Add client next protos to KMS connection info (#2246)

This builds on the previous change in the nodeenrollment library to
allow KMS connections to store incoming ALPN NextProto information.

internal/daemon/controller/intercepting_listener.go

@@ -127,8 +127,9 @@ func (m *interceptingListener) Accept() (net.Conn, error) {
 		}
 		workerInfo := workerInfoRaw.(*workerAuthEntry)
 		workerInfo.conn = tlsConn
+		m.c.workerAuthCache.Delete(string(nonce))
 		event.WriteSysEvent(ctx, op, "worker successfully authed", "name", workerInfo.Name, "description", workerInfo.Description, "proxy_address", workerInfo.ProxyAddress)
-		return tlsConn, nil
+		return protocol.NewConn(tlsConn, workerInfo.clientNextProtos), nil
 
 	default:
 		return nil, newTempError(errors.New("unable to authenticate incoming connection"))

internal/daemon/controller/worker_tls_config.go

@@ -19,7 +19,8 @@ import (
 
 type workerAuthEntry struct {
 	*base.WorkerAuthInfo
-	conn net.Conn
+	conn             net.Conn
+	clientNextProtos []string
 }
 
 // validateWorkerTls is called by the Go TLS stack with client info. It calls
@@ -44,9 +45,14 @@ func (c Controller) validateWorkerTls(hello *tls.ClientHelloInfo) (*tls.Config,
 				// nonce unique constraint, which is by far the more important
 				// thing to validate (although there are DB-level tests for that
 				// too).
-				c.workerAuthCache.Store(workerInfo.ConnectionNonce, &workerAuthEntry{
+				authEntry := &workerAuthEntry{
 					WorkerAuthInfo: workerInfo,
-				})
+				}
+				if len(hello.SupportedProtos) > 0 {
+					authEntry.clientNextProtos = make([]string, len(hello.SupportedProtos))
+					copy(authEntry.clientNextProtos, hello.SupportedProtos)
+				}
+				c.workerAuthCache.Store(workerInfo.ConnectionNonce, authEntry)
 			}
 			return tlsConf, err
 		}