[Rspamd-Users] Simple rule trouble.

[Vsevolod Stakhov]

On 10/09/2025 11:20, Vsevolod Stakhov wrote:
> On 09/09/2025 13:45, Michelle Sullivan wrote:
>> Hi All,
>>
>> I seem to think I’m being really stupid here but I can’t seem to work 
>> out how to do the simplest of tasks in rspamd…. For example I need a 
>> rule that looks like the following (pseudo code):
>>
>> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches 
>> regexp then score = 10.0
>>
>> Is there a simple way to do this?
>>
>> Specifically for this example:
>>
>> If the incoming IP is NOT in 161.146.0.0/16 and the header From: 
>> matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>>
>> Thanks,
>>
>> Michelle
> 
> In fact, it's a good idea for a plugin that will do something like that. 
> We have now multimap and composites that can do all this things, but 
> that will require a lot of configuration and mental efforts.
> 
> A new plugin can just:
> 
> 1) Use selectors for extracting data - this framework is well defined 
> and simple to use for data extraction/transforms
> 2) Apply selectors output to a sort of simple rules like "match" or "map 
> lookup" or "equal" or "ipnetwork", where the potential match pattern 
> could be either a string, regexp, lua pattern, ipnetwork.
> 3) Use `rspamd_expression` to combine simple rules (similarly to 
> composites)
> 4) Add `=>` operator that will depict outcome, e.g. "symbol XXX(0.5) 
> {opt1, opt2,}" - for static symbols, "dyn_symbol YYY(10){opt1, opt2}" - 
> for symbols that needs to be registered and set via metric with the 
> specific score, "action reject" - to simulate force action
> 
> These individual rules can be defined statically in config or even 
> updated dynamically via maps/webui.
> 
> I agree that all those is already accessible via Lua rules, regexp rules 
> etc but adding a simple rules engine won't hurt at all I suppose.
> 


In fact, I have added selectors support to SA like maps in multimap, and 
it will cover all use cases you have.

https://docs.rspamd.com/modules/multimap/#spamassassin-like-rules

For sure, they are reloaded automatically.