Fail-closed SSL verification, HttpClient reuse, and robustness fixes

.github/workflows/ci.yml

@@ -17,14 +17,6 @@ jobs:
         java:
           - 11
         vault:
-          - 1.8.12
-          - 1.9.10
-          - 1.10.11
-          - 1.11.12
-          - 1.12.11
-          - 1.13.8
-          - 1.14.4
-          - 1.15.6
           - 1.16.3
           - 1.17.6
           - 1.18.5
@@ -36,6 +28,9 @@ jobs:
           - 2.0.2
           - 2.0.3
           - 2.0.4
+          - 2.1.0
+          - 2.1.1
+          - 2.1.2
           - latest
         os:
           - ubuntu-latest
@@ -64,4 +59,6 @@ jobs:
         with:
           overwrite: true
           name: test-results-${{ matrix.os }}-${{ matrix.vault }}
-          path: build/test-results/
+          path: |
+            target/surefire-reports/TEST-*.xml
+            target/failsafe-reports/TEST-*.xml

.github/workflows/test-report.yml

@@ -4,16 +4,19 @@ on:
     workflows: [ 'CI' ]                     # runs after CI workflow
     types:
       - completed
+permissions:
+  contents: read
+  actions: read                             # download artifacts of the CI run
+  checks: write                             # publish the report as a check run
 jobs:
   report:
     runs-on: ubuntu-latest
     steps:
       - uses: dorny/test-reporter@v1
         with:
-          artifact: test-results
-          name: Tests Report
-          path: '**/reports/*.*'
+          artifact: /test-results-(.*)/     # one report per CI matrix entry
+          name: Tests Report $1
+          path: '**/TEST-*.xml'
           reporter: java-junit
           list-suites: 'all'
           list-tests: 'all'
-

README.md

@@ -15,14 +15,12 @@ most commonly used Java clients for Hashicorp, but has had no activity or releas
 December 2019. The project is not
 maintaining [by author](https://github.com/BetterCloud/vault-java-driver/pull/245#issuecomment-954066376).
 
-This Change
------------
-
 Table of Contents
 -----------------
 
 * [Installing the Driver](#installing-the-driver)
 * [Initializing a Driver Instance](#initializing-a-driver-instance)
+* [Environment Variables](#environment-variables)
 * [Key/Value Secret Engine Config](#key-value-secret-engine-config)
 * [SSL Config](#ssl-config)
     * [General Options](#general-options)
@@ -85,19 +83,57 @@ final VaultConfig config =
     new VaultConfig()
         .address("http://127.0.0.1:8200")               // Defaults to "VAULT_ADDR" environment variable
         .token("3c9fd6be-7bc2-9d1f-6fb3-cd746c0fc4e8")  // Defaults to "VAULT_TOKEN" environment variable
-        .openTimeout(5)                                 // Defaults to "VAULT_OPEN_TIMEOUT" environment variable
-        .readTimeout(30)                                // Defaults to "VAULT_READ_TIMEOUT" environment variable
+        .openTimeout(5)                                 // Defaults to "VAULT_OPEN_TIMEOUT" environment variable (0 = no timeout)
+        .readTimeout(30)                                // Defaults to "VAULT_READ_TIMEOUT" environment variable (0 = no timeout)
         .sslConfig(new SslConfig().build())             // See "SSL Config" section below
         .build();
 ```
 
+See [Environment Variables](#environment-variables) for how these variables are read.
+
 Once you have initialized a `VaultConfig` object, you can use it to construct an instance of
 the `Vault` primary driver class:
 
 ```
 final Vault vault = Vault.create(config);
 ```
 
+Environment Variables
+---------------------
+Any setting that is not set in code is read from an environment variable when `build()` is called.
+A value set in code always takes priority, and the matching environment variable is then not read
+at all.
+
+| Variable             | Setting                    | Notes                                                                                                                         |
+|----------------------|----------------------------|-------------------------------------------------------------------------------------------------------------------------------|
+| `VAULT_ADDR`         | `VaultConfig.address`      | Required if no address is set in code, otherwise `build()` fails with "No address is set".                                     |
+| `VAULT_TOKEN`        | `VaultConfig.token`        | If unset, the token is read from the `.vault-token` file in the user's home directory, if present.                             |
+| `VAULT_OPEN_TIMEOUT` | `VaultConfig.openTimeout`  | Seconds to wait for a connection. `0` means no timeout.                                                                        |
+| `VAULT_READ_TIMEOUT` | `VaultConfig.readTimeout`  | Seconds to wait for a response. `0` means no timeout.                                                                          |
+| `VAULT_SSL_VERIFY`   | `SslConfig.verify`         | Whether to verify the Vault server's SSL certificate. Only `false` disables verification (see below).                          |
+| `VAULT_SSL_CERT`     | `SslConfig.pemFile`        | Path to a PEM file with the Vault server's certificate. Only used if verification is enabled and no certificate is set in code. |
+
+All values are handled the same way:
+
+* Surrounding whitespace is removed, so a trailing newline (e.g. from a mounted Kubernetes secret)
+  is harmless.
+* An empty or blank value is treated as unset. This also applies to the `.vault-token` file.
+* An invalid timeout (not an integer, or negative) is ignored, and a warning is logged. A negative
+  timeout set in code makes `build()` throw a `VaultException`.
+
+`VAULT_SSL_VERIFY` fails closed, so that a typo can never disable SSL verification by accident:
+
+* `false` (in any case) disables verification.
+* `true`, `t`, `1`, `y`, `yes` and `on` (in any case), or an empty value, enable it.
+* Any other value, including `0`, `no` and `off`, also enables it, and a warning is logged.
+
+To disable loading from environment variables, or to read the values from another source, pass
+your own `EnvironmentLoader` implementation to `VaultConfig.environmentLoader()`. Whitespace removal
+and empty values are still handled as above for the values it returns, while the `.vault-token`
+fallback is part of the default `EnvironmentLoader` only. An `SslConfig` passed to `VaultConfig`
+without calling its own `build()` is built by `VaultConfig.build()`, using the same
+`EnvironmentLoader`.
+
 Key Value Secret Engine Config
 ------------------------------
 Shortly before its `1.0` release, Vault added a Version 2 of
@@ -166,10 +202,17 @@ own `SslConfig` class. This class likewise using a builder pattern.
 .verify(false)    // Defaults to "VAULT_SSL_VERIFY" environment variable (or else "true")
 ```
 
-To disable SSL certificate verification altogether, set `sslVerify(false)`. YOU SHOULD NOT DO THIS
+To disable SSL certificate verification altogether, set `verify(false)`, or set the
+`VAULT_SSL_VERIFY` environment variable to `false` (see
+[Environment Variables](#environment-variables)). YOU SHOULD NOT DO THIS
 IS A REAL PRODUCTION SETTING!  However, it can be useful in a development or testing server context.
 If this value is explicitly set to `false`, then all other SSL config is basically unused.
 
+Certificate settings changed after calling `build()` only take effect once `build()` is called
+again. An `SslConfig` can be serialized together with its PEM data, but not with its JKS keystore
+and truststore: after deserialization, a JKS-based config verifies the Vault server's certificate
+against the JVM's default trusted CAs instead.
+
 #### Java Keystore (JKS) based config
 
 You can provide the driver with a JKS truststore, containing Vault's server-side certificate for
@@ -221,7 +264,7 @@ the `SslConfig` Javadocs for more detail).
 
 If SSL verification is enabled, no JKS-based config is provided, AND none of these three methods are
 called, then `SslConfig` will by default check for a `VAULT_SSL_CERT` environment variable. If
-that's sets then it will be treated as a filesystem path.
+that's set, then it will be treated as a filesystem path.
 
 To use Vault's TLS Certificate auth backend for SSL client auth, you must provide your client
 certificate and private key, using some pair from the following options:
@@ -293,6 +336,10 @@ final LogicalResponse response = vault.withRetries(5, 1000)
                                    .read("secret/hello");
 ```
 
+Only transient failures are retried: I/O errors (e.g. connection refused or timed out) and HTTP 5xx,
+408, 412 and 429 responses. Other 4xx responses (e.g. 400, 403, 404) fail immediately, since
+retrying them would not help.
+
 API Reference (Javadocs)
 ------------------------
 Full [Javadoc documentation](https://jopenlibs.github.io/vault-java-driver/javadoc).
@@ -305,6 +352,61 @@ and may require modifications in your code to migrate. Changes to the minor vers
 number) should represent non-breaking changes. The third number represents any very minor bugfix
 patches.
 
+* **Unreleased**: This release contains the following updates:
+  * Security: fixes [CVE-2026-109408](https://www.cve.org/CVERecord?id=CVE-2026-109408), where SSL
+    certificate verification could be silently disabled. See the `VAULT_SSL_VERIFY` and `SslConfig`
+    entries below
+  * Environment variables: surrounding whitespace is removed, and empty values are treated as unset
+  * `VAULT_SSL_VERIFY` now only disables SSL verification when set to `false`. Previously any value
+    other than `true` disabled it, including `1`, `yes`, typos and empty values. **Values like `0`,
+    `no` or `off` now keep verification enabled: use `false` instead.**
+  * A timeout of `0` means no timeout again, as before 6.0.0. Negative timeouts are rejected
+  * `VAULT_TOKEN` and the `.vault-token` file are no longer read when a token is set in code
+  * An `SslConfig` passed to `VaultConfig` without calling its `build()` is now built by
+    `VaultConfig.build()`, and verifies SSL certificates by default. Previously it silently disabled
+    verification and ignored its certificates
+  * A deserialized `SslConfig` now keeps its settings. Previously it had SSL verification disabled.
+    An `SslConfig` serialized by an older release can still be deserialized, and verifies SSL
+    certificates unless it was serialized with `verify(false)`. This includes one built with
+    `VAULT_SSL_VERIFY=false`, since the serialized data cannot tell where that value came from
+  * Each `VaultConfig` now reuses a single HTTP client, so connections are reused between requests
+    instead of a new client being created for every request. `VaultConfig.getHttpClient()` now
+    returns the client in use instead of `null` when none was set. The client is rebuilt when the
+    `SslConfig` changes (e.g. SSL verification turned on or off, or `SslConfig.build()` called again
+    with new certificates)
+  * A `VaultConfig` with a custom `HttpClient` can be serialized. The client itself is not
+    serialized: the deserialized copy uses its own default client
+  * Query parameters are url-encoded only once. Previously reserved characters (e.g. `/`, `&`, `%`)
+    were encoded twice
+  * Response bodies are returned exactly as received. Previously non-UTF-8 (e.g. binary) bodies
+    were corrupted
+  * Only transient errors are retried: I/O errors and HTTP 5xx, 408, 412 and 429 responses.
+    **Other 4xx responses (e.g. 400, 403, 404) now fail immediately instead of being retried.** An
+    interrupt while waiting between retries stops retrying
+  * `AuthResponse`, `WrapResponse`, `LookupResponse` and `UnwrapResponse` no longer throw on
+    missing or `null` JSON fields
+  * `Vault.create(config, null)` throws `IllegalArgumentException`, and a `null`
+    `useSecretsEnginePathMap` counts as `false`. When no KV engine version is set, version 2 is used
+    (`Logical.getEngineVersionForSecretPath()` returns `2` instead of `null`)
+  * `VaultConfig.nameSpace()` no longer throws `VaultException`: an empty namespace is rejected by
+    `build()` instead. `VaultConfig.getSecretsEnginePathMap()` returns an unmodifiable map
+  * `VaultConfig.address()` treats a `null` or blank address as unset, falling back to `VAULT_ADDR`,
+    instead of throwing `NullPointerException`
+  * When the KV engine version map cannot be generated (e.g. no access to `sys/mounts`), the
+    `VaultException` message says so, instead of ending in `null`
+  * Warnings are logged with `java.util.logging` instead of being printed to standard error
+  * Build: pinned Maven plugin versions, fixed test reports in the GitHub Actions CI, removed the
+    unused Travis CI configuration. Checkstyle now runs in the build, and fails it on violations
+  * CI tests Vault 1.16 to 2.1 only: versions 1.8 to 1.15 are deprecated. `Auth.loginByAppID()` is
+    deprecated, since the App ID auth backend is not available in Vault 1.16 and later: use
+    `Auth.loginByAppRole()` instead
+  * Methods documented as deprecated are now also annotated with `@Deprecated`, so using them
+    produces a compiler warning: `Vault.leases()`, `Vault.mounts()`, `Vault.seal()`,
+    `Auth.lookupWrap()`, `Auth.unwrap()`, `Auth.wrap()` and `Auth.rewrap()`. Use their `Sys`
+    equivalents instead (e.g. `vault.sys().leases()`, `vault.sys().wrapping().unwrap()`)
+  * Javadoc examples use the `Sys` methods instead of the deprecated ones. The `Wrapping` examples
+    are fixed: they used `new Vault(config)` instead of `Vault.create(config)`, and a misspelled
+    `lookupWarp()` method
 * **6.2.3**: This release contains the following updates:
   * Improved Java 11 compatibility
   * Fixed integration tests with Vault 2.x

pom.xml

@@ -111,7 +111,7 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-simple</artifactId>
-            <version>2.0.5</version>
+            <version>2.0.7</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -120,15 +120,42 @@
         <plugins>
             <!-- Compiler -->
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.13.0</version>
                 <configuration>
                     <release>11</release>
                 </configuration>
             </plugin>
 
+            <!-- Code style -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>3.6.0</version>
+                <configuration>
+                    <configLocation>${project.basedir}/config/checkstyle/checkstyle.xml</configLocation>
+                    <includeTestSourceDirectory>true</includeTestSourceDirectory>
+                    <consoleOutput>true</consoleOutput>
+                    <failOnViolation>true</failOnViolation>
+                    <violationSeverity>warning</violationSeverity>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>checkstyle</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- Source and Javadoc JARs -->
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
+                <version>3.4.0</version>
                 <executions>
                     <execution>
                         <id>attach-sources</id>
@@ -140,7 +167,9 @@
                 </executions>
             </plugin>
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
+                <version>3.12.0</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -161,7 +190,6 @@
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.2.5</version>
                 <configuration>
-                    <testSourceDirectory>${project.basedir}/test</testSourceDirectory>
                     <includes>
                         <include>**/*Test.java</include>
                         <include>**/*Tests.java</include>
@@ -227,7 +255,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-javadoc-plugin</artifactId>
-                        <version>3.6.3</version>
+                        <version>3.12.0</version>
                         <executions>
                             <execution>
                                 <id>attach-javadocs</id>