net/tlsdial: add memory-optimized TLS cert verification path for iOS

Behind a build tag for now.

control/controlclient/direct.go

@@ -16,6 +16,7 @@ import (
 	"io/ioutil"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"reflect"
 	"strconv"
@@ -114,6 +115,10 @@ func NewDirect(opts Options) (*Direct, error) {
 		return nil, errors.New("controlclient.New: no server URL specified")
 	}
 	opts.ServerURL = strings.TrimRight(opts.ServerURL, "/")
+	serverURL, err := url.Parse(opts.ServerURL)
+	if err != nil {
+		return nil, err
+	}
 	if opts.TimeNow == nil {
 		opts.TimeNow = time.Now
 	}
@@ -125,7 +130,7 @@ func NewDirect(opts Options) (*Direct, error) {
 
 	tr := http.DefaultTransport.(*http.Transport).Clone()
 	tr.ForceAttemptHTTP2 = true
-	tr.TLSClientConfig = tlsdial.Config("", tr.TLSClientConfig)
+	tr.TLSClientConfig = tlsdial.Config(serverURL.Host, tr.TLSClientConfig)
 	httpc := &http.Client{Transport: tr}
 
 	c := &Direct{