[lamtrinhdev]

PR type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactoring (no functional changes, no api changes)
• Build related changes
• Documentation content changes
• Other... Please describe:

Description

Both the recipient and alias handlers checked service domains with
strings.Contains(h.Cfg.Domains, domain), which matches substrings, not
domains. Two visible consequences:

• False rejections: with DOMAINS=ivpn.net, adding a recipient like
  foo@vpn.net fails with "Selected domain is invalid." because vpn.net
  happens to be a substring of ivpn.net.
• Bypasses: strings.Contains is case-sensitive, so foo@IVPN.NET slipped
  past the recipient check, and in resolveDomain any alias domain that
  merely contained a service domain as a substring was accepted
  (e.g. foo@ivpn.net.attacker.com).

Fix

Added a small isOwnDomain helper that splits the DOMAINS config on commas
and compares with strings.EqualFold (plus TrimSpace, so stray whitespace in
the env var doesn't break matching). Both call sites now use it:

• PostRecipient blocks recipients only on exact service-domain matches
• resolveDomain accepts built-in alias domains only on exact matches

Also switched the recipient handler to use the last @-separated segment
instead of index [1], so a malformed a@b@c.com checks the actual domain
rather than b.

[lamtrinhdev]

Dear @jurajhilje ,

I have a small fix, when you have time, please help me to review it.

Thanks,
Lam