1package http

2

3import (

4 "encoding/xml"

5 "fmt"

6 "log/slog"

7 "net/http"

8 "strings"

9

10 "github.com/prometheus/client_golang/prometheus"

11 "github.com/prometheus/client_golang/prometheus/promauto"

12 "rsc.io/qr"

13

14 "github.com/mjl-/mox/admin"

15 "github.com/mjl-/mox/smtp"

16)

17

18var (

19 metricAutoconf = promauto.NewCounterVec(

20 prometheus.CounterOpts{

21 Name: "mox_autoconf_request_total",

22 Help: "Number of autoconf requests.",

23 },

24 []string{"domain"},

25 )

26 metricAutodiscover = promauto.NewCounterVec(

27 prometheus.CounterOpts{

28 Name: "mox_autodiscover_request_total",

29 Help: "Number of autodiscover requests.",

30 },

31 []string{"domain"},

32 )

33)

34

35// Autoconfiguration/Autodiscovery:

36//

37// - Thunderbird will request an "autoconfig" xml file.

38// - Microsoft tools will request an "autodiscovery" xml file.

39// - In my tests on an internal domain, iOS mail only talks to Apple servers, then

40// does not attempt autoconfiguration. Possibly due to them being private DNS

41// names. Apple software can be provisioned with "mobileconfig" profile files,

42// which users can download after logging in.

43//

44// DNS records seem optional, but autoconfig.<domain> and autodiscover.<domain>

45// (both CNAME or A) are useful, and so is SRV _autodiscovery._tcp.<domain> 0 0 443

46// autodiscover.<domain> (or just <hostname> directly).

47//

48// Autoconf/discovery only works with valid TLS certificates, not with self-signed

49// certs. So use it on public endpoints with certs signed by common CA's, or run

50// your own (internal) CA and import the CA cert on your devices.

51//

52// Also see https://roll.urown.net/server/mail/autoconfig.html

53

54// Autoconfiguration for Mozilla Thunderbird.

55// User should create a DNS record: autoconfig.<domain> (CNAME or A).

56// See https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat

57func autoconfHandle(w http.ResponseWriter, r *http.Request) {

58 log := pkglog.WithContext(r.Context())

59

60 var addrDom string

61 defer func() {

62 metricAutoconf.WithLabelValues(addrDom).Inc()

63 }()

64

65 email := r.FormValue("emailaddress")

66 log.Debug("autoconfig request", slog.String("email", email))

67 addr, err := smtp.ParseAddress(email)

68 if err != nil {

69 http.Error(w, "400 - bad request - invalid parameter emailaddress", http.StatusBadRequest)

70 return

71 }

72

73 socketType := func(tlsMode admin.TLSMode) (string, error) {

74 switch tlsMode {

75 case admin.TLSModeImmediate:

76 return "SSL", nil

77 case admin.TLSModeSTARTTLS:

78 return "STARTTLS", nil

79 case admin.TLSModeNone:

80 return "plain", nil

81 default:

82 return "", fmt.Errorf("unknown tls mode %v", tlsMode)

83 }

84 }

85

86 var imapTLS, submissionTLS string

87 config, err := admin.ClientConfigDomain(addr.Domain)

88 if err == nil {

89 imapTLS, err = socketType(config.IMAP.TLSMode)

90 }

91 if err == nil {

92 submissionTLS, err = socketType(config.Submission.TLSMode)

93 }

94 if err != nil {

95 http.Error(w, "400 - bad request - "+err.Error(), http.StatusBadRequest)

96 return

97 }

98

99 // Thunderbird doesn't seem to allow U-labels, always return ASCII names.

100 var resp autoconfigResponse

101 resp.Version = "1.1"

102 resp.EmailProvider.ID = addr.Domain.ASCII

103 resp.EmailProvider.Domain = addr.Domain.ASCII

104 resp.EmailProvider.DisplayName = email

105 resp.EmailProvider.DisplayShortName = addr.Domain.ASCII

106

107 // todo: specify SCRAM-SHA-256 once thunderbird and autoconfig supports it. or perhaps that will fall under "password-encrypted" by then.

108 // todo: let user configure they prefer or require tls client auth and specify "TLS-client-cert"

109

110 resp.EmailProvider.IncomingServer.Type = "imap"

111 resp.EmailProvider.IncomingServer.Hostname = config.IMAP.Host.ASCII

112 resp.EmailProvider.IncomingServer.Port = config.IMAP.Port

113 resp.EmailProvider.IncomingServer.SocketType = imapTLS

114 resp.EmailProvider.IncomingServer.Username = email

115 resp.EmailProvider.IncomingServer.Authentication = "password-encrypted"

116

117 resp.EmailProvider.OutgoingServer.Type = "smtp"

118 resp.EmailProvider.OutgoingServer.Hostname = config.Submission.Host.ASCII

119 resp.EmailProvider.OutgoingServer.Port = config.Submission.Port

120 resp.EmailProvider.OutgoingServer.SocketType = submissionTLS

121 resp.EmailProvider.OutgoingServer.Username = email

122 resp.EmailProvider.OutgoingServer.Authentication = "password-encrypted"

123

124 // todo: should we put the email address in the URL?

125 resp.ClientConfigUpdate.URL = fmt.Sprintf("https://autoconfig.%s/mail/config-v1.1.xml", addr.Domain.ASCII)

126

127 w.Header().Set("Content-Type", "application/xml; charset=utf-8")

128 enc := xml.NewEncoder(w)

129 enc.Indent("", "\t")

130 fmt.Fprint(w, xml.Header)

131 if err := enc.Encode(resp); err != nil {

132 log.Errorx("marshal autoconfig response", err)

133 }

134}

135

136// Autodiscover from Microsoft, also used by Thunderbird.

137// User should create a DNS record: _autodiscover._tcp.<domain> SRV 0 0 443 <hostname>

138//

139// In practice, autodiscover does not seem to work wit microsoft clients. A

140// connectivity test tool for outlook is available on

141// https://testconnectivity.microsoft.com/, it has an option to do "Autodiscover to

142// detect server settings". Incoming TLS connections are all failing, with various

143// errors.

144//

145// Thunderbird does understand autodiscover.

146func autodiscoverHandle(w http.ResponseWriter, r *http.Request) {

147 log := pkglog.WithContext(r.Context())

148

149 var addrDom string

150 defer func() {

151 metricAutodiscover.WithLabelValues(addrDom).Inc()

152 }()

153

154 if r.Method != "POST" {

155 http.Error(w, "405 - method not allowed - post required", http.StatusMethodNotAllowed)

156 return

157 }

158

159 var req autodiscoverRequest

160 if err := xml.NewDecoder(r.Body).Decode(&req); err != nil {

161 http.Error(w, "400 - bad request - parsing autodiscover request: "+err.Error(), http.StatusMethodNotAllowed)

162 return

163 }

164

165 log.Debug("autodiscover request", slog.String("email", req.Request.EmailAddress))

166

167 addr, err := smtp.ParseAddress(req.Request.EmailAddress)

168 if err != nil {

169 http.Error(w, "400 - bad request - invalid parameter emailaddress", http.StatusBadRequest)

170 return

171 }

172

173 // tlsmode returns the "ssl" and "encryption" fields.

174 tlsmode := func(tlsMode admin.TLSMode) (string, string, error) {

175 switch tlsMode {

176 case admin.TLSModeImmediate:

177 return "on", "TLS", nil

178 case admin.TLSModeSTARTTLS:

179 return "on", "", nil

180 case admin.TLSModeNone:

181 return "off", "", nil

182 default:

183 return "", "", fmt.Errorf("unknown tls mode %v", tlsMode)

184 }

185 }

186

187 var imapSSL, imapEncryption string

188 var submissionSSL, submissionEncryption string

189 config, err := admin.ClientConfigDomain(addr.Domain)

190 if err == nil {

191 imapSSL, imapEncryption, err = tlsmode(config.IMAP.TLSMode)

192 }

193 if err == nil {

194 submissionSSL, submissionEncryption, err = tlsmode(config.Submission.TLSMode)

195 }

196 if err != nil {

197 http.Error(w, "400 - bad request - "+err.Error(), http.StatusBadRequest)

198 return

199 }

200

201 // The docs are generated and fragmented in many tiny pages, hard to follow.

202 // High-level starting point, https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxdscli/78530279-d042-4eb0-a1f4-03b18143cd19

203 // Request: https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxdscli/2096fab2-9c3c-40b9-b123-edf6e8d55a9b

204 // Response, protocol: https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxdscli/f4238db6-a983-435c-807a-b4b4a624c65b

205 // It appears autodiscover does not allow specifying SCRAM-SHA-256 as

206 // authentication method, or any authentication method that real clients actually

207 // use. See

208 // https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxdscli/21fd2dd5-c4ee-485b-94fb-e7db5da93726

209

210 w.Header().Set("Content-Type", "application/xml; charset=utf-8")

211

212 // todo: let user configure they prefer or require tls client auth and add "AuthPackage" with value "certificate" to Protocol? see https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxdscli/21fd2dd5-c4ee-485b-94fb-e7db5da93726

213

214 resp := autodiscoverResponse{}

215 resp.XMLName.Local = "Autodiscover"

216 resp.XMLName.Space = "http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"

217 resp.Response.XMLName.Local = "Response"

218 resp.Response.XMLName.Space = "http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a"

219 resp.Response.Account = autodiscoverAccount{

220 AccountType: "email",

221 Action: "settings",

222 Protocol: []autodiscoverProtocol{

223 {

224 Type: "IMAP",

225 Server: config.IMAP.Host.ASCII,

226 Port: config.IMAP.Port,

227 LoginName: req.Request.EmailAddress,

228 SSL: imapSSL,

229 Encryption: imapEncryption,

230 SPA: "off", // Override default "on", this is Microsofts proprietary authentication protocol.

231 AuthRequired: "on",

232 },

233 {

234 Type: "SMTP",

235 Server: config.Submission.Host.ASCII,

236 Port: config.Submission.Port,

237 LoginName: req.Request.EmailAddress,

238 SSL: submissionSSL,

239 Encryption: submissionEncryption,

240 SPA: "off", // Override default "on", this is Microsofts proprietary authentication protocol.

241 AuthRequired: "on",

242 },

243 },

244 }

245 enc := xml.NewEncoder(w)

246 enc.Indent("", "\t")

247 fmt.Fprint(w, xml.Header)

248 if err := enc.Encode(resp); err != nil {

249 log.Errorx("marshal autodiscover response", err)

250 }

251}

252

253// Thunderbird requests these URLs for autoconfig/autodiscover:

254// https://autoconfig.example.org/mail/config-v1.1.xml?emailaddress=user%40example.org

255// https://autodiscover.example.org/autodiscover/autodiscover.xml

256// https://example.org/.well-known/autoconfig/mail/config-v1.1.xml?emailaddress=user%40example.org

257// https://example.org/autodiscover/autodiscover.xml

258type autoconfigResponse struct {

259 XMLName xml.Name `xml:"clientConfig"`

260 Version string `xml:"version,attr"`

261

262 EmailProvider struct {

263 ID string `xml:"id,attr"`

264 Domain string `xml:"domain"`

265 DisplayName string `xml:"displayName"`

266 DisplayShortName string `xml:"displayShortName"`

267

268 IncomingServer struct {

269 Type string `xml:"type,attr"`

270 Hostname string `xml:"hostname"`

271 Port int `xml:"port"`

272 SocketType string `xml:"socketType"`

273 Username string `xml:"username"`

274 Authentication string `xml:"authentication"`

275 } `xml:"incomingServer"`

276

277 OutgoingServer struct {

278 Type string `xml:"type,attr"`

279 Hostname string `xml:"hostname"`

280 Port int `xml:"port"`

281 SocketType string `xml:"socketType"`

282 Username string `xml:"username"`

283 Authentication string `xml:"authentication"`

284 } `xml:"outgoingServer"`

285 } `xml:"emailProvider"`

286

287 ClientConfigUpdate struct {

288 URL string `xml:"url,attr"`

289 } `xml:"clientConfigUpdate"`

290}

291

292type autodiscoverRequest struct {

293 XMLName xml.Name `xml:"Autodiscover"`

294 Request struct {

295 EmailAddress string `xml:"EMailAddress"`

296 AcceptableResponseSchema string `xml:"AcceptableResponseSchema"`

297 }

298}

299

300type autodiscoverResponse struct {

301 XMLName xml.Name

302 Response struct {

303 XMLName xml.Name

304 Account autodiscoverAccount

305 }

306}

307

308type autodiscoverAccount struct {

309 AccountType string

310 Action string

311 Protocol []autodiscoverProtocol

312}

313

314type autodiscoverProtocol struct {

315 Type string

316 Server string

317 Port int

318 DirectoryPort int

319 ReferralPort int

320 LoginName string

321 SSL string

322 Encryption string `xml:",omitempty"`

323 SPA string

324 AuthRequired string

325}

326

327// Serve a .mobileconfig file. This endpoint is not a standard place where Apple

328// devices look. We point to it from the account page.

329func mobileconfigHandle(w http.ResponseWriter, r *http.Request) {

330 if r.Method != "GET" {

331 http.Error(w, "405 - method not allowed - get required", http.StatusMethodNotAllowed)

332 return

333 }

334 addresses := r.FormValue("addresses")

335 fullName := r.FormValue("name")

336 var buf []byte

337 var err error

338 if addresses == "" {

339 err = fmt.Errorf("missing/empty field addresses")

340 }

341 l := strings.Split(addresses, ",")

342 if err == nil {

343 buf, err = MobileConfig(l, fullName)

344 }

345 if err != nil {

346 http.Error(w, "400 - bad request - "+err.Error(), http.StatusBadRequest)

347 return

348 }

349 h := w.Header()

350 filename := l[0]

351 filename = strings.ReplaceAll(filename, ".", "-")

352 filename = strings.ReplaceAll(filename, "@", "-at-")

353 filename = "email-account-" + filename + ".mobileconfig"

354 h.Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))

355 w.Write(buf)

356}

357

358// Serve a png file with qrcode with the link to the .mobileconfig file, should be

359// helpful for mobile devices.

360func mobileconfigQRCodeHandle(w http.ResponseWriter, r *http.Request) {

361 if r.Method != "GET" {

362 http.Error(w, "405 - method not allowed - get required", http.StatusMethodNotAllowed)

363 return

364 }

365 if !strings.HasSuffix(r.URL.Path, ".qrcode.png") {

366 http.NotFound(w, r)

367 return

368 }

369

370 // Compose URL, scheme and host are not set.

371 u := *r.URL

372 if r.TLS == nil {

373 u.Scheme = "http"

374 } else {

375 u.Scheme = "https"

376 }

377 u.Host = r.Host

378 u.Path = strings.TrimSuffix(u.Path, ".qrcode.png")

379

380 code, err := qr.Encode(u.String(), qr.L)

381 if err != nil {

382 http.Error(w, "500 - internal server error - generating qr-code: "+err.Error(), http.StatusInternalServerError)

383 return

384 }

385 h := w.Header()

386 h.Set("Content-Type", "image/png")

387 w.Write(code.PNG())

388}

389