[Fix] SPF: check the original envelope sender

SPF evaluates the RFC5321.MailFrom as it was transmitted (including
local-part macros), so resolve the SPF record and credentials from the
original envelope sender even if the envelope from has been rewritten,
e.g. by the aliases module.

Issue: #6137

diff --git a/src/libserver/spf.c b/src/libserver/spf.c
index 2beec32fdb77843c180576792c630925d847674f..c06aae27c9632f11aa6bd3d489d60a98522199e8 100644 (file)
--- a/src/libserver/spf.c
+++ b/src/libserver/spf.c
@@ -2670,7 +2670,11 @@ rspamd_spf_cache_domain(struct rspamd_task *task)
        struct rspamd_email_address *addr;
        struct rspamd_spf_cred *cred = NULL;
 
-       addr = rspamd_task_get_sender(task);
+       /*
+        * SPF checks the RFC5321.MailFrom as it was transmitted, so use the
+        * original sender even if the envelope from has been rewritten
+        */
+       addr = rspamd_task_get_original_sender(task);
        if (!addr || (addr->flags & RSPAMD_EMAIL_ADDR_EMPTY)) {
                /* Get domain from helo */
 

diff --git a/src/libserver/task.c b/src/libserver/task.c
index 31953cf16a194ecd09743c71d530442fb256a843..28ee5f693afda89029a5d30a436fda3a56de3d1c 100644 (file)
--- a/src/libserver/task.c
+++ b/src/libserver/task.c
@@ -954,6 +954,16 @@ rspamd_task_get_sender(struct rspamd_task *task)
        return task->from_envelope;
 }
 
+struct rspamd_email_address *
+rspamd_task_get_original_sender(struct rspamd_task *task)
+{
+       if (task->from_envelope_orig) {
+               return task->from_envelope_orig;
+       }
+
+       return task->from_envelope;
+}
+
 static const char *
 rspamd_task_cache_principal_recipient(struct rspamd_task *task,
                                                                          const char *rcpt, gsize len)

diff --git a/src/libserver/task.h b/src/libserver/task.h
index 8225e6293a9201a9c0a244d9366ce4e0ac090e9a..e189ae410304d38ce8eee99598999d8eb198d992 100644 (file)
--- a/src/libserver/task.h
+++ b/src/libserver/task.h
@@ -280,6 +280,14 @@ gboolean rspamd_task_process(struct rspamd_task *task, unsigned int stages);
  */
 struct rspamd_email_address *rspamd_task_get_sender(struct rspamd_task *task);
 
+/**
+ * Return the original (pre-rewrite) envelope sender if the envelope from has
+ * been modified (e.g. by aliases resolution), or the current sender otherwise
+ * @param task
+ * @return
+ */
+struct rspamd_email_address *rspamd_task_get_original_sender(struct rspamd_task *task);
+
 /**
  * Return addresses in the following precedence:
  * - deliver to