[Rspamd-Users] multimap - content filter not working

[Andreas Wass - Glas Gasperlmair]

found a solution and did it this way:

1. step

vi /etc/rspamd/local.d/multimap.conf

CONTENT_BLACKLISTED {
   type = "content";
   filter = "body"; # can be headers, full, oneline, text, rawtext
   map = "${LOCAL_CONFDIR}/local.d/local_content.map";
   symbols = ["CONTENT_BLACKLISTED1"];
   regexp = true;
}

2. step
vi /etc/rspamd/local.d/groups.conf

group "MyGroup" {
   symbols =  {
     "CONTENT_BLACKLISTED1" {
       # score = Multiplikator und wird mit Wert in local_content.map 
(steht hinter dem Doppelpunkt z.B. /Spende/ CONTENT_BLACKLISTED1:10) 
multipliziert
       score = 1.0;
     }
   }
}

3. step
vi /etc/rspamd/local.d/local_content.map

# searchtext (case sensitiv) - Symbol - Score
# Score wird mit Multiplikator in /etc/rspamd/local.d/groups.conf 
multipliziert

# Score >= 15 rejecten
/Wir haben eine Spende für Sie/ CONTENT_BLACKLISTED1:30

# ab Score >= 6 soft reject (greylist)
/Die Spende/ CONTENT_BLACKLISTED1:7


best regards, Andy

Am 21.09.2021 um 13:12 schrieb Aste:
> Hi!
>
> Tuesday, September 21, 2021, 1:43:13 PM, you wrote:
> AWGG> # local.d/multimap.conf
> AWGG> CONTENT_BLACKLISTED {
> AWGG>    type = "content";
> AWGG>    filter = "body"; # can be headers, full, oneline, text, rawtext
> AWGG>    map = "${LOCAL_CONFDIR}/local.d/local_content.map";
> According to documentation you need to specify map type as multimap
> map  = regexp_multi;  ${LOCAL_CONFDIR}/local.d/local_content.map;
>
> And you always can add global score there
> score = 10;
>
> AWGG>    symbols = ["CONTENT_BLACKLISTED1", "CONTENT_BLACKLISTED2"];
> AWGG>    regexp = true;
> AWGG> }
>
> AWGG> In this example, you can use 3 symbols:
>
> AWGG>      CONTENT_BLACKLISTED
> AWGG>      CONTENT_BLACKLISTED1
> AWGG>      CONTENT_BLACKLISTED2
>
> AWGG> the map:
>
> AWGG> # Symbol + score
> AWGG> /re1/ CONTENT_BLACKLISTED1:10
> AWGG> # Symbol with default score
> AWGG> /re2/ CONTENT_BLACKLISTED2
> AWGG> # Just a default symbol: CONTENT_BLACKLISTED
> AWGG> /re3/
>
> AWGG> Symbols that are not defined in the symbols attribute but used in the map are ignored and replaced by the default map symbol. If the value of a key-value pair is missing, then Rspamd just inserts the default symbol with dynamic weight equal to 1.0 (which is multiplied by metric score afterwards)
>
>
> AWGG> ...matches the right symbol (CONTENT_BLACKLISTED1) in the header :
>
> AWGG> X-Spamd-Result: default: False [0.80 / 15.00];
> AWGG>      ...
> AWGG>      CONTENT_BLACKLISTED1(0.00)[];
> AWGG>      ...
>
> AWGG> ...but why is score 0.00 and not 10 like it is defined in local_content.map?
>
>
> AWGG> best regards, Andy
>
> AWGG> Am 21.09.2021 um 11:53 schrieb Andreas Wass - Glas Gasperlmair:
>>> Hi,
>>>
>>> i'm trying to use rspamd as soon as possible for our company > mailserver, and testing content filtering with multimap as shown in
>>>
>>> https://rspamd.com/doc/modules/multimap.html
>>>
>>> *Configured the following.*..
>>>
>>>
>>>     Multiple symbol maps
>>>
>>>  From the version 1.3.1, it is possible to define multiple symbols and > scores using multimap module. To do that, you should define all > possible symbols using|symbols|option in multimap:
>>>
>>> |# local.d/multimap.conf CONTENT_BLACKLISTED { type = "content"; > filter = "body"; # can be headers, full, oneline, text, rawtext map = > "${LOCAL_CONFDIR}/local.d/local_content.map"; symbols = > ["CONTENT_BLACKLISTED1", "CONTENT_BLACKLISTED2"]; regexp = true; } |
>>>
>>> In this example, you can use 3 symbols:
>>>
>>>   * CONTENT_BLACKLISTED
>>>   * CONTENT_BLACKLISTED1
>>>   * CONTENT_BLACKLISTED2
>>>
>>> the map:
>>>
>>> |# Symbol + score /re1/ CONTENT_BLACKLISTED1:10 # Symbol with default > score /re2/ CONTENT_BLACKLISTED2 # Just a default symbol: > CONTENT_BLACKLISTED /re3/ |
>>>
>>> Symbols that are not defined in the|symbols|attribute but used in the > map are ignored and replaced by the default map symbol. If the value > of a key-value pair is missing, then Rspamd just inserts the default > symbol with dynamic weight equal to|1.0|(which is multiplied by metric > score afterwards)
>>>
>>>
>>> *...matches the right symbol (CONTENT_BLACKLISTED1) in the header :*
>>>
>>> X-Spamd-Result: default: False [0.80 / 15.00];
>>>      ...
>>>      CONTENT_BLACKLISTED1(0.00)[];
>>>      ...
>>>
>>> *...but why is score 0.00 and not 10 like it is defined in > local_content.map?*
>>>
>>>
>>> best regards, Andy
>>>
>
>
>