api: fix TLS when redirecting the request (tikv#1740)

Signed-off-by: Ryan Leung <[email protected]>

.gitignore

@@ -9,3 +9,5 @@ tags
 /.retools/
 vendor
 default*
+*.bak
+.vscode/

server/api/redirector.go

@@ -14,10 +14,12 @@
 package api
 
 import (
+	"crypto/tls"
 	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strings"
+	"sync"
 
 	log "github.com/pingcap/log"
 	"github.com/pingcap/pd/server"
@@ -33,6 +35,8 @@ const (
 	errRedirectToNotLeader = "redirect to not leader"
 )
 
+var initHTTPClientOnce sync.Once
+
 type redirector struct {
 	s *server.Server
 }
@@ -67,7 +71,20 @@ func (h *redirector) ServeHTTP(w http.ResponseWriter, r *http.Request, next http
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
-
+	initHTTPClientOnce.Do(func() {
+		var tlsConfig *tls.Config
+		tlsConfig, err = h.s.GetSecurityConfig().ToTLSConfig()
+		dialClient = &http.Client{
+			Transport: &http.Transport{
+				DisableKeepAlives: true,
+				TLSClientConfig:   tlsConfig,
+			},
+		}
+	})
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
 	newCustomReverseProxies(urls).ServeHTTP(w, r)
 }
 

tests/pdctl/cluster/cluster_test.go

@@ -69,6 +69,7 @@ func (s *clusterTestSuite) TestClusterAndPing(c *C) {
 	temp.Close()
 	os.Stdout = old
 	out, _ := ioutil.ReadFile(fname)
+	os.Remove(fname)
 	c.Assert(strings.Contains(string(out), "no such file or directory"), IsTrue)
 
 	// cluster status

tests/pdctl/region/region_test.go

@@ -68,6 +68,7 @@ func (s *regionTestSuite) TestRegionKeyFormat(c *C) {
 	temp.Close()
 	os.Stdout = old
 	out, _ := ioutil.ReadFile(fname)
+	os.Remove(fname)
 	c.Assert(strings.Contains(string(out), "unknown flag"), IsFalse)
 }