Repository: nodejs/node
Pull request: http2: createSecureServer support ALPNCallback option

<!--
Before submitting a pull request, please read:

- the CONTRIBUTING guide at https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md
- the commit message formatting guidelines at
  https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines

For code changes:
1. Include tests for any bug fixes or new features.
2. Update documentation if relevant.
3. Ensure that `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes.

If you believe this PR should be highlighted in the Node.js CHANGELOG
please add the `notable-change` label.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.
-->
Fixes: https://github.com/nodejs/node/issues/55994
Refs: https://github.com/nodejs/node/pull/45190


Changed files:
filename: lib/internal/http2/core.js
patch: @@ -3136,9 +3136,13 @@ function initializeOptions(options) {
 
 function initializeTLSOptions(options, servername) {
   options = initializeOptions(options);
-  options.ALPNProtocols = ['h2'];
-  if (options.allowHTTP1 === true)
-    options.ALPNProtocols.push('http/1.1');
+
+  if (!options.ALPNCallback) {
+    options.ALPNProtocols = ['h2'];
+    if (options.allowHTTP1 === true)
+      options.ALPNProtocols.push('http/1.1');
+  }
+
   if (servername !== undefined && !options.servername)
     options.servername = servername;
   return options;

filename: test/parallel/test-http2-alpn.js
patch: @@ -0,0 +1,47 @@
+'use strict';
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+
+// This test verifies that http2 server support ALPNCallback option.
+
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const assert = require('assert');
+const h2 = require('http2');
+const tls = require('tls');
+
+{
+  // Server sets two incompatible ALPN options:
+  assert.throws(() => h2.createSecureServer({
+    ALPNCallback: () => 'a',
+    ALPNProtocols: ['b', 'c']
+  }), (error) => error.code === 'ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS');
+}
+
+{
+  const server = h2.createSecureServer({
+    key: fixtures.readKey('rsa_private.pem'),
+    cert: fixtures.readKey('rsa_cert.crt'),
+    ALPNCallback: () => 'a',
+  });
+
+  server.on(
+    'secureConnection',
+    common.mustCall((socket) => {
+      assert.strictEqual(socket.alpnProtocol, 'a');
+      socket.end();
+      server.close();
+    })
+  );
+
+  server.listen(0, function() {
+    const client = tls.connect({
+      port: server.address().port,
+      rejectUnauthorized: false,
+      ALPNProtocols: ['a'],
+    }, common.mustCall(() => {
+      assert.strictEqual(client.alpnProtocol, 'a');
+      client.end();
+    }));
+  });
+}