Add support for ECH on Android 37

.github/workflows/build.yml

@@ -299,11 +299,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        api-level:
-          - 21
-          - 23
-          - 29
-          - 34
+        include:
+          - api-level: 21
+            arch: x86
+            target: default
+          - api-level: 23
+            arch: x86
+            target: default
+          - api-level: 29
+            arch: x86
+            target: default
+          - api-level: 34
+            arch: x86_64
+            target: default
 
     steps:
       - name: Checkout
@@ -338,7 +346,7 @@ jobs:
         uses: actions/cache@v5
         id: avd-cache
         with:
-          key: avd-${{ runner.os }}-${{ matrix.api-level }}-${{ matrix.api-level >= 30 && 'x86_64' || 'x86' }}
+          key: avd-${{ runner.os }}-${{ matrix.api-level }}-${{ matrix.target }}-${{ matrix.arch }}
           path: |
             ~/.android/avd/*
             ~/.android/adb*
@@ -351,7 +359,9 @@ jobs:
         with:
           api-level: ${{ matrix.api-level }}
           force-avd-creation: false
-          arch: ${{ matrix.api-level >= 30 && 'x86_64' || 'x86' }}
+          target: ${{ matrix.target }}
+          arch: ${{ matrix.arch }}
+          emulator-boot-timeout: 1200
           # No window, no audio, and use swiftshader for headless environments
           emulator-options: >
             -no-window
@@ -367,14 +377,111 @@ jobs:
         uses: reactivecircus/android-emulator-runner@v2
         with:
           api-level: ${{ matrix.api-level }}
-          arch: ${{ matrix.api-level == '34' && 'x86_64' || 'x86' }}
+          target: ${{ matrix.target }}
+          arch: ${{ matrix.arch }}
+          emulator-boot-timeout: 1200
+          # Match the snapshot creation options. The action default includes -no-snapshot,
+          # which forces a slow cold boot.
+          emulator-options: >
+            -no-window
+            -gpu swiftshader_indirect
+            -noaudio
+            -no-boot-anim
+            -camera-back none
+            -memory 2048
           script: ./gradlew -PandroidBuild=true connectedCheck
         env:
           API_LEVEL: ${{ matrix.api-level }}
 
       - name: Build Release App
         run: ./gradlew android-test-app:lint android-test-app:assembleRelease
 
+  android37:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Configure JDK
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Enable KVM group perms
+        # https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Verify KVM
+        run: |
+          sudo apt-get install -y cpu-checker
+          kvm-ok || echo "KVM is not accelerated"
+          kvm-ok || exit 1
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c
+
+      - name: Gradle cache
+        run: ./gradlew :android-test:test
+
+      - name: Run Android 37 Tests
+        run: |
+          SDKMANAGER="$(find "$ANDROID_HOME/cmdline-tools" -path '*/bin/sdkmanager' | sort | tail -n 1)"
+          AVDMANAGER="$(find "$ANDROID_HOME/cmdline-tools" -path '*/bin/avdmanager' | sort | tail -n 1)"
+          ADB="$ANDROID_HOME/platform-tools/adb"
+          EMULATOR="$ANDROID_HOME/emulator/emulator"
+          export ANDROID_AVD_HOME="$HOME/.android/avd"
+          mkdir -p "$ANDROID_AVD_HOME"
+
+          yes | "$SDKMANAGER" --licenses > /dev/null
+          "$SDKMANAGER" --install \
+            'build-tools;36.0.0' \
+            platform-tools \
+            'platforms;android-37.0' \
+            emulator \
+            'system-images;android-37.0;google_apis_playstore_ps16k;x86_64' \
+            --channel=0 > /dev/null
+
+          printf 'no\n' | "$AVDMANAGER" create avd \
+            --force \
+            --name test \
+            --package 'system-images;android-37.0;google_apis_playstore_ps16k;x86_64'
+
+          "$AVDMANAGER" list avd
+
+          "$EMULATOR" \
+            -port 5554 \
+            -avd test \
+            -no-window \
+            -gpu swiftshader_indirect \
+            -no-snapshot \
+            -noaudio \
+            -no-boot-anim \
+            -camera-back none \
+            -memory 4096 &
+
+          "$ADB" -s emulator-5554 wait-for-device
+          timeout 1200 bash -c 'until [[ "$("$1" -s emulator-5554 shell getprop sys.boot_completed | tr -d "\r")" == "1" ]]; do sleep 2; done' -- "$ADB"
+          timeout 300 bash -c 'until "$1" -s emulator-5554 shell service check input | grep -q "found"; do sleep 2; done' -- "$ADB"
+          timeout 300 bash -c 'until "$1" -s emulator-5554 shell service check package | grep -q "found"; do sleep 2; done' -- "$ADB"
+          timeout 300 bash -c 'until "$1" -s emulator-5554 shell service check activity | grep -q "found"; do sleep 2; done' -- "$ADB"
+          "$ADB" -s emulator-5554 shell getprop ro.build.version.sdk
+          "$ADB" -s emulator-5554 shell getprop ro.build.version.release
+
+          ./gradlew -PandroidBuild=true connectedCheck
+        env:
+          API_LEVEL: 37.0
+
+      - name: Stop Android 37 Emulator
+        if: always()
+        run: |
+          "$ANDROID_HOME/platform-tools/adb" -s emulator-5554 emu kill || true
+
   loom:
     runs-on: ubuntu-latest
 
@@ -440,4 +547,3 @@ jobs:
 
       - name: Run with Jlink
         run: ./gradlew module-tests:imageRun -PokhttpModuleTests=true
-

android-test-app/build.gradle.kts

@@ -1,15 +1,14 @@
 @file:Suppress("UnstableApiUsage")
 
-import okhttp3.buildsupport.testJavaVersion
-
-
 plugins {
   id("okhttp.base-conventions")
   id("com.android.application")
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.testapp"
 
@@ -18,7 +17,7 @@ android {
 
   defaultConfig {
     minSdk = 21
-    targetSdk = 36
+    targetSdk = 37
     testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
   }
 

android-test-app/src/androidTest/kotlin/okhttp/android/testapp/PublicSuffixDatabaseTest.kt

@@ -15,15 +15,23 @@
  */
 package okhttp3.android
 
+import androidx.test.platform.app.InstrumentationRegistry
 import assertk.assertThat
 import assertk.assertions.isEqualTo
 import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.OkHttp
+import org.junit.Before
 import org.junit.Test
 
 /**
  * Run with "./gradlew :android-test-app:connectedCheck -PandroidBuild=true" and make sure ANDROID_SDK_ROOT is set.
  */
 class PublicSuffixDatabaseTest {
+  @Before
+  fun setUp() {
+    OkHttp.initialize(InstrumentationRegistry.getInstrumentation().targetContext)
+  }
+
   @Test
   fun testTopLevelDomain() {
     assertThat("https://www.google.com/robots.txt".toHttpUrl().topPrivateDomain()).isEqualTo("google.com")

android-test/build.gradle.kts

@@ -8,7 +8,9 @@ plugins {
 }
 
 android {
-  compileSdk = 36
+  compileSdk {
+    version = release(37)
+  }
 
   namespace = "okhttp.android.test"
 
@@ -24,26 +26,16 @@ android {
     )
   }
 
-  if (androidBuild) {
-    sourceSets["androidTest"].java.srcDirs(
-      "../okhttp-brotli/src/test/java",
-      "../okhttp-dnsoverhttps/src/test/java",
-      "../okhttp-logging-interceptor/src/test/java",
-      "../okhttp-sse/src/test/java"
-    )
-  }
-
   compileOptions {
     targetCompatibility(JavaVersion.VERSION_11)
     sourceCompatibility(JavaVersion.VERSION_11)
   }
 
   testOptions {
-    targetSdk = 34
+    targetSdk = 37
     unitTests.isIncludeAndroidResources = true
   }
 
-
   // issue merging due to conflict with httpclient and something else
   packagingOptions.resources.excludes += setOf(
     "META-INF/DEPENDENCIES",
@@ -55,11 +47,25 @@ android {
   )
 }
 
+if (androidBuild) {
+  androidComponents {
+    onVariants(selector().all()) { variant ->
+      variant.androidTest?.sources?.java?.apply {
+        addStaticSourceDirectory("../okhttp-brotli/src/test/java")
+        addStaticSourceDirectory("../okhttp-dnsoverhttps/src/test/java")
+        addStaticSourceDirectory("../okhttp-logging-interceptor/src/test/java")
+        addStaticSourceDirectory("../okhttp-sse/src/test/java")
+      }
+    }
+  }
+}
+
 dependencies {
   implementation(libs.kotlin.reflect)
   implementation(libs.playservices.safetynet)
   "friendsImplementation"(projects.okhttp)
   "friendsImplementation"(projects.okhttpDnsoverhttps)
+  implementation(libs.androidx.activity)
 
   testImplementation(projects.okhttp)
   testImplementation(libs.junit)
@@ -114,3 +120,8 @@ junitPlatform {
     excludeTags("Remote")
   }
 }
+
+tasks.withType<Test> {
+  // Fix for robolectric https://github.com/robolectric/robolectric/pull/10996
+  jvmArgs("--add-opens", "java.base/jdk.internal.access=ALL-UNNAMED")
+}

android-test/src/androidTest/java/okhttp/android/test/EchTest.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2026 OkHttp Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package okhttp.android.test
+
+import assertk.assertThat
+import assertk.assertions.isNotNull
+import assertk.assertions.matchesPredicate
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import org.junit.jupiter.api.Tag
+import org.junit.jupiter.api.Test
+
+@Tag("Remote")
+class EchTest {
+
+  @Test
+  fun testHttpsRequest() {
+    val client: OkHttpClient =
+      OkHttpClient
+        .Builder()
+        .build()
+
+    val cloudflareEchBody =
+      client.sendRequest(Request.Builder().url("https://cloudflare-ech.com/").build()) {
+        it.body.string()
+      }
+    assertThat(cloudflareEchBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val cloudflareBody = client.sendRequest(
+      Request.Builder().url("https://crypto.cloudflare.com/cdn-cgi/trace").build()
+    ) {
+      it.body.string()
+    }
+    assertThat(cloudflareBody).matchesPredicate { it.contains("ECH enabled") }
+
+    val tlsEchBody = client.sendRequest(Request.Builder().url("https://tls-ech.dev/").build()) {
+      it.body.string()
+    }
+    assertThat(tlsEchBody).matchesPredicate { it.contains("ECH enabled") }
+  }
+
+  private fun <T> OkHttpClient.sendRequest(request: Request, fn: (Response) -> T): T {
+    val response = newCall(request).execute()
+
+    return response.use {
+      fn(it)
+    }
+  }
+}

android-test/src/main/AndroidManifest.xml

@@ -4,6 +4,6 @@
   <uses-permission android:name="android.permission.INTERNET" />
   <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
-  <application android:usesCleartextTraffic="true" tools:targetApi="m"/>
+  <application android:usesCleartextTraffic="true" tools:targetApi="m" android:networkSecurityConfig="@xml/network_security_config"/>
 
 </manifest>

android-test/src/main/res/xml/network_security_config.xml

@@ -2,4 +2,13 @@
 <network-security-config>
   <base-config cleartextTrafficPermitted="false">
   </base-config>
-</network-security-config>
+  <domain-config cleartextTrafficPermitted="true">
+    <domain includeSubdomains="false">localhost</domain>
+  </domain-config>
+  <domain-config>
+    <domain includeSubdomains="true">cloudflare-ech.com</domain>
+    <domain includeSubdomains="true">crypto.cloudflare.com</domain>
+    <domain includeSubdomains="true">tls-ech.dev</domain>
+    <domainEncryption mode="opportunistic" />
+  </domain-config>
+</network-security-config>