TCP, SSL, Configure Host Verification

Make key/trust store types configurable; add a test with host violation.

* Fix some typos and code style in the related classed and docs
* Add asserts for the store type properties

* Changes for 5.0.x to disable by default, after cherry-pick.

src/reference/asciidoc/ip.adoc

@@ -655,7 +655,7 @@ For both inbound and outbound, if the adapter is started, you may force the adap
 The inbound TCP gateway `TcpInboundGateway` and outbound TCP gateway `TcpOutboundGateway` use a server and client connection factory respectively.
 Each connection can process a single request/response at a time.
 
-The inbound gateway, after constructing a message with the incoming payload and sending it to the requestChannel, waits for a response and sends the payload from the response message by writing it to the connection.
+The inbound gateway, after constructing a message with the incoming payload and sending it to the `requestChannel`, waits for a response and sends the payload from the response message by writing it to the connection.
 
 NOTE: For the inbound gateway, care must be taken to retain, or populate, the _ip_connectionId_ header because it is used to correlate the message to a connection.
 Messages that originate at the gateway will automatically have the header set.
@@ -1014,6 +1014,45 @@ The keystore file names (first two constructor arguments) use the Spring `Resour
 Starting with _version 4.3.6_, when using NIO, you can specify an `ssl-handshake-timeout` (seconds) on the connection factory.
 This timeout (default 30) is used during SSL handshake when waiting for data; if the timeout is exceeded, the process is aborted and the socket closed.
 
+[[tcp-ssl-host-verification]]
+==== Host Verification
+
+Starting with version 5.0.8, you can configure whether or not to enable host verification.
+Starting with version 5.1, it will be enabled by default; before that version, the mechanism to enable it depends on whether or not you are using NIO.
+
+Host verification is used to ensure the server you are connected to matches information in the certificate, even if the certificate is trusted.
+
+When using NIO, configure the `DefaultTcpNioSSLConnectionSupport`, for example.
+
+====
+[source, java]
+----
+@Bean
+public DefaultTcpNioSSLConnectionSupport connectionSupport() {
+    DefaultTcpSSLContextSupport sslContextSupport = new DefaultTcpSSLContextSupport("test.ks",
+            "test.truststore.ks", "secret", "secret");
+    sslContextSupport.setProtocol("SSL");
+    DefaultTcpNioSSLConnectionSupport tcpNioConnectionSupport =
+            new DefaultTcpNioSSLConnectionSupport(sslContextSupport, true);
+    return tcpNioConnectionSupport;
+}
+----
+====
+
+The second constructor argument enables host verification.
+The `connectionSupport` bean is then injected into the NIO connection factory.
+
+When not using NIO, the configuration is in the `TcpSocketSupport`:
+
+====
+[source, java]
+----
+connectionFactory.setTcpSocketSupport(new DefaultTcpSocketSupport(true));
+----
+====
+
+Again, the constructor argument enables host verification.
+
 [[tcp-advanced-techniques]]
 === Advanced Techniques
 

src/reference/asciidoc/whats-new.adoc

@@ -314,6 +314,14 @@ See <<micrometer-integration>> for more information.
 IMPORTANT: Changes were made to the Micrometer `Meters` in _version 5.0.3_ to make them more suitable for use in dimensional systems.
 Further changes were made in 5.0.4; if using Micrometer, a minimum of version 5.0.4 is recommended.
 
+[[x51.-tcp]]
+=== TCP Support
+
+When using SSL, host verification can be configured, to prevent man-in-the-middle attacks with a trusted certificate.
+See <<tcp-ssl-host-verification>> for more information.
+
+In addition the key and trust store types can now be configured on the `DefaultTcpSSLContextSupport`.
+
 
 ==== @EndpointId Annotations
 
@@ -325,4 +333,3 @@ See <<endpoint-bean-names>> for more information.
 Starting with _version 5.0.5_, generated bean names for the components in an `IntegrationFlow` include the flow bean name, followed by a dot, as a prefix.
 
 See <<java-dsl-flows>> for more information.
-