[otlp] Add mTLS Support for OTLP Exporter

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/ExportClient/OtlpGrpcExportClient.cs

@@ -10,7 +10,7 @@
 namespace OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient;
 
 /// <summary>Base class for sending OTLP export request over gRPC.</summary>
-internal sealed class OtlpGrpcExportClient : OtlpExportClient
+internal sealed class OtlpGrpcExportClient : OtlpExportClient, IDisposable
 {
     public const string GrpcStatusDetailsHeader = "grpc-status-details-bin";
     private static readonly ExportClientHttpResponse SuccessExportResponse = new(success: true, deadlineUtc: default, response: null, exception: null);
@@ -24,18 +24,97 @@ private static readonly ExportClientGrpcResponse DefaultExceptionExportClientGrp
             status: null,
             grpcStatusDetailsHeader: null);
 
+#if NET8_0_OR_GREATER
+    private readonly HttpClient? secureClient;
+    private readonly bool useMtls;
+    private readonly OtlpExporterOptions options;
+    private readonly string signalPath;
+    private bool disposed;
+#endif
+
     public OtlpGrpcExportClient(OtlpExporterOptions options, HttpClient httpClient, string signalPath)
         : base(options, httpClient, signalPath)
     {
+#if NET8_0_OR_GREATER
+        this.options = options;
+        this.signalPath = signalPath;
+
+        // Determine if we should use mTLS based on certificate configuration and endpoint
+        this.useMtls = options.Endpoint.Scheme == Uri.UriSchemeHttps &&
+            (!string.IsNullOrEmpty(options.CertificateFilePath) ||
+            (!string.IsNullOrEmpty(options.ClientCertificateFilePath) && !string.IsNullOrEmpty(options.ClientKeyFilePath)));
+
+        // Create a secure client if mTLS is enabled
+        if (this.useMtls)
+        {
+            using var handler = new HttpClientHandler();
+
+            #if !NET462
+            handler.CheckCertificateRevocationList = true;
+            #endif
+
+            if (!string.IsNullOrEmpty(options.CertificateFilePath))
+            {
+                using var trustedCertificate = MtlsUtility.LoadCertificateWithValidation(options.CertificateFilePath);
+                handler.ServerCertificateCustomValidationCallback = (_, cert, __, unexpectedErrors) =>
+                {
+                    return MtlsUtility.ValidateCertificateChain(cert!, trustedCertificate);
+                };
+            }
+
+            if (!string.IsNullOrEmpty(options.ClientCertificateFilePath) && !string.IsNullOrEmpty(options.ClientKeyFilePath))
+            {
+                var clientCertificate = MtlsUtility.LoadCertificateWithValidation(
+                    options.ClientCertificateFilePath,
+                    options.ClientKeyFilePath);
+                handler.ClientCertificates.Add(clientCertificate);
+            }
+
+            this.secureClient = new HttpClient(handler)
+            {
+                Timeout = TimeSpan.FromMilliseconds(options.TimeoutMilliseconds),
+            };
+        }
+#endif
     }
 
     internal override MediaTypeHeaderValue MediaTypeHeader => MediaHeaderValue;
 
     internal override bool RequireHttp2 => true;
 
-    /// <inheritdoc/>
+    /// <inheritdoc />
     public override ExportClientResponse SendExportRequest(byte[] buffer, int contentLength, DateTime deadlineUtc, CancellationToken cancellationToken = default)
     {
+#if NET8_0_OR_GREATER
+        if (this.useMtls && this.secureClient != null)
+        {
+            try
+            {
+                using var request = new HttpRequestMessage(HttpMethod.Post, this.Endpoint)
+                {
+                    Content = new ByteArrayContent(buffer, 0, contentLength)
+                    {
+                        Headers =
+                        {
+                            ContentType = this.MediaTypeHeader,
+                        },
+                    },
+                };
+
+                using var response = this.secureClient.SendAsync(request, cancellationToken).GetAwaiter().GetResult();
+                response.EnsureSuccessStatusCode();
+
+                OpenTelemetryProtocolExporterEventSource.Log.ExportSuccess(this.Endpoint.ToString(), "mTLS export completed successfully.");
+                return SuccessExportResponse;
+            }
+            catch (Exception ex)
+            {
+                OpenTelemetryProtocolExporterEventSource.Log.FailedToReachCollector(this.Endpoint, ex);
+                return DefaultExceptionExportClientGrpcResponse;
+            }
+        }
+#endif
+
         try
         {
             using var httpRequest = this.CreateHttpRequest(buffer, contentLength);
@@ -44,7 +123,7 @@ public override ExportClientResponse SendExportRequest(byte[] buffer, int conten
             httpResponse.EnsureSuccessStatusCode();
 
             var trailingHeaders = httpResponse.TrailingHeaders();
-            Status status = GrpcProtocolHelpers.GetResponseStatus(httpResponse, trailingHeaders);
+            var status = GrpcProtocolHelpers.GetResponseStatus(httpResponse, trailingHeaders);
 
             if (status.Detail.Equals(Status.NoReplyDetailMessage, StringComparison.Ordinal))
             {
@@ -153,11 +232,64 @@ public override ExportClientResponse SendExportRequest(byte[] buffer, int conten
         }
     }
 
+    /// <summary>
+    /// Shuts down the exporter and cleans up any resources.
+    /// </summary>
+    /// <param name="timeoutMilliseconds">The maximum time to wait for the shutdown to complete.</param>
+    /// <returns>True if shutdown succeeded. False otherwise.</returns>
+    public new bool Shutdown(int timeoutMilliseconds)
+    {
+#if NET8_0_OR_GREATER
+        if (this.secureClient != null)
+        {
+            try
+            {
+                this.secureClient.Dispose();
+            }
+            catch
+            {
+                // Ignore shutdown errors
+            }
+        }
+#endif
+        return base.Shutdown(timeoutMilliseconds);
+    }
+
+    /// <summary>
+    /// Releases all resources used by the current instance.
+    /// </summary>
+    public void Dispose()
+    {
+#if NET8_0_OR_GREATER
+        this.Dispose(true);
+        GC.SuppressFinalize(this);
+#endif
+    }
+
     private static bool IsTransientNetworkError(HttpRequestException ex)
     {
         return ex.InnerException is System.Net.Sockets.SocketException socketEx
             && (socketEx.SocketErrorCode == System.Net.Sockets.SocketError.TimedOut
                 || socketEx.SocketErrorCode == System.Net.Sockets.SocketError.ConnectionReset
                 || socketEx.SocketErrorCode == System.Net.Sockets.SocketError.HostUnreachable);
     }
+
+#if NET8_0_OR_GREATER
+    /// <summary>
+    /// Releases the unmanaged resources used by the instance and optionally releases the managed resources.
+    /// </summary>
+    /// <param name="disposing">true to release both managed and unmanaged resources; false to release only unmanaged resources.</param>
+    private void Dispose(bool disposing)
+    {
+        if (!this.disposed)
+        {
+            if (disposing)
+            {
+                this.secureClient?.Dispose();
+            }
+
+            this.disposed = true;
+        }
+    }
+#endif
 }

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/MtlsUtility.cs

@@ -0,0 +1,185 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#if NET8_0_OR_GREATER
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+
+namespace OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation;
+
+/// <summary>
+/// Utility class for mutual TLS (mTLS) certificate operations.
+/// </summary>
+internal static class MtlsUtility
+{
+    /// <summary>
+    /// Loads a certificate from a PEM file with validation checks.
+    /// </summary>
+    /// <param name="certificateFilePath">Path to the certificate file.</param>
+    /// <returns>The loaded certificate.</returns>
+    /// <exception cref="FileNotFoundException">Thrown when the certificate file is not found.</exception>
+    /// <exception cref="UnauthorizedAccessException">Thrown when there's insufficient permission to read the file.</exception>
+    /// <exception cref="CryptographicException">Thrown when the certificate is invalid.</exception>
+    public static X509Certificate2 LoadCertificateWithValidation(string certificateFilePath)
+    {
+        ArgumentNullException.ThrowIfNull(certificateFilePath);
+
+        if (!File.Exists(certificateFilePath))
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateFileNotFound(certificateFilePath);
+            throw new FileNotFoundException("Certificate file not found.", certificateFilePath);
+        }
+
+#if NET9_0_OR_GREATER
+        try
+        {
+            var pemContent = File.ReadAllText(certificateFilePath);
+            var certificate = X509Certificate2.CreateFromPem(pemContent);
+            ValidateCertificate(certificate);
+            return certificate;
+        }
+        catch (CryptographicException ex)
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateInvalid(ex);
+            throw;
+        }
+#else
+        try
+        {
+            // Read the PEM content from the certificate file
+            var pemContent = File.ReadAllText(certificateFilePath);
+
+            // Create the certificate from PEM. If the PEM contains only the certificate,
+            // the resulting X509Certificate2 will not have a private key.
+            var certificate = X509Certificate2.CreateFromPem(pemContent);
+            ValidateCertificate(certificate);
+            return certificate; // Caller is responsible for disposal
+        }
+        catch (CryptographicException ex)
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateInvalid(ex);
+            throw;
+        }
+#endif
+    }
+
+    /// <summary>
+    /// Loads a certificate with its private key from PEM files with validation checks.
+    /// </summary>
+    /// <param name="certificateFilePath">Path to the certificate file.</param>
+    /// <param name="keyFilePath">Path to the private key file.</param>
+    /// <returns>The loaded certificate with private key.</returns>
+    /// <exception cref="FileNotFoundException">Thrown when either file is not found.</exception>
+    /// <exception cref="UnauthorizedAccessException">Thrown when there\'s insufficient permission to read either file.</exception>
+    /// <exception cref="CryptographicException">Thrown when the certificate or key is invalid.</exception>
+    public static X509Certificate2 LoadCertificateWithValidation(string certificateFilePath, string keyFilePath)
+    {
+        ArgumentNullException.ThrowIfNull(certificateFilePath);
+        ArgumentNullException.ThrowIfNull(keyFilePath);
+
+        if (!File.Exists(certificateFilePath))
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateFileNotFound(certificateFilePath);
+            throw new FileNotFoundException("Certificate file not found.", certificateFilePath);
+        }
+
+        if (!File.Exists(keyFilePath))
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateFileNotFound(keyFilePath);
+            throw new FileNotFoundException("Key file not found.", keyFilePath);
+        }
+
+#if NET9_0_OR_GREATER
+        try
+        {
+            var certPem = File.ReadAllText(certificateFilePath);
+            var keyPem = File.ReadAllText(keyFilePath);
+            var certificate = X509Certificate2.CreateFromPem(certPem, keyPem);
+            ValidateCertificate(certificate);
+            return certificate;
+        }
+        catch (CryptographicException ex)
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateInvalid(ex);
+            throw;
+        }
+#else
+        try
+        {
+            // Read the PEM content from the certificate and key files
+            var certPem = File.ReadAllText(certificateFilePath);
+            var keyPem = File.ReadAllText(keyFilePath);
+
+            // Create the certificate from PEM, associating the private key.
+            var certificate = X509Certificate2.CreateFromPem(certPem, keyPem);
+            ValidateCertificate(certificate);
+            return certificate; // Caller is responsible for disposal
+        }
+        catch (CryptographicException ex)
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateInvalid(ex);
+            throw;
+        }
+#endif
+    }
+
+    /// <summary>
+    /// Validates a certificate chain against a trusted root certificate.
+    /// </summary>
+    /// <param name="certificate">The certificate to validate.</param>
+    /// <param name="trustedRoot">The trusted root certificate.</param>
+    /// <returns>True if the chain is valid, false otherwise.</returns>
+    public static bool ValidateCertificateChain(X509Certificate2 certificate, X509Certificate2 trustedRoot)
+    {
+        using var chain = new X509Chain();
+        chain.ChainPolicy.ExtraStore.Add(trustedRoot);
+        chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+        chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;
+
+        bool isValid = chain.Build(certificate);
+
+        if (!isValid)
+        {
+            foreach (var status in chain.ChainStatus)
+            {
+                OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateChainValidationFailed(
+                    status.StatusInformation);
+            }
+        }
+
+        return isValid;
+    }
+
+    private static void ValidateCertificate(X509Certificate2 certificate)
+    {
+        ArgumentNullException.ThrowIfNull(certificate);
+
+        using var chain = new X509Chain();
+        chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+        chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;
+
+        if (!chain.Build(certificate))
+        {
+            var statusInformation = string.Join(", ", chain.ChainStatus.Select(s => $"{s.StatusInformation} ({s.Status})"));
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsCertificateChainValidationFailed(statusInformation);
+            throw new InvalidOperationException($"Certificate chain validation failed: {statusInformation}");
+        }
+    }
+
+    private static void ValidateFilePermissions(string filePath)
+    {
+        try
+        {
+            // Check if file exists and is readable
+            using (File.OpenRead(filePath))
+            {
+            }
+        }
+        catch (Exception ex)
+        {
+            OpenTelemetryProtocolExporterEventSource.Log.MtlsFilePermissionCheckFailed(filePath, ex);
+            throw;
+        }
+    }
+}
+#endif