quic: send correct OpenSSL alert for ALPN mismatches

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: #63193
Backport-PR-URL: #64675
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: pimterry

src/quic/tlscontext.cc

@@ -338,7 +338,7 @@ int TLSContext::OnSelectAlpn(SSL* ssl,
           in,
           inlen) == OPENSSL_NPN_NO_OVERLAP) {
     Debug(&tls_session.session(), "ALPN negotiation failed");
-    return SSL_TLSEXT_ERR_NOACK;
+    return SSL_TLSEXT_ERR_ALERT_FATAL;
   }
 
   // ALPN negotiated successfully. *out/*outlen point to the selected

test/parallel/test-quic-alpn-mismatch.mjs

@@ -2,31 +2,39 @@
 
 // Test: ALPN mismatch causes connection failure.
 // The server offers 'quic-test' but the client requests 'nonexistent'.
-// The handshake should fail.
+// The handshake should fail with a `no_application_protocol` alert.
+//
+// The QUIC transport error code for a CRYPTO_ERROR carrying a TLS alert is
+// 0x100 | <tls_alert>. For `no_application_protocol` (alert 120 / 0x78) this
+// is 0x178 == 376. ERR_QUIC_TRANSPORT_ERROR formats the wire code into its
+// message as a bigint, so we match `376n` to assert the specific alert was
+// sent rather than some other handshake failure.
 
 import { hasQuic, skip, mustCall } from '../common/index.mjs';
 import assert from 'node:assert';
 
-const { rejects, strictEqual } = assert;
+const { rejects, strictEqual, match } = assert;
 
 if (!hasQuic) {
   skip('QUIC is not enabled');
 }
 
 const { listen, connect } = await import('../common/quic.mjs');
 
+const expected = {
+  code: 'ERR_QUIC_TRANSPORT_ERROR',
+  message: /\b376n\b/,
+};
+
 const onerror = mustCall((err) => {
   strictEqual(err.code, 'ERR_QUIC_TRANSPORT_ERROR');
+  match(err.message, /\b376n\b/);
 }, 2);
 const transportParams = { maxIdleTimeout: 1 };
 
 const serverEndpoint = await listen(mustCall(async (serverSession) => {
-  await rejects(serverSession.opened, {