Client                                               Server​ClientHello                  -------->                                                ServerHello                                               Certificate*                                         ServerKeyExchange*                                        CertificateRequest*                             <--------      ServerHelloDoneCertificate*ClientKeyExchangeCertificateVerify*[ChangeCipherSpec]Finished                     -------->                                         [ChangeCipherSpec]                             <--------             FinishedApplication Data             <------->     Application Data​                   TLS 1.2握手流程（来自 RFC 5246）

public final class ConnectInterceptor implements Interceptor {  @Override public Response intercept(Chain chain) throws IOException {    RealInterceptorChain realChain = (RealInterceptorChain) chain;    Request request = realChain.request();    StreamAllocation streamAllocation = realChain.streamAllocation();​    // We need the network to satisfy this request. Possibly for validating a conditional GET.    boolean doExtensiveHealthChecks = !request.method().equals("GET");    HttpCodec httpCodec = streamAllocation.newStream(client, chain, doExtensiveHealthChecks);    RealConnection connection = streamAllocation.connection();​    return realChain.proceed(request, streamAllocation, httpCodec, connection);  }}

public HttpCodec newStream(      OkHttpClient client, Interceptor.Chain chain, boolean doExtensiveHealthChecks) {  ...     RealConnection resultConnection = findHealthyConnection(connectTimeout, readTimeout,        writeTimeout, pingIntervalMillis, connectionRetryEnabled, doExtensiveHealthChecks);    HttpCodec resultCodec = resultConnection.newCodec(client, chain, this);  ...}​private RealConnection findHealthyConnection(int connectTimeout, int readTimeout,      int writeTimeout, int pingIntervalMillis, boolean connectionRetryEnabled,      boolean doExtensiveHealthChecks) throws IOException {    while (true) {      RealConnection candidate = findConnection(connectTimeout, readTimeout, writeTimeout,          pingIntervalMillis, connectionRetryEnabled);    ...      return candidate;    }}    /**   * Returns a connection to host a new stream. This prefers the existing connection if it exists,   * then the pool, finally building a new connection.   */  private RealConnection findConnection(int connectTimeout, int readTimeout, int writeTimeout,      int pingIntervalMillis, boolean connectionRetryEnabled) throws IOException {    ...        // 尝试从connectionPool中获取可用connection    Internal.instance.acquire(connectionPool, address, this, null);    if (connection != null) {    foundPooledConnection = true;    result = connection;    } else {    selectedRoute = route;    }       ...       if (!foundPooledConnection) {      ...       // 如果最终没有可复用的connection，则创建一个新的        result = new RealConnection(connectionPool, selectedRoute);    }  ...}

/** * Manages reuse of HTTP and HTTP/2 connections for reduced network latency. HTTP requests that * share the same {@link Address} may share a {@link Connection}. This class implements the policy * of which connections to keep open for future use. */public final class ConnectionPool {
  private final Runnable cleanupRunnable = () -> {    while (true) {      long waitNanos = cleanup(System.nanoTime());      if (waitNanos == -1) return;      if (waitNanos > 0) {        long waitMillis = waitNanos / 1000000L;        waitNanos -= (waitMillis * 1000000L);        synchronized (ConnectionPool.this) {          try {            ConnectionPool.this.wait(waitMillis, (int) waitNanos);          } catch (InterruptedException ignored) {          }        }      }    }  };
  // 用一个队列保存当前的连接  private final Deque<RealConnection> connections = new ArrayDeque<>();      /**   * Create a new connection pool with tuning parameters appropriate for a single-user application.   * The tuning parameters in this pool are subject to change in future OkHttp releases. Currently   * this pool holds up to 5 idle connections which will be evicted after 5 minutes of inactivity.   */  public ConnectionPool() {    this(5, 5, TimeUnit.MINUTES);  }
  public ConnectionPool(int maxIdleConnections, long keepAliveDuration, TimeUnit timeUnit) {  ...  }    void acquire(Address address, StreamAllocation streamAllocation, @Nullable Route route) {    assert (Thread.holdsLock(this));    for (RealConnection connection : connections) {      if (connection.isEligible(address, route)) {        streamAllocation.acquire(connection, true);        return;      }    }  }

/**   * Returns true if this connection can carry a stream allocation to {@code address}. If non-null   * {@code route} is the resolved route for a connection.   */  public boolean isEligible(Address address, @Nullable Route route) {    // If this connection is not accepting new streams, we're done.    if (allocations.size() >= allocationLimit || noNewStreams) return false;
    // If the non-host fields of the address don't overlap, we're done.    if (!Internal.instance.equalsNonHost(this.route.address(), address)) return false;
    // If the host exactly matches, we're done: this connection can carry the address.    if (address.url().host().equals(this.route().address().url().host())) {      return true; // This connection is a perfect match.    }
    // At this point we don't have a hostname match. But we still be able to carry the request if    // our connection coalescing requirements are met. See also:    // https://hpbn.co/optimizing-application-delivery/#eliminate-domain-sharding    // https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/
    // 1. This connection must be HTTP/2.    if (http2Connection == null) return false;
    // 2. The routes must share an IP address. This requires us to have a DNS address for both    // hosts, which only happens after route planning. We can't coalesce connections that use a    // proxy, since proxies don't tell us the origin server's IP address.    if (route == null) return false;    if (route.proxy().type() != Proxy.Type.DIRECT) return false;    if (this.route.proxy().type() != Proxy.Type.DIRECT) return false;    if (!this.route.socketAddress().equals(route.socketAddress())) return false;
    // 3. This connection's server certificate's must cover the new host.    if (route.address().hostnameVerifier() != OkHostnameVerifier.INSTANCE) return false;    if (!supportsUrl(address.url())) return false;
    // 4. Certificate pinning must match the host.    try {      address.certificatePinner().check(address.url().host(), handshake().peerCertificates());    } catch (SSLPeerUnverifiedException e) {      return false;    }
    return true; // The caller's address can be carried by this connection.  }