[Rspamd-Users] Simple rule trouble.

[Michelle Sullivan]

> On 10 Sep 2025, at 20:20, Vsevolod Stakhov <vsevolod at rspamd.com> wrote:
> 
> On 09/09/2025 13:45, Michelle Sullivan wrote:
>> Hi All,
>> I seem to think I’m being really stupid here but I can’t seem to work out how to do the simplest of tasks in rspamd…. For example I need a rule that looks like the following (pseudo code):
>> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches regexp then score = 10.0
>> Is there a simple way to do this?
>> Specifically for this example:
>> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>> Thanks,
>> Michelle
> 
> In fact, it's a good idea for a plugin that will do something like that. We have now multimap and composites that can do all this things, but that will require a lot of configuration and mental efforts.
> 
> A new plugin can just:
> 
> 1) Use selectors for extracting data - this framework is well defined and simple to use for data extraction/transforms
> 2) Apply selectors output to a sort of simple rules like "match" or "map lookup" or "equal" or "ipnetwork", where the potential match pattern could be either a string, regexp, lua pattern, ipnetwork.
> 3) Use `rspamd_expression` to combine simple rules (similarly to composites)
> 4) Add `=>` operator that will depict outcome, e.g. "symbol XXX(0.5){opt1, opt2,}" - for static symbols, "dyn_symbol YYY(10){opt1, opt2}" - for symbols that needs to be registered and set via metric with the specific score, "action reject" - to simulate force action
> 
> These individual rules can be defined statically in config or even updated dynamically via maps/webui.
> 
> I agree that all those is already accessible via Lua rules, regexp rules etc but adding a simple rules engine won't hurt at all I suppose.
> 

This would be great - or even a map type that can remote load rules (seen Andrew Lewis’s rule - looks perfect except that I would have to deploy a config - absolutely fine for static stuff like the example, but difficult for stuff you might want to deploy ‘on the fly’ - I have a lua based plugin I’m working on that loads a map I’m working on however having trouble getting it to work.  Will ping you off-line when we have the support contract in place.

Regards,

Michelle