Skip to content

Commit 35433b7

Browse files
andrewkrohkarmi
authored andcommitted
Use TLS MinVersion, not MaxVersion, in documentation and code examples
Let the examples pin the minimum supported TLS version, not the maximum. This will prevent connections to TLS 1.0. I removed InsecureSkipVerify from the examples so that users to don't inadvertently copy this insecure setup into their applications. Closes #26
1 parent 3ffd7a3 commit 35433b7

5 files changed

+8
-9
lines changed

README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,8 @@ cfg := elasticsearch.Config{
115115
ResponseHeaderTimeout: time.Second,
116116
DialContext: (&net.Dialer{Timeout: time.Second}).DialContext,
117117
TLSClientConfig: &tls.Config{
118-
MaxVersion: tls.VersionTLS11,
119-
InsecureSkipVerify: true,
118+
MinVersion: tls.VersionTLS11,
119+
// ...
120120
},
121121
},
122122
}

_examples/configuration.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ func main() {
2727
ResponseHeaderTimeout: time.Millisecond,
2828
DialContext: (&net.Dialer{Timeout: time.Nanosecond}).DialContext,
2929
TLSClientConfig: &tls.Config{
30-
MaxVersion: tls.VersionTLS11,
31-
InsecureSkipVerify: true,
30+
MinVersion: tls.VersionTLS11,
31+
// ...
3232
},
3333
},
3434
}
@@ -38,5 +38,6 @@ func main() {
3838
log.Printf("Error creating the client: %s", err)
3939
} else {
4040
log.Println(es.Info())
41+
// => dial tcp: i/o timeout
4142
}
4243
}

doc.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,7 @@ To configure the client, pass a Config object to the NewClient function:
2020
ResponseHeaderTimeout: time.Second,
2121
DialContext: (&net.Dialer{Timeout: time.Second}).DialContext,
2222
TLSClientConfig: &tls.Config{
23-
MaxVersion: tls.VersionTLS11,
24-
InsecureSkipVerify: true,
23+
MinVersion: tls.VersionTLS11,
2524
},
2625
},
2726
}

elasticsearch_example_test.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@ func ExampleNewClient() {
4242
ResponseHeaderTimeout: time.Second,
4343
DialContext: (&net.Dialer{Timeout: time.Second}).DialContext,
4444
TLSClientConfig: &tls.Config{
45-
MaxVersion: tls.VersionTLS11,
46-
InsecureSkipVerify: true,
45+
MinVersion: tls.VersionTLS11,
4746
},
4847
},
4948
}

elasticsearch_integration_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func TestClientTransport(t *testing.T) {
125125
ResponseHeaderTimeout: time.Second,
126126
DialContext: (&net.Dialer{Timeout: time.Nanosecond}).DialContext,
127127
TLSClientConfig: &tls.Config{
128-
MaxVersion: tls.VersionTLS11,
128+
MinVersion: tls.VersionTLS11,
129129
InsecureSkipVerify: true,
130130
},
131131
},

0 commit comments

Comments
 (0)