Re: [mail-dev] Request for enhancement - Show transport protocol version

["Rob Griffin (rgriffin)" <Rob.Griffin@xxxxxxxxx>]

Hi Jason,

Thanks for that info. However it is not enough to know which protocol version is in use. We want to ensure TLS1.2 is being used.

Regards,

Rob Griffin
Software Analyst, Spotlight on SQL Server
Quest | R&D
rob.griffin@xxxxxxxxx 

-----Original Message-----
From: mail-dev-bounces@xxxxxxxxxxx <mail-dev-bounces@xxxxxxxxxxx> On Behalf Of Jason Mehrens
Sent: Friday, 28 August 2020 1:51 PM
To: mail-dev@xxxxxxxxxxx
Subject: Re: [mail-dev] Request for enhancement - Show transport protocol version

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.


Hi Rob,

There are public methods that you can query to determine this information.  You need to have access to a Transport, Message, or Session in order to invoke them.

A transport is a type of service so all you need to do is gain access to the Transport used to send the message.  If you don't have a transport then you need to gain access to a Session that is used to create a transport.  Message and MessageContext can gain access to the session assigned to a MimeMessage.  Once you have access to the Session you need to call one of the getTransport methods.  If you are using the static Transport::send the you need to emulate the transport lookup rules in : https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Feclipse-ee4j%2Fmail%2Fblob%2Fmaster%2Fmail%2Fsrc%2Fmain%2Fjava%2Fjakarta%2Fmail%2FTransport.java%23L217&amp;data=02%7C01%7Crob.griffin%40quest.com%7C7b77107d397b4f2ed14308d84b05b23c%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637341835130994647&amp;sdata=MaasybNM1KTEOMkhuECY0w45brPOamt0vBqbCd6eMec%3D&amp;reserved=0

Now there is no service query method that determines if implementation is secure.  However, there are query methods that don't require resorting to reflection.  They are:

1. Inspect Service::getURLName (https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Feclipse-ee4j.github.io%2Fmail%2Fdocs%2Fapi%2Fjavax%2Fmail%2FService.html%23getURLName--&amp;data=02%7C01%7Crob.griffin%40quest.com%7C7b77107d397b4f2ed14308d84b05b23c%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637341835130994647&amp;sdata=F6fbec%2BYAXKbPE%2B6kGApsiUnqJFFpUMi%2FHj8%2FKqRKe8%3D&amp;reserved=0) to see if the transport is secure.
2. Check the type of the transport.  If you are not using a custom transport the secure transport class contains SSL in the class name.

Jason

________________________________________
From: mail-dev-bounces@xxxxxxxxxxx <mail-dev-bounces@xxxxxxxxxxx> on behalf of Rob Griffin (rgriffin) <Rob.Griffin@xxxxxxxxx>
Sent: Thursday, August 27, 2020 7:29 PM
To: mail-dev@xxxxxxxxxxx
Subject: [mail-dev] Request for enhancement - Show transport protocol version

Hi,

We are using currently using JavaMail in our application (Spotlight on SQL Server Enterprise) but will be switching to Jakarta Mail shortly. We want to warn users when they are using an insecure protocol to send email. We are planning to use reflection to discover which protocol is being used but that is a very hacky way to find this out. Would it be possible to add a method to the API to show the transport protocol and version?

Regards,

Rob Griffin
Software Analyst, Spotlight on SQL Server Quest | R&D rob.griffin@xxxxxxxxx<mailto:rob.griffin@xxxxxxxxx> ?
_______________________________________________
mail-dev mailing list
mail-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.eclipse.org%2Fmailman%2Flistinfo%2Fmail-dev&amp;data=02%7C01%7Crob.griffin%40quest.com%7C7b77107d397b4f2ed14308d84b05b23c%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637341835130994647&amp;sdata=%2F8R5i8W1X6DXVUKfGubvwpRnJnTTb49cw76mkW%2B3u%2B8%3D&amp;reserved=0