feat: implement mtls

pom.xml

@@ -461,7 +461,7 @@
                                 **/target/**, **/*.jar, **/.git/**, **/.*, **/*.png, **/*.iml, **/*.bolt, .idea/**,
                                 **/*nightly*/**, **/.m2/**, LICENSE, **/*.md, **/.github/**, license_header.txt,
                                 release.properties/, **/pom.xml.releaseBackup, **/pom.xml.tag, **/semantic.yml,
-                                .circleci/config.yml, **/*.pem
+                                .circleci/config.yml, **/*.pem, **/*.p12, **/*.crt, **/*.key
                             </excludes>
                         </licenseSet>
                     </licenseSets>

src/main/java/com/influxdb/v3/client/config/ClientConfig.java

@@ -129,7 +129,15 @@ public final class ClientConfig {
     private final String proxyUrl;
     private final Authenticator authenticator;
     private final Map<String, String> headers;
+
+    private final String certificatePath;
+    private final String certificateKeyPath;
+    private final String certificateP12FilePath;
+    private final char[] keyPassword;
+
     private final String sslRootsFilePath;
+    private final char[] sslRootFilePassword;
+
     private final boolean disableGRPCCompression;
     private final List<ClientInterceptor> interceptors;
 
@@ -337,6 +345,31 @@ public String sslRootsFilePath() {
         return sslRootsFilePath;
     }
 
+    @Nullable
+    public char[] getSslRootFilePassword() {
+        return sslRootFilePassword;
+    }
+
+    @Nullable
+    public String getCertificatePath() {
+        return certificatePath;
+    }
+
+    @Nullable
+    public String getCertificateKeyPath() {
+        return certificateKeyPath;
+    }
+
+    @Nullable
+    public String getCertificateP12FilePath() {
+        return certificateP12FilePath;
+    }
+
+    @Nullable
+    public char[] getKeyPassword() {
+        return keyPassword;
+    }
+
     /**
      * Gets the (proxy) authenticator.
      *
@@ -424,6 +457,11 @@ public boolean equals(final Object o) {
                 && Objects.equals(authenticator, that.authenticator)
                 && Objects.equals(headers, that.headers)
                 && Objects.equals(sslRootsFilePath, that.sslRootsFilePath)
+                && Arrays.equals(sslRootFilePassword, that.sslRootFilePassword)
+                && Objects.equals(certificatePath, that.certificatePath)
+                && Objects.equals(certificateKeyPath, that.certificateKeyPath)
+                && Objects.equals(certificateP12FilePath, that.certificateP12FilePath)
+                && Arrays.equals(keyPassword, that.keyPassword)
                 && disableGRPCCompression == that.disableGRPCCompression
                 && Objects.equals(interceptors, that.interceptors);
     }
@@ -434,7 +472,9 @@ public int hashCode() {
                 database, writePrecision, gzipThreshold, writeNoSync, writeAcceptPartial, writeUseV2Api,
                 timeout, writeTimeout, queryTimeout, allowHttpRedirects, disableServerCertificateValidation,
                 proxy, proxyUrl, authenticator, headers,
-                defaultTags, sslRootsFilePath, disableGRPCCompression, interceptors);
+                defaultTags, sslRootsFilePath, Arrays.hashCode(sslRootFilePassword), certificatePath,
+                certificateKeyPath, certificateP12FilePath, Arrays.hashCode(keyPassword),
+                disableGRPCCompression, interceptors);
     }
 
     @Override
@@ -459,6 +499,11 @@ public String toString() {
                 .add("headers=" + headers)
                 .add("defaultTags=" + defaultTags)
                 .add("sslRootsFilePath=" + sslRootsFilePath)
+                .add("sslRootFilePassword=" + Arrays.toString(sslRootFilePassword))
+                .add("certificatePath=" + certificatePath)
+                .add("certificateKeyPath=" + certificateKeyPath)
+                .add("certificateP12FilePath=" + certificateP12FilePath)
+                .add("keyPassword=" + Arrays.toString(keyPassword))
                 .add("disableGRPCCompression=" + disableGRPCCompression)
                 .toString();
     }
@@ -490,7 +535,15 @@ public static final class Builder {
         private String proxyUrl;
         private Authenticator authenticator;
         private Map<String, String> headers;
+
+        private String certificatePath;
+        private String certificateKeyPath;
+        private String certificateP12FilePath;
+        private char[] keyPassword;
+
         private String sslRootsFilePath;
+        private char[] sslRootFilePassword;
+
         private boolean disableGRPCCompression;
         private List<ClientInterceptor> interceptors;
 
@@ -805,6 +858,45 @@ public Builder sslRootsFilePath(@Nullable final String sslRootsFilePath) {
             return this;
         }
 
+        @Nonnull
+        public Builder sslRootFilePassword(@Nullable final char[] sslRootFilePassword) {
+
+            this.sslRootFilePassword = sslRootFilePassword;
+            return this;
+        }
+
+        /**
+         * Sets the file paths for the certificate and its corresponding private key for secure connections.
+         *
+         * @param certificatePath the file path to the certificate file in PEM format, must not be null.
+         * @param certificateKeyPath the file path to the certificate's private key in PEM format, must not be null.
+         * @return the updated {@link ClientConfig.Builder} instance.
+         */
+        @Nonnull
+        public Builder certificateFilePath(@Nonnull final String certificatePath,
+                                           @Nonnull final String certificateKeyPath) {
+            this.certificatePath = certificatePath;
+            this.certificateKeyPath = certificateKeyPath;
+
+            return this;
+        }
+
+        @Nonnull
+        public Builder certificateP12FilePath(@Nonnull final String certificateP12FilePath,
+                                                                    @Nullable final char[] password) {
+            this.certificateP12FilePath = certificateP12FilePath;
+            this.keyPassword = password;
+
+            return this;
+        }
+
+        @Nonnull
+        public Builder keyPassword(@Nullable final char[] keyPassword) {
+
+            this.keyPassword = keyPassword;
+            return this;
+        }
+
         /**
          * Sets whether to disable gRPC compression. Default is 'false'.
          *
@@ -1023,6 +1115,11 @@ private ClientConfig(@Nonnull final Builder builder) {
         authenticator = builder.authenticator;
         headers = builder.headers;
         sslRootsFilePath = builder.sslRootsFilePath;
+        sslRootFilePassword = builder.sslRootFilePassword;
+        certificatePath = builder.certificatePath;
+        certificateKeyPath = builder.certificateKeyPath;
+        certificateP12FilePath = builder.certificateP12FilePath;
+        keyPassword = builder.keyPassword;
         disableGRPCCompression = builder.disableGRPCCompression;
         interceptors = builder.interceptors;
     }

src/main/java/com/influxdb/v3/client/internal/FlightSqlClient.java

@@ -21,7 +21,6 @@
  */
 package com.influxdb.v3.client.internal;
 
-import java.io.FileInputStream;
 import java.net.InetSocketAddress;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -38,6 +37,8 @@
 import java.util.stream.StreamSupport;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManagerFactory;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -190,9 +191,28 @@ SslContext createNettySslContext(@Nonnull final ClientConfig config) {
             sslContextBuilder = GrpcSslContexts.forClient();
             if (config.getDisableServerCertificateValidation()) {
                 sslContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE);
-            } else if (config.sslRootsFilePath() != null) {
-                try (FileInputStream fileInputStream = new FileInputStream(config.sslRootsFilePath())) {
-                    sslContextBuilder.trustManager(fileInputStream);
+            } else {
+                TrustManagerFactory tmf = null;
+                KeyManagerFactory kmf = null;
+                if (config.sslRootsFilePath() != null) {
+                    tmf = Utils.createTmf(
+                            config.sslRootsFilePath(),
+                            config.getSslRootFilePassword());
+                }
+
+                if (config.getCertificatePath() != null && config.getCertificateKeyPath() != null) {
+                    kmf = Utils.createKmf(config.getCertificatePath(), config.getCertificateKeyPath());
+                }
+
+                if (config.getCertificateP12FilePath() != null) {
+                    kmf = Utils.createKmfP12(config.getCertificateP12FilePath(), config.getKeyPassword());
+                }
+
+                if (tmf != null) {
+                    sslContextBuilder.trustManager(tmf);
+                }
+                if (kmf != null) {
+                    sslContextBuilder.keyManager(kmf);
                 }
             }
             return sslContextBuilder.build();

src/main/java/com/influxdb/v3/client/internal/RestClient.java

@@ -42,6 +42,7 @@
 import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
@@ -127,16 +128,32 @@ public void checkServerTrusted(
 
         if (baseUrl.startsWith("https")) {
             try {
-                SSLContext sslContext = SSLContext.getInstance("TLS");
                 if (config.getDisableServerCertificateValidation()) {
+                    SSLContext sslContext = SSLContext.getInstance("TLS");
                     sslContext.init(null, TRUST_ALL_CERTS, new SecureRandom());
-                } else if (config.sslRootsFilePath() != null) {
-                    X509TrustManager x509TrustManager = getX509TrustManagerFromFile(config.sslRootsFilePath());
-                    sslContext.init(null, new X509TrustManager[]{x509TrustManager}, new SecureRandom());
+                    builder.sslContext(sslContext);
                 } else {
-                    sslContext.init(null, null, new SecureRandom());
+                    TrustManagerFactory tmf = null;
+                    KeyManagerFactory kmf = null;
+                    if (config.sslRootsFilePath() != null) {
+                        tmf = Utils.createTmf(
+                                config.sslRootsFilePath(),
+                                config.getSslRootFilePassword());
+                    }
+
+                    if (config.getCertificatePath() != null && config.getCertificateKeyPath() != null) {
+                        kmf = Utils.createKmf(config.getCertificatePath(), config.getCertificateKeyPath());
+                    }
+
+                    if (config.getCertificateP12FilePath() != null) {
+                        kmf = Utils.createKmfP12(config.getCertificateP12FilePath(), config.getKeyPassword());
+                    }
+
+                    SSLContext sslContext = Utils.buildSslContext(kmf, tmf);
+                    if (sslContext != null) {
+                        builder.sslContext(sslContext);
+                    }
                 }
-                builder.sslContext(sslContext);
             } catch (Exception e) {
                 throw new RuntimeException(e);
             }
@@ -487,6 +504,7 @@ private String errNonEmptyField(@Nullable final JsonNode object, @Nonnull final
         return errNonEmptyText(object.get(fieldName));
     }
 
+    //todo remove?
     private X509TrustManager getX509TrustManagerFromFile(@Nonnull final String filePath) {
         try {
             KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());