),
        )
      }
      else -> {
        val failure =
          ProtocolException(
            "Too many tunnel connections attempted: $MAX_TUNNEL_ATTEMPTS",
          )
        user.connectFailed(route, null, failure)
        return ConnectResult(plan = this, throwable = failure)
      }
    }
  }

  @Throws(IOException::class)
  private fun connectTls(

    client: OkHttpClient,
    failedRoute: Route,
    failure: IOException,
  ) {
    // Tell the proxy selector when we fail to connect on a fresh connection.
    if (failedRoute.proxy.type() != Proxy.Type.DIRECT) {
      val address = failedRoute.address
      address.proxySelector.connectFailed(
        address.url.toUri(),
        failedRoute.proxy.address(),
        failure,
      )
    }

    check(rule.startsWith(WILDCARD_CHAR)) {
      """Wildcard Assertion Failure: '$rule'
A wildcard rule was added with a wildcard that is not in leftmost position! We'll need to change the ${PublicSuffixDatabase::class.java.name} to handle this."""
    }
    check(rule.indexOf(WILDCARD_CHAR, 1) == -1) {
      """Wildcard Assertion Failure: '$rule'

 * share the same [Address] may share a [Connection]. This class implements the policy
 * of which connections to keep open for future use.
 *
 * @constructor Create a new connection pool with tuning parameters appropriate for a single-user
 * application. The tuning parameters in this pool are subject to change in future OkHttp releases.
 * Currently this pool holds up to 5 idle connections which will be evicted after 5 minutes of
 * inactivity.
 */

## Version 4.12.0

_2023-10-16_

 *  Fix: Don't hang taking headers for HTTP 103 responses.

 *  Fix: Recover gracefully when a cache entry's certificate is corrupted.

 *  Fix: Fail permanently when there's a failure loading the bundled public suffix database.
    This is the dataset that powers `HttpUrl.topPrivateDomain()`.

 *  Fix: Immediately update the connection's flow control window instead of waiting for the

          responseCallback.onResponse(this@RealCall, response)
        } catch (e: IOException) {
          if (signalledCallback) {
            // Do not signal the callback twice!
            Platform.get().log("Callback failure for ${toLoggableString()}", Platform.INFO, e)
          } else {
            responseCallback.onFailure(this@RealCall, e)
          }
        } catch (t: Throwable) {
          cancel()

import java.net.InetSocketAddress
import java.net.ServerSocket
import java.security.PrivateKey
import java.util.concurrent.ExecutorService
import java.util.concurrent.Executors
import java.util.concurrent.Future
import javax.net.ServerSocketFactory
import javax.net.SocketFactory
import javax.net.ssl.SSLSocket
import okhttp3.Handshake
import okhttp3.Handshake.Companion.handshake
import okhttp3.TestUtil.threadFactory

      .containsExactlyInAnyOrder(
        "/lookup?ct&dns=AAABAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ",
        "/lookup?ct&dns=AAABAAABAAAAAAAABmdvb2dsZQNjb20AABwAAQ",
      )
  }

  @Test
  fun failure() {
    server.enqueue(
      dnsResponse(
        "0000818300010000000100000e7364666c6b686673646c6b6a64660265650000010001c01b00060001000" +

          call: Call,
          response: Response,
        ) {
          throw IOException("a")
        }
      },
    )
    assertThat(testLogHandler.take())
      .isEqualTo("INFO: Callback failure for call to " + server.url("/") + "...")
  }

  @Test
  fun connectionPooling() {
    server.enqueue(MockResponse(body = "abc"))
    server.enqueue(MockResponse(body = "def"))

    assertFailsWith<IOException> {
      call.execute()
    }.also { expected ->
      assertThat(call.isCanceled()).isTrue()
    }
    val recordedRequest = server.takeRequest()
    assertThat(recordedRequest.failure!!).hasMessage("stream was reset: CANCEL")
  }

  @ParameterizedTest
  @ArgumentsSource(ProtocolParamProvider::class)
  fun http2WithProxy(
    protocol: Protocol,
    mockWebServer: MockWebServer,