Testing mail.smtp.ssl.trust seems to be broken #187

copyright-exclude

@@ -30,6 +30,8 @@ mailhandler/src/main/resources/META-INF/hk2-locator/default
 docker/JTReportParser/
 providers/angus-mail/src/test/resources/org/eclipse/angus/mail/util/paramdatanostrict
 providers/angus-mail/src/test/resources/org/eclipse/angus/mail/util/paramdata
+providers/angus-mail/src/test/resources/keystore.jks
+providers/angus-mail/src/test/resources/test-hosts
 .txt
 .TXT
 www/

core/src/main/java/org/eclipse/angus/mail/util/MailSSLSocketFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2023 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -18,10 +18,12 @@
 
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLSocket;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509ExtendedTrustManager;
 import javax.net.ssl.X509TrustManager;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -334,51 +336,120 @@ public synchronized Socket createSocket(String s, int i)
      *
      * @author Stephan Sann
      */
-    private class MailTrustManager implements X509TrustManager {
+    private class MailTrustManager extends X509ExtendedTrustManager {
 
         /**
-         * A TrustManager to pass method calls to
+         * A TrustManager to delegate to
          */
-        private X509TrustManager adapteeTrustManager = null;
+        private final X509ExtendedTrustManager adapteeTrustManager;
 
-        /**
-         * Initializes a new TrustManager instance.
-         */
         private MailTrustManager() throws GeneralSecurityException {
             TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
             tmf.init((KeyStore) null);
-            adapteeTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
+
+            TrustManager tm = tmf.getTrustManagers()[0];
+
+            if (tm instanceof X509ExtendedTrustManager) {
+                adapteeTrustManager = (X509ExtendedTrustManager) tm;
+            } else {
+                // Should not happen, but wrap X509TrustManager if needed
+                adapteeTrustManager = new X509ExtendedTrustManager() {
+                    private final X509TrustManager base = (X509TrustManager) tm;
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
+                            throws CertificateException {
+                        base.checkClientTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                            throws CertificateException {
+                        base.checkClientTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
+                            throws CertificateException {
+                        base.checkServerTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                            throws CertificateException {
+                        base.checkServerTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] chain, String authType)
+                            throws CertificateException {
+                        base.checkClientTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] chain, String authType)
+                            throws CertificateException {
+                        base.checkServerTrusted(chain, authType);
+                    }
+
+                    @Override
+                    public X509Certificate[] getAcceptedIssuers() {
+                        return base.getAcceptedIssuers();
+                    }
+                };
+            }
+        }
+
+        private boolean shouldDelegate() {
+            return !(isTrustAllHosts() || getTrustedHosts() != null);
         }
 
-        /* (non-Javadoc)
-         * @see javax.net.ssl.X509TrustManager#checkClientTrusted(
-         *		java.security.cert.X509Certificate[], java.lang.String)
-         */
         @Override
         public void checkClientTrusted(X509Certificate[] certs, String authType)
                 throws CertificateException {
-            if (!(isTrustAllHosts() || getTrustedHosts() != null))
+            if (shouldDelegate())
                 adapteeTrustManager.checkClientTrusted(certs, authType);
         }
 
-        /* (non-Javadoc)
-         * @see javax.net.ssl.X509TrustManager#checkServerTrusted(
-         *		java.security.cert.X509Certificate[], java.lang.String)
-         */
         @Override
         public void checkServerTrusted(X509Certificate[] certs, String authType)
                 throws CertificateException {
-
-            if (!(isTrustAllHosts() || getTrustedHosts() != null))
+            if (shouldDelegate())
                 adapteeTrustManager.checkServerTrusted(certs, authType);
         }
 
-        /* (non-Javadoc)
-         * @see javax.net.ssl.X509TrustManager#getAcceptedIssuers()
-         */
         @Override
         public X509Certificate[] getAcceptedIssuers() {
             return adapteeTrustManager.getAcceptedIssuers();
         }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
+                throws CertificateException {
+            if (shouldDelegate())
+                adapteeTrustManager.checkClientTrusted(chain, authType, socket);
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                throws CertificateException {
+            if (shouldDelegate())
+                adapteeTrustManager.checkClientTrusted(chain, authType, engine);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
+                throws CertificateException {
+            if (shouldDelegate())
+                adapteeTrustManager.checkServerTrusted(chain, authType, socket);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                throws CertificateException {
+            if (shouldDelegate())
+                adapteeTrustManager.checkServerTrusted(chain, authType, engine);
+        }
     }
+
 }

core/src/main/java/org/eclipse/angus/mail/util/SocketFetcher.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2024 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -628,15 +628,15 @@ private static void configureSSLSocket(Socket socket, String host,
                     Arrays.asList(sslsocket.getEnabledCipherSuites()));
         }
 
+        boolean checkServerIdentity =
+                PropUtil.getBooleanProperty(props, prefix + ".ssl.checkserveridentity", true);
         try {
             /*
              * Check server identity and trust.
              * See: JDK-8062515 and JDK-7192189
              * LDAPS requires the same regex handling as we need
              */
-            String eia = PropUtil.getBooleanProperty(props,
-                    prefix + ".ssl.checkserveridentity", true)
-                    ? "LDAPS" : (String) null;
+            String eia = checkServerIdentity ? "LDAPS" : (String) null;
             SSLParameters params = sslsocket.getSSLParameters();
             params.setEndpointIdentificationAlgorithm(eia);
             sslsocket.setSSLParameters(params);
@@ -679,7 +679,7 @@ private static void configureSSLSocket(Socket socket, String host,
 
         if (sf instanceof MailSSLSocketFactory) {
             MailSSLSocketFactory msf = (MailSSLSocketFactory) sf;
-            if (!msf.isServerTrusted(host, sslsocket)) {
+            if (checkServerIdentity && !msf.isServerTrusted(host, sslsocket)) {
                 throw cleanupAndThrow(sslsocket,
                         new IOException("Server is not trusted: " + host));
             }

doc/src/main/resources/docs/CHANGES.txt

@@ -7,6 +7,12 @@ for the Eclipse EE4J Angus Mail project:
 
     https://github.com/eclipse-ee4j/angus-mail/issues/<bug-number>
 
+          CHANGES IN THE 2.1.0 RELEASE
+          ----------------------------
+The following bugs have been fixed in the 2.1.0 release.
+
+187: "mail.smtp.ssl.trust" seems to be broken
+
           CHANGES IN THE 2.0.5 RELEASE
           ----------------------------
 The following bugs have been fixed in the 2.0.5 release.

doc/src/main/resources/docs/COMPAT.txt

@@ -3,6 +3,19 @@
 
 		    Angus Mail ${angus-mail.version} release
 		    ------------------------------
+
+-- Angus Mail 2.1.0 --
+
+- MailTrustManager updated to extend X509ExtendedTrustManager
+
+    The internal MailTrustManager implementation has been updated to extend
+    X509ExtendedTrustManager instead of X509TrustManager.  This allows Angus Mail
+    to pass the connected SSLSocket or SSLEngine to the TrustManager during
+    certificate validation.
+
+	As a result of this, setting mail.<protocol>.ssl.checkserveridentity = true
+	will check trusted hosts.
+
 -- Angus Mail 2.0.5 --
 
 - Resource File Duplication due to Jakartification