaches [DnsResolver], which is the API that takes a signal. */
+        val cancellationSignal = if (type == TYPE_A) null else CancellationSignal()
+        private val completed = AtomicBoolean()
+
+        fun complete(block: () -> Unit) {
+          if (completed.compareAndSet(false, true)) block()
+        }
+      }
+    }
+  }

okhttp/src/androidMain/kotlin/okhttp3/internal/platform/Android10Platform.kt

@@ -30,6 +30,7 @@ import okhttp3.Protocol
 import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.platform.AndroidPlatform.Companion.Tag
 import okhttp3.internal.platform.android.Android10SocketAdapter
+import okhttp3.internal.platform.android.Android17SocketAdapter
 import okhttp3.internal.platform.android.AndroidCertificateChainCleaner
 import okhttp3.internal.platform.android.AndroidSocketAdapter
 import okhttp3.internal.platform.android.BouncyCastleSocketAdapter
@@ -48,6 +49,7 @@ class Android10Platform :
 
   private val socketAdapters =
     listOfNotNull(
+      Android17SocketAdapter.buildIfSupported(),
       Android10SocketAdapter.buildIfSupported(),
       DeferredSocketAdapter(AndroidSocketAdapter.playProviderFactory),
       // Delay and Defer any initialisation of Conscrypt and BouncyCastle