wneessen/go-mail
1
1
Fork 0
mirror of https://github.com/wneessen/go-mail.git synced 2024-11-15 02:12:55 +01:00
Code Issues Projects Releases Packages Wiki Activity

Redact authentication logs

Browse source 
Add a boolean flag `authIsActive` to manage redaction of sensitive authentication information in debug logs. When this flag is true, authentication details are replaced with `<auth redacted>`.
This commit is contained in:
Winni Neessen 2024-10-12 20:53:58 +02:00
parent 8faac3d101
commit 7acfe8015d
Signed by: wneessen
GPG key ID: 385AC9889632126E
1 changed files with 24 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
smtp/smtp.go
View file

@ -82,7 +82,8 @@ type Client struct {
localName string // the name to use in HELO/EHLO localName string // the name to use in HELO/EHLO
// logger will be used for debug logging // logger will be used for debug logging
logger log.Logger logger log.Logger
authIsActive bool
// mutex is used to synchronize access to shared resources, ensuring that only one goroutine can access // mutex is used to synchronize access to shared resources, ensuring that only one goroutine can access
// the resource at a time. // the resource at a time.
@ -174,7 +175,12 @@ func (c *Client) Hello(localName string) error {
func (c *Client) cmd(expectCode int, format string, args ...interface{}) (int, string, error) { func (c *Client) cmd(expectCode int, format string, args ...interface{}) (int, string, error) {
c.mutex.Lock() c.mutex.Lock()
c.debugLog(log.DirClientToServer, format, args...) var logMsg []interface{}
logMsg = args
if c.authIsActive {
logMsg = []interface{}{"<auth redacted>"}
}
c.debugLog(log.DirClientToServer, format, logMsg...)
id, err := c.Text.Cmd(format, args...) id, err := c.Text.Cmd(format, args...)
if err != nil { if err != nil {
c.mutex.Unlock() c.mutex.Unlock()
@ -182,7 +188,12 @@ func (c *Client) cmd(expectCode int, format string, args ...interface{}) (int, s
} }
c.Text.StartResponse(id) c.Text.StartResponse(id)
code, msg, err := c.Text.ReadResponse(expectCode) code, msg, err := c.Text.ReadResponse(expectCode)
c.debugLog(log.DirServerToClient, "%d %s", code, msg)
logMsg = []interface{}{code, msg}
if c.authIsActive && code >= 300 {
logMsg = []interface{}{code, "<auth redacted>"}
}
c.debugLog(log.DirServerToClient, "%d %s", logMsg...)
c.Text.EndResponse(id) c.Text.EndResponse(id)
c.mutex.Unlock() c.mutex.Unlock()
return code, msg, err return code, msg, err
@ -256,6 +267,16 @@ func (c *Client) Auth(a Auth) error {
if err := c.hello(); err != nil { if err := c.hello(); err != nil {
return err return err
} }
c.mutex.Lock()
c.authIsActive = true
c.mutex.Unlock()
defer func() {
c.mutex.Lock()
c.authIsActive = false
c.mutex.Unlock()
}()
encoding := base64.StdEncoding encoding := base64.StdEncoding
mech, resp, err := a.Start(&ServerInfo{c.serverName, c.tls, c.auth}) mech, resp, err := a.Start(&ServerInfo{c.serverName, c.tls, c.auth})
if err != nil { if err != nil {