check(state == STATE_OPEN_RESPONSE_BODY) { "state: $state" }
    state = STATE_READING_RESPONSE_BODY
    carrier.noNewExchanges()
    return UnknownLengthSource()
  }

  /**
   * Sets the delegate of `timeout` to [Timeout.NONE] and resets its underlying timeout
   * to the default configuration. Use this to avoid unexpected sharing of timeouts between pooled
   * connections.
   */

    open fun message(message: String) = commonMessage(message)

    open fun handshake(handshake: Handshake?) =
      apply {
        this.handshake = handshake
      }

    /**
     * Sets the header named [name] to [value]. If this request already has any headers
     * with that name, they are all replaced.
     */
    open fun header(
      name: String,
      value: String,

   * SET types.
   *
   * The fields are specified as a list of member adapters. When decoding, a value for each
   * non-optional member but be included in sequence.
   *
   * TODO: for sets, sort by tag when encoding.
   * TODO: for set ofs, sort by encoded value when encoding.
   */
  fun <T> sequence(
    name: String,
    vararg members: DerAdapter<*>,
    decompose: (T) -> List<*>,

    server.enqueue(
      MockResponse(body = "This gets leaked."),
    )
    client =
      clientTestRule.newClientBuilder()
        .connectionPool(ConnectionPool(0, 10, TimeUnit.MILLISECONDS))
        .build()
    val request = Request(server.url("/"))
    client.newCall(request).execute() // Ignore the response so it gets leaked then GC'd.
    awaitGarbageCollection()

  private val client: OkHttpClient

  init {
    // This implementation just embeds the PEM files in Java strings; most applications will
    // instead read this from a resource file that gets bundled with the application.
    val certificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(letsEncryptCertificateAuthority)
        .addTrustedCertificate(entrustRootCertificateAuthority)

    serverListener.assertOpen()
    serverListener.assertFailure(EOFException::class.java)
    serverListener.assertExhausted()
    clientListener.assertFailure(e)
  }

  @Disabled("AsyncCall currently lets runtime exceptions propagate.")
  @Test
  @Throws(
    Exception::class,
  )
  fun throwingOnFailLogs() {
    webServer.enqueue(
      MockResponse.Builder()
        .code(200)
        .body("Body")

    val requestBodyDelay = 250L
    val responseHeadersStartDelay = 250L
    val responseBodyStartDelay = 250L
    val responseBodyEndDelay = 250L

    // Warm up the client so the timing part of the test gets a pooled connection.
    server.enqueue(MockResponse())
    val warmUpCall =
      client.newCall(
        Request.Builder()
          .url(server.url("/"))
          .build(),
      )

 *  * DER: Distinguished Encoding Rules. This further constrains ASN.1 for deterministic encoding.
 *  * BER: Basic Encoding Rules.
 *
 * This class was implemented according to the [X.690 spec][[x690]], and under the advice of
 * [Lets Encrypt's ASN.1 and DER][asn1_and_der] guide.
 *
 * [x690]: https://www.itu.int/rec/T-REC-X.690
 * [asn1_and_der]: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
 */
internal class DerReader(source: Source) {

 * Given a request and cached response, this figures out whether to use the network, the cache, or
 * both.
 *
 * Selecting a cache strategy may add conditions to the request (like the "If-Modified-Since" header
 * for conditional GETs) or warnings to the cached response (if the cached data is potentially
 * stale).
 */
class CacheStrategy internal constructor(
  /** The request to send on the network, or null if this call doesn't use the network. */

   * triggering different chains to be discovered by the TLS engine and our chain cleaner. In this
   * attack there's several different chains.
   *
   *
   * The victim's gets a non-CA certificate signed by a CA, and pins the CA root and/or
   * intermediate. This is business as usual.
   *
   * ```
   *   pinnedRoot (trusted by CertificatePinner)