}

  companion object {
    /**
     * A network that resolves only one IP address per host. Use this when testing route selection
     * fallbacks to prevent the host machine's various IP addresses from interfering.
     */
    private val SINGLE_INET_ADDRESS_DNS =
      Dns { hostname ->
        val addresses = Dns.SYSTEM.lookup(hostname)
        listOf(addresses[0])
      }

          true -> return // found open event
          false -> return@loop // this is not the open event so continue
        }
      }
      Assertions.fail<Any>("event $e without matching start event")
    }
  }

  override fun connectStart(
    route: Route,
    call: Call,
  ) = logEvent(ConnectionEvent.ConnectStart(System.nanoTime(), route, call))

  override fun connectFailed(

been, leading to rare cases of infinite retries. Please upgrade to this release!

 *  Fix: don't return stale DNS entries in `DnsOverHttps`. We were caching DNS results indefinitely
    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate

    reading the public suffix database would cause subsequent reads to hang when they should have
    crashed.

 *  Fix: Avoid `InetAddress.getCanonicalHostName()` in MockWebServer. This avoids problems if the
    host machine's IP address has additional DNS registrations.

 *  New: Create a JPMS-compatible artifact for `JavaNetCookieJar`. Previously, multiple OkHttp

 *
 * By orchestrating two different servers with the same port but different IP addresses, we can
 * test what OkHttp does when both are reachable, or if only one is reachable.
 *
 * This test only runs on host machines that have both IPv4 and IPv6 addresses for localhost.
 */
@Timeout(30)
class FastFallbackTest {
  @RegisterExtension
  val clientTestRule = OkHttpClientTestRule()

 *
 * See [RFC 7234, 5.2](https://tools.ietf.org/html/rfc7234#section-5.2).
 */
class CacheControl internal constructor(
  /**
   * In a response, this field's name "no-cache" is misleading. It doesn't prevent us from caching
   * the response; it only means we have to validate the response with the origin server before
   * returning it. We can do this with a conditional GET.
   *
   * In a request, it means do not use a cache to satisfy the request.

     */
    open fun <T> tag(
      type: Class<in T>,
      tag: T?,
    ) = commonTag(type.kotlin, tag)

    /**
     * Override the [Request.url] for caching, if it is either polluted with
     * transient query params, or has a canonical URL possibly for a CDN.
     *
     * Note that POST requests will not be sent to the server if this URL is set

            ?: throw ProtocolException("expected a value at $reader")

        val choice =
          choices.firstOrNull { it.matches(peekedHeader) }
            ?: throw ProtocolException(
              "expected a matching choice but was $peekedHeader at $reader",
            )

        return choice to choice.fromDer(reader)
      }

      override fun toDer(
        writer: DerWriter,

    // names or patterns, but they should be treated as absolute. At the same time, any hostname
    // presented to this method should also be treated as absolute for the purposes of matching
    // to the server certificate.
    //   www.android.com  matches www.android.com
    //   www.android.com  matches www.android.com.
    //   www.android.com. matches www.android.com.

    assertThat(verifier.verify("a.b.foo.com", session)).isFalse()
  }

  @Test fun verifyWilcardCnOnTld() {
    // It's the CA's responsibility to not issue broad-matching certificates!
    // CN=*.co.jp
    val session =
      session(
        """
        -----BEGIN CERTIFICATE-----
        MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD