val clientTestRule = OkHttpClientTestRule()

  private lateinit var server: MockWebServer

  @BeforeEach
  fun setup(server: MockWebServer) {
    this.server = server

    // BCX509ExtendedTrustManager not supported in TlsUtil.newTrustManager
    platform.assumeNotBouncyCastle()
  }

  @Test fun `untrusted host in insecureHosts connects successfully`() {
    val serverCertificates = platform.localhostHandshakeCertificates()

 *
 * Specifically while junit instances passes into test constructor
 * are typically shares amongst all tests, a fresh instance will be
 * received here. Use with @BeforeAll and @AfterAll, is not supported.
 *
 * There are 3 ids for instances
 * - The test instance default (passed into constructor)
 * - The test lifecycle default (passed into test method, plus @BeforeEach, @AfterEach)

Security
========

## Supported Versions

| Version | Supported           | Notes                                        |
| ------- | ------------------- | -------------------------------------------- |
| 5.x     | ✅                  | APIs subject to change in alpha releases.    |
| 4.x     | ✅                  | Android 5.0+ (API level 21+) and on Java 8+. |
| 3.x     | ❌ Ended 2021-12-31 | Android 2.3+ (API level 9+) and Java 7+.     |

 *  New: APIs to iterate and selectively clear the response cache.
 *  New: Support for SOCKS proxies.
 *  New: Support for `TLS_FALLBACK_SCSV`.
 *  New: Update HTTP/2 support to `h2-16` and `hpack-10`.
 *  New: APIs to prevent retrying non-idempotent requests.
 *  Fix: Drop NPN support. Going forward we support ALPN only.
 *  Fix: The hostname verifier is now strict. This is consistent with the hostname

    if (bytesLeft == -1L || constructed) {
      throw ProtocolException("constructed octet strings not supported for DER")
    }
    return source.readByteString(bytesLeft)
  }

  fun readUtf8String(): String {
    if (bytesLeft == -1L || constructed) {
      throw ProtocolException("constructed strings not supported for DER")
    }
    return source.readUtf8(bytesLeft)
  }

  fun readObjectIdentifier(): String {

  if (headersContentLength() != -1L ||
    "chunked".equals(header("Transfer-Encoding"), ignoreCase = true)
  ) {
    return true
  }

  return false
}

@Deprecated(
  message = "No longer supported",
  level = DeprecationLevel.ERROR,
  replaceWith = ReplaceWith(expression = "response.promisesBody()"),
)
fun hasBody(response: Response): Boolean {
  return response.promisesBody()

 */
class BouncyCastleSocketAdapter : SocketAdapter {
  override fun matchesSocket(sslSocket: SSLSocket): Boolean = sslSocket is BCSSLSocket

  override fun isSupported(): Boolean = BouncyCastlePlatform.isSupported

  override fun getSelectedProtocol(sslSocket: SSLSocket): String? {
    val s = sslSocket as BCSSLSocket

    return when (val protocol = s.applicationProtocol) {
      null, "" -> null

import okio.Buffer
import okio.BufferedSource
import okio.ByteString

/**
 * A one-shot stream from the origin server to the client application with the raw bytes of the
 * response body. Each response body is supported by an active connection to the webserver. This
 * imposes both obligations and limits on the client application.
 *
 * ### The response body must be closed.
 *

 * example this converts `☃.net` to `xn--n3h.net`, and `WwW.GoOgLe.cOm` to `www.google.com`.
 * `null` will be returned if the host cannot be ToASCII encoded or if the result contains
 * unsupported ASCII characters.
 */
internal fun String.toCanonicalHost(): String? {
  val host: String = this

  // If the input contains a :, it’s an IPv6 address.
  if (":" in host) {

import okio.Timeout

/**
 * Bridge between OkHttp's application and network layers. This class exposes high-level application
 * layer primitives: connections, requests, responses, and streams.
 *
 * This class supports [asynchronous canceling][cancel]. This is intended to have the smallest
 * blast radius possible. If an HTTP/2 stream is active, canceling will cancel that stream but not