Update TLS configuration options #2330

urso · 2016-08-21T11:50:15Z

rename tls to SSL + adapt some fields:

insecure has become verification_mode. insecure: false is replaced by mode full and insecure: true by mode none.
renamed certificate_key to key
introduced key_passphrase
replaced min_version and max_version with supported_protocols using an array of ok versions. New versions strings: SSLv3, SSLV3.0, TLSv1 (use TLSv1.0), TLSv1.0, TLSv1.1 and TLSv1.2

Changes:

rewrite TLS dialer and TLS configuration
add support for encrypted key files
use TLS dialer with elasticsearch output (some more manual tests with and without system certificates required)
update unit/integration tests to use new settings
update default configuration files to use new ssl settings
update documentation (docs URL did also change from tls to ssl)
update migration script

dedemorton · 2016-08-22T18:29:25Z

filebeat/docs/reference/configuration.asciidoc

@@ -19,7 +19,7 @@ configuration settings, you need to restart {beatname_uc} to pick up the changes
 * <<redis-output>>
 * <<file-output>>
 * <<console-output>>
-* <<configuration-output-tls>>
+* <<configuration-output-ssl>>


Just a note that when we change IDs for topics, we need to ask the web team to set up redirects, or our links from forum topics will be broken. That's a good reason to avoid renaming IDs unless (which is probably true in this case) you definitely want the name to change, and it's worth the extra work to get the redirect set up.

dedemorton · 2016-08-25T14:18:22Z

libbeat/docs/outputconfig.asciidoc

+
+===== enabled
+
+The `enabled` settings can be used to disable the ssl configuration by setting


typo: setting

ruflin · 2016-08-30T06:17:07Z

filebeat/docs/migration.asciidoc


-If you follow the section on migrating the configuration, you will have TLS
-enabled. However, you must be aware that if the `tls` section is missing from the
+If you follow the section on migrating the configuration, you will have WSSL


ruflin · 2016-08-30T06:19:23Z

This needs an update to the CHANGELOG.md file under breaking changes.

ruflin · 2016-08-30T06:20:35Z

filebeat/filebeat.full.yml

+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server host


s/host/hosts/

ruflin · 2016-08-30T06:38:28Z

libbeat/scripts/migrate_beat_config_1_x_to_5_0.py

+
+
+@collect_lines
+def migrate_tls_settings(content):


ruflin · 2016-08-30T06:41:06Z

LGTM. I left a few minor comments. Would be good to get a second review as this one is quite big.

ruflin · 2016-08-30T06:42:06Z

@urso Did you run make docs to check if all the docs still build?

urso · 2016-08-30T13:09:56Z

Did you run make docs to check if all the docs still build?

Yep, still builds.

Only issue with docs is (as described by @dedemorton):

Just a note that when we change IDs for topics, we need to ask the web team to set up redirects, or our links from forum topics will be broken. That's a good reason to avoid renaming IDs unless (which is probably true in this case) you definitely want the name to change, and it's worth the extra work to get the redirect set up.

tsg · 2016-08-31T09:58:53Z

All looking good, thanks @urso for the great work.

Seems like quite a few redirects are required. We should decide one way or the other so we know if we want to merge the PR as is or adjust it.

ruflin · 2016-08-31T10:46:42Z

I suggest to go with the new urls and do redirects, as ssl is probably also what people search for and want to see in the url.

@urso Needs rebase.

urso · 2016-08-31T11:06:00Z

Yeah, not really happy about all the redirect. But agree with @ruflin about using ssl over tls.

rename tls to SSL + adapt some fields: - `insecure` has become `verification_mode`. `insecure: false` is replaced by mode `full` and `insecure: true` by mode `none`. - renamed `certificate_key` to `key` - introduced `key_passphrase` - replaced `min_version` and `max_version` with `supported_protocols` using an array of ok versions. New versions strings: `SSLv3`, `SSLV3.0`, `TLSv1` (use TLSv1.0), `TLSv1.0`, `TLSv1.1` and `TLSv1.2` Changes: - rewrite TLS dialer and TLS configuration - add support for encrypted key files - use TLS dialer with elasticsearch output (some more manual tests with and without system certificates required) - update unit/integration tests to use new settings - update default configuration files to use new ssl settings - update documentation (docs URL did also change from `tls` to `ssl`) - update migration script

urso added in progress Pull request is currently in progress. discuss Issue needs further discussion. labels Aug 21, 2016

dedemorton reviewed Aug 22, 2016
View reviewed changes

urso force-pushed the ssl-settings branch 3 times, most recently from 0df5e97 to a5cffdc Compare August 24, 2016 12:28

urso added review libbeat and removed in progress Pull request is currently in progress. discuss Issue needs further discussion. labels Aug 25, 2016

urso changed the title ~~[WIP] Update TLS configuration options~~ Update TLS configuration options Aug 25, 2016

dedemorton reviewed Aug 25, 2016
View reviewed changes

urso force-pushed the ssl-settings branch from cecb462 to 60c137b Compare August 28, 2016 13:31

ruflin reviewed Aug 30, 2016
View reviewed changes

libbeat/scripts/migrate_beat_config_1_x_to_5_0.py

@collect_lines

def migrate_tls_settings(content):

Copy link

Member

ruflin Aug 30, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice

urso force-pushed the ssl-settings branch 2 times, most recently from 3e74fce to 2f2bbe5 Compare August 31, 2016 11:31

dedemorton mentioned this pull request Aug 31, 2016

Get redirects set up for the following topics: #2426

Closed

13 tasks

urso force-pushed the ssl-settings branch from 2f2bbe5 to 31b906e Compare September 1, 2016 11:51

ruflin merged commit d15cab2 into elastic:master Sep 1, 2016

ppf2 mentioned this pull request Aug 18, 2017

Configtest should check for previous breaking changes #4943

Closed

urso deleted the ssl-settings branch February 19, 2019 18:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update TLS configuration options #2330

Update TLS configuration options #2330

urso commented Aug 21, 2016 •

edited

Loading

dedemorton Aug 22, 2016

dedemorton Aug 25, 2016

ruflin Aug 30, 2016

urso Aug 30, 2016

ruflin commented Aug 30, 2016

ruflin Aug 30, 2016

ruflin Aug 30, 2016

ruflin commented Aug 30, 2016

ruflin commented Aug 30, 2016

urso commented Aug 30, 2016

tsg commented Aug 31, 2016

ruflin commented Aug 31, 2016

urso commented Aug 31, 2016


		===== enabled

		The `enabled` settings can be used to disable the ssl configuration by setting

Update TLS configuration options #2330

Update TLS configuration options #2330

Conversation

urso commented Aug 21, 2016 • edited Loading

dedemorton Aug 22, 2016

Choose a reason for hiding this comment

dedemorton Aug 25, 2016

Choose a reason for hiding this comment

ruflin Aug 30, 2016

Choose a reason for hiding this comment

urso Aug 30, 2016

Choose a reason for hiding this comment

ruflin commented Aug 30, 2016

ruflin Aug 30, 2016

Choose a reason for hiding this comment

ruflin Aug 30, 2016

Choose a reason for hiding this comment

ruflin commented Aug 30, 2016

ruflin commented Aug 30, 2016

urso commented Aug 30, 2016

tsg commented Aug 31, 2016

ruflin commented Aug 31, 2016

urso commented Aug 31, 2016

urso commented Aug 21, 2016 •

edited

Loading