|
| 1 | +package tech.httptoolkit.android |
| 2 | + |
| 3 | +import android.content.Context |
| 4 | +import io.sentry.SentryEvent |
| 5 | +import io.sentry.SentryOptions |
| 6 | +import io.sentry.android.core.SentryAndroid |
| 7 | +import tech.httptoolkit.android.vpn.transport.PacketHeaderException |
| 8 | +import java.io.IOException |
| 9 | +import java.net.BindException |
| 10 | +import java.net.ConnectException |
| 11 | +import java.net.SocketException |
| 12 | +import java.net.SocketTimeoutException |
| 13 | +import java.security.cert.CertificateException |
| 14 | + |
| 15 | +/** |
| 16 | + * Central Sentry configuration. We initialize manually (auto-init is disabled in the |
| 17 | + * manifest via io.sentry.auto-init) so that we can attach a beforeSend hook. This is the |
| 18 | + * single place where we filter out expected/unactionable noise and collapse high-cardinality |
| 19 | + * issues, rather than scattering ignore-checks across individual capture call sites. |
| 20 | + * |
| 21 | + * The DSN and enabled flag are still read from the manifest meta-data, so the existing |
| 22 | + * build-type gating (reporting only in release builds) continues to apply unchanged. |
| 23 | + */ |
| 24 | +fun initSentry(context: Context) { |
| 25 | + SentryAndroid.init(context) { options -> |
| 26 | + options.beforeSend = SentryOptions.BeforeSendCallback { event, _ -> |
| 27 | + if (shouldDropEvent(event)) { |
| 28 | + null |
| 29 | + } else { |
| 30 | + normalizeEvent(event) |
| 31 | + event |
| 32 | + } |
| 33 | + } |
| 34 | + } |
| 35 | +} |
| 36 | + |
| 37 | +private fun shouldDropEvent(event: SentryEvent): Boolean { |
| 38 | + val throwable = event.throwable |
| 39 | + return throwable != null && causedByIgnorableException(throwable) |
| 40 | +} |
| 41 | + |
| 42 | +/** |
| 43 | + * Walks the full cause chain, so an expected error wrapped in something else is still dropped. |
| 44 | + */ |
| 45 | +private fun causedByIgnorableException(throwable: Throwable): Boolean { |
| 46 | + var current: Throwable? = throwable |
| 47 | + val seen = HashSet<Throwable>() |
| 48 | + while (current != null && seen.add(current)) { |
| 49 | + if (isIgnorableException(current)) return true |
| 50 | + current = current.cause |
| 51 | + } |
| 52 | + return false |
| 53 | +} |
| 54 | + |
| 55 | +private fun isIgnorableException(e: Throwable): Boolean { |
| 56 | + val message = e.message ?: "" |
| 57 | + return when (e) { |
| 58 | + // Plain connection failures: the upstream/proxy was unreachable, timed out, or the |
| 59 | + // local address couldn't be bound. All expected for a VPN proxy, nothing to fix here. |
| 60 | + is SocketTimeoutException -> true |
| 61 | + is ConnectException -> true |
| 62 | + is BindException -> true |
| 63 | + |
| 64 | + // IPv6 isn't supported by our packet parsing yet - known and unactionable. |
| 65 | + is PacketHeaderException -> message.contains("IP version should be 4 but was 6") |
| 66 | + |
| 67 | + // Mid-connection socket failures and file-descriptor exhaustion, all expected operationally. |
| 68 | + is SocketException -> |
| 69 | + message.contains("Connection reset") || |
| 70 | + message.contains("Broken pipe") || |
| 71 | + message.contains("EPIPE") || |
| 72 | + message.contains("ENETUNREACH") || |
| 73 | + message.contains("Network is unreachable") || |
| 74 | + message.contains("EMFILE") || |
| 75 | + message.contains("Too many open files") |
| 76 | + |
| 77 | + is IOException -> |
| 78 | + message.contains("unexpected end of stream") || |
| 79 | + message.contains("Too many open files") |
| 80 | + |
| 81 | + // Android 12+ forbids starting our foreground service from the background. This is a |
| 82 | + // platform restriction we can't avoid here, so we don't report it as a crash. |
| 83 | + // (BackgroundServiceStartNotAllowedException is itself an IllegalStateException.) |
| 84 | + is IllegalStateException -> message.contains("Not allowed to start service") |
| 85 | + |
| 86 | + else -> false |
| 87 | + } |
| 88 | +} |
| 89 | + |
| 90 | +/** |
| 91 | + * Collapse known high-cardinality issues into a single group by giving them a stable |
| 92 | + * fingerprint, instead of letting dynamic values in the message split one underlying |
| 93 | + * problem into thousands of separate Sentry issues. |
| 94 | + */ |
| 95 | +private fun normalizeEvent(event: SentryEvent) { |
| 96 | + val throwable = event.throwable ?: return |
| 97 | + if ( |
| 98 | + throwable is CertificateException && |
| 99 | + (throwable.message ?: "").contains("Proxy returned mismatched certificate") |
| 100 | + ) { |
| 101 | + // The message embeds the (always different) cert fingerprints, so group by a fixed key. |
| 102 | + event.fingerprints = listOf("proxy-cert-mismatch") |
| 103 | + } |
| 104 | +} |
0 commit comments