feat: make native TLS protocol boundary explicit

transport/native/tls_test.go

@@ -10,6 +10,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -186,3 +187,69 @@ func TestNativeTLSRequestMetadata(t *testing.T) {
 		t.Fatalf("TLS metadata unavailable to handler: status=%d", response.StatusCode)
 	}
 }
+
+func TestNativeTLSDefaultsToHTTP11ALPN(t *testing.T) {
+	server := native.New(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS == nil || r.TLS.NegotiatedProtocol != "http/1.1" {
+			http.Error(w, "missing HTTP/1.1 ALPN", http.StatusInternalServerError)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	certificate := testCertificate(t)
+	leaf, err := x509.ParseCertificate(certificate.Certificate[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	roots.AddCert(leaf)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan error, 1)
+	go func() {
+		done <- server.ServeTLS(context.Background(), listener, &tls.Config{
+			Certificates: []tls.Certificate{certificate}, MinVersion: tls.VersionTLS12,
+		})
+	}()
+	defer func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		if err := server.Shutdown(ctx); err != nil {
+			t.Errorf("TLS shutdown: %v", err)
+		}
+		if err := <-done; err != nil {
+			t.Errorf("TLS serve: %v", err)
+		}
+	}()
+	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{
+		RootCAs: roots, ServerName: "localhost", MinVersion: tls.VersionTLS12,
+		NextProtos: []string{"http/1.1"},
+	}}, Timeout: 2 * time.Second}
+	defer client.CloseIdleConnections()
+	response, err := client.Get("https://" + listener.Addr().String() + "/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	response.Body.Close()
+	if response.StatusCode != http.StatusNoContent {
+		t.Fatalf("unexpected status: %d", response.StatusCode)
+	}
+}
+
+func TestNativeTLSRejectsUnsupportedALPN(t *testing.T) {
+	server := native.New(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	certificate := testCertificate(t)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	err = server.ServeTLS(context.Background(), listener, &tls.Config{
+		Certificates: []tls.Certificate{certificate}, NextProtos: []string{"h2"},
+	})
+	if err == nil || !strings.Contains(err.Error(), "unsupported TLS ALPN protocol") {
+		t.Fatalf("expected unsupported ALPN error, got %v", err)
+	}
+}