From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Thu, 6 Aug 2026 14:36:00 +0000 (+0100)
Subject: [Fix] Fuzzy: per-key ACL applies to delayed v1 replies
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Frspamd.git

[Fix] Fuzzy: per-key ACL applies to delayed v1 replies

The v1 reply path gated the per-key forbidden_ids check on prob > 0.
The DELAY branch above it zeroes ts, prob and value but leaves flag
intact, so a delayed reply took the `else if (default_disabled)` branch
instead: a key with its own forbidden_ids silently lost its ACL and the
global default_forbidden_ids applied after all. That is the same
inversion fixed in the v2 path in the previous commit, just limited to
encrypted delayed replies.

Drop the prob check so the per-key set overrides the default regardless
of the match result, matching rspamd_fuzzy_flag_is_forbidden(). Outside
DELAY this changes nothing: prob == 0 means a miss, where flag is 0 too
and neither set matches.

Only EPOCH10/EPOCH11 clients reach this path.
---

diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index e85eaa6a2b..8b3094df06 100644
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -859,7 +859,11 @@ rspamd_fuzzy_make_reply(struct rspamd_fuzzy_cmd *cmd,
 			}
 
 			if (flags & RSPAMD_FUZZY_REPLY_ENCRYPTED) {
-				if (session->reply.v1.rep.v1.prob > 0 && session->key && session->key->forbidden_ids) {
+				/* No prob check here: a key with its own forbidden_ids
+				 * overrides the default regardless of the match result,
+				 * otherwise a delayed reply (prob is zeroed, flag is not)
+				 * would fall back to default_forbidden_ids. */
+				if (session->key && session->key->forbidden_ids) {
 					khiter_t k;
 					k = kh_get(fuzzy_key_ids_set, session->key->forbidden_ids, session->reply.v1.rep.v1.flag);
 					if (k != kh_end(session->key->forbidden_ids)) {