1package mox

2

3import (

4 "crypto/tls"

5 "fmt"

6 "log/slog"

7

8 "github.com/mjl-/mox/mlog"

9)

10

11// TLSReceivedComment returns a comment about TLS of the connection for use in a Receive header.

12func TLSReceivedComment(log mlog.Log, cs tls.ConnectionState) []string {

13 // todo future: we could use the "tls" clause for the Received header as specified in ../rfc/8314:496. however, the text implies it is only for submission, not regular smtp. and it cannot specify the tls version. for now, not worth the trouble.

14

15 // Comments from other mail servers:

16 // gmail.com: (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128)

17 // yahoo.com: (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256)

18 // proton.me: (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested)

19 // outlook.com: (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)

20

21 var l []string

22 add := func(s string) {

23 l = append(l, s)

24 }

25

26 versions := map[uint16]string{

27 tls.VersionTLS10: "TLS1.0",

28 tls.VersionTLS11: "TLS1.1",

29 tls.VersionTLS12: "TLS1.2",

30 tls.VersionTLS13: "TLS1.3",

31 }

32

33 if version, ok := versions[cs.Version]; ok {

34 add(version)

35 } else {

36 log.Info("unknown tls version identifier", slog.Any("version", cs.Version))

37 add(fmt.Sprintf("TLS identifier %x", cs.Version))

38 }

39

40 add(tls.CipherSuiteName(cs.CipherSuite))

41

42 // Make it a comment.

43 l[0] = "(" + l[0]

44 l[len(l)-1] = l[len(l)-1] + ")"

45

46 return l

47}

48