[Rspamd-Users] Reject force_action based on symbol and score

[Philip Iezzi]

Ok, I think I found the ideal solution now but not quite sure yet if this has no negative side effects.

local.d/force_actions.conf:

rules {
  REJECT_SPAMMY_FORWARDING {
    action = "reject";
    expression = "IS_FORWARDING";
    # require_action setting defines actions that will be overridden
    require_action = ["add header"];
    message = "This message cannot be sent because it looks like spam."
  }
}

local.d/multimap.conf:

IS_FORWARDING {
    type = "rcpt";
    map = "/etc/rspamd/local.d/maps.d/forwardings.inc.local";
}

Like this, the forced reject action would get triggered if the defined spam level X is reached (defined in actions.conf as "add_header = X;"), but only if the email was sent to a forwarding address (IS_FORWARDING with 0 score).

Can anybody please tell if this is a sane solution and if there is no need to specify any honor_action actions in REJECT_SPAMMY_FORWARDING?

Cheers,
Philip



> On 12 Apr 2021, at 23:32, Philip Iezzi via Users <users at lists.rspamd.com> wrote:
> 
> Hi there,
> 
> I am trying to write a force_action module reject rule based on a symbol and spam score, something like:
> 
> rules {
>  REJECT_SPAMMY_FORWARDING {
>    action = "reject";
>    expression = "IS_FORWARDING & ${score} > 4.0"; # pseudo expression, don't copy!
>  }
> }
> 
> while IS_FORWARDING symbol would be defined in multimaps (and forwardings.inc.local would contain recipient email addresses that are forwarded to external ones):
> 
> IS_FORWARDING {
>    type = "rcpt";
>    map = "/etc/rspamd/local.d/maps.d/forwardings.inc.local";
> }
> 
> The idea:
> Reject at a lower score than usual (defined in local.d/actions.conf as reject score) for recipients that are forwardings and will not get filtered by final destination mailbox Sieve rule. As we only filter on Dovecot mailbox level based on X-Spam-Level header, and want the customer to have full control over the relevant spam score, we cannot lower the global reject score.
> 
> I don't know about the expression syntax to check for score, as this does not seem to be documented anywhere. I am running latest Rspamd 2.7 on Debian Buster. In Rspamd 1.7 Changelog, it says:
>> [Feature] Add ability to match score in force_actions module
> 
> ... which sounds exactly like what I need.
> 
> Any help is greatly appreciated!
> 
> Cheers,
> Philip
> -- 
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users