* a mechanism to trust some hosts and not others.
     *
     * @param hostname the exact hostname from the URL for insecure connections.
     */
    fun addInsecureHost(hostname: String) =
      apply {
        insecureHosts += hostname
      }

    fun build(): HandshakeCertificates {
      val immutableInsecureHosts = insecureHosts.toImmutableList()

class RecordingHostnameVerifier : HostnameVerifier {
  @JvmField
  val calls: MutableList<String> = mutableListOf()

  @Synchronized override fun verify(
    hostname: String,
    session: SSLSession,
  ): Boolean {
    calls.add("verify $hostname")
    return true
  }

      ),
    )
    server!!.enqueue(MockResponse())
    val dns = FakeDns()
    dns["fakeurl"] = client.dns.lookup(server!!.hostName)
    dns["www.fakeurl"] = client.dns.lookup(server!!.hostName)
    client =
      client.newBuilder()
        .dns(dns)
        .build()
    val call =
      client.newCall(
        Request.Builder()

 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
@file:JvmName("GenerateIdnaMappingTableCode")

package okhttp3.internal.idn

import com.squareup.kotlinpoet.ClassName
import com.squareup.kotlinpoet.FileSpec
import com.squareup.kotlinpoet.KModifier
import com.squareup.kotlinpoet.PropertySpec
import java.io.File
import okio.FileSystem
import okio.Path.Companion.toPath

          val domainNameLength: Int = fromSource.readByte() and 0xff
          val domainName = fromSource.readUtf8(domainNameLength.toLong())
          // Resolve HOSTNAME_THAT_ONLY_THE_PROXY_KNOWS to localhost.
          when {
            domainName.equals(HOSTNAME_THAT_ONLY_THE_PROXY_KNOWS, ignoreCase = true) -> {
              InetAddress.getByName("localhost")
            }
            else -> InetAddress.getByName(domainName)

    assertThat(dnsStart.call).isSameAs(call)
    assertThat(dnsStart.domainName).isEqualTo(server.hostName)
    val dnsEnd: DnsEnd = listener.removeUpToEvent<DnsEnd>()
    assertThat(dnsEnd.call).isSameAs(call)
    assertThat(dnsEnd.domainName).isEqualTo(server.hostName)
    assertThat(dnsEnd.inetAddressList.size).isEqualTo(1)
  }

  @Test
  fun noDnsLookupOnPooledConnection() {

      )
    }

  val clientCertificates =
    HandshakeCertificates.Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost(server.hostName)
      .build()

  val client =
    OkHttpClient.Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)
      .build()

  fun run() {
    try {

      else -> null // No TLS extensions if the socket class is custom.
    }

  override fun configureTlsExtensions(
    sslSocket: SSLSocket,
    hostname: String?,
    protocols: List<Protocol>,
  ) {
    // No TLS extensions if the socket class is custom.
    if (matchesSocket(sslSocket)) {
      // Enable session tickets.

 * pinning.
 */
abstract class CertificateChainCleaner {
  @Throws(SSLPeerUnverifiedException::class)
  abstract fun clean(
    chain: List<Certificate>,
    hostname: String,
  ): List<Certificate>

  companion object {
    fun get(trustManager: X509TrustManager): CertificateChainCleaner {
      return Platform.get().buildCertificateChainCleaner(trustManager)
    }

      null
    }
  }

  @SuppressLint("NewApi")
  override fun configureTlsExtensions(
    sslSocket: SSLSocket,
    hostname: String?,
    protocols: List<Protocol>,
  ) {
    try {
      SSLSockets.setUseSessionTickets(sslSocket, true)

      val sslParameters = sslSocket.sslParameters

      // Enable ALPN.