1 files changed, 45 insertions, 0 deletions
diff --git a/rules/forwarding.lua b/rules/forwarding.lua
index a008c587d..f8218e1cb 100644
--- a/rules/forwarding.lua
+++ b/rules/forwarding.lua
@@ -107,6 +107,51 @@ rspamd_config.FWD_SRS = {
   group = "forwarding"
 }
 
+rspamd_config.FWD_SIEVE = {
+  callback = function(task)
+    if not (task:has_from(1) and task:has_recipients(1)) then
+      return false
+    end
+    local envfrom = task:get_from(1)
+    local envrcpts = task:get_recipients(1)
+    -- Forwarding is only to a single recipient
+    if #envrcpts > 1 then
+      return false
+    end
+    if envfrom[1].user:lower():find('^srs[01]=') then
+      return task:has_header('X-Sieve-Redirected-From')
+    end
+    return false
+  end,
+  score = 0.0,
+  description = "Message was forwarded using Sieve",
+  group = "forwarding"
+}
+
+rspamd_config.FWD_CPANEL = {
+  callback = function(task)
+    if not (task:has_from(1) and task:has_recipients(1)) then
+      return false
+    end
+    local envfrom = task:get_from(1)
+    local envrcpts = task:get_recipients(1)
+    -- Forwarding is only to a single recipient
+    if #envrcpts > 1 then
+      return false
+    end
+    if envfrom[1].user:lower():find('^srs[01]=') then
+      local rewrite_hdr = task:get_header('From-Rewrite')
+      if rewrite_hdr and rewrite_hdr:find('forwarded message') then
+        return true
+      end
+    end
+    return false
+  end,
+  score = 0.0,
+  description = "Message was forwarded using cPanel",
+  group = "forwarding"
+}
+
 rspamd_config.FORWARDED = {
   callback = function(task)
     local function normalize_addr(addr)