Openfire throws a NPE when routing a stanza that has no 'from' address. IQRouter tries to determine the domain of the 'from' address, to see if the entity is eligible to initiate S2S.
Under conditions, it is permissible to route stanzas that have no 'from' attribute. Section 184.108.40.206 of RFC 6120 describes how to handle these stanzas.
Notably, stanzas without 'from' attribute is not permissible in s2s traffic.
IQRouter's implementation should be modified to prevent evaluation if the stanza is to be routed over S2S if the 'from' stanza is missing (as having no 'from' attribute in S2S is illegal).
If the 'to' address is present, and does not reflect the local domain, some kind of error should occur.