[Rspamd-Users] Question about composite rules

[Vsevolod Stakhov]

On 03/01/2021 21:00, Marcel Menzel wrote:
> Yes, the configdump composites was printing the expression correctly
> while it was missing in the config file. Also adding the missing
> semicolon did not help here, the symbol is still being triggered.
> 
> Am 03.01.2021 um 17:29 schrieb Alex JOST:
>> Am 03.01.2021 um 16:32 schrieb Marcel Menzel:
>>> Hello List,
>>>
>>> I have the following composite rule to add a score to mails originating
>>> from freemail accounts, but not for receiving them from a mailing list:
>>>
>>> FREEMAIL_INVOLVED {
>>>    expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO |
>>> FREEMAIL_CC) & (! CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST | ! MAILLIST)"
>>>    score = 3.0;
>>>    policy = "leave";
>>> }
>>>
>>> Some mailinglists are not being detected by rspamd, so I made the
>>> "CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST" multimap.
>>>
>>> Now, when a mail from an undetected mailinglist from a freemail sender
>>> arrives in rspamd, it still triggers the "FREEMAIL_INVOLVED" symbol
>>> while the mail itself has the "CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST"
>>> symbol set aswell (MAILLIST is not set):
>>>
>>> FREEMAIL_INVOLVED (3)
>>> FREEMAIL_FROM (0) [gmail.com]
>>> CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST (0) [formilux.org]
>>>
>>> Am I hitting a bug here or am I missing something out?
>>
>> Have you checked with 'rspamadm configdump composites' that rspamd is
>> correctly reading your rules? It looks like you are missing a
>> semicolon at the end of 'expression' and you might need to remove the
>> spaces after the exclamation marks.
>>
>> FREEMAIL_INVOLVED {
>>     expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO
>> | FREEMAIL_CC) & (!CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST | !MAILLIST)";
>>     score = 3.0;
>>     policy = "leave";
>>  }
>>
> 

Please stop top posting here.

WRT your issue you need to check your logical expression.
(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO | FREEMAIL_CC) &
(!CUSTOM_WHITELIST_SENDER_DOMAIN_MAILLIST | !MAILLIST)

the first `()` is triggered by `FREEMAIL_FROM` the second `()` is
triggered by `!MAILLIST`.