import org.mockserver.socket.tls.KeyStoreFactory
import org.testcontainers.containers.MockServerContainer
import org.testcontainers.junit.jupiter.Container
import org.testcontainers.junit.jupiter.Testcontainers
import org.testcontainers.utility.DockerImageName

@Testcontainers
class BasicMockServerTest {
  @Container
  val mockServer: MockServerContainer = MockServerContainer(MOCKSERVER_IMAGE)

  val client =
    OkHttpClient.Builder()

      if (first) {
        firstIsRandalcat = codePoint in randalcatSet
      } else if (firstIsRandalcat) {
        // 'If a string contains any RandALCat character, the string MUST NOT contain any LCat
        // character.'
        if (codePoint in lcatSet) return null

        // 'If a string contains any RandALCat character, a RandALCat character MUST be the last
        // character of the string.'

    return getSubjectAltNames(certificate, ALT_DNS_NAME).any {
      verifyHostname(hostname, it)
    }
  }

  /**
   * This is like [toLowerCase] except that it does nothing if this contains any non-ASCII
   * characters. We want to avoid lower casing special chars like U+212A (Kelvin symbol) because
   * they can return ASCII characters that match real hostnames.
   */

     * lu/GJQZoU9lDrCPeUcQ28tzOWw==
     * -----END PRIVATE KEY-----
     * ```
     *
     * The string should contain exactly one certificate and one private key in [PKCS #8][rfc_5208]
     * format. It should not contain any other PEM-encoded blocks, but it may contain other text
     * which will be ignored.
     *
     * Encode a held certificate into this format by concatenating the results of

     * followed by those lines.
     *
     * HTTPS responses also contain SSL session information. This begins with a blank line, and then
     * a line containing the cipher suite. Next is the length of the peer certificate chain. These
     * certificates are base64-encoded and appear each on their own line. The next line contains the
     * length of the local certificate chain. These certificates are also base64-encoded and appear

## [Requests](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-request/)

Each HTTP request contains a URL, a method (like `GET` or `POST`), and a list of headers. Requests may also contain a body: a data stream of a specific content type.

## [Responses](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-response/)

      return
    }

    try {
      testHttpUrl(testData)
      if (KNOWN_FAILURES.contains(testData.toString())) {
        System.err.println("Expected failure but was success: $testData")
      }
    } catch (e: Throwable) {
      if (KNOWN_FAILURES.contains(testData.toString())) {
        System.err.println("Ignoring known failure: $testData")
        e.printStackTrace()
      } else {

 * limitations under the License.
 */
package okhttp.android.test.sni

import android.os.Build
import android.util.Log
import assertk.assertThat
import assertk.assertions.contains
import assertk.assertions.isEqualTo
import java.security.cert.X509Certificate
import javax.net.ssl.SNIHostName
import javax.net.ssl.SNIServerName
import javax.net.ssl.SSLSocket
import javax.net.ssl.SSLSocketFactory

    assertRoute(selection2.next(), address, proxyB, dns.lookup(PROXY_B_HOST, 0), PROXY_B_PORT)
    assertThat(selection2.hasNext()).isFalse()

    // Confirm the last selection contains the postponed route from ProxyA.
    val selection3 = routeSelector.next()
    dns.assertRequests()
    assertRoute(selection3.next(), address, proxyA, dns.lookup(PROXY_A_HOST, 0), PROXY_A_PORT)

    }

    assertThat(verifier.verify("foo.com", session)).isFalse()
    assertThat(verifier.verify("a.foo.com", session)).isFalse()
    // these checks test alternative subjects. The test data contains an
    // alternative subject starting with a japanese kanji character. This is
    // not supported by Android because the underlying implementation from