Use JDK platform APIs for ALPN negotiation

[vasilmkd]

Before (curl output):

vasil@vasil-mac ~ % curl -v -k https://127.0.0.1:8443/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol                    ### <----------------------------------------
* Server certificate:
*  subject: C=Unknown; ST=Unknown; L=Unknown; O=Unknown; OU=Unknown; CN=Unknown
*  start date: Dec  7 21:49:01 2014 GMT
*  expire date: Dec  2 21:49:01 2015 GMT
*  issuer: C=Unknown; ST=Unknown; L=Unknown; O=Unknown; OU=Unknown; CN=Unknown
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET / HTTP/1.1
> Host: 127.0.0.1:8443
> User-Agent: curl/7.64.1
> Accept: */*
> 
< HTTP/1.1 200 OK                    ### <----------------------------------------
< content-type: text/plain; charset=utf-8
< date: Fri, 16 Apr 2021 13:07:16 GMT
< content-length: 104
< 
Hello world!
Path: /
Headers
["Host", "127.0.0.1:8443"]
["User-Agent", "curl/7.64.1"]
["Accept", "*/*"]
* Connection #0 to host 127.0.0.1 left intact
* Closing connection 0

After (curl output):

vasil@vasil-mac ~ % curl -v -k https://127.0.0.1:8443/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2                    ### <----------------------------------------
* Server certificate:
*  subject: C=Unknown; ST=Unknown; L=Unknown; O=Unknown; OU=Unknown; CN=Unknown
*  start date: Dec  7 21:49:01 2014 GMT
*  expire date: Dec  2 21:49:01 2015 GMT
*  issuer: C=Unknown; ST=Unknown; L=Unknown; O=Unknown; OU=Unknown; CN=Unknown
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
* Using HTTP2, server supports multi-use                    ### <----------------------------------------
* Connection state changed (HTTP/2 confirmed)                    ### <----------------------------------------
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7feeaa00c400)
> GET / HTTP/2                    ### <----------------------------------------
> Host: 127.0.0.1:8443
> User-Agent: curl/7.64.1
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200                     ### <----------------------------------------
< content-length: 77
< content-type: text/plain; charset=utf-8
< 
Hello world!
Path: /
Headers
["user-agent", "curl/7.64.1"]
["accept", "*/*"]
* Connection #0 to host 127.0.0.1 left intact
* Closing connection 0

[vasilmkd]

The tests are passing for me reliably when running them locally. They also passed once before in CI, because I got to the mima checks. I can't tell if there's an issue with my changes.

[vasilmkd]

It seems the same is happening in #520.

[rossabaker]

Oh, uh, @hamnis (I think) found something related to a localhost change in http4s main repo.

[rossabaker]

The failing tests might be http4s/http4s@2836af0.

[rossabaker]

Nope, those tests run on the wildcard address.

[vasilmkd]

There's a better solution on the server part, I'll keep iterating on this.

[vasilmkd]

I'm actually really happy how this turned out. I anticipated it would be much worse to do the switch.

[vasilmkd]

Will rebase on #524 when that is merged.

Edit: Rebased.

[rossabaker]

This is nice.

[rossabaker]

I think this is only strictly true for HTTP/2, but it's such good advice anyway, I'm happy not to qualify it.