nsqd: add --tls-min-version config option

[twmb]

This adds a new tls-min-version flag that enables nsqd users
to specify a min tls version acceptable. The arguments to this
flag, , follow the format of Version in the tls package.

This commit adds --tls-min-version=ssl30 to the test.sh flags.

This PR also go fmt's nsq_to_nsq, which has been unformatted for a while, and reduces code clutter from tlsRequiredOption.String.

closes #512.

[twmb]

If tls-min-version is acceptable here, I will work on the same patch for go-nsq.

[twmb]

RFR @mreiferson

[mreiferson]

@twmb thanks!

Got an error in the travis run:

2014/12/09 23:00:31 ERROR: option resolution failed to coerce 768 for TLSMinVersion (<uint16 Value>) - invalid type

[twmb]

I was looking at it. I can't repro in dev and the message it gives (can't coerce 768 into uint16) doesn't make sense on surface inspection.

[mreiferson]

LGTM, thanks!

[jehiah]

It turns out that (until Go 1.5) if we don't specify max version we don't get TLS_FALLBACK_SCSV via https://twitter.com/benburkert/status/546063006975533057

@mreiferson do you think we should add a -tls-max-version or just set that value by default (or both)?

[mreiferson]

@jehiah let's just set the default for now? want to open the PR?

[mreiferson]

@jehiah relatedly, we probably shouldn't default --tls-min-version to ssl30, right?

[jehiah]

I Also realized as I started looking at this that specifying the flag type as an int type doesn't translate for the config file where you'd have to set 771 to get tls1.2. PR coming shortly to improve that too

[mreiferson]

Nah, you can set it to a string - it looks a bit convoluted but it works...

[mreiferson]

Sorry, I read that wrong, the config file can be set to a string but you're right, if you were setting Config directly (using nsqd as a package?) you would need to set an int...

It would be nice to be able to set a string there, too...

[mreiferson]

... take 3 - can't you just use the constants if you were setting Config directly? I actually don't think it makes sense to set strings there - unless I'm not understanding something?

[twmb]

Yeah, it'd make sense to take the tls constants. Sorry the code is a bit convoluted, I thought it'd make more sense to take "ssl30" from the command line as opposed to 0, but also I thought it'd make more sense to use tls.VersionSSL30 if using nsqd as a package.