fix: support SMTP STARTTLS mode and NTLM auth

common/constants.go

@@ -120,6 +120,8 @@ var InsecureTLSConfig = &tls.Config{InsecureSkipVerify: true}
 var SMTPServer = ""
 var SMTPPort = 587
 var SMTPSSLEnabled = false
+var SMTPStartTLSEnabled = false
+var SMTPInsecureSkipVerify = false
 var SMTPForceAuthLogin = false
 var SMTPAccount = ""
 var SMTPFrom = ""

common/email.go

@@ -27,10 +27,52 @@ func shouldUseSMTPLoginAuth() bool {
 }
 
 func getSMTPAuth() smtp.Auth {
-	if shouldUseSMTPLoginAuth() {
-		return LoginAuth(SMTPAccount, SMTPToken)
+	return AutoSMTPAuth(SMTPAccount, SMTPToken)
+}
+
+func shouldAuthenticateSMTP() bool {
+	return SMTPAccount != "" && SMTPToken != ""
+}
+
+func smtpTLSConfig() *tls.Config {
+	return &tls.Config{
+		ServerName:         SMTPServer,
+		InsecureSkipVerify: SMTPInsecureSkipVerify, // #nosec G402 -- admin-controlled SMTP compatibility option.
+	}
+}
+
+func newSMTPClient(addr string) (*smtp.Client, error) {
+	if SMTPSSLEnabled || (SMTPPort == 465 && !SMTPStartTLSEnabled) {
+		conn, err := tls.Dial("tcp", addr, smtpTLSConfig())
+		if err != nil {
+			return nil, err
+		}
+		client, err := smtp.NewClient(conn, SMTPServer)
+		if err != nil {
+			_ = conn.Close()
+			return nil, err
+		}
+		return client, nil
 	}
-	return smtp.PlainAuth("", SMTPAccount, SMTPToken, SMTPServer)
+
+	client, err := smtp.Dial(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	if SMTPStartTLSEnabled {
+		startTLSSupported, _ := client.Extension("STARTTLS")
+		if !startTLSSupported {
+			_ = client.Close()
+			return nil, fmt.Errorf("SMTP server does not support STARTTLS")
+		}
+		if err := client.StartTLS(smtpTLSConfig()); err != nil {
+			_ = client.Close()
+			return nil, err
+		}
+	}
+
+	return client, nil
 }
 
 func SendEmail(subject string, receiver string, content string) error {
@@ -56,47 +98,37 @@ func SendEmail(subject string, receiver string, content string) error {
 	addr := fmt.Sprintf("%s:%d", SMTPServer, SMTPPort)
 	to := strings.Split(receiver, ";")
 	var err error
-	if SMTPPort == 465 || SMTPSSLEnabled {
-		tlsConfig := &tls.Config{
-			InsecureSkipVerify: true,
-			ServerName:         SMTPServer,
-		}
-		conn, err := tls.Dial("tcp", fmt.Sprintf("%s:%d", SMTPServer, SMTPPort), tlsConfig)
-		if err != nil {
-			return err
-		}
-		client, err := smtp.NewClient(conn, SMTPServer)
-		if err != nil {
-			return err
-		}
-		defer client.Close()
+	client, err := newSMTPClient(addr)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+	if shouldAuthenticateSMTP() {
 		if err = client.Auth(auth); err != nil {
 			return err
 		}
-		if err = client.Mail(SMTPFrom); err != nil {
-			return err
-		}
-		receiverEmails := strings.Split(receiver, ";")
-		for _, receiver := range receiverEmails {
-			if err = client.Rcpt(receiver); err != nil {
-				return err
-			}
-		}
-		w, err := client.Data()
-		if err != nil {
-			return err
-		}
-		_, err = w.Write(mail)
-		if err != nil {
-			return err
-		}
-		err = w.Close()
-		if err != nil {
+	}
+	if err = client.Mail(SMTPFrom); err != nil {
+		return err
+	}
+	for _, receiver := range to {
+		if err = client.Rcpt(receiver); err != nil {
 			return err
 		}
-	} else {
-		err = smtp.SendMail(addr, auth, SMTPFrom, to, mail)
 	}
+	w, err := client.Data()
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(mail)
+	if err != nil {
+		return err
+	}
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+	err = client.Quit()
 	if err != nil {
 		SysError(fmt.Sprintf("failed to send email to %s: %v", receiver, err))
 	}

common/email_ntlm_auth.go

@@ -0,0 +1,83 @@
+package common
+
+import (
+	"errors"
+	"net/smtp"
+	"strings"
+
+	ntlmssp "github.com/Azure/go-ntlmssp"
+)
+
+type smtpAutoAuth struct {
+	username string
+	password string
+	mech     string
+}
+
+func AutoSMTPAuth(username, password string) smtp.Auth {
+	return &smtpAutoAuth{username: username, password: password}
+}
+
+func (a *smtpAutoAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
+	useLoginAuth := SMTPForceAuthLogin
+	if !useLoginAuth && shouldUseSMTPLoginAuth() {
+		useLoginAuth = !(server != nil && len(server.Auth) == 1 && smtpServerSupportsAuth(server, "NTLM"))
+	}
+	if useLoginAuth {
+		a.mech = "LOGIN"
+		return "LOGIN", []byte{}, nil
+	}
+
+	switch {
+	case smtpServerSupportsAuth(server, "PLAIN"):
+		a.mech = "PLAIN"
+		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+	case smtpServerSupportsAuth(server, "LOGIN"):
+		a.mech = "LOGIN"
+		return "LOGIN", []byte{}, nil
+	case smtpServerSupportsAuth(server, "NTLM"):
+		a.mech = "NTLM"
+		negotiateMessage, err := ntlmssp.NewNegotiateMessage("", "")
+		if err != nil {
+			return "", nil, err
+		}
+		return "NTLM", negotiateMessage, nil
+	default:
+		a.mech = "PLAIN"
+		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+	}
+}
+
+func (a *smtpAutoAuth) Next(fromServer []byte, more bool) ([]byte, error) {
+	if !more {
+		return nil, nil
+	}
+
+	switch a.mech {
+	case "LOGIN":
+		switch string(fromServer) {
+		case "Username:":
+			return []byte(a.username), nil
+		case "Password:":
+			return []byte(a.password), nil
+		default:
+			return nil, errors.New("unknown SMTP AUTH LOGIN challenge")
+		}
+	case "NTLM":
+		return ntlmssp.NewAuthenticateMessage(fromServer, a.username, a.password, nil)
+	default:
+		return nil, errors.New("unexpected SMTP auth challenge")
+	}
+}
+
+func smtpServerSupportsAuth(server *smtp.ServerInfo, mechanism string) bool {
+	if server == nil {
+		return false
+	}
+	for _, auth := range server.Auth {
+		if strings.EqualFold(auth, mechanism) {
+			return true
+		}
+	}
+	return false
+}