caddyhttp: wrap accepted connection to suppress tls.ConnectionState

[WeidiDeng]

Golang 1.25 comes with 56110 merged. However, this means connections accepted from listeners that implements

type connectionStater interface {
	ConnectionState() tls.ConnectionState
}

will not work with h2 unless it's a *tls.Conn.

It kind of abuses h2c handling mechanism, but it makes sure connections are transmitting the correct data for h1 or h2 (every h2 connection has the same preface). This also makes handling h2 requests with listener wrappers easier, as connections are managed by *http.Server and graceful shutdown for those connections are handled as well.

It does mean h2c upgrade won't work, but that method isn't used very much now, and as far as I know, curl will use this method unless --http2-prior-knowledge is specified. In practice this is rarely used and there are no reports this is a problem.

To be fair, curl handles the situation when h2c upgrade fails. Because the first request sent on a h2c upgrade connection is a normal h1 request with the header Upgrade: h2c, the server can send the response in h1 wire format and ignore the header, or h2 format and treats the connection as a h2 connection. Theoretically robust clients will handle this situation.

In golang 1.25 this check will always fail due to the merge of said pr.

https://github.com/golang/go/blob/6447ff409ac7e2a621bc8ca5c44b2eaed751fbaa/src/net/http/server.go#L2021

Assistance Disclosure

No AI was used.