platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val reversed = ConnectionSpec.COMPATIBLE_TLS.cipherSuites!!.reversed()
    val client =
      makeClient(
        ConnectionSpec.COMPATIBLE_TLS,
        TlsVersion.TLS_1_2,
        reversed,
      )

    makeRequest(client)

          " supported protocols=${sslSocket.enabledProtocols!!.contentToString()}",
      )
  }

  /**
   * Returns a copy of this connection with the next connection spec to try, or null if no other
   * compatible connection specs are available.
   */
  internal fun nextConnectionSpec(
    connectionSpecs: List<ConnectionSpec>,
    sslSocket: SSLSocket,
  ): ConnectPlan? {

        .allEnabledTlsVersions()
        .build()
    val set: MutableSet<Any> = CopyOnWriteArraySet()
    assertThat(set.add(ConnectionSpec.MODERN_TLS)).isTrue()
    assertThat(set.add(ConnectionSpec.COMPATIBLE_TLS)).isTrue()
    assertThat(set.add(ConnectionSpec.CLEARTEXT)).isTrue()
    assertThat(set.add(allTlsVersions)).isTrue()
    assertThat(set.add(allCipherSuites)).isTrue()
    allCipherSuites.hashCode()

    This is a source-incompatible change. If you have code that calls
    `RequestBody.contentLength()`, your compile will break with this
    update. The change is binary-compatible, however: code compiled
    for OkHttp 2.0 and 2.1 will continue to work with this update.

 *  **`COMPATIBLE_TLS` no longer supports SSLv3.** In response to the
    [POODLE](https://googleonlinesecurity.blogspot.ca/2014/10/this-poodle-bites-exploiting-ssl-30.html)

    crashed.

 *  Fix: Avoid `InetAddress.getCanonicalHostName()` in MockWebServer. This avoids problems if the
    host machine's IP address has additional DNS registrations.

 *  New: Create a JPMS-compatible artifact for `JavaNetCookieJar`. Previously, multiple OkHttp
    artifacts defined classes in the `okhttp3` package, but this is forbidden by the Java module

    connectionSpec = ConnectionSpec.MODERN_TLS
    connectionSpec = ConnectionSpec.COMPATIBLE_TLS
    connectionSpec = ConnectionSpec.CLEARTEXT
    val tlsVersions: List<TlsVersion>? = connectionSpec.tlsVersions
    val cipherSuites: List<CipherSuite>? = connectionSpec.cipherSuites
    val supportsTlsExtensions: Boolean = connectionSpec.supportsTlsExtensions
    val compatible: Boolean =
      connectionSpec.isCompatible(

By default, OkHttp will attempt a `MODERN_TLS` connection.  However by configuring the client connectionSpecs you can allow a fall back to `COMPATIBLE_TLS` connection if the modern configuration fails.

```java
OkHttpClient client = new OkHttpClient.Builder()
    .connectionSpecs(Arrays.asList(ConnectionSpec.MODERN_TLS, ConnectionSpec.COMPATIBLE_TLS))
    .build();
```

import okhttp3.internal.ws.WebSocketProtocol.PAYLOAD_SHORT
import okhttp3.internal.ws.WebSocketProtocol.toggleMask
import okio.Buffer
import okio.BufferedSource
import okio.ByteString

/**
 * An [RFC 6455][rfc_6455]-compatible WebSocket frame reader.
 *
 * This class is not thread safe.
 *
 * [rfc_6455]: http://tools.ietf.org/html/rfc6455
 */
class WebSocketReader(
  private val isClient: Boolean,
  val source: BufferedSource,

        .build()
        .routeDatabase,
    )
    assertNotSame(
      client.routeDatabase,
      client.newBuilder()
        .connectionSpecs(listOf(ConnectionSpec.COMPATIBLE_TLS))
        .build()
        .routeDatabase,
    )
    assertNotSame(
      client.routeDatabase,
      client.newBuilder()
        .proxySelector(proxySelector)
        .build()

        .supportsTlsExtensions(true)
        .build()

    /**
     * A backwards-compatible fallback configuration that works on obsolete client platforms and can
     * connect to obsolete servers. When possible, prefer to upgrade your client platform or server
     * rather than using this configuration.
     */
    @JvmField
    val COMPATIBLE_TLS =
      Builder(true)
        .cipherSuites(*APPROVED_CIPHER_SUITES.toTypedArray())