assertThat(CertificateAdapters.extension.toDer(extension))
      .isEqualTo(bytes)
    assertThat(CertificateAdapters.extension.fromDer(bytes))
      .isEqualTo(extension)
  }

  /** Tags larger than 30 are a special case. */
  @Test fun `large tag`() {
    val bytes = "df83fb6800".decodeHex()

    val adapter = Adapters.NULL.withTag(tagClass = DerHeader.TAG_CLASS_PRIVATE, tag = 65_000L)

  private var source: BufferedSource?,
  private var sink: BufferedSink?,
  private val pingIntervalMillis: Int,
  internal val connectionListener: ConnectionListener,
) : Http2Connection.Listener(), Connection, ExchangeCodec.Carrier {
  private var http2Connection: Http2Connection? = null

  internal val lock: ReentrantLock = ReentrantLock()

  // These properties are guarded by [lock].

  /**

    compressing outbound web socket messages. Configure this with 0L to always compress outbound
    messages and `Long.MAX_VALUE` to never compress outbound messages. The default is 1024L which
    compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on
    the web socket server's configuration.)
 *  New: Defer constructing `Inflater` and `Deflater` instances until they are needed. This saves

 */
class Http1ExchangeCodec(
  /** The client that configures this stream. May be null for HTTPS proxy tunnels. */
  private val client: OkHttpClient?,
  override val carrier: ExchangeCodec.Carrier,
  private val source: BufferedSource,
  private val sink: BufferedSink,
) : ExchangeCodec {
  private var state = STATE_IDLE
  private val headersReader = HeadersReader(source)

  internal val routes: List<Route>?,
  private val attempt: Int,
  private val tunnelRequest: Request?,
  internal val connectionSpecIndex: Int,
  internal val isTlsFallback: Boolean,
) : RoutePlanner.Plan, ExchangeCodec.Carrier {
  /** True if this connect was canceled; typically because it lost a race. */
  @Volatile private var canceled = false

  // These properties are initialized by connect() and never reassigned.

    @JvmStatic
    fun X509Certificate.sha256Hash(): ByteString = publicKey.encoded.toByteString().sha256()

    /**
     * Returns the SHA-256 of `certificate`'s public key.
     *
     * In OkHttp 3.1.2 and earlier, this returned a SHA-1 hash of the public key. Both types are
     * supported, but SHA-256 is preferred.
     */
    @JvmStatic
    fun pin(certificate: Certificate): String {

 *
 * This class may be used to stream very large responses. For example, it is possible to use this
 * class to read a response that is larger than the entire memory allocated to the current process.
 * It can even stream a response larger than the total storage on the current device, which is a
 * common requirement for video streaming applications.
 *

    // All other connections created will expire sooner
    routePlanner.defaultConnectionIdleAtNanos = expireSooner

    // Turn it into an http/2 connection that supports 5 concurrent streams
    // which can satisfy a larger policy
    val connection = routePlanner.plans.first().connection
    val http2Connection = connectHttp2(peer, connection, 5)
    setPolicy(pool, address, ConnectionPool.AddressPolicy(5))

        fl2WRY8hb4x+zRrwsFaLEpdEvqcjOQ==
        -----END CERTIFICATE-----
        """.trimIndent(),
      )
    assertThat(verifier.verify("127.0.0.1", session)).isFalse()
  }

  /**
   * Earlier implementations of Android's hostname verifier required that wildcard names wouldn't
   * match "*.com" or similar. This was a nonstandard check that we've since dropped. It is the CA's

# FORMAT NOT DOCUMENTED YET (parser is urltestparser.js)

# Based on http://trac.webkit.org/browser/trunk/LayoutTests/fast/url/script-tests/segments.js
http://example\t.\norg http://example.org/foo/bar s:http h:example.org p:/
http://user:pass@foo:21/bar;par?b#c  s:http u:user pass:pass h:foo port:21 p:/bar;par q:?b f:#c
http:foo.com  s:http h:example.org p:/foo/foo.com
\t\s\s\s:foo.com\s\s\s\n  s:http h:example.org p:/foo/:foo.com