tcp: use matching in message instead
ssl: support NPN