commit c361d5a: [Minor] Lua_scanners: Various fixes in VadeSecure plugin
Vsevolod Stakhov
vsevolod at highsecure.ru
Fri Jan 18 14:56:03 UTC 2019
Author: Vsevolod Stakhov
Date: 2019-01-18 14:55:00 +0000
URL: https://github.com/rspamd/rspamd/commit/c361d5a35f5e64d3ea429f6358cdc078c29a15c8 (HEAD -> master)
[Minor] Lua_scanners: Various fixes in VadeSecure plugin
---
lualib/lua_scanners/init.lua | 1 +
lualib/lua_scanners/vadesecure.lua | 87 ++++++++++++++++++++++++++++-------
src/plugins/lua/external_services.lua | 20 +++++++-
3 files changed, 91 insertions(+), 17 deletions(-)
diff --git a/lualib/lua_scanners/init.lua b/lualib/lua_scanners/init.lua
index 0c2857e01..d56bf4c6d 100644
--- a/lualib/lua_scanners/init.lua
+++ b/lualib/lua_scanners/init.lua
@@ -41,6 +41,7 @@ require_scanner('sophos')
require_scanner('dcc')
require_scanner('oletools')
require_scanner('icap')
+require_scanner('vadesecure')
exports.add_scanner = function(name, t, conf_func, check_func)
assert(type(conf_func) == 'function' and type(check_func) == 'function',
diff --git a/lualib/lua_scanners/vadesecure.lua b/lualib/lua_scanners/vadesecure.lua
index 6f2124ccb..99ac19b30 100644
--- a/lualib/lua_scanners/vadesecure.lua
+++ b/lualib/lua_scanners/vadesecure.lua
@@ -31,10 +31,10 @@ local function vade_check(task, content, digest, rule)
local function vade_url(addr)
local url
if rule.use_https then
- url = string.format('https://%s:%d/%s', tostring(addr),
+ url = string.format('https://%s:%d%s', tostring(addr),
rule.default_port, rule.url)
else
- url = string.format('http://%s:%d/%s', tostring(addr),
+ url = string.format('http://%s:%d%s', tostring(addr),
rule.default_port, rule.url)
end
@@ -117,20 +117,21 @@ local function vade_check(task, content, digest, rule)
-- Parse the response
if upstream then upstream:ok() end
if code ~= 200 then
+ rspamd_logger.errx(task, 'invalid HTTP code: %s, body: %s, headers: %s', code, body, headers)
task:insert_result(rule.symbol_fail, 1.0, 'Bad HTTP code: ' .. code)
return
end
local parser = ucl.parser()
local ret, err = parser:parse_string(body)
if not ret then
- rspamd_logger.errx(task, 'Weird response body (raw): %s', body)
+ rspamd_logger.errx(task, 'vade: bad response body (raw): %s', body)
task:insert_result(rule.symbol_fail, 1.0, 'Parser error: ' .. err)
return
end
local obj = parser:get_object()
local verdict = obj.verdict
if not verdict then
- rspamd_logger.errx(task, 'Weird response JSON: %s', obj)
+ rspamd_logger.errx(task, 'vade: bad response JSON (no verdict): %s', obj)
task:insert_result(rule.symbol_fail, 1.0, 'No verdict/unknown verdict')
return
end
@@ -142,7 +143,8 @@ local function vade_check(task, content, digest, rule)
sym = rule.symbols.other
end
- if type(sym) == 'table' then
+ if not sym.symbol then
+ -- Subcategory match
local lvl = 'low'
if vparts and vparts[1] then
lvl = vparts[1]
@@ -166,13 +168,16 @@ local function vade_check(task, content, digest, rule)
if rule.log_spamcause and obj.spamcause then
rspamd_logger.infox(task, 'vadesecure returned verdict="%s", score=%s, spamcause="%s"',
verdict, obj.score, obj.spamcause)
+ else
+ lua_util.debugm(rule.name, task, 'vadesecure returned verdict="%s", score=%s, spamcause="%s"',
+ verdict, obj.score, obj.spamcause)
end
if #vparts > 0 then
table.insert(opts, 'verdict=' .. verdict .. ';' .. table.concat(vparts, ':'))
end
- task:insert_result(sym, 1.0, opts)
+ task:insert_result(sym.symbol, 1.0, opts)
end
end
@@ -200,18 +205,68 @@ local function vade_config(opts)
symbol_fail = 'VADE_FAIL',
symbol = 'VADE_CHECK',
symbols = {
- clean = 'VADE_CLEAN',
+ clean = {
+ symbol = 'VADE_CLEAN',
+ score = -0.5,
+ description = 'VadeSecure decided message to be clean'
+ },
spam = {
- high = 'VADE_SPAM_HIGH',
- medium = 'VADE_SPAM_MEDIUM',
- low = 'VADE_SPAM_LOW'
+ high = {
+ symbol = 'VADE_SPAM_HIGH',
+ score = 8.0,
+ description = 'VadeSecure decided message to be clearly spam'
+ },
+ medium = {
+ symbol = 'VADE_SPAM_MEDIUM',
+ score = 5.0,
+ description = 'VadeSecure decided message to be highly likely spam'
+ },
+ low = {
+ symbol = 'VADE_SPAM_LOW',
+ score = 2.0,
+ description = 'VadeSecure decided message to be likely spam'
+ },
+ },
+ malware = {
+ symbol = 'VADE_MALWARE',
+ score = 8.0,
+ description = 'VadeSecure decided message to be malware'
+ },
+ scam = {
+ symbol = 'VADE_SCAM',
+ score = 7.0,
+ description = 'VadeSecure decided message to be scam'
+ },
+ phishing = {
+ symbol = 'VADE_PHISHING',
+ score = 8.0,
+ description = 'VadeSecure decided message to be phishing'
+ },
+ commercial = {
+ symbol = 'VADE_COMMERCIAL',
+ score = 0.0,
+ description = 'VadeSecure decided message to be commercial message'
+ },
+ community = {
+ symbol = 'VADE_COMMUNITY',
+ score = 0.0,
+ description = 'VadeSecure decided message to be community message'
+ },
+ transactional = {
+ symbol = 'VADE_TRANSACTIONAL',
+ score = 0.0,
+ description = 'VadeSecure decided message to be transactional message'
+ },
+ suspect = {
+ symbol = 'VADE_SUSPECT',
+ score = 3.0,
+ description = 'VadeSecure decided message to be suspicious message'
+ },
+ bounce = {
+ symbol = 'VADE_BOUNCE',
+ score = 0.0,
+ description = 'VadeSecure decided message to be bounce message'
},
- malware = 'VADE_MALWARE',
- scam = 'VADE_SCAM',
- phishing = 'VADE_PHISHING',
- ['commercial:dce'] = 'VADE_DCE',
- suspect = 'VADE_SUSPECT',
- bounce = 'VADE_BOUNCE',
other = 'VADE_OTHER',
}
}
diff --git a/src/plugins/lua/external_services.lua b/src/plugins/lua/external_services.lua
index 6ee0535ba..c5889112f 100644
--- a/src/plugins/lua/external_services.lua
+++ b/src/plugins/lua/external_services.lua
@@ -251,7 +251,25 @@ if opts and type(opts) == 'table' then
group = N
})
elseif type(sym) == 'table' then
- reg_symbols(sym)
+ if sym.symbol then
+ rspamd_config:register_symbol({
+ type = 'virtual',
+ name = sym.symbol,
+ parent = id,
+ group = N
+ })
+
+ if sym.score then
+ rspamd_config:set_metric_symbol({
+ name = sym.symbol,
+ score = sym.score,
+ description = sym.description,
+ group = sym.group or N,
+ })
+ end
+ else
+ reg_symbols(sym)
+ end
end
end
end
More information about the Commits
mailing list