Play Framework

fix(ssl): suppress benign mid-handshake Connection reset WARN (PF-109)

Browsers race HTTP/3 against HTTP/1.1+h2 and pre-open speculative TCP
connections for six-per-host parallelism, tearing both down with RST
once a sibling negotiates h2 via ALPN. Inside that handshake window
the SSL pipeline has only ssl + alpn installed — SslPlayHandler isn't
in yet — so the SocketException propagates to DefaultChannelPipeline
tail and emits an unhelpful WARN with a full stack trace. Three per
page load is typical noise that buries real warnings.

Add a small ChannelInboundHandlerAdapter that lives in the pipeline
only during the handshake window: it consumes IOException with
"Connection reset" or "Broken pipe", lets SSLException and anything
else propagate, and self-removes on successful SslHandshakeCompletionEvent
so steady-state traffic hits the unchanged catch-all.

Placed BETWEEN ssl and alpn rather than after them — Netty 4.2.12's
ApplicationProtocolNegotiationHandler.exceptionCaught also logs a WARN
("Failed to select the application-level protocol:") for any non-SSL
exception it sees, which the ticket's original positioning would have
left behind. Intercepting before alpn kills both noisy WARNs in one
shot without affecting successful handshakes (verified by the full
integration suite, including Http2FunctionalTest's real ALPN path).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>