assertThat(request.requestUrl.toString()).isEqualTo("http://127.0.0.1/")
  }

  @Test fun testHostname() {
    val headers = headersOf("Host", "host-from-header.com")
    val socket =
      FakeSocket(
        localAddress =
          InetAddress.getByAddress(
            "host-from-address.com",
            byteArrayOf(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1),
          ),
        localPort = 80,
      )

    return SocketChannel.open().socket()
  }

  override fun createSocket(
    host: String,
    port: Int,
  ): Socket = TODO("Not yet implemented")

  override fun createSocket(
    host: String,
    port: Int,
    localHost: InetAddress,
    localPort: Int,
  ): Socket = TODO("Not yet implemented")

  override fun createSocket(
    host: InetAddress,
    port: Int,
  ): Socket = TODO("Not yet implemented")

        .addSubjectAlternativeName("intermediate_ca.com")
        .build()
    serverCert =
      HeldCertificate.Builder()
        .signedBy(serverIntermediateCa)
        .serialNumber(3L)
        .commonName("Local Host")
        .addSubjectAlternativeName(server.hostName)
        .build()
    clientRootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")

    chain: Array<out X509Certificate>,
    authType: String,
    host: String,
  ): List<Certificate> {
    if (host in insecureHosts) return listOf()
    try {
      val method =
        checkServerTrustedMethod
          ?: throw CertificateException("Failed to call checkServerTrusted")
      return method.invoke(delegate, chain, authType, host) as List<Certificate>
    } catch (e: InvocationTargetException) {

  fun setup(server: MockWebServer) {
    this.server = server

    // BCX509ExtendedTrustManager not supported in TlsUtil.newTrustManager
    platform.assumeNotBouncyCastle()
  }

  @Test fun `untrusted host in insecureHosts connects successfully`() {
    val serverCertificates = platform.localhostHandshakeCertificates()
    server.useHttps(serverCertificates.sslSocketFactory())
    server.enqueue(MockResponse())

    // 3.5 MBytes so this test can pass on devices with little memory.
    server.bodyLimit = 7 * 512 * 1024
    val connection = server.url("/").toUrl().openConnection() as HttpURLConnection
    connection.setRequestMethod("POST")
    connection.setDoOutput(true)
    connection.setFixedLengthStreamingMode(1024 * 1024 * 1024) // 1 GB
    connection.connect()
    val out = connection.outputStream
    val data = ByteArray(1024 * 1024)

    val encoded = encodeQuery("google.com", TYPE_A)
    assertThat(encoded).isEqualTo("AAABAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ")
  }

  private fun encodeQuery(
    host: String,
    type: Int,
  ): String {
    return DnsRecordCodec.encodeQuery(host, type).base64Url().replace("=", "")
  }

  @Test
  fun testGoogleDotComEncodingWithIPv6() {
    val encoded = encodeQuery("google.com", TYPE_AAAA)

  // PEM files for root certificates of Comodo and Entrust. These two CAs are sufficient to view
  // https://publicobject.com (Comodo) and https://squareup.com (Entrust). But they aren't
  // sufficient to connect to most HTTPS sites including https://godaddy.com and https://visa.com.
  // Typically developers will need to get a PEM file from their organization's TLS administrator.

/**
 * Android implementation of CertificateChainCleaner using direct Android API calls.
 * Not used if X509TrustManager doesn't implement [X509TrustManager.checkServerTrusted] with
 * an additional host param.
 */
internal class AndroidCertificateChainCleaner(
  private val trustManager: X509TrustManager,
  private val x509TrustManagerExtensions: X509TrustManagerExtensions,
) : CertificateChainCleaner() {

import okhttp3.curl.Main
import okhttp3.internal.http.StatusLine
import okio.sink

internal fun Main.commonCreateRequest(): Request {
  val request = Request.Builder()

  val requestMethod = method ?: if (data != null) "POST" else "GET"

  val url = url ?: throw IOException("No url provided")

  request.url(url)

  data?.let {
    request.method(requestMethod, it.toRequestBody(mediaType()))
  }