# Config: Transport Section

Some Fluentd input, output, and filter plugins, that use `server`/`http_server` plugin helper, also support the `<transport>` section to specify how to handle the connections.

## Transport Section Overview

The **`transport`** section must be under `<match>`, `<source>`, and `<filter>` sections. It specifies the transport protocol, version, and certificates.

```text
# tcp
<transport tcp>
</transport>

# udp
<transport udp>
</transport>

# tls
<transport tls>
  cert_path /path/to/fluentd.crt
  private_key_path /path/to/fluentd.key
  private_key_passphrase YOUR_PASSPHRASE
  # ...
</transport>
```

## Parameters

### Protocol

The protocol is specified as the argument of `<transport>` section.

```
<transport PROTOCOL>
</transport>
```

* \[enum: `tcp`/`udp`/`tls`\]
  * Default: `tcp`

### General Setting

#### `linger_timeout`

| type | default | available transport type | version |
| :--- | :--- | :--- | :--- |
| integer | 0 | tcp, tls | 1.14.6 |

The timeout \(seconds\) to set `SO_LINGER`.

The default value `0` is to send RST rather than FIN to avoid lots of connections sitting in TIME_WAIT on closing.

You can set positive value to send FIN on closing.

{% hint style='info' %}
On Windows, Fluentd sends FIN without depending on this setting.
{% endhint %}

```
<transport tcp>
  linger_timeout 1
</transport>
```

#### `receive_buffer_size`

| type | default | available transport type | version |
| :--- | :--- | :--- | :--- |
| integer | nil | tcp, udp, tls | 1.18.0 |

The max size of socket receive buffer for TCP/UDP. This is used in `SO_RCVBUF` socket option.

```text
<transport udp>
  receive_buffer_size 4194304
</transport>
```

### TLS Setting

* `version`: \[enum: `TLS1_1`/`TLS1_2`/`TLS1_3`\]
  * Default: `TLSv1_2`
* `min_version`: \[enum: `TLS1_1`/`TLS1_2`/`TLS1_3`\]
  * Default: `nil`
  * Specifies the lower bound of the supported SSL/TLS protocol.
* `max_version`: \[enum: `TLS1_1`/`TLS1_2`/`TLS1_3`\]
  * Default: `nil`
  * Specifies the upper bound of the supported SSL/TLS protocol.
* `ciphers` \[string\]
  * Default: `"ALL:!aNULL:!eNULL:!SSLv2"`
  * OpenSSL 1.0.0 or higher default.
* `insecure` \[bool\]
  * Default: `false` \(uses secure connection with `tls`\)
* `ensure_fips`: \[bool\]
  * Default: `false`
  * Version: 1.18.0
  * Specifies whether it must use FIPS mode with OpenSSL. If `true`, Fluentd will check FIPS mode is supported in your environment, if not, just aborts.
    If `false`, it does nothing and doesn't care about FIPS mode with OpenSSL.

If you want to accept multiple TLS protocols, use `min_version`/`max_version` instead of `version`. To support the old style, fluentd accepts `TLS1_1` and `TLSv1_1` values.

NOTE: `TLS1_3` is available when your system supports TLS 1.3.

### Signed Public CA Parameters

For `<transport tls>`:

* `ca_path`: \[string\]
  * Default: `nil`
  * Specifies the path of CA certificate file
* `cert_path`: \[string\]
  * Default: `nil`
  * Specifies the path of Certificate file
* `private_key_path`: \[string\]
  * Default: `nil`
  * Specifies the path of Private Key file
* `private_key_passphrase`: \[string\]
  * Default: `nil`
  * Specifies the public CA private key passphrase
* `client_cert_auth`: \[bool\]
  * Default: `false`
  * If `true`, Fluentd will check all the incoming HTTPS requests for a

    client certificate signed by the trusted CA. The requests that don't

    supply a valid client certificate will fail.
* `cert_verifier`: \[string\]
  * Default: `nil`
  * Specifies the code path for cert verification. See also \[server

    article\]\(/developer/api-plugin-helper-server.md\#cert\_verifier-example\).

### Generated and Signed by Private CA Parameters

For `<transport tls>`:

* `ca_cert_path`: \[string\]
  * Default: `nil`
  * Specifies the private CA cert path
* `ca_private_key_path`: \[string\]
  * Default: `nil`
  * Specifies the private CA private key path
* `ca_private_key_passphrase`: \[string\]
  * Default: `nil`
  * Specifies the private CA private key passphrase

### Generated and Signed by Private CA Certs or Self-signed Parameters

For `<transport tls>`:

* `generate_private_key_length`: \[integer\]
  * Default: 2048
* `generate_cert_country`: \[string\]
  * Default: US
* `generate_cert_state`: \[string\]
  * Default: CA
* `generate_cert_locality`: \[string\]
  * Default: Mountain View
* `generate_cert_common_name`: \[string\]
  * Default: `nil`
* `generate_cert_expiration`: \[time\]
  * Default: \(60 \* 60 \* 24 = 86400\) \* 365 \* 10 = 10 years

## Cert Digest Algorithm Parameter

For `<transport tls>`:

* `generate_cert_digest`: \[enum: `sha1`/`sha256`/`sha384`/`sha512`\]
  * Default: `sha256`