/**
 * Android implementation of CertificateChainCleaner using direct Android API calls.
 * Not used if X509TrustManager doesn't implement [X509TrustManager.checkServerTrusted] with
 * an additional host param.
 */
internal class AndroidCertificateChainCleaner(
  private val trustManager: X509TrustManager,
  private val x509TrustManagerExtensions: X509TrustManagerExtensions,
) : CertificateChainCleaner() {

   * was empty or unchunked.
   */
  val chunkSizes: List<Int>,
  /** The total size of the body of this POST request (before truncation).*/
  val bodySize: Long,
  /** The body of this POST request. This may be truncated. */
  val body: Buffer,
  /**
   * The index of this request on its HTTP connection. Since a single HTTP connection may serve

        val host = url.host
        return host.substring(1, host.length - 5).lowercase()
      }

      override fun canonicalize(s: String): String = s.lowercase()
    },

    PATH {
      override fun urlString(value: String): String = "http://example.com/a${value}z/"

      override fun encodedValue(url: HttpUrl): String {
        val path = url.encodedPath
        return path.substring(2, path.length - 2)
      }

          } catch (e: Exception) {
            false
          }
        }
        .build()

    val request =
      Request.Builder()
        .url("https://sni.cloudflaressl.com/cdn-cgi/trace")
        .header("Host", "cloudflare-dns.com")
        .build()
    client.newCall(request).execute().use { response ->
      assertThat(response.code).isEqualTo(200)
      assertThat(response.protocol).isEqualTo(Protocol.HTTP_2)

 * [HTTP Public Key Pinning (HPKP)][rfc_7469] or SHA-1 base64 hashes as in Chromium's
 * [static certificates][static_certificates].
 *
 * ## Setting up Certificate Pinning
 *
 * The easiest way to pin a host is turn on pinning with a broken configuration and read the
 * expected configuration when the connection fails. Be sure to do this on a trusted network, and

  val client =
    OkHttpClient.Builder()
      .trustMockServer()
      .build()

  @Test
  fun testRequest() {
    MockServerClient(mockServer.host, mockServer.serverPort).use { mockServerClient ->
      mockServerClient
        .`when`(
          request().withPath("/person")
            .withQueryStringParameter("name", "peter"),
        )

        add(buildCryptoSx(client)) // 521 - server down
      }
      add(buildChantra(client))
    }
  }

  private fun getByIp(host: String): InetAddress {
    return try {
      InetAddress.getByName(host)
    } catch (e: UnknownHostException) {
      // unlikely
      throw RuntimeException(e)
    }
  }

        throw UnknownServiceException("CLEARTEXT communication not enabled for client")
      }

      val host = route.address.url.host
      if (!Platform.get().isCleartextTrafficPermitted(host)) {
        throw UnknownServiceException(
          "CLEARTEXT communication to $host not permitted by network security policy",
        )
      }
    } else {

      assertThat(connection.inputStream.source().buffer().readUtf8()).contains("Peter the person")
    }
  }

  private fun testRequest(function: (MockServerClient) -> Unit) {
    MockServerClient(mockServer.host, mockServer.serverPort).use { mockServerClient ->
      val request =
        request().withPath("/person")
          .withQueryStringParameter("name", "peter")

      mockServerClient
        .`when`(

  fun encodeQuery(
    host: String,
    type: Int,
  ): ByteString =
    Buffer().apply {
      writeShort(0) // query id
      writeShort(256) // flags with recursion
      writeShort(1) // question count
      writeShort(0) // answerCount
      writeShort(0) // authorityResourceCount
      writeShort(0) // additional

      val nameBuf = Buffer()
      val labels = host.split('.').dropLastWhile { it.isEmpty() }