1package message

2

3import (

4 "crypto/tls"

5 "fmt"

6

7 "github.com/mjl-/mox/mlog"

8)

9

10// TLSReceivedComment returns a comment about TLS of the connection for use in a Receive header.

11func TLSReceivedComment(log *mlog.Log, cs tls.ConnectionState) []string {

12 // todo future: we could use the "tls" clause for the Received header as specified in ../rfc/8314:496. however, the text implies it is only for submission, not regular smtp. and it cannot specify the tls version. for now, not worth the trouble.

13

14 // Comments from other mail servers:

15 // gmail.com: (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128)

16 // yahoo.com: (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256)

17 // proton.me: (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested)

18 // outlook.com: (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)

19

20 var l []string

21 add := func(s string) {

22 l = append(l, s)

23 }

24

25 versions := map[uint16]string{

26 tls.VersionTLS10: "TLS1.0",

27 tls.VersionTLS11: "TLS1.1",

28 tls.VersionTLS12: "TLS1.2",

29 tls.VersionTLS13: "TLS1.3",

30 }

31

32 if version, ok := versions[cs.Version]; ok {

33 add(version)

34 } else {

35 log.Info("unknown tls version identifier", mlog.Field("version", cs.Version))

36 add(fmt.Sprintf("TLS identifier %x", cs.Version))

37 }

38

39 add(tls.CipherSuiteName(cs.CipherSuite))

40

41 // Make it a comment.

42 l[0] = "(" + l[0]

43 l[len(l)-1] = l[len(l)-1] + ")"

44

45 return l

46}

47