[Rspamd-Users] Issue being seen with postfilter composites

[Bruce Thompson (bructhom)]

Following up, I’ve narrowed it down to a change between 3.8.4 and 3.9.0, working on isolating the particular commit now.

Cheers,
Bruce.

On Jul 21, 2025, at 07:49, Bruce Thompson <bructhom at cisco.com> wrote:

Hi folks,

Vesvolod, my colleague Steve Sturges mentioned a potential issue we were encountering when you were both in Portugal this past February, this is regarding that issue.

We’re running into an issue with rspamd-3.12.0. For context, we are upgrading from 3.6. The issue we are seeing is that postfilter composite symbols never fire. I have example symbols that we are using for testing, I’ve enclosed them below along with results from 3.6 and from 3.12.0. In digging through the source changes, it looks like this is related to change https://github.com/rspamd/rspamd/commit/24a4b03e8a5acd33f72c5747936e6e96650a8992 but I have not yet been successful in finding a solution/workaround.

Any ideas here? This is a significant issue for us because we heavily depend on postfilter composites for our scoring.

I have attached sample code, lua callbacks and symbol definitions.

<sample.conf>
<sample.lua>


For 3.6, when scanning we get the following symbol hits:
      "TEST_CALLBACK_01" : {
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01",
         "score" : 1
      },
      "TEST_CALLBACK_01_COMPOSITE" : {
         "description" : "TEST_CALLBACK_01 && TEST_CALLBACK_01_VIRTUAL",
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01_COMPOSITE",
         "score" : 1
      },
      "TEST_CALLBACK_01_COMPOSITE_NONVIRTUAL" : {
         "description" : "TEST_CALLBACK_01 && TEST_CALLBACK_01",
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01_COMPOSITE_NONVIRTUAL",
         "score" : 1
      },
      "TEST_CALLBACK_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01_VIRTUAL",
         "score" : 1
      },
      "TEST_POSTFILTER_01" : {
         "metric_score" : 1,
         "name" : "TEST_POSTFILTER_01",
         "score" : 1
      },
      "TEST_POSTFILTER_01_COMPOSITE" : {
         "description" : "TEST_POSTFILTER_01 && TEST_POSTFILTER_01_VIRTUAL",
         "metric_score" : 1,
         "name" : "TEST_POSTFILTER_01_COMPOSITE",
         "score" : 1
      },
      "TEST_POSTFILTER_01_COMPOSITE_NONVIRTUAL" : {
         "description" : "TEST_POSTFILTER_01 && TEST_POSTFILTER_01",
         "metric_score" : 0,
         "name" : "TEST_POSTFILTER_01_COMPOSITE_NONVIRTUAL",
         "score" : 0
      },
      "TEST_POSTFILTER_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_POSTFILTER_01_VIRTUAL",
         "score" : 1
      },
      "TEST_PREFILTER_01" : {
         "metric_score" : 1,
         "name" : "TEST_PREFILTER_01",
         "score" : 1
      },
      "TEST_PREFILTER_01_COMPOSITE" : {
         "description" : "TEST_PREFILTER_01 && TEST_PREFILTER_01_VIRTUAL",
         "metric_score" : 0,
         "name" : "TEST_PREFILTER_01_COMPOSITE",
         "score" : 0
      },
      "TEST_PREFILTER_01_COMPOSITE_NONVIRTUAL" : {
         "description" : "TEST_PREFILTER_01 && TEST_PREFILTER_01",
         "metric_score" : 0,
         "name" : "TEST_PREFILTER_01_COMPOSITE_NONVIRTUAL",
         "score" : 0
      },
      "TEST_PREFILTER_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_PREFILTER_01_VIRTUAL",
         "score" : 1
      },

For 3.12.0 we get the following symbol hits:
      "TEST_CALLBACK_01" : {
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01",
         "score" : 1
      },
      "TEST_CALLBACK_01_COMPOSITE" : {
         "description" : "TEST_CALLBACK_01 && TEST_CALLBACK_01_VIRTUAL",
         "metric_score" : 0,
         "name" : "TEST_CALLBACK_01_COMPOSITE",
         "score" : 0
      },
      "TEST_CALLBACK_01_COMPOSITE_NONVIRTUAL" : {
         "description" : "TEST_CALLBACK_01 && TEST_CALLBACK_01",
         "metric_score" : 0,
         "name" : "TEST_CALLBACK_01_COMPOSITE_NONVIRTUAL",
         "score" : 0
      },
      "TEST_CALLBACK_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_CALLBACK_01_VIRTUAL",
         "score" : 1
      },
      "TEST_POSTFILTER_01" : {
         "metric_score" : 1,
         "name" : "TEST_POSTFILTER_01",
         "score" : 1
      },
      "TEST_POSTFILTER_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_POSTFILTER_01_VIRTUAL",
         "score" : 1
      },
      "TEST_PREFILTER_01" : {
         "metric_score" : 1,
         "name" : "TEST_PREFILTER_01",
         "score" : 1
      },
      "TEST_PREFILTER_01_COMPOSITE" : {
         "description" : "TEST_PREFILTER_01 && TEST_PREFILTER_01_VIRTUAL",
         "metric_score" : 0,
         "name" : "TEST_PREFILTER_01_COMPOSITE",
         "score" : 0
      },
      "TEST_PREFILTER_01_COMPOSITE_NONVIRTUAL" : {
         "description" : "TEST_PREFILTER_01 && TEST_PREFILTER_01",
         "metric_score" : 0,
         "name" : "TEST_PREFILTER_01_COMPOSITE_NONVIRTUAL",
         "score" : 0
      },
      "TEST_PREFILTER_01_VIRTUAL" : {
         "metric_score" : 1,
         "name" : "TEST_PREFILTER_01_VIRTUAL",
         "score" : 1
      },

As you can see, the prefilter and normal symbols all hit in 3.12, but most of the postfilter symbols do not.

Any ideas on what to look at, or recommendations to file this as a bug would be greatly appreciated. Meanwhile I am attempting to dig deeper into exactly how the behavior has changed comparing the code paths for evaluating composites between 3.6 and 3.12.

Thanks very much!
Bruce.