[Heartbeat] Add Additional ECS tls.* fields

[andrewvc]

Work in support of elastic/uptime#161

This patch adds additional ECS TLS and x509 fields. Note that we are blocked on the x509 fields which are not yet merged into ECS.

Sample output of the tls.* fields with this patch is below. Note the somewhat strange nesting of data in issuer and subject. This is per the ECS spec, but a bit awkward. We may want to break this data out into the more specific ECS x509 type in the future. For UI work we are likely fine to parse this on the client and display the CN section in most cases. I did break out the CN into its own field in x509.subject/issuer.common_name. However, if we do want to aggregate on issuer in the future it's good to have the full distinguished name to do that on.

This PR also refactors some libbeat code around parsing TLS versions and adds test coverage there as well.

{
	"tls": {
		"certificate_not_valid_after": "2020-07-16T03:15:39Z",
		"certificate_not_valid_before": "2019-08-16T01:40:25Z",
		"server": {
			"hash": {
				"sha1": "b7b4b89ef0d0caf39d223736f0fdbb03c7b426f1",
				"sha256": "12b00d04db0db8caa302bfde043e88f95baceb91e86ac143e93830b4bbec726d"
			},
			"x509": {
				"issuer": {
					"common_name": "GlobalSign CloudSSL CA - SHA256 - G3",
					"distinguished_name": "CN=GlobalSign CloudSSL CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE"
				},
				"not_after": "2020-07-16T03:15:39Z",
				"not_before": "2019-08-16T01:40:25Z",
				"public_key_algorithm": "RSA",
				"public_key_size": 2048,
				"serial_number": "26610543540289562361990401194",
				"signature_algorithm": "SHA256-RSA",
				"subject": {
					"common_name": "r2.shared.global.fastly.net",
					"distinguished_name": "CN=r2.shared.global.fastly.net,O=Fastly\\, Inc.,L=San Francisco,ST=California,C=US"
				}
			}
		}
	}
}

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Verify that the fields here match the ECS spec

How to test this PR locally

Run against TLS/Non-TLS endpoints

[elasticmachine]

Pinging @elastic/uptime (:uptime)

[axrayn]

@andrewvc Looking forward to this addition, will save our current heartbeat/packetbeat kludge to report on TLS certificates validity.

Any chance that you could also include the server certificate key length? We have a need from our Cyber folks to be able to identify certificates with a KeyLength less than 2048 bits.

Packetbeat uses a function here that should be able to be replicated over to the tlsmeta/tls.go file for this.

[blakerouse]

Overall this looks good. Just one comment, but not really a blocker.

[blakerouse]

It might be easier to test and use less memory to create a TLSMeta struct and place that inside of the event. Using map[string]interface{} everywhere is not very memory efficent. Example is #16538 where it was converted to a struct.

Its not really a blocker, just something that could help.

[andrewvc]

Discussed this with @simitt . Looks like this is an area @urso is working on, but isn't possible today because beats processors expect all event fields to be maps. I agree that it would be nice.

[blakerouse]

Looks good and the tests looks like it gives great coverage!

[blakerouse]

Wildcard changes also look good.