[okio_3_6_0]: https://square.github.io/okio/changelog/#version-360
 [public_suffix]: https://publicsuffix.org/
 [rfc_2045]: https://tools.ietf.org/html/rfc2045
 [rfc_7231_647]: https://tools.ietf.org/html/rfc7231#section-6.4.7
 [rfc_7692]: https://tools.ietf.org/html/rfc7692
 [semver]: https://semver.org/

 *
 * Copy WireSharkKeyLoggerListener to your test code to use in development.
 *
 * This logs TLSv1.2 on a JVM (OpenJDK 11+) without any additional code.  For TLSv1.3
 * an existing external tool is required.
 *
 * See https://stackoverflow.com/questions/61929216/how-to-log-tlsv1-3-keys-in-jsse-for-wireshark-to-decode-traffic
 *
 * Steps to run in your own code
 *

  /**
   * If true, no new exchanges can be created on this connection. It is necessary to set this to
   * true when removing a connection from the pool; otherwise a racing caller might get it from the
   * pool when it shouldn't. Symmetrically, this must always be checked before returning a
   * connection from the pool.
   *
   * Once true this is always true. Guarded by this.
   */
  var noNewExchanges = false

  /**

  pos: Int,
  limit: Int,
): ByteArray? {
  val address = ByteArray(16)
  var b = 0
  var compress = -1
  var groupOffset = -1

  var i = pos
  while (i < limit) {
    if (b == address.size) return null // Too many groups.

    // Read a delimiter.
    if (i + 2 <= limit && input.startsWith("::", startIndex = i)) {
      // Compression "::" delimiter, which is anywhere in the input, including its prefix.

        return jdkWithJettyBoot
      }

      return Platform()
    }

    /**
     * Returns the concatenation of 8-bit, length prefixed protocol names.
     * http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-4
     */
    fun concatLengthPrefixed(protocols: List<Protocol>): ByteArray {
      val result = Buffer()
      for (protocol in alpnProtocolNames(protocols)) {

    assertFailsWith<ProtocolException> {
      CertificateAdapters.subjectPublicKeyInfo.fromDer(bytes)
    }.also { expected ->
      assertThat(expected.message).isEqualTo("enclosed object too large")
    }
  }

  /** Object identifiers are nominally self-delimiting. Outrun the limit with one. */
  @Test fun `variable length long outruns limit`() {
    val bytes = "060229ffffff7f".decodeHex()

  require(millis <= Integer.MAX_VALUE) { "$name too large" }
  require(millis != 0L || duration <= 0L) { "$name too small" }
  return millis.toInt()
}

internal fun checkDuration(
  name: String,
  duration: Duration,
): Int {
  check(!duration.isNegative()) { "$name < 0" }
  val millis = duration.inWholeMilliseconds
  require(millis <= Integer.MAX_VALUE) { "$name too large" }

  }

  /**
   * Variable-length quantity special cases strings which are longer than 127 bytes.  Values such as
   * cookies can be 4KiB, and should be possible to send.
   *
   *  http://tools.ietf.org/html/draft-ietf-httpbis-header-compression-12#section-5.2
   */
  @Test
  fun largeHeaderValue() {
    val value = CharArray(4096)
    Arrays.fill(value, '!')

    // Running at time 75, the pool returns that nothing can be evicted until time 150.
    assertThat(pool.closeConnections(75L)).isEqualTo(75L)
    assertThat(pool.connectionCount()).isEqualTo(2)

    // Running at time 149, the pool returns that nothing can be evicted until time 150.
    assertThat(pool.closeConnections(149L)).isEqualTo(1L)
    assertThat(pool.connectionCount()).isEqualTo(2)

import java.math.BigInteger
import java.net.ProtocolException
import okio.ByteString

/**
 * ASN.1 adapters adapted from the specifications in [RFC 5280][rfc_5280].
 *
 * [rfc_5280]: https://tools.ietf.org/html/rfc5280
 */
@Suppress("UNCHECKED_CAST") // This needs to cast decoded collections.
internal object CertificateAdapters {
  /**
   * ```
   * Time ::= CHOICE {
   *   utcTime        UTCTime,