Motivation

When an HTTPS request uses an HTTP proxy, AHC establishes a CONNECT tunnel and then performs TLS with the target. If ALPN selects h2, the tunnel path currently leaves the HTTP/1.1 codec in place. The target then receives HTTP/1.1 bytes on a connection that negotiated HTTP/2 and closes it.

Modification

• Check the negotiated ALPN protocol after the target TLS handshake in both proxy tunnel paths.
• When ALPN selects h2, upgrade the existing channel pipeline to HTTP/2 and register the physical tunnel connection with its existing pool partition key.
• Preserve the existing HTTP/1.1 fallback and WebSocket behavior.
• Add regression tests using local HTTP and HTTPS CONNECT proxies with a TLS HTTP/2 target.
• Verify that the upgraded tunnel is registered and reused for a second request.
• Preserve the existing public tunneling method signatures for binary compatibility.

Result

HTTPS requests through HTTP and HTTPS CONNECT proxies now send HTTP/2 frames when the target negotiates h2. The regression tests verify successful HTTP/2 responses and reuse of a single physical target connection.

Testing

• ./mvnw -pl client -Dtest=BasicHttp2Test,HttpsProxyTest test — 60 tests passed.
• Full client test suite passed as part of verify; the local run then stopped at artifact signing because gpg is not installed.
• ./mvnw -pl client -DskipTests -Dgpg.skip=true verify — packaging and API compatibility checks passed.

Fixes #2241