redirect from one hostname to another, and where both hosts had common certificates.

 *  Fix: Don't fail on a redirect when a client has configured a 'trust everything' trust manager.
    Typically this would cause certain redirects to fail in debug and development configurations.


## Version 4.4.0

_2020-02-17_

     * Connections will still be closed if they idle beyond the keep-alive but will be replaced.
     */
    @JvmField val minimumConcurrentCalls: Int = 0,
    /** How long to wait to retry pre-emptive connection attempts that fail. */
    @JvmField val backoffDelayMillis: Long = 60 * 1000,
    /** How much jitter to introduce in connection retry backoff delays */
    @JvmField val backoffJitterMillis: Int = 100,
  )

   * in practice. To simplify the implementation, we've avoided implementing the flexible rules in
   * favor of supporting what's actually used in practice. That means if these assertions ever fail,
   * the implementation will need to be revisited to support a more flexible rule.
   */
  private fun assertWildcardRule(rule: String) {
    check(rule.startsWith(WILDCARD_CHAR)) {

    // order, not in increasing index order.
    val codePoints = mutableListOf<Int>()

    // consume all code points before the last delimiter (if there is one)
    //  and copy them to output, fail on any non-basic code point
    val lastDelimiter = string.lastIndexOf('-', limit)
    if (lastDelimiter >= pos) {
      while (pos < lastDelimiter) {
        when (val codePoint = string[pos++]) {

  internal fun connectFailed(
    client: OkHttpClient,
    failedRoute: Route,
    failure: IOException,
  ) {
    // Tell the proxy selector when we fail to connect on a fresh connection.
    if (failedRoute.proxy.type() != Proxy.Type.DIRECT) {
      val address = failedRoute.address
      address.proxySelector.connectFailed(
        address.url.toUri(),

import okhttp3.testing.PlatformRule
import okio.Buffer
import okio.ByteString.Companion.decodeHex
import okio.Path.Companion.toPath
import okio.fakefilesystem.FakeFileSystem
import org.junit.jupiter.api.Assertions.fail
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Tag
import org.junit.jupiter.api.Test
import org.junit.jupiter.api.extension.RegisterExtension

@Tag("Slowish")
class DnsOverHttpsTest {

    val response = executeSynchronously("/")
    response.assertFailure(
      // JDK 11 response to the FAIL_HANDSHAKE:
      SSLException::class.java,
      // RI response to the FAIL_HANDSHAKE:
      SSLProtocolException::class.java,
      // Android's response to the FAIL_HANDSHAKE:
      SSLHandshakeException::class.java,
    )

 *    we must send a `CONNECT` request, and handle authorization challenges from the proxy.
 *  * Optional [TLS handshake][connectTls].
 *
 * Each step may fail. If a retry is possible, a new instance is created with the next plan, which
 * will be configured differently.
 */
class ConnectPlan(
  private val taskRunner: TaskRunner,
  private val connectionPool: RealConnectionPool,

import okio.Buffer
import okio.ForwardingSource
import okio.buffer
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Test
import org.junit.jupiter.api.extension.RegisterExtension
import org.junit.jupiter.api.fail

class SuspendCallTest {
  @RegisterExtension
  val clientTestRule = OkHttpClientTestRule()

  private var client = clientTestRule.newClientBuilder().build()

  private lateinit var server: MockWebServer

      }
    }
  }

  private fun readAndWriteFrames() {
    check(socket == null)
    val socket = serverSocket!!.accept()!!
    this.socket = socket

    // Bail out now if this instance was closed while waiting for the socket to accept.
    synchronized(this) {
      if (executor.isShutdown) {
        socket.close()
        return
      }
    }