chore(): Refactor TLS and mTLS support in OpenTelemetry Protocol Expo… #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

sandy2008 wants to merge 53 commits into main from feat/tls-mtls

...nTelemetry.Exporter.OpenTelemetryProtocol/Implementation/IHttpClientSecurityConfigurer.cs

-Original file line number
+Diff line change
@@ -0,0 +1,13 @@
+    // Copyright The OpenTelemetry Authors
+    // SPDX-License-Identifier: Apache-2.0
+    #if NET
+    namespace OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation;
+    internal interface IHttpClientSecurityConfigurer
+    {
+        void Apply(HttpClientHandler handler);
+    }
+    #endif

...Exporter.OpenTelemetryProtocol/Implementation/OpenTelemetryProtocolExporterEventSource.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -325,5 +325,12 @@ internal void MtlsHttpClientCreationFailed(Exception ex) @@
             Level = EventLevel.Error)]
         internal void MtlsHttpClientCreationFailed(string exception) =>
             this.WriteEvent(34, exception);
+        [Event(
+,
+            Message = "TLS configuration enabled. Trusted CA certificate: '{0}'.",
+            Level = EventLevel.Informational)]
+        internal void TlsConfigurationEnabled(string caCertificateSubject) =>
+            this.WriteEvent(35, caCertificateSubject);
     #endif
     }

...lementation/OtlpMtlsCertificateManager.cs → .../Implementation/OtlpCertificateManager.cs

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -10,9 +10,9 @@
  
    namespace OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation;

    /// <summary>

    /// Manages certificate loading, validation, and security checks for mTLS connections.

    /// Manages certificate loading, validation, and security checks for TLS connections.

    /// </summary>

    internal static class OtlpMtlsCertificateManager

    internal static class OtlpCertificateManager

    {

        internal const string CaCertificateType = "CA certificate";

        internal const string ClientCertificateType = "Client certificate";

....Exporter.OpenTelemetryProtocol/Implementation/OtlpHttpClientSecurityConfigurerFactory.cs

-Original file line number
+Diff line change
@@ -0,0 +1,157 @@
+    // Copyright The OpenTelemetry Authors
+    // SPDX-License-Identifier: Apache-2.0
+    #if NET
+    using System.Security.Cryptography.X509Certificates;
+    namespace OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation;
+    internal static class OtlpHttpClientSecurityConfigurerFactory
+    {
+        public static IHttpClientSecurityConfigurer? Create(
+            OtlpTlsOptions? tlsOptions,
+            OtlpMtlsOptions? mtlsOptions)
+        {
+            IHttpClientSecurityConfigurer? trustedCertConfigurer =
+                tlsOptions?.IsEnabled == true
+                    ? new TrustedCertConfigurer(tlsOptions)
+                    : null;
+            IHttpClientSecurityConfigurer? clientCertConfigurer =
+                mtlsOptions?.IsEnabled == true
+                    ? new ClientCertConfigurer(mtlsOptions)
+                    : null;
+            if (trustedCertConfigurer == null)
+            {
+                return clientCertConfigurer;
+            }
+            if (clientCertConfigurer == null)
+            {
+                return trustedCertConfigurer;
+            }
+            return new CompositeConfigurer(trustedCertConfigurer, clientCertConfigurer);
+        }
+        private sealed class CompositeConfigurer : IHttpClientSecurityConfigurer
+        {
+            private readonly IHttpClientSecurityConfigurer first;
+            private readonly IHttpClientSecurityConfigurer second;
+            internal CompositeConfigurer(IHttpClientSecurityConfigurer first, IHttpClientSecurityConfigurer second)
+            {
+                this.first = first;
+                this.second = second;
+            }
+            public void Apply(HttpClientHandler handler)
+            {
+                this.first.Apply(handler);
+                this.second.Apply(handler);
+            }
+        }
+        private sealed class TrustedCertConfigurer : IHttpClientSecurityConfigurer
+        {
+            private readonly OtlpTlsOptions tlsOptions;
+            internal TrustedCertConfigurer(OtlpTlsOptions tlsOptions)
+            {
+                this.tlsOptions = tlsOptions;
+            }
+            public void Apply(HttpClientHandler handler)
+            {
+                ArgumentNullException.ThrowIfNull(handler);
+                if (handler is not OtlpTlsHttpClientFactory.TlsHttpClientHandler tlsHandler)
+                {
+                    throw new ArgumentException(
+                        $"Expected handler type '{typeof(OtlpTlsHttpClientFactory.TlsHttpClientHandler)}'.",
+                        nameof(handler));
+                }
+                X509Certificate2? caCertificate = null;
+                try
+                {
+                    caCertificate = OtlpCertificateManager.LoadCaCertificate(this.tlsOptions.CertificatePath!);
+                    if (this.tlsOptions.EnableCertificateChainValidation)
+                    {
+                        OtlpCertificateManager.ValidateCertificateChain(
+                            caCertificate,
+                            OtlpCertificateManager.CaCertificateType);
+                    }
+                    OpenTelemetryProtocolExporterEventSource.Log.TlsConfigurationEnabled(
+                        caCertificate.Subject);
+                    tlsHandler.ConfigureTrustedCaCertificate(caCertificate);
+                    // Handler now owns the certificate and will dispose it when disposed.
+                    caCertificate = null;
+                }
+                finally
+                {
+                    caCertificate?.Dispose();
+                }
+            }
+        }
+        private sealed class ClientCertConfigurer : IHttpClientSecurityConfigurer
+        {
+            private readonly OtlpMtlsOptions mtlsOptions;
+            internal ClientCertConfigurer(OtlpMtlsOptions mtlsOptions)
+            {
+                this.mtlsOptions = mtlsOptions;
+            }
+            public void Apply(HttpClientHandler handler)
+            {
+                ArgumentNullException.ThrowIfNull(handler);
+                if (handler is not OtlpTlsHttpClientFactory.TlsHttpClientHandler tlsHandler)
+                {
+                    throw new ArgumentException(
+                        $"Expected handler type '{typeof(OtlpTlsHttpClientFactory.TlsHttpClientHandler)}'.",
+                        nameof(handler));
+                }
+                X509Certificate2? clientCertificate = null;
+                try
+                {
+                    clientCertificate = string.IsNullOrEmpty(this.mtlsOptions.ClientKeyPath)
+                        ? OtlpCertificateManager.LoadClientCertificate(
+                            this.mtlsOptions.ClientCertificatePath!,
+                            null)
+                        : OtlpCertificateManager.LoadClientCertificate(
+                            this.mtlsOptions.ClientCertificatePath!,
+                            this.mtlsOptions.ClientKeyPath);
+                    if (this.mtlsOptions.EnableCertificateChainValidation)
+                    {
+                        OtlpCertificateManager.ValidateCertificateChain(
+                            clientCertificate,
+                            OtlpCertificateManager.ClientCertificateType);
+                    }
+                    OpenTelemetryProtocolExporterEventSource.Log.MtlsConfigurationEnabled(
+                        clientCertificate.Subject);
+                    tlsHandler.ConfigureClientCertificate(clientCertificate);
+                    // Handler now owns the certificate and will dispose it when disposed.
+                    clientCertificate = null;
+                }
+                finally
+                {
+                    clientCertificate?.Dispose();
+                }
+            }
+        }
+    }
+    #endif

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsHttpClientFactory.cs

This file was deleted.

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpSpecConfigDefinitions.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -32,8 +32,10 @@ internal static class OtlpSpecConfigDefinitions @@
         public const string TracesTimeoutEnvVarName = "OTEL_EXPORTER_OTLP_TRACES_TIMEOUT";
         public const string TracesProtocolEnvVarName = "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL";
-        // mTLS certificate environment variables
+        // TLS certificate environment variables
         public const string CertificateEnvVarName = "OTEL_EXPORTER_OTLP_CERTIFICATE";
+        // mTLS client certificate environment variables
         public const string ClientKeyEnvVarName = "OTEL_EXPORTER_OTLP_CLIENT_KEY";
         public const string ClientCertificateEnvVarName = "OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE";
     }

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(): Refactor TLS and mTLS support in OpenTelemetry Protocol Expo… #2

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!