Add Sieve and cPanel forwarding symbols

diff --git a/rules/forwarding.lua b/rules/forwarding.lua
index a008c587d5d60b4ef8d782f588fbed5fee8c93a1..8feb63145924999d2efccad20f82947bd4d9a4e8 100644 (file)
--- a/rules/forwarding.lua
+++ b/rules/forwarding.lua
@@ -107,6 +107,53 @@ rspamd_config.FWD_SRS = {
   group = "forwarding"
 }
 
+rspamd_config.FWD_SIEVE = {
+  callback = function(task)
+    if not (task:has_from(1) and task:has_recipients(1)) then
+      return false
+    end
+    local envfrom = task:get_from(1)
+    local envrcpts = task:get_recipients(1)
+    -- Forwarding is only to a single recipient
+    if #envrcpts > 1 then
+      return false
+    end
+    if envfrom[1].user:lower():find('^srs[01]=') then
+      return task:has_header('X-Sieve-Redirected-From')
+    end
+    return false
+  end,
+  score = 0.0,
+  description = "Message was forwarded using Sieve",
+  group = "forwarding"
+}
+
+rspamd_config.FWD_CPANEL = {
+  callback = function(task)
+    if not (task:has_from(1) and task:has_recipients(1)) then
+      return false
+    end
+    local envfrom = task:get_from(1)
+    local envrcpts = task:get_recipients(1)
+    -- Forwarding is only to a single recipient
+    if #envrcpts > 1 then
+      return false
+    end
+    if envfrom[1].user:lower():find('^srs[01]=') then
+      local rewrite_hdr = task:get_header('From-Rewrite')
+      if rewrite_hdr then
+        return rewrite_hdr:find('forwarded message')
+      else
+        return false
+      end
+    end
+    return false
+  end,
+  score = 0.0,
+  description = "Message was forwarded using cPanel",
+  group = "forwarding"
+}
+
 rspamd_config.FORWARDED = {
   callback = function(task)
     local function normalize_addr(addr)