docs: private Request createTunnel(int readTimeout, int writeTimeout, Request tunnelRequest,
        HttpUrl url) throws IOException {
      // Make an SSL Tunnel on the first message pair of each SSL + proxy connection.
      String requestLine = "CONNECT " + Util.hostHeader(url, true) + " HTTP/1.1";
      while (true) {
        Http1ExchangeCodec tunnelCodec = new Http1ExchangeCodec(null, null, source, sink);
        source.timeout().timeout(readTimeout, MILLISECONDS);
        sink.timeout().timeout(writeTimeout, MILLISECONDS);
        tunnelCodec.writeRequest(tunnelRequest.headers(), requestLine);
        tunnelCodec.finishRequest();
        Response response = tunnelCodec.readResponseHeaders(false)
            .request(tunnelRequest)
            .build();
        tunnelCodec.skipConnectBody(response);
  
        switch (response.code()) {
          case HTTP_OK:
            // Assume the server won't send a TLS ServerHello until we send a TLS ClientHello. If
            // that happens, then we will have buffered bytes that are needed by the SSLSocket!
            // This check is imperfect: it doesn't tell us whether a handshake will succeed, just
            // that it will almost certainly fail because the proxy has sent unexpected data.
            if (!source.getBuffer().exhausted() || !sink.buffer().exhausted()) {
              throw new IOException("TLS tunnel buffered too many bytes!");
            }
            return null;
  
          case HTTP_PROXY_AUTH:
            tunnelRequest = route.address().proxyAuthenticator().authenticate(route, response);
            if (tunnelRequest == null) throw new IOException("Failed to authenticate with proxy");
  
            if ("close".equalsIgnoreCase(response.header("Connection"))) {
              return tunnelRequest;
            }
            break;
  
          default:
            throw new IOException(
                "Unexpected response code for CONNECT: " + response.code());
        }
      }
    }