test: add test tls/mtls

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 1.51.0 [unreleased]
 
+### Documentation
+
+1. [#721](https://github.com/influxdata/influxdb-client-python/pull/721): Add examples for configure TLS/mTLS for the Influxdb client.
+
 ### Bug Fixes
 
 1. [#706](https://github.com/influxdata/influxdb-client-python/pull/706): Use logger instead logging.

examples/config_tls_mtls.py

@@ -0,0 +1,36 @@
+import ssl
+
+from influxdb_client import InfluxDBClient
+
+path_client_cert_file = "path/to/cert_file.crt"
+path_client_key_file = "path/to/cert_file.key"
+path_client_cert_file_pem = "path/to/cert_file.pem"
+
+path_server_cert = "path/to/server_cert.crt"
+
+# Config mTLS with client send certificate to the server with separated .crt file and .key file.
+# `ssl_ca_cert` is optional.
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_ca_cert=path_server_cert,
+                    cert_file=path_client_cert_file,
+                    cert_key_file=path_client_key_file, ) as client:
+    client.version()
+
+# Config mTLS with client send a certificate to the server with both certificate and key bundled inside a .pem file.
+# `ssl_ca_cert` is optional.
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_ca_cert=path_server_cert,
+                    cert_file=path_client_cert_file_pem) as client:
+    client.version()
+
+# Configure TLS with SSLContext; omit cert_file, cert_key_file and ssl_ca_cert when supplying a configured context.
+ssl_context = ssl.create_default_context(cafile=path_server_cert)
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_context=ssl_context) as client:
+    client.version()

scripts/generate-self-signed-cert.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# The MIT License
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+
+set -e
+
+PKCS12_PASSWORD="changeit"
+INFLUXDB_SERVER_NAME="influxdb"
+OTHER_SERVER_NAME="other-server"
+CERTS_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../tests/test_data/certificates" && pwd)"
+
+# Gen Server .crt and .key with SAN then convert to .p12 file
+for SERVER_NAME in "$INFLUXDB_SERVER_NAME" "$OTHER_SERVER_NAME"; do
+  echo "### Generate server key and certificate for $SERVER_NAME..."
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 | openssl pkcs8 -topk8 -nocrypt -out "$CERTS_DIR/${SERVER_NAME}.key"
+
+  openssl req -new -x509 -key "$CERTS_DIR/${SERVER_NAME}.key" -out "$CERTS_DIR/${SERVER_NAME}.crt" -days 3650 \
+    -subj "/CN=localhost/O=Development/C=US" \
+    -addext "subjectAltName = DNS:localhost,IP:127.0.0.1"
+
+  cat "$CERTS_DIR/${SERVER_NAME}.crt" "$CERTS_DIR/${SERVER_NAME}.key" > "$CERTS_DIR/${SERVER_NAME}.pem"
+
+#  openssl pkcs12 -export -in "$CERTS_DIR/${SERVER_NAME}.crt" -inkey "$CERTS_DIR/${SERVER_NAME}.key" \
+#    -out "$CERTS_DIR/${SERVER_NAME}.p12" -name "myalias" -password "pass:$PKCS12_PASSWORD"
+done
+
+# Gen Client .crt and .key then convert to .p12 file
+echo "### Generate client key..."
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 | openssl pkcs8 -topk8 -nocrypt -out "$CERTS_DIR/client.key"
+openssl req -new -x509 -key "$CERTS_DIR/client.key" -out "$CERTS_DIR/client.crt" -days 3650 \
+  -subj "/CN=test-client/O=Development/C=US"
+
+cat "$CERTS_DIR/client.crt" "$CERTS_DIR/client.key" > "$CERTS_DIR/client.pem"
+
+#openssl pkcs12 -export -in "$CERTS_DIR/client.crt" -inkey "$CERTS_DIR/client.key" \
+#  -out "$CERTS_DIR/client.p12" -name "myalias" -password "pass:$PKCS12_PASSWORD"

tests/test_InfluxDBClient.py

@@ -15,18 +15,43 @@
 from influxdb_client import InfluxDBClient, Point
 from influxdb_client.client.write.retry import WritesRetry
 from influxdb_client.client.write_api import WriteOptions, WriteType, SYNCHRONOUS
+from influxdb_client.rest import ApiException
 from tests.base_test import BaseTest
 
 
 class InfluxDBClientTest(unittest.TestCase):
 
+    cert_dir = os.path.join(os.path.dirname(__file__), "test_data", "certificates")
+
+    influxdb_cert_pem = os.path.join(cert_dir, "influxdb.pem")
+    influxdb_cert = os.path.join(cert_dir, "influxdb.crt")
+    influxdb_key = os.path.join(cert_dir, "influxdb.key")
+
+    client_cert_pem = os.path.join(cert_dir, "client.pem")
+    client_cert = os.path.join(cert_dir, "client.crt")
+    client_key = os.path.join(cert_dir, "client.key")
+
+    other_server_pem = os.path.join(cert_dir, "other-server.pem")
+    other_server_cert = os.path.join(cert_dir, "other-server.crt")
+    other_server_key = os.path.join(cert_dir, "other-server.key")
+
+
+    def setUp(self) -> None:
+        self.client = None
+
     def tearDown(self) -> None:
         if self.client:
             self.client.close()
+        self._stop_https_server()
+
+    def _stop_https_server(self) -> None:
         if hasattr(self, 'httpd'):
             self.httpd.shutdown()
+            self.httpd.server_close()
+            delattr(self, 'httpd')
         if hasattr(self, 'httpd_thread'):
             self.httpd_thread.join()
+            delattr(self, 'httpd_thread')
 
     def test_default_conf(self):
         self.client = InfluxDBClient(url="http://localhost:8086", token="my-token", org="my-org")
@@ -59,35 +84,103 @@ def test_TrailingSlashInUrl(self):
         self.assertEqual('http://localhost:8086', self.client.api_client.configuration.host)
 
     def test_ConnectToSelfSignedServer(self):
-        self._start_http_server()
+        self._start_https_server()
 
         self.client = InfluxDBClient(f"https://localhost:{self.httpd.server_address[1]}",
                                      token="my-token", verify_ssl=False)
         ping = self.client.ping()
 
         self.assertTrue(ping)
 
-    def test_certificate_file(self):
-        self._start_http_server()
-
-        self.client = InfluxDBClient(f"https://localhost:{self.httpd.server_address[1]}",
-                                     token="my-token", verify_ssl=True,
-                                     ssl_ca_cert=f'{os.path.dirname(__file__)}/server.pem')
-        ping = self.client.ping()
-
-        self.assertTrue(ping)
-
-    def test_certificate_context(self):
-        self._start_http_server()
-
-        ssl_context = ssl.create_default_context(cafile=f"{os.path.dirname(__file__)}/server.pem")
-
-        self.client = InfluxDBClient(f"https://localhost:{self.httpd.server_address[1]}",
-                                     token="my-token", verify_ssl=True,
-                                     ssl_context=ssl_context)
-        ping = self.client.ping()
-
-        self.assertTrue(ping)
+    def test_tls_mtls(self):
+        test_cases = [
+            {
+                "name": "correct self-signed certificate config from client",
+                "ca_certs": self.influxdb_cert,
+                "cert_file": None,
+                "key_file": None,
+                "is_mtls": False,
+                "expect_success": True
+            },
+            {
+                "name": "correct .pem self-signed certificate config from client",
+                "ca_certs": self.influxdb_cert_pem,
+                "cert_file": None,
+                "key_file": None,
+                "is_mtls": False,
+                "expect_success": True
+            },
+            {
+                "name": "incorrect self-signed certificate config from client",
+                "ca_certs": self.other_server_pem,
+                "cert_file": None,
+                "key_file": None,
+                "is_mtls": False,
+                "expect_success": False
+            },
+            {
+                "name": "mtls correct self-signed certificate config from client",
+                "ca_certs": self.influxdb_cert,
+                "cert_file": self.client_cert,
+                "key_file": self.client_key,
+                "is_mtls": True,
+                "expect_success": True
+            },
+            {
+                "name": "mtls correct .pem self-signed certificate config from client",
+                "ca_certs": self.influxdb_cert,
+                "cert_file": self.client_cert_pem,
+                "key_file": None,
+                "is_mtls": True,
+                "expect_success": True
+            },
+            {
+                "name": "mtls incorrect self-signed certificate config from client",
+                "ca_certs": self.influxdb_cert,
+                "cert_file": self.other_server_cert,
+                "key_file": self.other_server_key,
+                "is_mtls": True,
+                "expect_success": False
+            }
+        ]
+        for test_case in test_cases:
+            with self.subTest(test_case=test_case["name"]):
+                client_cert = self.client_cert if test_case["is_mtls"] else None
+                self._start_https_server(client_cert=client_cert)
+                try:
+                    self.client = InfluxDBClient(f"https://localhost:{self.httpd.server_address[1]}",
+                                                 token="my-token",
+                                                 verify_ssl=True,
+                                                 cert_file=test_case["cert_file"],
+                                                 cert_key_file=test_case["key_file"],
+                                                 ssl_ca_cert=test_case["ca_certs"])
+                    if test_case["expect_success"]:
+                        self.assertIsNotNone(self.client.version())
+                    else:
+                        with self.assertRaises(ApiException) as exc_info:
+                            self.client.version()
+                        self.assertIn("SSL", exc_info.exception.reason)
+                finally:
+                    if self.client:
+                        self.client.close()
+                        self.client = None
+                    self._stop_https_server()
+
+    def test_mtls_ssl_context_object(self):
+        self._start_https_server(client_cert=self.client_cert)
+        ssl_context = ssl.create_default_context(cafile=self.influxdb_cert)
+        ssl_context.load_cert_chain(certfile=self.client_cert, keyfile=self.client_key)
+        try:
+            self.client = InfluxDBClient(f"https://localhost:{self.httpd.server_address[1]}",
+                                         token="my-token",
+                                         verify_ssl=True,
+                                         ssl_context=ssl_context)
+            self.client.version()
+        except Exception as e:
+            self.fail(f"Unexpected exception: {e}")
+        finally:
+            self.client.close()
+            self._stop_https_server()
 
     def test_init_from_ini_file(self):
         self.client = InfluxDBClient.from_config_file(f'{os.path.dirname(__file__)}/config.ini')
@@ -259,20 +352,37 @@ def test_init_from_env_kwargs(self):
         self.client = InfluxDBClient.from_env_properties(retries=retry)
         self.assertEqual(self.client.retries, retry)
 
-    def _start_http_server(self):
+    def _start_https_server(self, cert_file=None, key_file=None, client_cert=None):
         import http.server
         import ssl
         # Disable unverified HTTPS requests
         import urllib3
         urllib3.disable_warnings()
+        if cert_file is not None and cert_file.endswith(".pem"):
+            if key_file is not None:
+                raise ValueError("Key file is not required for .pem certificate")
+        else:
+            if not cert_file:
+                cert_file = f'{self.cert_dir}/influxdb.crt'
+            if not key_file:
+                key_file = f'{self.cert_dir}/influxdb.key'
+
         # Configure HTTP server
-        self.httpd = http.server.HTTPServer(('localhost', 0), ServerWithSelfSingedSSL)
-        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        context.load_cert_chain(f'{os.path.dirname(__file__)}/server.pem')
-        self.httpd.socket = context.wrap_socket(self.httpd.socket, server_side=True)
-        # Start server at background
-        self.httpd_thread = threading.Thread(target=self.httpd.serve_forever)
-        self.httpd_thread.start()
+        try:
+            self.httpd = http.server.HTTPServer(('localhost', 0), ServerWithSelfSingedSSL)
+            context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+            context.load_cert_chain(cert_file, key_file)
+
+            if client_cert:
+                context.verify_mode = ssl.CERT_REQUIRED
+                context.load_verify_locations(cafile=client_cert)
+
+            self.httpd.socket = context.wrap_socket(self.httpd.socket, server_side=True)
+            # Start server at background
+            self.httpd_thread = threading.Thread(target=self.httpd.serve_forever)
+            self.httpd_thread.start()
+        except Exception as e:
+            raise e
 
     def test_write_context_manager(self):
 

tests/test_data/certificates/client.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDUzCCAjugAwIBAgIUeiLXvSUn7rJImhXlTNH8M0cnsUQwDQYJKoZIhvcNAQEL
+BQAwOTEUMBIGA1UEAwwLdGVzdC1jbGllbnQxFDASBgNVBAoMC0RldmVsb3BtZW50
+MQswCQYDVQQGEwJVUzAeFw0yNjEwMjEwNzIxMzZaFw0zNjEwMTgwNzIxMzZaMDkx
+FDASBgNVBAMMC3Rlc3QtY2xpZW50MRQwEgYDVQQKDAtEZXZlbG9wbWVudDELMAkG
+A1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeebeS5zss
+fMskfST16LwwJFiFUaki3FujvzP2b9RXoWddeT1bUwH/xB15/q6TeeMJHaAI8kV3
+UgiJCYlYMWJL/1TEAmgpxKeR2Mlgiy1VyaBWX5I1SLVrrBJF6crqIXnrXFRQGmIc
+ko63yu6dzZrfOFUVKR3BmqKMAbDjGmSatQBMM1HOEW2Yo6hreJ0nhtVgBw9CM7bm
+8jSprPtoN+qy04ydPvLxIu3Ul0Ie34W6wYkKEiSYnCsaqm6LbM7Gysxq0Z8zk+ui
+SId3SXJoE3aZd83fRhH4CBsE8rfeyoJKHS54TK1bglPY2WcH9nldgDeTZaiKtph3
+yjP7I0l+5uzvAgMBAAGjUzBRMB0GA1UdDgQWBBSLa0oZmPGqfYvhzkJwBO0dgsVB
+zTAfBgNVHSMEGDAWgBSLa0oZmPGqfYvhzkJwBO0dgsVBzTAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB5sHYc3wU0BQA3bsPV0Qh0Aqh5iJOiXdWe
+A2KNtEuure9Sl3LCXlEt5+Osj/TfvThOFc5/iQTa6G/n9gE6s7cvqn9IfwgLiFhh
+MqvvB6WGRFQDeNdEkRuWpAGU2d4cz1MXua20HaeRI5w198Pb8c+eBwnGmDPEy2sV
+QWVokosBCtsvcHMiIL6WcPeTY8D3fBQC4BIJKHMwgsjXKVC97oXIAbA/OscJvCDa
+DWnesUDPIE11bouz0Rh9tc4lbIbaScZ8s6tGZUgDE1IqyaQTFiUOk2eBe0yuD+0O
+PbV97177fPEWZ99Z2W1DUhoOfndZVUEmOu6qAQBlu6tLxACX0PoQ
+-----END CERTIFICATE-----