* intermediate certificate, "Entrust Certification Authority - L1M". The intermediate certificate
 * is used to verify the signature of the "www.squareup.com" certificate.
 *
 * This roles are reversed for client authentication. In that case the client has a private key and
 * a chain of certificates. The server uses a set of trusted root certificates to authenticate the

    labelStart = dot + 1
  }

  return false
}

internal fun String.containsInvalidHostnameAsciiCodes(): Boolean {
  for (i in 0 until length) {
    val c = this[i]
    // The WHATWG Host parsing rules accepts some character codes which are invalid by
    // definition for OkHttp's host header checks (and the WHATWG Host syntax definition). Here
    // we rule out characters that would cause problems in host headers.

    response even if the server rejects your request body.
 *  Fix: Use literal IP addresses directly rather than passing them to `DnsOverHttps`.
 *  Fix: Embed Proguard rules to prevent warnings from tools like DexGuard and R8. These warnings
    were triggered by OkHttp’s feature detection for TLS packages like `org.conscrypt`,
    `org.bouncycastle`, and `org.openjsse`.

 */
@Timeout(30)
class FastFallbackTest {
  @RegisterExtension
  val clientTestRule = OkHttpClientTestRule()

  // Don't use JUnit 5 test rules for these; otherwise we can't bind them to a single local IP.
  private lateinit var localhostIpv4: InetAddress
  private lateinit var localhostIpv6: InetAddress
  private lateinit var serverIpv4: MockWebServer

      }
      sink.flush()
    }
  }

  /**
   * Send a connection-level ping to the peer. `ack` indicates this is a reply. The data in
   * `payload1` and `payload2` opaque binary, and there are no rules on the content.
   */
  @Throws(IOException::class)
  fun ping(
    ack: Boolean,
    payload1: Int,
    payload2: Int,
  ) {
    this.withLock {
      if (closed) throw IOException("closed")

    /** HTTP/2 only. */
    fun ackSettings()

    /**
     * Read a connection-level ping from the peer. `ack` indicates this is a reply. The data
     * in `payload1` and `payload2` opaque binary, and there are no rules on the content.
     */
    fun ping(
      ack: Boolean,
      payload1: Int,
      payload2: Int,
    )

    /**
     * The peer tells us to stop creating streams. It is safe to replay streams with

     */
    @JvmField
    val PARALLEL = "multipart/parallel".toMediaType()

    /**
     * The media-type multipart/form-data follows the rules of all multipart MIME data streams as
     * outlined in RFC 2046. In forms, there are a series of fields to be supplied by the user who
     * fills out the form. Each field has a name. Within a given form, the names are unique.

        .domain("example.com")
        .sameSite(sameSite)
        .build()
    assertThat(cookie.sameSite).isEqualTo(sameSite)
  }

  /** Note that we permit building a cookie that doesn’t follow the rules. */
  @Test fun builderSameSiteNoneDoesNotRequireSecure() {
    val cookieBuilder =
      Cookie.Builder()
        .name("a")
        .value("b")
        .domain("example.com")
        .sameSite("None")

    a malformed URL.)

 *  **We've improved connect failure recovery.** We now differentiate between
    setup, connecting, and connected and implement appropriate recovery rules
    for each. This changes `Address` to no longer use `ConnectionSpec`. (This is
    an incompatible API change).

 *  **`FormEncodingBuilder` now uses `%20` instead of `+` for encoded spaces.**

        if (rule != null) {
          wildcardMatch = rule
          break
        }
      }
    }

    // Exception rules only apply to wildcard rules, so only try it if we matched a wildcard.
    var exception: String? = null
    if (wildcardMatch != null) {
      for (labelIndex in 0 until domainLabelsUtf8Bytes.size - 1) {
        val rule =