fix: support SMTP STARTTLS mode and NTLM auth (#5426)

* fix: support SMTP STARTTLS mode and NTLM auth

Add explicit SMTP STARTTLS configuration for 587-style connections and keep SSL/TLS as the implicit TLS mode.

Prefer PLAIN when advertised, keep LOGIN compatibility, and add NTLM as a fallback for Exchange SMTP servers that require it after STARTTLS.

* fix: respect explicit SMTP encryption mode

* fix: preserve SMTP TLS compatibility

common/email_ntlm_auth.go

@@ -0,0 +1,83 @@
+package common
+
+import (
+	"errors"
+	"net/smtp"
+	"strings"
+
+	ntlmssp "github.com/Azure/go-ntlmssp"
+)
+
+type smtpAutoAuth struct {
+	username string
+	password string
+	mech     string
+}
+
+func AutoSMTPAuth(username, password string) smtp.Auth {
+	return &smtpAutoAuth{username: username, password: password}
+}
+
+func (a *smtpAutoAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
+	useLoginAuth := SMTPForceAuthLogin
+	if !useLoginAuth && shouldUseSMTPLoginAuth() {
+		useLoginAuth = !(server != nil && len(server.Auth) == 1 && smtpServerSupportsAuth(server, "NTLM"))
+	}
+	if useLoginAuth {
+		a.mech = "LOGIN"
+		return "LOGIN", []byte{}, nil
+	}
+
+	switch {
+	case smtpServerSupportsAuth(server, "PLAIN"):
+		a.mech = "PLAIN"
+		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+	case smtpServerSupportsAuth(server, "LOGIN"):
+		a.mech = "LOGIN"
+		return "LOGIN", []byte{}, nil
+	case smtpServerSupportsAuth(server, "NTLM"):
+		a.mech = "NTLM"
+		negotiateMessage, err := ntlmssp.NewNegotiateMessage("", "")
+		if err != nil {
+			return "", nil, err
+		}
+		return "NTLM", negotiateMessage, nil
+	default:
+		a.mech = "PLAIN"
+		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+	}
+}
+
+func (a *smtpAutoAuth) Next(fromServer []byte, more bool) ([]byte, error) {
+	if !more {
+		return nil, nil
+	}
+
+	switch a.mech {
+	case "LOGIN":
+		switch string(fromServer) {
+		case "Username:":
+			return []byte(a.username), nil
+		case "Password:":
+			return []byte(a.password), nil
+		default:
+			return nil, errors.New("unknown SMTP AUTH LOGIN challenge")
+		}
+	case "NTLM":
+		return ntlmssp.NewAuthenticateMessage(fromServer, a.username, a.password, nil)
+	default:
+		return nil, errors.New("unexpected SMTP auth challenge")
+	}
+}
+
+func smtpServerSupportsAuth(server *smtp.ServerInfo, mechanism string) bool {
+	if server == nil {
+		return false
+	}
+	for _, auth := range server.Auth {
+		if strings.EqualFold(auth, mechanism) {
+			return true
+		}
+	}
+	return false
+}