val toEvictIdleAtNs: Long
    when {
      // We had at least one OLD connection. Close the oldest one.
      earliestOldConnection != null -> {
        toEvict = earliestOldConnection
        toEvictIdleAtNs = earliestOldIdleAtNs
      }

      // We have too many EVICTABLE connections. Close the oldest one.
      evictableConnectionCount > maxIdleConnections -> {
        toEvict = earliestEvictableConnection

import java.security.cert.Certificate;
import java.security.cert.X509Certificate;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;

/**
 * Simple test adaptable to show a failure in older versions of OkHttp
 * or Android SDKs.
 */
@RunWith(AndroidJUnit4.class)
public class IssueReproductionTest {
  @Test public void getFailsWithoutAdditionalCert() throws IOException {

 *  Upgrade: Build with Conscrypt 2.5.1.


## Version 4.8.1

_2020-08-06_

 *  Fix: Don't crash in `HeldCertificate.Builder` when creating certificates on older versions of
    Android, including Android 6. We were using a feature of `SimpleDateFormat` that wasn't
    available in those versions!


## Version 4.8.0

_2020-07-11_

    assertThat(hpackReader!!.headerCount).isEqualTo(0)
    assertThat(hpackReader!!.getAndResetHeaderList()).isEqualTo(
      headerEntries("custom-key", "custom-header"),
    )
  }

  /** Oldest entries are evicted to support newer ones.  */
  @Test
  fun writerEviction() {
    val headerBlock =
      headerEntries(
        "custom-foo",
        "custom-header",
        "custom-bar",

   *
   * It is an error to call this method after the body has been consumed.
   *
   * **Warning:** this method loads the requested bytes into memory. Most applications should set
   * a modest limit on `byteCount`, such as 1 MiB.
   */
  @Throws(IOException::class)
  fun peekBody(byteCount: Long): ResponseBody {
    val peeked = body.source().peek()
    val buffer = Buffer()
    peeked.request(byteCount)

 */
class CipherSuite private constructor(
  /**
   * Returns the Java name of this cipher suite. For some older cipher suites the Java name has the
   * prefix `SSL_`, causing the Java name to be different from the instance name which is always
   * prefixed `TLS_`. For example, `TLS_RSA_EXPORT_WITH_RC4_40_MD5.javaName()` is

    assertThat(CipherSuite.TLS_RSA_WITH_AES_128_CBC_SHA256.toString())
      .isEqualTo(CipherSuite.TLS_RSA_WITH_AES_128_CBC_SHA256.javaName)
  }

  /**
   * On the Oracle JVM some older cipher suites have the "SSL_" prefix and others have the "TLS_"
   * prefix. On the IBM JVM all cipher suites have the "SSL_" prefix.
   *

 *  Fix: Don't change Conscrypt configuration globally. We migrated from a process-wide setting to
    configuring only OkHttp's TLS sockets.
 *  Fix: Prefer TLSv1.2 where it is available. On certain older platforms it is necessary to opt-in
    to TLSv1.2.
 *  New: `Request.tag()` permits multiple tags. Use a `Class<?>` as a key to identify tags. Note

 * **Connectivity** to as many hosts as possible. That includes advanced hosts that run the latest versions of [boringssl](https://boringssl.googlesource.com/boringssl/) and less out of date hosts running older versions of [OpenSSL](https://www.openssl.org/).
 * **Security** of the connection. This includes verification of the remote webserver with certificates and the privacy of data exchanged with strong ciphers.

    assertThat("⑴".map()).isEqualTo("(1)")
  }

  @Test fun outOfBounds() {
    assertFailsWith<IllegalArgumentException> {
      table.map(-1, Buffer())
    }
    table.map(0, Buffer()) // Lowest legal code point.
    table.map(0x10ffff, Buffer()) // Highest legal code point.
    assertFailsWith<IllegalArgumentException> {
      table.map(0x110000, Buffer())
    }
  }