connections.** Stale or canceled connections were incorrectly attempted when they shouldn't have
been, leading to rare cases of infinite retries. Please upgrade to this release!

 *  Fix: don't return stale DNS entries in `DnsOverHttps`. We were caching DNS results indefinitely
    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate

    var routeSelector = newRouteSelector(address)
    dns[PROXY_A_HOST] = dns.allocate(1)
    dns[PROXY_B_HOST] = dns.allocate(1)

    // Mark the ProxyA route as failed.
    val selection = routeSelector.next()
    dns.assertRequests(PROXY_A_HOST)
    val route = selection.next()
    assertRoute(route, address, proxyA, dns.lookup(PROXY_A_HOST, 0), PROXY_A_PORT)
    routeDatabase.failed(route)

  private lateinit var dns: Dns
  private val cacheFs = FakeFileSystem()
  private val bootstrapClient =
    OkHttpClient.Builder()
      .protocols(listOf(Protocol.HTTP_2, Protocol.HTTP_1_1))
      .build()

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
    server.protocols = bootstrapClient.protocols
    dns = buildLocalhost(bootstrapClient, false)
  }

  @Test

  private const val INITIAL_N = 0x80

  /**
   * Returns null if any label is oversized so much that the encoder cannot encode it without
   * integer overflow. This will not return null for labels that fit within the DNS size
   * limits.
   */
  fun encode(string: String): String? {
    var pos = 0
    val limit = string.length
    val result = Buffer()

    while (pos < limit) {

 * configure the factory when sample values impact the correctness of the test.
 */
class TestValueFactory : Closeable {
  var taskFaker: TaskFaker = TaskFaker()
  var taskRunner: TaskRunner = taskFaker.taskRunner
  var dns: Dns = Dns.SYSTEM
  var proxy: Proxy = Proxy.NO_PROXY
  var proxySelector: ProxySelector = RecordingProxySelector()
  var proxyAuthenticator: Authenticator = RecordingOkAuthenticator("password", null)

    return true // The caller's address can be carried by this connection.
  }

  /**
   * Returns true if this connection's route has the same address as any of [candidates]. This
   * requires us to have a DNS address for both hosts, which only happens after route planning. We
   * can't coalesce connections that use a proxy, since proxies don't tell us the origin server's IP
   * address.
   */

          .build(),
      )
      .setDnsOptions(
        DnsOptions.Builder()
          .setUseHttpStackDnsResolver(DnsOptions.DNS_OPTION_ENABLED)
          .setStaleDns(DnsOptions.DNS_OPTION_ENABLED)
          .setPersistHostCache(DnsOptions.DNS_OPTION_ENABLED)
          .build(),
      )
      .setQuicOptions(
        QuicOptions.Builder()
          .addAllowedQuicHost("google.com")

/**
 * A HostnameVerifier consistent with [RFC 2818][rfc_2818].
 *
 * [rfc_2818]: http://www.ietf.org/rfc/rfc2818.txt
 */
@Suppress("NAME_SHADOWING")
object OkHostnameVerifier : HostnameVerifier {
  private const val ALT_DNS_NAME = 2
  private const val ALT_IPA_NAME = 7

  override fun verify(
    host: String,
    session: SSLSession,
  ): Boolean {
    return if (!host.isAscii()) {
      false
    } else {
      try {

      .assertHeader("", "ef")
  }

  @Test
  fun customDns() {
    // Configure a DNS that returns our local MockWebServer for android.com.
    val dns = FakeDns()
    dns["android.com"] = Dns.SYSTEM.lookup(server.url("/").host)
    client =
      client.newBuilder()
        .dns(dns)
        .build()
    server.enqueue(MockResponse())

      }

    /**
     * Sets the DNS service used to lookup IP addresses for hostnames.
     *
     * If unset, the [system-wide default][Dns.SYSTEM] DNS will be used.
     */
    fun dns(dns: Dns) =
      apply {
        if (dns != this.dns) {
          this.routeDatabase = null
        }
        this.dns = dns
      }

    /**