* limitations under the License.
 */
package okhttp3.tls.internal.der

import okio.ByteString

/**
 * Like a [ByteString], but whose bits are not necessarily a strict multiple of 8.
 */
internal data class BitString(
  val byteString: ByteString,
  /** 0-7 unused bits in the last byte. */
  val unusedBitsCount: Int,
) {
  // Avoid Long.hashCode(long) which isn't available on Android 5.
  override fun hashCode(): Int {

  val issuer: List<List<AttributeTypeAndValue>>,
  val validity: Validity,
  val subject: List<List<AttributeTypeAndValue>>,
  val subjectPublicKeyInfo: SubjectPublicKeyInfo,
  val issuerUniqueID: BitString?,
  val subjectUniqueID: BitString?,
  val extensions: List<Extension>,
) {
  /**
   * Returns the standard name of this certificate's signature algorithm as specified by

    for (shift in (lengthByteCount - 1) * 8 downTo 0 step 8) {
      sink.writeByte((v shr shift).toInt())
    }
  }

  fun writeBitString(bitString: BitString) {
    val sink = sink()
    sink.writeByte(bitString.unusedBitsCount)
    sink.write(bitString.byteString)
  }

  fun writeOctetString(byteString: ByteString) {
    sink().write(byteString)
  }

  fun writeUtf8(value: String) {

                  AlgorithmIdentifier(
                    algorithm = RSA_ENCRYPTION,
                    parameters = null,
                  ),
                subjectPublicKey =
                  BitString(
                    byteString = publicKeyBytes,
                    unusedBitsCount = 0,
                  ),
              ),
            issuerUniqueID = null,
            subjectUniqueID = null,

                    throw new PACDecodingException("Invalid kerberos request");
                break;
            case 2:
                DERBitString bitString = ASN1Util.as(DERBitString.class, tagged);
                this.apOptions = bitString.getBytes()[ 0 ];
                break;
            case 3:
                ASN1TaggedObject derTicket = ASN1Util.as(ASN1TaggedObject.class, tagged);

      .isEqualTo(bytes)
  }

  @Test fun `bit string`() {
    val bytes = "0304066e5dc0".decodeHex()
    val bitString = BitString("6e5dc0".decodeHex(), 6)

    assertThat(Adapters.BIT_STRING.fromDer(bytes)).isEqualTo(bitString)
    assertThat(Adapters.BIT_STRING.toDer(bitString)).isEqualTo(bytes)
  }

  @Test fun `cannot decode empty bit string`() {
    val bytes = "0300".decodeHex()

    while (byteCount < limit) {
      result = result shl 8
      result += source.readByte().toInt() and 0xff
    }
    return result
  }

  fun readBitString(): BitString {
    if (bytesLeft == -1L || constructed) {
      throw ProtocolException("constructed bit strings not supported for DER")
    }
    if (bytesLeft < 1) {
      throw ProtocolException("malformed bit string")
    }

          subject = (it[5] as Pair<*, *>).second as List<List<AttributeTypeAndValue>>,
          subjectPublicKeyInfo = it[6] as SubjectPublicKeyInfo,
          issuerUniqueID = it[7] as BitString?,
          subjectUniqueID = it[8] as BitString?,
          extensions = it[9] as List<Extension>,
        )
      },
    )

  /**
   * ```
   * Certificate ::= SEQUENCE  {
   *   tbsCertificate       TBSCertificate,

      tagClass = DerHeader.TAG_CLASS_UNIVERSAL,
      tag = 3L,
      codec =
        object : BasicDerAdapter.Codec<BitString> {
          override fun decode(reader: DerReader): BitString = reader.readBitString()

          override fun encode(
            writer: DerWriter,
            value: BitString,
          ) = writer.writeBitString(value)
        },
    )

  val OCTET_STRING =
    BasicDerAdapter(

import okhttp3.internal.canParseAsIpAddress
import okhttp3.tls.internal.der.AlgorithmIdentifier
import okhttp3.tls.internal.der.AttributeTypeAndValue
import okhttp3.tls.internal.der.BasicConstraints
import okhttp3.tls.internal.der.BitString
import okhttp3.tls.internal.der.Certificate
import okhttp3.tls.internal.der.CertificateAdapters
import okhttp3.tls.internal.der.CertificateAdapters.generalNameDnsName