Skip to content

Fix TLS v1.3 on modern Postfix #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GermanCoding merged 2 commits into from
Sep 18, 2025
Merged

Fix TLS v1.3 on modern Postfix #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d580097
Add test for new Postfix TLS 1.3 syntax
christiaangoossens Sep 17, 2025
1f07132
Fix regex to work for Stalwart and modern Postfix
christiaangoossens Sep 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions test/TlsIconTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ final class TlsIconTest extends TestCase
/** @var string */
private $strStalwartCryptedTlsv13WithCipher = '<img class="lock_icon" src="plugins/tls_icon/lock.svg" title="TLSv1.3 with cipher TLS13_AES_256_GCM_SHA384" />';

/** @var string */
private $strNewPostfixTLSv13 = '<img class="lock_icon" src="plugins/tls_icon/lock.svg" title="TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (secp384r1) server-signature RSA-PSS (4096 bits) server-digest SHA256" />';

public function testInstance()
{
$o = new tls_icon();
Expand Down Expand Up @@ -196,6 +199,43 @@ public function testMessageHeadersInternal()
], $headersProcessed);
}

public function testPostfixTLS13NewSyntax()
{
$header = 'from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazon11023139.outbound.protection.outlook.com [52.101.83.139])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (secp384r1) server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by example.com with ESMTPS id EXAMPLE
for <test@example.com>; Tue, 16 Sep 2025 12:26:17 +0200 (CEST)';

$o = new tls_icon();
$headersProcessed = $o->message_headers([
'output' => [
'subject' => [
'value' => 'Sent to you',
],
],
'headers' => (object)[
'others' => [
'received' => $header,
]
]
]);
$this->assertEquals([
'output' => [
'subject' => [
'value' => 'Sent to you' . $this->strNewPostfixTLSv13,
'html' => 1,
],
],
'headers' => (object)[
'others' => [
'received' => $header,
]
]
], $headersProcessed);
}


public function testMessageHeadersMultiFromWithConfig()
{
$inputHeaders = [
Expand Down
8 changes: 5 additions & 3 deletions tls_icon.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

class tls_icon extends rcube_plugin
{
const POSTFIX_TLS_REGEX = "/\(using (TLS[^()]+(?:\([^)]+\))?)\)/im";
const POSTFIX_TLS_REGEX = "/\(using (TLS(?:[^()]|\([^()]*\))*)\)/im";
const POSTFIX_LOCAL_REGEX = "/\([a-zA-Z]*, from userid [0-9]*\)/im";
const SENDMAIL_TLS_REGEX = "/\(version=(TLS.*)\)(\s+for|;)/im";

Expand Down Expand Up @@ -59,8 +59,10 @@ public function message_headers($p)
return $p;
}

if (preg_match_all(tls_icon::POSTFIX_TLS_REGEX, $Received, $items, PREG_PATTERN_ORDER) ||
preg_match_all(tls_icon::SENDMAIL_TLS_REGEX, $Received, $items, PREG_PATTERN_ORDER)) {
if (
preg_match_all(tls_icon::POSTFIX_TLS_REGEX, $Received, $items, PREG_PATTERN_ORDER) ||
preg_match_all(tls_icon::SENDMAIL_TLS_REGEX, $Received, $items, PREG_PATTERN_ORDER)
) {
$data = $items[1][0];
$this->icon_img .= '<img class="lock_icon" src="plugins/tls_icon/lock.svg" title="' . htmlentities($data) . '" />';
} elseif (preg_match_all(tls_icon::POSTFIX_LOCAL_REGEX, $Received, $items, PREG_PATTERN_ORDER)) {
Expand Down