[Rspamd-Users] Simple rule trouble.

[Vsevolod Stakhov]

On 09/09/2025 13:45, Michelle Sullivan wrote:
> Hi All,
> 
> I seem to think I’m being really stupid here but I can’t seem to work out how to do the simplest of tasks in rspamd…. For example I need a rule that looks like the following (pseudo code):
> 
> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches regexp then score = 10.0
> 
> Is there a simple way to do this?
> 
> Specifically for this example:
> 
> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
> 
> Thanks,
> 
> Michelle

In fact, it's a good idea for a plugin that will do something like that. 
We have now multimap and composites that can do all this things, but 
that will require a lot of configuration and mental efforts.

A new plugin can just:

1) Use selectors for extracting data - this framework is well defined 
and simple to use for data extraction/transforms
2) Apply selectors output to a sort of simple rules like "match" or "map 
lookup" or "equal" or "ipnetwork", where the potential match pattern 
could be either a string, regexp, lua pattern, ipnetwork.
3) Use `rspamd_expression` to combine simple rules (similarly to composites)
4) Add `=>` operator that will depict outcome, e.g. "symbol 
XXX(0.5){opt1, opt2,}" - for static symbols, "dyn_symbol YYY(10){opt1, 
opt2}" - for symbols that needs to be registered and set via metric with 
the specific score, "action reject" - to simulate force action

These individual rules can be defined statically in config or even 
updated dynamically via maps/webui.

I agree that all those is already accessible via Lua rules, regexp rules 
etc but adding a simple rules engine won't hurt at all I suppose.