TCP, SSL, Enable Host Verification by default

Make key/trust store types configurable; add a test with host violation.

* Fix some typos and code style in the related classed and docs
* Add asserts for the store type properties

src/reference/asciidoc/ip.adoc

@@ -719,7 +719,7 @@ Then you can examine the current state with `@adapter_id.isClientModeConnected()
 The inbound TCP gateway `TcpInboundGateway` and outbound TCP gateway `TcpOutboundGateway` use a server and client connection factory, respectively.
 Each connection can process a single request or response at a time.
 
-The inbound gateway, after constructing a message with the incoming payload and sending it to the requestChannel, waits for a response and sends the payload from the response message by writing it to the connection.
+The inbound gateway, after constructing a message with the incoming payload and sending it to the `requestChannel`, waits for a response and sends the payload from the response message by writing it to the connection.
 
 NOTE: For the inbound gateway, you must retain or populate, the `ip_connectionId` header, because it is used to correlate the message to a connection.
 Messages that originate at the gateway automatically have the header set.
@@ -1113,6 +1113,45 @@ Starting with version 4.3.6, when you use NIO, you can specify an `ssl-handshake
 This timeout (the default is 30 seconds) is used during SSL handshake when waiting for data.
 If the timeout is exceeded, the process is aborted and the socket is closed.
 
+[[tcp-ssl-host-verification]]
+==== Host Verification
+
+Starting with version 5.0.8, you can configure whether or not to enable host verification.
+Starting with version 5.1, it is enabled by default; the mechanism to disable it depends on whether or not you are using NIO.
+
+Host verification is used to ensure the server you are connected to matches information in the certificate, even if the certificate is trusted.
+
+When using NIO, configure the `DefaultTcpNioSSLConnectionSupport`, for example.
+
+====
+[source, java]
+----
+@Bean
+public DefaultTcpNioSSLConnectionSupport connectionSupport() {
+    DefaultTcpSSLContextSupport sslContextSupport = new DefaultTcpSSLContextSupport("test.ks",
+            "test.truststore.ks", "secret", "secret");
+    sslContextSupport.setProtocol("SSL");
+    DefaultTcpNioSSLConnectionSupport tcpNioConnectionSupport =
+            new DefaultTcpNioSSLConnectionSupport(sslContextSupport, false);
+    return tcpNioConnectionSupport;
+}
+----
+====
+
+The second constructor argument disables host verification.
+The `connectionSupport` bean is then injected into the NIO connection factory.
+
+When not using NIO, the configuration is in the `TcpSocketSupport`:
+
+====
+[source, java]
+----
+connectionFactory.setTcpSocketSupport(new DefaultTcpSocketSupport(false));
+----
+====
+
+Again, the constructor argument disables host verification.
+
 [[tcp-advanced-techniques]]
 === Advanced Techniques
 

src/reference/asciidoc/whats-new.adoc

@@ -139,6 +139,14 @@ See <<ftp-streaming>> and <<sftp-streaming>> for more information.
 In addition, the synchronizers for inbound channel adapters can now be provided with a `Comparator`.
 This is useful when using `maxFetchSize` to limit the files retrieved.
 
+[[x51.-tcp]]
+=== TCP Support
+
+When using SSL, host verification is now enabled, by default, to prevent man-in-the-middle attacks with a trusted certificate.
+See <<tcp-ssl-host-verification>> for more information.
+
+In addition the key and trust store types can now be configured on the `DefaultTcpSSLContextSupport`.
+
 [[x5.1-twitter]]
 === Twitter Support