feat(httpconnect): add NewH2ProxyTransport for pure H2 CONNECT tunneling

[fortuna]

Summary

Adds HTTP CONNECT proxy tunnel support to the httpconnect package and integrates it into configurl.

x/httpconnect — new HTTP CONNECT tunnel client over H1, H2, and H3:

• NewHTTPProxyTransport — H1.1 or H2 via TLS ALPN (multiplexed when H2 is negotiated)
• NewH2ProxyTransport — pure HTTP/2; always multiplexed; supports h2c (cleartext) via
  WithPlainHTTP()
• NewH3ProxyTransport — HTTP/3 over QUIC; always multiplexed (renamed from NewHTTP3ProxyTransport)
• NewConnectClient — transport.StreamDialer that sends CONNECT requests through any of the above
• Extended httpproxy.NewConnectHandler to support H2/H3 streams (no longer requires http.Hijacker)
• Package docs with Caddy setup guide for manual testing

x/configurl — three new transport types:

• httpconnect://host:port[?sni=SNI][&certname=CERTNAME]
• h2connect://host:port[?sni=SNI][&certname=CERTNAME][&plain=true]
• h3connect://host:port[?sni=SNI][&certname=CERTNAME]

This improves #319

TLS path correctness

When TLS is used, DialTLSContext performs the handshake using stdTLS.Client() and returns
*stdTLS.Conn directly. This is required because http2.Transport internally type-asserts to
*tls.Conn to read NegotiatedProtocol — returning the SDK's tls.WrapConn wrapper would
silently break protocol negotiation.

Tests

New tests covering all new paths, plus a refactor of the existing test suite:

Test	What it covers
Test_ConnectClient_H2C	h2c via NewH2ProxyTransport + WithPlainHTTP(), served by http2.Server.ServeConn on a raw TCP listener
Test_ConnectClient_H2_TLS_Multiplexed	TLS path of NewH2ProxyTransport; asserts 3 concurrent CONNECT streams share exactly 1 TCP connection using a counting dialer

The existing test file was also refactored for readability:

• Replaced the single table-driven test with standalone test functions
  (Test_ConnectClient_{protocol}_{modifier})
• Extracted verifyTunnel() and newH2ConnectHandler() helpers to eliminate duplication
• Replaced custom RSA CA generation with httptest's built-in certificate via proxySrv.Certificate()
• Added doc comments to all test functions and helpers

[fortuna]

/cc @nikolaikabanenkov

[Copilot]

Pull request overview

This PR adds NewH2ProxyTransport, a new transport factory that uses golang.org/x/net/http2.Transport directly (instead of wrapping net/http.Transport with http2.ConfigureTransport). This enables two new capabilities not available in the existing NewHTTPProxyTransport: true H2 multiplexing (multiple concurrent CONNECT tunnels over a single TCP connection) and h2c (cleartext HTTP/2 via prior knowledge) via WithPlainHTTP(). The PR also refactors the existing test suite from a single table-driven test into standalone, well-documented test functions.

Changes:

• NewH2ProxyTransport factory function supporting both h2c (plaintext) and TLS modes, with correct *tls.Conn return in DialTLSContext to satisfy http2.Transport's internal type assertion
• Two new tests: Test_ConnectClient_H2C (h2c via raw TCP + http2.Server.ServeConn) and Test_ConnectClient_H2_TLS_Multiplexed (asserts 3 concurrent streams share 1 TCP connection using a counting dialer)
• Test refactor: table-driven test split into standalone functions, shared helpers extracted (verifyTunnel, newH2ConnectHandler, tlsCertPool), custom RSA CA generation removed in favor of httptest's built-in certificate

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
x/httpconnect/transport.go	Adds NewH2ProxyTransport with h2c and TLS paths using golang.org/x/net/http2.Transport
x/httpconnect/connect_client_test.go	Refactors tests to standalone functions; adds Test_ConnectClient_H2C and Test_ConnectClient_H2_TLS_Multiplexed

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

x/httpconnect/connect_client_test.go:454

• The flusherWriter type (lines 427–454) is defined but no longer used by any test in the refactored test suite. It was only used in the old inline H2 test-server code that has been replaced by httpproxy.NewConnectHandler. This dead code should be removed to keep the file clean.

// flusherWriter wraps an http.ResponseWriter so that every Write is followed by a Flush.
// This is required when relaying data over an H2 response stream: without explicit flushing,
// written bytes sit in the buffer and the remote end never receives them.
type flusherWriter struct {
	http.Flusher
	io.Writer
}

func (fw flusherWriter) ReadFrom(r io.Reader) (int64, error) {
	var (
		buf   = make([]byte, 32*1024)
		total int64
	)
	for {
		nr, er := r.Read(buf)
		if nr > 0 {
			nw, ew := fw.Writer.Write(buf[:nr])
			total += int64(nw)
			if ew != nil {
				return total, ew
			}
			fw.Flush()
		}
		if er != nil {
			if er == io.EOF {
				return total, nil
			}
			return total, er
		}
	}
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.