[Rspamd-Users] How to use the Multimap "url" filter?

[Tim Harman]

Hi,

I've added the following to my local.d/multimap.conf

URLHAUS_ABUSE {
   type = "url";
   filter = "full";
   map = "https://urlhaus.abuse.ch/downloads/text/";
   description = "URL in abuse.ch URLhaus";
   action = "reject";
   message = "Links to Malware are not accepted here";
}

My thinking was that any email scanned that had a URL in the urlhaus 
list would be seen and rejected.

However I've tried a few test emails, both with a URL in plain text and 
wrapped in <a href= and neither triggers a reject.
I know rspamd is reading the mail just fine as MW_SURBL_MULTI fires 
(because the bad url is listed in surbl as well)

Does anyone know what I'm doing wrong?

I know it's reading the urlhaus URL's properly:

393:2019-05-08 09:42:05 #16946(controller) <ddqpuj>; map; 
rspamd_map_save_http_cached_file: saved data from 
https://urlhaus.abuse.ch/downloads/text/ in 
/var/lib/rspamd/63b836d3491fb85b1539211161cdec667d24c800.map, 10206096 
bytes
404:2019-05-08 09:43:33 #16947(normal) <ddqpuj>; map; 
rspamd_map_read_cached: https://urlhaus.abuse.ch/downloads/text/: read 
map data cached 10206096 bytes

-!- ~ » more  
/var/lib/rspamd/63b836d3491fb85b1539211161cdec667d24c800.map
rmcd1000
# abuse.ch URLhaus Plain-Text URL List (URLs only)             #
# Last updated: 2019-05-07 21:33:06 (UTC)                      #
#                                                              #
# Terms Of Use: https://urlhaus.abuse.ch/api/                  #
# For questions please contact urlhaus [at] abuse.ch           #
################################################################
#
# url

(I won't paste any URLs here in case it triggers all your MW_SURBL_MULTI 
rules!)


Thanks,
Tim