From b6933fdb964f230cfdd6937d6d51aeb9ec2f7cc0 Mon Sep 17 00:00:00 2001
From: andryyy <andre.peters@debinux.de>
Date: Mon, 25 May 2020 16:13:51 +0200
Subject: [PATCH] [Web] Improve SPF checks

---
 data/web/inc/ajax/dns_diagnostics.php |  2 +-
 data/web/inc/spf.inc.php              | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/data/web/inc/ajax/dns_diagnostics.php b/data/web/inc/ajax/dns_diagnostics.php
index 841b86f22..1b4c6ea79 100644
--- a/data/web/inc/ajax/dns_diagnostics.php
+++ b/data/web/inc/ajax/dns_diagnostics.php
@@ -368,7 +368,7 @@ foreach ($records as $record) {
       $record[2] == $spf_link) {
         $state = state_nomatch;
         $rslt = get_spf_allowed_hosts($record[0]);
-        if(in_array($ip, $rslt) && in_array($ip6, $rslt)){
+        if(in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)){
             $state = state_good;
         }
         $state .= '<br />' . $current[$data_field[$current['type']]].state_optional;
diff --git a/data/web/inc/spf.inc.php b/data/web/inc/spf.inc.php
index ddb9d48c2..5e63b38b2 100644
--- a/data/web/inc/spf.inc.php
+++ b/data/web/inc/spf.inc.php
@@ -1,6 +1,12 @@
 <?php
 error_reporting(0);
 
+function expand_ipv6($ip) {
+	$hex = unpack("H*hex", inet_pton($ip));
+	$ip = substr(preg_replace("/([A-f0-9]{4})/", "$1:", $hex['hex']), 0, -1);
+	return $ip;
+}
+
 function get_spf_allowed_hosts($check_domain)
 {
 	$hosts = array();
@@ -33,6 +39,8 @@ function get_spf_allowed_hosts($check_domain)
 			else
 			{
 				unset($cidr);
+				// reset domain to check_domain
+				$domain = $check_domain;
 				if (strpos($mech, ':') !== FALSE) // handle a domain specification
 				{
 					$split = explode(':', $mech);
@@ -77,7 +85,11 @@ function get_spf_allowed_hosts($check_domain)
 			}
 		}
 	}
-	
+	foreach ($hosts as &$host) {
+		if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+			$host = expand_ipv6($host);
+		}
+	}
 	return $hosts;
 }