assertThat(response.isSuccessful).isTrue()

    val recordedRequest = server.takeRequest()
    assertThat(recordedRequest.handshakeServerNames).containsExactly(url.host)
  }

  /**
   * Use different hostnames for the TLS handshake (including SNI) and the HTTP request (in the
   * Host header).
   */
  @Test
  fun domainFronting() {
    val heldCertificate =
      HeldCertificate.Builder()

package okhttp3.internal

import okhttp3.internal.idn.IDNA_MAPPING_TABLE
import okhttp3.internal.idn.Punycode
import okio.Buffer

/**
 * Quick and dirty pattern to differentiate IP addresses from hostnames. This is an approximation
 * of Android's private InetAddress#isNumeric API.
 *
 * This matches IPv6 addresses as a hex string containing at least one colon, and possibly

 *  Fix: Don't crash with an `InaccessibleObjectException` when running on JDK17+ with strong
    encapsulation enabled.
 *  Fix: Strictly verify hostnames used with OkHttp's `HostnameVerifier`. Programs that make direct
    manual calls to `HostnameVerifier` could be defeated if the hostnames they pass in are not
    strictly ASCII. This issue is tracked as [CVE-2021-0341].


## Version 4.9.1

_2021-01-30_

    }
  }

  /** Returns true if [certificate] matches [hostname]. */
  private fun verifyHostname(
    hostname: String,
    certificate: X509Certificate,
  ): Boolean {
    val hostname = hostname.asciiToLowercase()
    return getSubjectAltNames(certificate, ALT_DNS_NAME).any {
      verifyHostname(hostname, it)
    }
  }

  /**

  private final Set<HttpUrl> fetchedUrls = Collections.synchronizedSet(new LinkedHashSet<>());
  private final LinkedBlockingQueue<HttpUrl> queue = new LinkedBlockingQueue<>();
  private final ConcurrentHashMap<String, AtomicInteger> hostnames = new ConcurrentHashMap<>();

  public Crawler(OkHttpClient client) {
    this.client = client;
  }

  private void parallelDrainQueue(int threadCount) {

  fun check(
    hostname: String,
    vararg peerCertificates: Certificate,
  ) {
    check(hostname, peerCertificates.toList())
  }

  /**
   * Returns list of matching certificates' pins for the hostname. Returns an empty list if the
   * hostname does not have pinned certificates.
   */
  fun findMatchingPins(hostname: String): List<Pin> = pins.filterList { matchesHostname(hostname) }

 *    "www.squareup.com".
 *
 *  * **A set of hostnames.** These are in the certificate's subject alternative name (SAN)
 *    extension. A subject alternative name is either a literal hostname (`squareup.com`), a literal
 *    IP address (`74.122.190.80`), or a hostname pattern (`*.api.squareup.com`).
 *

    assertThat(
      "0:0:0:0:0:FFFF:129.144.52.38".toCanonicalHost(),
    ).isEqualTo("129.144.52.38")

    assertThat("::FFFF:129.144.52.38".toCanonicalHost()).isEqualTo("129.144.52.38")

    // Hostnames
    assertThat("WwW.GoOgLe.cOm".toCanonicalHost()).isEqualTo("www.google.com")
    assertThat("localhost".toCanonicalHost()).isEqualTo("localhost")
    assertThat("☃.net".toCanonicalHost()).isEqualTo("xn--n3h.net")

  @get:JvmName("dns") val dns: Dns,
  /** Returns the socket factory for new connections. */
  @get:JvmName("socketFactory") val socketFactory: SocketFactory,
  /** Returns the SSL socket factory, or null if this is not an HTTPS address. */
  @get:JvmName("sslSocketFactory") val sslSocketFactory: SSLSocketFactory?,
  /** Returns the hostname verifier, or null if this is not an HTTPS address. */

     * a mechanism to trust some hosts and not others.
     *
     * @param hostname the exact hostname from the URL for insecure connections.
     */
    fun addInsecureHost(hostname: String) =
      apply {
        insecureHosts += hostname
      }

    fun build(): HandshakeCertificates {
      val immutableInsecureHosts = insecureHosts.toImmutableList()