72 lines
1.8 KiB
Go
72 lines
1.8 KiB
Go
package checker
|
|
|
|
import (
|
|
"net"
|
|
"strconv"
|
|
|
|
sdk "git.happydns.org/checker-sdk-go/checker"
|
|
tlsct "git.happydns.org/checker-tls/contract"
|
|
)
|
|
|
|
func Provider() sdk.ObservationProvider {
|
|
return &smtpProvider{}
|
|
}
|
|
|
|
type smtpProvider struct{}
|
|
|
|
func (p *smtpProvider) Key() sdk.ObservationKey {
|
|
return ObservationKeySMTP
|
|
}
|
|
|
|
// DiscoverEntries implements sdk.DiscoveryPublisher.
|
|
//
|
|
// We publish one tls.endpoint.v1 entry per MX target so the TLS checker
|
|
// picks up the connection and runs the cert/chain/SAN/expiry posture
|
|
// against it. STARTTLS is "smtp" and RequireSTARTTLS stays false because
|
|
// MX SMTP on port 25 is opportunistic (RFC 7672 / RFC 8461 are what turn
|
|
// it into a hard requirement, and they live in separate checkers).
|
|
//
|
|
// SNI is the MX target hostname: that is the name the receiving MTA
|
|
// controls and will typically present in its certificate. RFC 7672
|
|
// DANE-TLSA binds the TLSA record to <_port._tcp.mx-target>, so the
|
|
// target's A/AAAA+name are also the right reference for DANE.
|
|
func (p *smtpProvider) DiscoverEntries(data any) ([]sdk.DiscoveryEntry, error) {
|
|
d, ok := data.(*SMTPData)
|
|
if !ok || d == nil {
|
|
return nil, nil
|
|
}
|
|
if d.MX.NullMX {
|
|
return nil, nil
|
|
}
|
|
|
|
var out []sdk.DiscoveryEntry
|
|
seen := map[string]bool{}
|
|
for _, rec := range d.MX.Records {
|
|
if rec.Target == "" || rec.IsIPLiteral {
|
|
continue
|
|
}
|
|
key := endpointKey(rec.Target, smtpPort)
|
|
if seen[key] {
|
|
continue
|
|
}
|
|
seen[key] = true
|
|
|
|
ep := tlsct.TLSEndpoint{
|
|
Host: rec.Target,
|
|
Port: smtpPort,
|
|
SNI: rec.Target,
|
|
STARTTLS: "smtp",
|
|
RequireSTARTTLS: false,
|
|
}
|
|
entry, err := tlsct.NewEntry(ep)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, entry)
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func endpointKey(host string, port uint16) string {
|
|
return net.JoinHostPort(host, strconv.FormatUint(uint64(port), 10))
|
|
}
|