Support HTTP/2 after proxy CONNECT (#2250)

## Motivation

When an HTTPS request uses an HTTP proxy, AHC establishes a `CONNECT`
tunnel and then performs TLS with the target. If ALPN selects `h2`, the
tunnel path currently leaves the HTTP/1.1 codec in place. The target
then receives HTTP/1.1 bytes on a connection that negotiated HTTP/2 and
closes it.

## Modification

- Check the negotiated ALPN protocol after the target TLS handshake in
both proxy tunnel paths.
- When ALPN selects `h2`, upgrade the existing channel pipeline to
HTTP/2 and register the physical tunnel connection with its existing
pool partition key.
- Preserve the existing HTTP/1.1 fallback and WebSocket behavior.
- Add regression tests using local HTTP and HTTPS `CONNECT` proxies with
a TLS HTTP/2 target.
- Verify that the upgraded tunnel is registered and reused for a second
request.
- Preserve the existing public tunneling method signatures for binary
compatibility.

## Result

HTTPS requests through HTTP and HTTPS `CONNECT` proxies now send HTTP/2
frames when the target negotiates `h2`. The regression tests verify
successful HTTP/2 responses and reuse of a single physical target
connection.

## Testing

- `./mvnw -pl client -Dtest=BasicHttp2Test,HttpsProxyTest test` — 60
tests passed.
- Full client test suite passed as part of `verify`; the local run then
stopped at artifact signing because `gpg` is not installed.
- `./mvnw -pl client -DskipTests -Dgpg.skip=true verify` — packaging and
API compatibility checks passed.

Fixes #2241

Author: rampreeth

client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java

@@ -51,6 +51,7 @@
 import io.netty.handler.proxy.ProxyHandler;
 import io.netty.handler.proxy.Socks4ProxyHandler;
 import io.netty.handler.proxy.Socks5ProxyHandler;
+import io.netty.handler.ssl.ApplicationProtocolNames;
 import io.netty.handler.ssl.SslHandler;
 import io.netty.handler.stream.ChunkedWriteHandler;
 import io.netty.handler.timeout.IdleStateHandler;
@@ -123,6 +124,7 @@ public class ChannelManager {
     public static final String HTTP2_FRAME_CODEC = "http2-frame-codec";
     public static final String HTTP2_MULTIPLEX = "http2-multiplex";
     public static final String AHC_HTTP2_HANDLER = "ahc-http2";
+    private static final String TARGET_SSL_HANDLER = "target-ssl";
     private static final Logger LOGGER = LoggerFactory.getLogger(ChannelManager.class);
     // Guards the one-time WARN emitted when a native transport was requested but is unavailable and we
     // fall back to NIO. Logged once per JVM to avoid spamming logs when many clients are created.
@@ -806,13 +808,13 @@ public Future<Channel> updatePipelineForHttpsTunneling(ChannelPipeline pipeline,
             // This creates a nested SSL setup: Target SSL -> Proxy SSL -> Network
             if (isSslHandlerConfigured(pipeline)) {
                 // Insert target SSL handler after the proxy SSL handler
-                pipeline.addAfter(SSL_HANDLER, "target-ssl", sslHandler);
+                pipeline.addAfter(SSL_HANDLER, TARGET_SSL_HANDLER, sslHandler);
             } else {
                 // This shouldn't happen for HTTPS proxy, but fallback
                 pipeline.addBefore(INFLATER_HANDLER, SSL_HANDLER, sslHandler);
             }
 
-            pipeline.addAfter("target-ssl", HTTP_CLIENT_CODEC, newHttpClientCodec());
+            pipeline.addAfter(TARGET_SSL_HANDLER, HTTP_CLIENT_CODEC, newHttpClientCodec());
 
         } else {
             // For HTTPS proxy to HTTP target, just add HTTP codec
@@ -1084,6 +1086,23 @@ public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception
         }
     }
 
+    /**
+     * Upgrades and registers a proxy tunnel when the target TLS handshake negotiated HTTP/2.
+     * The caller controls when this runs so the upgrade can happen immediately before the
+     * tunneled request is sent.
+     */
+    public void upgradePipelineToHttp2AfterProxyConnect(ChannelPipeline pipeline, Object partitionKey) {
+        SslHandler targetSslHandler = (SslHandler) pipeline.get(TARGET_SSL_HANDLER);
+        if (targetSslHandler == null) {
+            targetSslHandler = (SslHandler) pipeline.get(SSL_HANDLER);
+        }
+        if (targetSslHandler != null
+                && ApplicationProtocolNames.HTTP_2.equals(targetSslHandler.applicationProtocol())) {
+            upgradePipelineToHttp2(pipeline);
+            registerHttp2Connection(partitionKey, pipeline.channel());
+        }
+    }
+
     public void upgradePipelineForWebSockets(ChannelPipeline pipeline) {
         pipeline.addAfter(HTTP_CLIENT_CODEC, WS_ENCODER_HANDLER, new WebSocket08FrameEncoder(true));
         pipeline.addAfter(WS_ENCODER_HANDLER, WS_DECODER_HANDLER, new WebSocket08FrameDecoder(false,

client/src/main/java/org/asynchttpclient/netty/request/NettyRequestSender.java

@@ -1457,6 +1457,10 @@ public void drainChannelAndExecuteNextRequest(final Channel channel, final Netty
             public void call() {
                 whenHandshaked.addListener(f -> {
                             if (f.isSuccess()) {
+                                if (!nextRequest.getUri().isWebSocket()) {
+                                    channelManager.upgradePipelineToHttp2AfterProxyConnect(
+                                            channel.pipeline(), future.getPartitionKey());
+                                }
                                 sendNextRequest(nextRequest, future);
                             } else {
                                 future.abort(f.cause());

client/src/test/java/org/asynchttpclient/BasicHttp2Test.java

@@ -48,7 +48,12 @@
 import io.netty.pkitesting.CertificateBuilder;
 import io.netty.pkitesting.X509Bundle;
 import io.netty.util.concurrent.GlobalEventExecutor;
+import org.asynchttpclient.proxy.ProxyServer;
+import org.asynchttpclient.proxy.ProxyType;
 import org.asynchttpclient.test.EventCollectingHandler;
+import org.eclipse.jetty.proxy.ConnectHandler;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -80,7 +85,10 @@
 import static java.util.concurrent.TimeUnit.SECONDS;
 import static org.asynchttpclient.Dsl.asyncHttpClient;
 import static org.asynchttpclient.Dsl.config;
+import static org.asynchttpclient.Dsl.proxyServer;
 import static org.asynchttpclient.test.TestUtils.AsyncCompletionHandlerAdapter;
+import static org.asynchttpclient.test.TestUtils.addHttpConnector;
+import static org.asynchttpclient.test.TestUtils.addHttpsConnector;
 import static org.asynchttpclient.util.DateUtils.unpreciseMillisTime;
 import static org.asynchttpclient.util.ThrowableUtil.unknownStackTrace;
 import static org.junit.jupiter.api.Assertions.*;
@@ -430,6 +438,52 @@ private AsyncHttpClient http2ClientWithConfig(Consumer<DefaultAsyncHttpClientCon
         return asyncHttpClient(builder);
     }
 
+    @Test
+    public void httpsRequestsThroughHttpProxyNegotiateAndReuseHttp2AfterConnect() throws Exception {
+        assertHttpsRequestsThroughProxyNegotiateAndReuseHttp2AfterConnect(false);
+    }
+
+    @Test
+    public void httpsRequestsThroughHttpsProxyNegotiateAndReuseHttp2AfterConnect() throws Exception {
+        assertHttpsRequestsThroughProxyNegotiateAndReuseHttp2AfterConnect(true);
+    }
+
+    private void assertHttpsRequestsThroughProxyNegotiateAndReuseHttp2AfterConnect(boolean secureProxy) throws Exception {
+        Server proxy = new Server();
+        ServerConnector proxyConnector = secureProxy ? addHttpsConnector(proxy) : addHttpConnector(proxy);
+        proxy.setHandler(new ConnectHandler());
+
+        try {
+            proxy.start();
+            try (AsyncHttpClient client = http2Client()) {
+                ProxyServer.Builder proxyBuilder = proxyServer("127.0.0.1", proxyConnector.getLocalPort());
+                if (secureProxy) {
+                    proxyBuilder.setProxyType(ProxyType.HTTPS);
+                }
+                ProxyServer proxyServer = proxyBuilder.build();
+                Response firstResponse = client.prepareGet(httpsUrl("/hello"))
+                        .setProxyServer(proxyServer)
+                        .execute()
+                        .get(30, SECONDS);
+                Response secondResponse = client.prepareGet(httpsUrl("/hello"))
+                        .setProxyServer(proxyServer)
+                        .execute()
+                        .get(30, SECONDS);
+
+                assertNotNull(firstResponse);
+                assertEquals(200, firstResponse.getStatusCode());
+                assertEquals(HttpProtocol.HTTP_2, firstResponse.getProtocol());
+                assertNotNull(secondResponse);
+                assertEquals(200, secondResponse.getStatusCode());
+                assertEquals(HttpProtocol.HTTP_2, secondResponse.getProtocol());
+                assertEquals(1, serverChildChannels.size(),
+                        "the HTTP/2 tunnel connection should be registered and reused");
+            }
+        } finally {
+            proxy.stop();
+        }
+    }
+
     /**
      * With {@link LoadBalance#ROUND_ROBIN}, a host resolving to several IPs gets one HTTP/2
      * connection per IP (the registry is keyed by the IP-aware partition key), so requests are spread

client/src/test/java/org/asynchttpclient/proxy/HttpsProxyTestcontainersIntegrationTest.java

@@ -146,8 +146,6 @@ public void testHttpProxyToHttpsTarget() throws Exception {
                         .setProxyType(ProxyType.HTTP)
                         .build())
                 .setUseInsecureTrustManager(true)
-                // HTTP/2 ALPN upgrade after proxy CONNECT tunnel is not yet supported
-                .setHttp2Enabled(false)
                 .setConnectTimeout(Duration.ofMillis(10000))
                 .setRequestTimeout(Duration.ofMillis(30000))
                 .build();
@@ -169,8 +167,6 @@ public void testHttpsProxyToHttpsTarget() throws Exception {
                         .setProxyType(ProxyType.HTTPS)
                         .build())
                 .setUseInsecureTrustManager(true)
-                // HTTP/2 ALPN upgrade after proxy CONNECT tunnel is not yet supported
-                .setHttp2Enabled(false)
                 .setConnectTimeout(Duration.ofMillis(10000))
                 .setRequestTimeout(Duration.ofMillis(30000))
                 .build();