So we have a dedicated thread for every socket that just reads frames and dispatches them.

The reader thread must never run application-layer code. Otherwise one slow stream can hold up the entire connection.

import okhttp3.internal.connection.RoutePlanner.Plan
import okhttp3.internal.okHttpName

/**
 * Speculatively connects to each IP address of a target address, returning as soon as one of them
 * connects successfully. This kicks off new attempts every 250 ms until a connect succeeds.
 */
internal class FastFallbackExchangeFinder(
  override val routePlanner: RoutePlanner,

 * token68:
 *
 * ```
 * WWW-Authenticate: Digest foo=bar
 * WWW-Authenticate: Digest foo=
 * ```
 *
 * Similarly, the first line has one challenge and the second line has two challenges:
 *
 * ```
 * WWW-Authenticate: Digest ,foo=bar
 * WWW-Authenticate: Digest ,foo
 * ```
 */
fun Headers.parseChallenges(headerName: String): List<Challenge> {

 *    prefix at all (`publicobject.com`). For most applications this is the best way to configure
 *    certificate pinning.
 *
 *  * **Exactly one subdomain**: Use a single asterisk like `*.publicobject.com` to match exactly
 *    one prefix (`www.publicobject.com`, `api.publicobject.com`). Be careful with this approach as
 *    no pinning will be enforced if additional prefixes are present, or if no prefixes are present.

/*
 *  Licensed to the Apache Software Foundation (ASF) under one or more
 *  contributor license agreements.  See the NOTICE file distributed with
 *  this work for additional information regarding copyright ownership.
 *  The ASF licenses this file to You under the Apache License, Version 2.0
 *  (the "License"); you may not use this file except in compliance with
 *  the License.  You may obtain a copy of the License at
 *

/**
 * Models the contents of a `Sec-WebSocket-Extensions` response header. OkHttp honors one extension
 * `permessage-deflate` and four parameters, `client_max_window_bits`, `client_no_context_takeover`,
 * `server_max_window_bits`, and `server_no_context_takeover`.
 *
 * Typically this will look like one of the following:
 *
 * ```
 * Sec-WebSocket-Extensions: permessage-deflate

/*
 *  Licensed to the Apache Software Foundation (ASF) under one or more
 *  contributor license agreements.  See the NOTICE file distributed with
 *  this work for additional information regarding copyright ownership.
 *  The ASF licenses this file to You under the Apache License, Version 2.0
 *  (the "License"); you may not use this file except in compliance with
 *  the License.  You may obtain a copy of the License at
 *

 *  * Preemptive proxy authentication failed.
 *
 * Planning failures are not necessarily fatal. For example, even if we can't DNS lookup the first
 * proxy in a list, looking up a subsequent one may succeed.
 */
internal class FailedPlan(e: Throwable) : RoutePlanner.Plan {
  val result = RoutePlanner.ConnectResult(plan = this, throwable = e)

  override val isReady = false

  override fun connectTcp() = result

      require(statusParts.size >= 2) { "Unexpected status: $status" }
      return statusParts[2]
    }

  val headers: Headers
  val trailers: Headers

  // At most one of (body,webSocketListener,streamHandler) is non-null.
  val body: MockResponseBody?
  val webSocketListener: WebSocketListener?
  val streamHandler: StreamHandler?

  val inTunnel: Boolean

        .signedBy(intermediate)
        .build()
    val handshakeCertificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(root.certificate) // BouncyCastle requires at least one
        .heldCertificate(certificate, intermediate.certificate)
        .build()
    assertPrivateKeysEquals(
      certificate.keyPair.private,
      handshakeCertificates.keyManager.getPrivateKey("private"),
    )