From bbb1ec597776ee8cc274a88b247f9da2838fd0e9 Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Sun, 9 Mar 2025 18:55:33 +0100
Subject: [PATCH] sender variable not set when evaluating must-match-sender
 (closes #1294)

---
 crates/smtp/src/core/mod.rs     |  8 +++-----
 crates/smtp/src/core/params.rs  | 14 --------------
 crates/smtp/src/inbound/mail.rs | 25 ++++++++++++++++++-------
 3 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/crates/smtp/src/core/mod.rs b/crates/smtp/src/core/mod.rs
index 7e5ac27f..57814f0c 100644
--- a/crates/smtp/src/core/mod.rs
+++ b/crates/smtp/src/core/mod.rs
@@ -12,10 +12,10 @@ use std::{
 };
 
 use common::{
+    Inner, Server,
     auth::AccessToken,
     config::smtp::auth::VerifyStrategy,
-    listener::{asn::AsnGeoLookupResult, ServerInstance},
-    Inner, Server,
+    listener::{ServerInstance, asn::AsnGeoLookupResult},
 };
 use directory::Directory;
 use mail_auth::{IprevOutput, SpfOutput};
@@ -121,7 +121,6 @@ pub struct SessionParameters {
     pub auth_require: bool,
     pub auth_errors_max: usize,
     pub auth_errors_wait: Duration,
-    pub auth_match_sender: bool,
 
     // Rcpt parameters
     pub rcpt_errors_max: usize,
@@ -239,7 +238,6 @@ impl Session<common::listener::stream::NullIo> {
                 rcpt_max: Default::default(),
                 rcpt_dsn: Default::default(),
                 max_message_size: Default::default(),
-                auth_match_sender: false,
                 iprev: VerifyStrategy::Disable,
                 spf_ehlo: VerifyStrategy::Disable,
                 spf_mail_from: VerifyStrategy::Disable,
@@ -250,7 +248,7 @@ impl Session<common::listener::stream::NullIo> {
     }
 
     pub fn has_failed(&mut self) -> Option<String> {
-        if self.stream.tx_buf.first().is_none_or( |&c| c == b'2') {
+        if self.stream.tx_buf.first().is_none_or(|&c| c == b'2') {
             self.stream.tx_buf.clear();
             None
         } else {
diff --git a/crates/smtp/src/core/params.rs b/crates/smtp/src/core/params.rs
index 5a4e873e..47827cae 100644
--- a/crates/smtp/src/core/params.rs
+++ b/crates/smtp/src/core/params.rs
@@ -93,11 +93,6 @@ impl<T: SessionStream> Session<T> {
             .eval_if(&ac.errors_wait, self, self.data.session_id)
             .await
             .unwrap_or_else(|| Duration::from_secs(30));
-        self.params.auth_match_sender = self
-            .server
-            .eval_if(&ac.must_match_sender, self, self.data.session_id)
-            .await
-            .unwrap_or(true);
 
         // VRFY/EXPN parameters
         let ec = &self.server.core.smtp.session.extensions;
@@ -126,15 +121,6 @@ impl<T: SessionStream> Session<T> {
             .eval_if(&ec.vrfy, self, self.data.session_id)
             .await
             .unwrap_or(false);
-        self.params.auth_match_sender = self
-            .server
-            .eval_if(
-                &self.server.core.smtp.session.auth.must_match_sender,
-                self,
-                self.data.session_id,
-            )
-            .await
-            .unwrap_or(true);
     }
 
     pub async fn eval_rcpt_params(&mut self) {
diff --git a/crates/smtp/src/inbound/mail.rs b/crates/smtp/src/inbound/mail.rs
index 01fec605..371b991d 100644
--- a/crates/smtp/src/inbound/mail.rs
+++ b/crates/smtp/src/inbound/mail.rs
@@ -7,8 +7,8 @@
 use std::time::{Duration, Instant, SystemTime};
 
 use common::{config::smtp::session::Stage, listener::SessionStream, scripts::ScriptModification};
-use mail_auth::{spf::verify::SpfParameters, IprevOutput, IprevResult, SpfOutput, SpfResult};
-use smtp_proto::{MailFrom, MtPriority, MAIL_BY_NOTIFY, MAIL_BY_RETURN, MAIL_REQUIRETLS};
+use mail_auth::{IprevOutput, IprevResult, SpfOutput, SpfResult, spf::verify::SpfParameters};
+use smtp_proto::{MAIL_BY_NOTIFY, MAIL_BY_RETURN, MAIL_REQUIRETLS, MailFrom, MtPriority};
 use trc::SmtpEvent;
 use utils::config::Rate;
 
@@ -231,7 +231,17 @@ impl<T: SessionStream> Session<T> {
 
         // Make sure that the authenticated user is allowed to send from this address
         match self.authenticated_as() {
-            Some(authenticated_as) if self.params.auth_match_sender => {
+            Some(authenticated_as)
+                if self
+                    .server
+                    .eval_if(
+                        &self.server.core.smtp.session.auth.must_match_sender,
+                        self,
+                        self.data.session_id,
+                    )
+                    .await
+                    .unwrap_or(true) =>
+            {
                 let address_lcase = self.data.mail_from.as_ref().unwrap().address_lcase.as_str();
                 if authenticated_as != address_lcase
                     && !self.authenticated_emails().iter().any(|e| {
@@ -563,10 +573,11 @@ impl<T: SessionStream> Session<T> {
                 Ok(true) => return Ok(result),
                 Ok(false) => (),
                 Err(err) => {
-                    trc::error!(err
-                        .caused_by(trc::location!())
-                        .span_id(self.data.session_id)
-                        .details("Failed to lookup local domain"));
+                    trc::error!(
+                        err.caused_by(trc::location!())
+                            .span_id(self.data.session_id)
+                            .details("Failed to lookup local domain")
+                    );
                 }
             }