[7.6][heartbeat][libbeat][metricbeat][filebeat] (#15875)

Fixes a bug where TLS options would not be passed to forward proxies. This fixes a reported issue where x509 client cert auth doesn't work due to the cert parameters not being passed in.

Since this doesn't give us a full dialer we can't easily record TLS certificate expiry with proxies in heartbeat with this approach, so those fields would be missing. I think it makes sense to merge this change as-is and fix that secondary bug in a subsequent PR. I've opened a separate issue ( #15797 ) to cover that.

I've tested this manually against with the following config: https://github.com/elastic/uptime-contrib/tree/master/testing/configs/client-auth , note that you'll need the included client certs in that directory, and will need to alter the YAML to point at their actual path.

I think in this scenario I'm fine with only having unit tests because the complexity of setting of a forward proxy + a custom TLS backend is very high.

Fixes #15524

(cherry picked from commit 0e57f6b)

CHANGELOG.next.asciidoc

@@ -39,6 +39,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Affecting all Beats*
 
 - Fix missing output in dockerlogbeat {pull}15719[15719]
+- Fix issue where TLS settings would be ignored when a forward proxy was in use. {pull}15516{15516}
 
 *Auditbeat*
 

heartbeat/monitors/active/http/http.go

@@ -138,6 +138,7 @@ func newRoundTripper(config *Config, tls *transport.TLSConfig) (*http.Transport,
 		Proxy:             proxy,
 		Dial:              dialer.Dial,
 		DialTLS:           tlsDialer.Dial,
+		TLSClientConfig:   tls.ToConfig(),
 		DisableKeepAlives: true,
 	}, nil
 }

heartbeat/monitors/active/http/http_test.go

@@ -39,6 +39,7 @@ import (
 	"github.com/elastic/beats/libbeat/beat"
 	"github.com/elastic/beats/libbeat/common"
 	"github.com/elastic/beats/libbeat/common/file"
+	"github.com/elastic/beats/libbeat/outputs/transport"
 	btesting "github.com/elastic/beats/libbeat/testing"
 	"github.com/elastic/go-lookslike"
 	"github.com/elastic/go-lookslike/isdef"
@@ -498,3 +499,31 @@ func TestRedirect(t *testing.T) {
 		event.Fields,
 	)
 }
+
+func TestNewRoundTripper(t *testing.T) {
+	configs := map[string]Config{
+		"Plain":      {Timeout: time.Second},
+		"With Proxy": {Timeout: time.Second, ProxyURL: "http://localhost:1234"},
+	}
+
+	for name, config := range configs {
+		t.Run(name, func(t *testing.T) {
+			transp, err := newRoundTripper(&config, &transport.TLSConfig{})
+			require.NoError(t, err)
+
+			if config.ProxyURL == "" {
+				require.Nil(t, transp.Proxy)
+			} else {
+				require.NotNil(t, transp.Proxy)
+			}
+
+			// It's hard to compare func types in tests
+			require.NotNil(t, transp.Dial)
+			require.NotNil(t, transport.TLSDialer)
+
+			require.Equal(t, (&transport.TLSConfig{}).ToConfig(), transp.TLSClientConfig)
+			require.True(t, transp.DisableKeepAlives)
+		})
+	}
+
+}

libbeat/common/transport/tlscommon/tls_config.go

@@ -66,11 +66,11 @@ type TLSConfig struct {
 	ClientAuth tls.ClientAuthType
 }
 
-// BuildModuleConfig takes the TLSConfig and transform it into a `tls.Config`.
-func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
+// ToConfig generates a tls.Config object. Note, you must use BuildModuleConfig to generate a config with
+// ServerName set, use that method for servers with SNI.
+func (c *TLSConfig) ToConfig() *tls.Config {
 	if c == nil {
-		// use default TLS settings, if config is empty.
-		return &tls.Config{ServerName: host}
+		return &tls.Config{}
 	}
 
 	minVersion, maxVersion := extractMinMaxVersion(c.Versions)
@@ -80,7 +80,6 @@ func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
 	}
 
 	return &tls.Config{
-		ServerName:         host,
 		MinVersion:         minVersion,
 		MaxVersion:         maxVersion,
 		Certificates:       c.Certificates,
@@ -93,3 +92,15 @@ func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
 		ClientAuth:         c.ClientAuth,
 	}
 }
+
+// BuildModuleConfig takes the TLSConfig and transform it into a `tls.Config`.
+func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
+	if c == nil {
+		// use default TLS settings, if config is empty.
+		return &tls.Config{ServerName: host}
+	}
+
+	config := c.ToConfig()
+	config.ServerName = host
+	return config
+}

libbeat/kibana/client.go

@@ -136,8 +136,9 @@ func NewClientWithConfig(config *ClientConfig) (*Client, error) {
 			Password: password,
 			HTTP: &http.Client{
 				Transport: &http.Transport{
-					Dial:    dialer.Dial,
-					DialTLS: tlsDialer.Dial,
+					Dial:            dialer.Dial,
+					DialTLS:         tlsDialer.Dial,
+					TLSClientConfig: tlsConfig.ToConfig(),
 				},
 				Timeout: config.Timeout,
 			},

libbeat/outputs/elasticsearch/client.go

@@ -213,9 +213,10 @@ func NewClient(
 			Headers:  s.Headers,
 			http: &http.Client{
 				Transport: &http.Transport{
-					Dial:    dialer.Dial,
-					DialTLS: tlsDialer.Dial,
-					Proxy:   proxy,
+					Dial:            dialer.Dial,
+					DialTLS:         tlsDialer.Dial,
+					TLSClientConfig: s.TLS.ToConfig(),
+					Proxy:           proxy,
 				},
 				Timeout: s.Timeout,
 			},

metricbeat/helper/http.go

@@ -96,9 +96,10 @@ func newHTTPFromConfig(config Config, name string, hostData mb.HostData) (*HTTP,
 		hostData: hostData,
 		client: &http.Client{
 			Transport: &http.Transport{
-				Dial:    dialer.Dial,
-				DialTLS: tlsDialer.Dial,
-				Proxy:   http.ProxyFromEnvironment,
+				Dial:            dialer.Dial,
+				DialTLS:         tlsDialer.Dial,
+				TLSClientConfig: tlsConfig.ToConfig(),
+				Proxy:           http.ProxyFromEnvironment,
 			},
 			Timeout: config.Timeout,
 		},

x-pack/filebeat/input/httpjson/input.go

@@ -260,6 +260,7 @@ func (in *httpjsonInput) run() error {
 		Transport: &http.Transport{
 			Dial:              dialer.Dial,
 			DialTLS:           tlsDialer.Dial,
+			TLSClientConfig:   tlsConfig.ToConfig(),
 			DisableKeepAlives: true,
 		},
 		Timeout: in.config.HTTPClientTimeout,