plugin/forward: Fix issue in DoH health checks used a default TLS instead of the configured CA (#8279)

This PR fixes issue in forward plugin where default TLS instead of
configured CA was used.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

plugin/forward/setup.go

@@ -244,6 +244,7 @@ func parseStanza(c *caddy.Controller) (*Forward, error) {
 				Timeout:   2 * time.Second,
 			}
 			f.proxies[i].SetHTTPClient(&c)
+			f.proxies[i].SetTLSConfig(f.tlsConfig)
 			f.proxies[i].SetDOHRequestOptions(f.dohMethod)
 		}
 

plugin/forward/setup_test.go

@@ -906,3 +906,30 @@ func TestSetupReadTimeout(t *testing.T) {
 		})
 	}
 }
+
+func TestSetupDOHHealthcheckTLSConfig(t *testing.T) {
+	c := caddy.NewTestController(
+		"dns",
+		`forward . https://127.0.0.1 {
+			tls_servername dns.example
+		}`,
+	)
+
+	fs, err := parseForward(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := fs[0].
+		proxies[0].
+		GetHealthchecker().
+		GetTLSConfig()
+
+	if got.ServerName != "dns.example" {
+		t.Fatalf(
+			"Expected DoH healthcheck TLS server name %q, got %q",
+			"dns.example",
+			got.ServerName,
+		)
+	}
+}