[Rspamd-Users] Simple rule trouble.

[Vsevolod Stakhov]

On 13/09/2025 07:59, Michelle Sullivan wrote:
> 
> 
>> On 13 Sep 2025, at 16:51, Vsevolod Stakhov <vsevolod at rspamd.com> wrote:
>>
>> On 10/09/2025 11:20, Vsevolod Stakhov wrote:
>>> On 09/09/2025 13:45, Michelle Sullivan wrote:
>>>> Hi All,
>>>>
>>>> I seem to think I’m being really stupid here but I can’t seem to work out how to do the simplest of tasks in rspamd…. For example I need a rule that looks like the following (pseudo code):
>>>>
>>>> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches regexp then score = 10.0
>>>>
>>>> Is there a simple way to do this?
>>>>
>>>> Specifically for this example:
>>>>
>>>> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>>>>
>>>> Thanks,
>>>>
>>>> Michelle
>>> In fact, it's a good idea for a plugin that will do something like that. We have now multimap and composites that can do all this things, but that will require a lot of configuration and mental efforts.
>>> A new plugin can just:
>>> 1) Use selectors for extracting data - this framework is well defined and simple to use for data extraction/transforms
>>> 2) Apply selectors output to a sort of simple rules like "match" or "map lookup" or "equal" or "ipnetwork", where the potential match pattern could be either a string, regexp, lua pattern, ipnetwork.
>>> 3) Use `rspamd_expression` to combine simple rules (similarly to composites)
>>> 4) Add `=>` operator that will depict outcome, e.g. "symbol XXX(0.5) {opt1, opt2,}" - for static symbols, "dyn_symbol YYY(10){opt1, opt2}" - for symbols that needs to be registered and set via metric with the specific score, "action reject" - to simulate force action
>>> These individual rules can be defined statically in config or even updated dynamically via maps/webui.
>>> I agree that all those is already accessible via Lua rules, regexp rules etc but adding a simple rules engine won't hurt at all I suppose.
>>
>>
>> In fact, I have added selectors support to SA like maps in multimap, and it will cover all use cases you have.
>>
>> https://docs.rspamd.com/modules/multimap/#spamassassin-like-rules
>>
>> For sure, they are reloaded automatically.
> 
> 
> Yeah I had seen those but couldn’t work out how to match the IP’s to networks without using external maps and symbols.. but that could be me not being familiar enough with SpamAssassin (haven’t touched it in 20 years.)
> 
> Michelle

It has nothing about SA, you can now use selectors.

~~~
# Match IPv4 address in 203.0.113.0/24 using masking
selector FROM_TEST_V4 ip.ipmask(24) =~ /^203\.0\.113\.0$/

# Match IPv6 address in 2001:db8:1234::/48 using masking
selector FROM_TEST_V6 ip.ipmask(48) =~ /^2001:db8:1234::$/i
~~~