[heartbeat][libbeat][metricbeat][filebeat] Pass TLS options to forward proxies

heartbeat/monitors/active/http/http.go

@@ -138,6 +138,7 @@ func newRoundTripper(config *Config, tls *transport.TLSConfig) (*http.Transport,
 		Proxy:             proxy,
 		Dial:              dialer.Dial,
 		DialTLS:           tlsDialer.Dial,
+		TLSClientConfig:   tls.ToConfig(),
 		DisableKeepAlives: true,
 	}, nil
 }

heartbeat/monitors/active/http/http_test.go

@@ -39,6 +39,7 @@ import (
 	"github.com/elastic/beats/libbeat/beat"
 	"github.com/elastic/beats/libbeat/common"
 	"github.com/elastic/beats/libbeat/common/file"
+	"github.com/elastic/beats/libbeat/outputs/transport"
 	btesting "github.com/elastic/beats/libbeat/testing"
 	"github.com/elastic/go-lookslike"
 	"github.com/elastic/go-lookslike/isdef"
@@ -498,3 +499,31 @@ func TestRedirect(t *testing.T) {
 		event.Fields,
 	)
 }
+
+func TestNewRoundTripper(t *testing.T) {
+	configs := map[string]Config{
+		"Plain":      {Timeout: time.Second},
+		"With Proxy": {Timeout: time.Second, ProxyURL: "http://localhost:1234"},
+	}
+
+	for name, config := range configs {
+		t.Run(name, func(t *testing.T) {
+			transp, err := newRoundTripper(&config, &transport.TLSConfig{})
+			require.NoError(t, err)
+
+			if config.ProxyURL == "" {
+				require.Nil(t, transp.Proxy)
+			} else {
+				require.NotNil(t, transp.Proxy)
+			}
+
+			// It's hard to compare func types in tests
+			require.NotNil(t, transp.Dial)
+			require.NotNil(t, transport.TLSDialer)
+
+			require.Equal(t, (&transport.TLSConfig{}).ToConfig(), transp.TLSClientConfig)
+			require.True(t, transp.DisableKeepAlives)
+		})
+	}
+
+}

libbeat/common/transport/tlscommon/tls_config.go

@@ -66,21 +66,16 @@ type TLSConfig struct {
 	ClientAuth tls.ClientAuthType
 }
 
-// BuildModuleConfig takes the TLSConfig and transform it into a `tls.Config`.
-func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
-	if c == nil {
-		// use default TLS settings, if config is empty.
-		return &tls.Config{ServerName: host}
-	}
-
+// ToConfig generates a tls.Config object. Note, you must use BuildModuleConfig to generate a config with
+// ServerName set, use that method for servers with SNI.
+func (c *TLSConfig) ToConfig() *tls.Config {
 	minVersion, maxVersion := extractMinMaxVersion(c.Versions)
 	insecure := c.Verification != VerifyFull
 	if insecure {
 		logp.Warn("SSL/TLS verifications disabled.")
 	}
 
 	return &tls.Config{
-		ServerName:         host,
 		MinVersion:         minVersion,
 		MaxVersion:         maxVersion,
 		Certificates:       c.Certificates,
@@ -93,3 +88,15 @@ func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
 		ClientAuth:         c.ClientAuth,
 	}
 }
+
+// BuildModuleConfig takes the TLSConfig and transform it into a `tls.Config`.
+func (c *TLSConfig) BuildModuleConfig(host string) *tls.Config {
+	if c == nil {
+		// use default TLS settings, if config is empty.
+		return &tls.Config{ServerName: host}
+	}
+
+	config := c.ToConfig()
+	config.ServerName = host
+	return config
+}