More clearly negotiate ALPN information

[cipherboy]

Vault's cluster listener would previously select ALPN information via returning the client's list of supported protocols, after first ensuring at least one match existed in the handler list.

This had two implications:

1. The globally set NextProtos are ignored.
2. A client sending multiple ALPNs could result in an ALPN without a handler being negotiated.
   -> As a side effect here, we'd also present any CA information for our found ALPN handler, even if another one was chosen instead.

Thus, we explicitly restrict NextProtos to the protocol we have specified certificates for (and expect to negotiate).

This was found in discussion with Brian and Scott.

[ncabatoff]

When you say "more clearly" I assume this makes things more obvious in the logs? Could you show before & after please?

[cipherboy]

@ncabatoff No, this does not affect the log output at all except for bad clients. This is from a TLS protocol standpoint, rather than returning all of the client's requested protocols as the list of protocols the server supports (for Go to choose one, usually the first one), we'll instead return only the one we have a handler for.

From Brian's investigation, namely here, we only send one in the client anyways, hence why this change shouldn't impact clients or servers at all and is mostly just cleanup.

I think, at worst, you'd previously see a line from here in the logs:

cl.logger.Debug("unknown negotiated protocol on cluster port")
tlsConn.Close()

if you send a client with e.g.,. ["bogus", "replication_resolver_v1"]. To my knowledge, we don't today, and so this change should be a no-op.

(But now, this would succeed, negotiating replication_resolver_v1 as the protocol, assuming bogus isn't a valid protocol we know about).

---

I guess, to restate, "clearly" is from a developer's perspective, not from an operator's perspective. :-)

[cipherboy]

Fixed the build errors. :-)

But, it looks like this fails in Enterprise PR:

2023-03-29T13:08:28.756Z [WARN]  TestPerfSecondaryTokenCreationStateEntityAlias.perf-pri.core0.core.cluster-listener: no TLS config found for ALPN: ALPN=["replication_v1"] 

[calvn]

This is missing the backport/1.14.x label now that the release branch has been cut. Do we still plan on merging this for the upcoming release?

[cipherboy]

@calvn Most likely when I have cycles to look at this again and figure out the state it is in, it'll be an enhancement for the future, targeting 1.15+. I've updated milestones appropriately, thank you!