if (localAddress.size != 4) {
          throw ProtocolException("unexpected address: " + toSocket.localAddress)
        }

        // Write the reply.
        fromSink.writeByte(VERSION_5)
        fromSink.writeByte(REPLY_SUCCEEDED)
        fromSink.writeByte(0)
        fromSink.writeByte(ADDRESS_TYPE_IPV4)
        fromSink.write(localAddress)
        fromSink.writeShort(toSocket.localPort)

 * Deferred implementation of SocketAdapter that works by observing the socket
 * and initializing on first use.
 *
 * We use this because eager classpath checks cause confusion and excessive logging in Android,
 * and we can't rely on classnames after proguard, so are probably best served by falling through
 * to a situation of trying our least likely noisiest options.
 */
class DeferredSocketAdapter(private val socketAdapterFactory: Factory) : SocketAdapter {

#### Shared reader thread

 * [OkHttp Profiler](https://plugins.jetbrains.com/plugin/11249-okhttp-profiler): An IntelliJ plugin for monitoring OkHttp calls.
 * [OkReplay](https://github.com/airbnb/okreplay): Record and replay OkHttp network interaction in your tests.
 * [okhttp-signpost](https://github.com/pakerfeldt/okhttp-signpost): OAuth signing with signpost and OkHttp.

#       options in "$@", and eventually passing that to Java.
#
#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
#       see the in-line comments for details.
#
#       There are tweaks for specific operating systems such as AIX, CygWin,
#       Darwin, MinGW, and NonStop.
#

        assertThat(sessionIds[1]).isNotEmpty()

        assertThat(directSessionIds).containsExactlyInAnyOrder(sessionIds[1])
      }
    } else {
      if (tlsVersion == TlsVersion.TLS_1_3) {
        // We can't rely on the same session id with TLSv1.3 ids.
        assertNotEquals(sessionIds[0], sessionIds[1])
      } else {
        // With TLSv1.2 it is really JDK specific.
        // assertEquals(sessionIds[0], sessionIds[1])

private key for their own certificate. The chain served by a server doesn't need the root
certificate.

The trusted roots don't need to be the same for client and server when using client authentication.
Clients might rely on the platform certificates and servers might use a private
organization-specific certificate authority.

By default `HeldCertificate` instances expire after 24 hours. Use `duration()` to adjust.