TLS hostname verification

[sharky5102-cyber]

Hi.

Seems that the TLS hostname verification state in Angus Mail is not great at the moment. The summary is, AFAICS:

• mail.smtp.ssl.checkserveridentity defaults to True, which is Good
• mail.smtp.ssl.hostnameverifier defaults to null, which I guess is Good since most people don't want custom logic
• mail.smtp.ssl.hostnameverifier.class also defaults to null, which I guess is Not Good because now the default is that no hostname verification is done, even though checkserveridentity is True
• mail.smtp.ssl.hostnameverifier.class = "legacy" tries to use the internal sun.security.util.HostnameChecker but that is no longer accessible by default in JDK17+, causing it to fallback to MailHostnameVerifier, which has issues (for example, it will accept a hostname of 'foo.bar.domain.com' against a cert for '*.domain.com', which is incorrect. Also, IP address SANs are unsupported, and I bet there are other corner cases.
• mail.smtp.ssl.hostnameverifier.class = "MailHostnameVerifier" does the same incorrect verification

So it seems like the default for users setting mail.smtp.ssl.checkserveridentity = True is to actually not check anything. And then if you set it to "sun.security.util.HostnameChecker" or "legacy" in JDK17 you might get some checking but it's not actually correct.

Am I right?

Anyway, there is a simpler solution. All we need is setEndpointIdentificationAlgorithm(). See https://gist.github.com/jfwilson/709b74000a79eb52177b#file-sslhostnametest-java-L55 .. this simply turns on TLS hostname verification during handshake, allowing us to delete all that workaround code! This makes all of the *.ssl.hostnameverifier features redundant, and we get the JDK-supported, correct, hostname verification. It's not even that much code if we put it into MailSSLSocketFactory.

Ideas ?