when certificates matched but the DNS addresses did not. This would only occur when following a
    redirect from one hostname to another, and where both hosts had common certificates.

 *  Fix: Don't fail on a redirect when a client has configured a 'trust everything' trust manager.
    Typically this would cause certain redirects to fail in debug and development configurations.

  // These properties are guarded by [lock].

  /**
   * If true, no new exchanges can be created on this connection. It is necessary to set this to
   * true when removing a connection from the pool; otherwise a racing caller might get it from the
   * pool when it shouldn't. Symmetrically, this must always be checked before returning a
   * connection from the pool.
   *
   * Once true this is always true. Guarded by this.
   */

    connection.calls.add(CallReference(this, callStackTrace))
  }

  /**
   * Releases resources held with the request or response of [exchange]. This should be called when
   * the request completes normally or when it fails due to an exception, in which case [e] should
   * be non-null.
   *
   * If the exchange was canceled or timed out, this will wrap [e] in an exception that provides

internal fun String.containsInvalidLabelLengths(): Boolean {
  if (length !in 1..253) return true

  var labelStart = 0
  while (true) {
    val dot = indexOf('.', startIndex = labelStart)
    val labelLength =
      when (dot) {
        -1 -> length - labelStart
        else -> dot - labelStart
      }
    if (labelLength !in 1..63) return true
    if (dot == -1) break
    if (dot == length - 1) break // Trailing '.' is allowed.

   *  * 8 bytes: *n*: upstream data size
   *  * 8 bytes: *m*: metadata size
   *  * *n* bytes: upstream data
   *  * *m* bytes: metadata
   *
   * This is closed and assigned to null when the last source is closed and no further sources
   * are permitted.
   */
  var file: RandomAccessFile?,
  /**
   * Null once the file has a complete copy of the upstream bytes. Only the [upstreamReader] thread

      logger.log(requestStartMessage)

      if (logHeaders) {
        val headers = request.headers

        if (requestBody != null) {
          // Request body headers are only present when installed as a network interceptor. When not
          // already present, force them to be included (if available) so their values are known.
          requestBody.contentType()?.let {
            if (headers["Content-Type"] == null) {

   * should be used specifically for [java.io.Closeable] objects and in conjunction with
   * [logCloseableLeak].
   */
  open fun getStackTraceForCloseable(closer: String): Any? {
    return when {
      logger.isLoggable(Level.FINE) -> Throwable(closer) // These are expensive to allocate.
      else -> null
    }
  }

  open fun logCloseableLeak(
    message: String,
    stackTrace: Any?,

  fun hostContainsOnlyStrippedCharacters() {
    val url = "http://>/".toHttpUrl()
    assertThat(url.host).isEqualTo(">")
    assertThat(url.toUri().host).isNull()
  }

  /**
   * Strip unexpected characters when converting to URI (which is more strict).
   * https://github.com/square/okhttp/issues/5667
   */
  @Test
  fun hostToUriStripsCharacters() {
    val httpUrl = "http://example\".com/".toHttpUrl()

    // Make sure this connection is healthy & eligible for new exchanges. If it's no longer needed
    // then we're on the hook to close it.
    val healthy = candidate.isHealthy(connectionUser.doExtensiveHealthChecks())
    var noNewExchangesEvent = false
    val toClose: Socket? =
      candidate.withLock {
        when {
          !healthy -> {
            noNewExchangesEvent = !candidate.noNewExchanges

    userResponse: Response,
    exchange: Exchange?,
  ): Request? {
    val route = exchange?.connection?.route()
    val responseCode = userResponse.code

    val method = userResponse.request.method
    when (responseCode) {
      HTTP_PROXY_AUTH -> {
        val selectedProxy = route!!.proxy
        if (selectedProxy.type() != Proxy.Type.HTTP) {