[NET-735] IMAP missing timeout on SSL handshake

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.5, 3.11.1
• Component/s: IMAP
• Flags: Patch
• Assignee: Unassigned
• Reporter: John van der Kamp
• Created: 23/Sep/24 15:13
• Updated: 23/Sep/24 15:13

Description

When an SSL handshake is not being received due to network issues, this is not detected and the connection hangs waiting for data. The code does not install a timeout on the ssl socket.

 

We are using the following patch to fix this:

 

--- commons-net/commons-net/3.11.1/commons-net-3.11.1-sources/org/apache/commons/net/imap/IMAPSClient.java
+++ commons-net/commons-net/3.11.1/commons-net-3.11.1-sources/org/apache/commons/net/imap/IMAPSClient.java
@@ -282,6 +282,7 @@ public class IMAPSClient extends IMAPClient {
         final SSLSocket socket = (SSLSocket) ssf.createSocket(socket, host, port, true);
         socket.setEnableSessionCreation(true);
         socket.setUseClientMode(true);
+        socket.setSoTimeout(1000);
 
         if (tlsEndpointChecking) {