listener.sessionGranted(session);
    } catch (IOException e) {
      return new MockResponse()
          .setResponseCode(400)
          .setBody("code exchange failed: " + e.getMessage());
    }

    synchronized (this) {
      listeners.remove(state);
    }

    // Success!
    return new MockResponse()
        .setResponseCode(302)

        this.username = userName;
    }

    /**
     * Get the passphrase of the private key file. The passphrase is used only when host/protocol supports
     * authentication via exchange of private/public keys and private key was used for authentication.
     *
     * @return passphrase of the private key file
     */
    public String getPassphrase() {
        return passphrase;
    }

    /**

          {
           "name": "istio.metadata_exchange",
           "typed_config": {
            "@type": "type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange",
            "protocol": "istio-peer-exchange"
           }
          },
          {
           "name": "istio.stats",
           "typed_config": {
            "@type": "type.googleapis.com/stats.PluginConfig",

var caPublicKey ssh.PublicKey

// https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.22.0:ssh/common.go;l=46
// preferredKexAlgos specifies the default preference for key-exchange
// algorithms in preference order. The diffie-hellman-group16-sha512 algorithm
// is disabled by default because it is a bit slower than the others.
var preferredKexAlgos = []string{

  /**
   * Cancel this stream. Resources held by this stream will be cleaned up, though not synchronously.
   * That may happen later by the connection pool thread.
   */
  fun cancel()

  /**
   * Carries an exchange. This is usually a connection, but it could also be a connect plan for
   * CONNECT tunnels. Note that CONNECT tunnels are significantly less capable than connections.
   */
  interface Carrier {
    val route: Route

  val handshake: Handshake?
  val requestUrl: HttpUrl?

  /**
   * Returns the name of the server the client requested via the SNI (Server Name Indication)
   * attribute in the TLS handshake. Unlike the rest of the HTTP exchange, this name is sent in
   * cleartext and may be monitored or blocked by a proxy or other middlebox.
   */
  val handshakeServerNames: List<String>

  init {
    if (socket is SSLSocket) {
      try {

   * response code like 404 or 500.
   *
   * @throws IOException if the request could not be executed due to cancellation, a connectivity
   *     problem or timeout. Because networks can fail during an exchange, it is possible that the
   *     remote server accepted the request before the failure.
   * @throws IllegalStateException when the call has already been executed.
   */
  @Throws(IOException::class)

  return charset to finalContentType
}

internal fun MediaType?.charsetOrUtf8(): Charset {
  return this?.charset() ?: Charsets.UTF_8
}

internal val Response.connection: RealConnection
  get() = this.exchange!!.connection

internal fun OkHttpClient.Builder.taskRunnerInternal(taskRunner: TaskRunner) = this.taskRunner(taskRunner)

internal fun buildConnectionPool(
  connectionListener: ConnectionListener,

   * provides support.
   */
  QUIC("quic"),

  /**
   * HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol used to
   * exchange information. HTTP/3 runs over QUIC, which is published as RFC 9000.
   *
   * HTTP/3 is not natively supported by OkHttp, but provided to allow a theoretical interceptor
   * that provides support.
   */
  HTTP_3("h3"),

}

// TLSCiphers returns a list of supported TLS transport
// cipher suite IDs.
//
// The list contains only ciphers that use AES-GCM or
// (non-FIPS) CHACHA20-POLY1305 and ellitpic curve key
// exchange.
func TLSCiphers() []uint16 {
	if Enabled {
		return []uint16{
			tls.TLS_AES_128_GCM_SHA256, // TLS 1.3
			tls.TLS_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, // TLS 1.2