[Rspamd-Users] Simple rule trouble.

[Vsevolod Stakhov]

On 10/09/2025 15:10, Michelle Sullivan wrote:
> 
> 
>> On 10 Sep 2025, at 23:03, Andrew Lewis via Users <users at lists.rspamd.com> wrote:
>>
>> Hi Michelle,
>>
>> On Tue, 2025-09-09 at 22:45 +1000, Michelle Sullivan wrote:
>>> Is there a simple way to do this?
>>>
>>> Specifically for this example:
>>>
>>> If the incoming IP is NOT in 161.146.0.0/16 and the header From:
>>> matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>>
>> In general regex rules are the way to do this sort of thing; the
>> relevant limitation is inability to work with IP addresses- you might
>> add a Lua condition to deal with that. Lua rules and/or selectors are
>> useful for more complex requirements.
>>
>> -- /etc/rspamd/lua.local.d/regex.lua
>>
>> local reconf = config.regexp
>>
>> reconf.MY_RULE_1 = {
>>   re = [[From=/mygov/H]],
>>   condition = function(task)
>>     local ip = task:get_from_ip()
>>     if not ip and ip:is_valid() then return false end
>>     if ip:apply_mask(16):to_string() == '161.146.0.0' then return false
>> end
>>     return true
>>   end,
>>   score = 10.0,
>> }
> 
> 
> Fantastic, perfect for the example (which would solve a chunk of rules I have/want) as they are static.
> 
> However, still runs into the issue of I have to deploy them which is change control, peer-review, approval, scheduling then finally 4 hours of someone deploying them which is impractical for something that needs a dynamic response.
> 
> Thank you, I will use this for a chunk of stuff for sure.
> 
> Regards,
> 
> Michelle

https://docs.rspamd.com/modules/multimap#spamassassin-like-rules - this 
might be relevant as well