Browse Source

[Minor] Lua_scanners: Various fixes in VadeSecure plugin

tags/1.9.0
Vsevolod Stakhov 5 years ago
parent
commit
c361d5a35f

+ 1
- 0
lualib/lua_scanners/init.lua View File

require_scanner('dcc') require_scanner('dcc')
require_scanner('oletools') require_scanner('oletools')
require_scanner('icap') require_scanner('icap')
require_scanner('vadesecure')


exports.add_scanner = function(name, t, conf_func, check_func) exports.add_scanner = function(name, t, conf_func, check_func)
assert(type(conf_func) == 'function' and type(check_func) == 'function', assert(type(conf_func) == 'function' and type(check_func) == 'function',

+ 71
- 16
lualib/lua_scanners/vadesecure.lua View File

local function vade_url(addr) local function vade_url(addr)
local url local url
if rule.use_https then if rule.use_https then
url = string.format('https://%s:%d/%s', tostring(addr),
url = string.format('https://%s:%d%s', tostring(addr),
rule.default_port, rule.url) rule.default_port, rule.url)
else else
url = string.format('http://%s:%d/%s', tostring(addr),
url = string.format('http://%s:%d%s', tostring(addr),
rule.default_port, rule.url) rule.default_port, rule.url)
end end


-- Parse the response -- Parse the response
if upstream then upstream:ok() end if upstream then upstream:ok() end
if code ~= 200 then if code ~= 200 then
rspamd_logger.errx(task, 'invalid HTTP code: %s, body: %s, headers: %s', code, body, headers)
task:insert_result(rule.symbol_fail, 1.0, 'Bad HTTP code: ' .. code) task:insert_result(rule.symbol_fail, 1.0, 'Bad HTTP code: ' .. code)
return return
end end
local parser = ucl.parser() local parser = ucl.parser()
local ret, err = parser:parse_string(body) local ret, err = parser:parse_string(body)
if not ret then if not ret then
rspamd_logger.errx(task, 'Weird response body (raw): %s', body)
rspamd_logger.errx(task, 'vade: bad response body (raw): %s', body)
task:insert_result(rule.symbol_fail, 1.0, 'Parser error: ' .. err) task:insert_result(rule.symbol_fail, 1.0, 'Parser error: ' .. err)
return return
end end
local obj = parser:get_object() local obj = parser:get_object()
local verdict = obj.verdict local verdict = obj.verdict
if not verdict then if not verdict then
rspamd_logger.errx(task, 'Weird response JSON: %s', obj)
rspamd_logger.errx(task, 'vade: bad response JSON (no verdict): %s', obj)
task:insert_result(rule.symbol_fail, 1.0, 'No verdict/unknown verdict') task:insert_result(rule.symbol_fail, 1.0, 'No verdict/unknown verdict')
return return
end end
sym = rule.symbols.other sym = rule.symbols.other
end end


if type(sym) == 'table' then
if not sym.symbol then
-- Subcategory match
local lvl = 'low' local lvl = 'low'
if vparts and vparts[1] then if vparts and vparts[1] then
lvl = vparts[1] lvl = vparts[1]
if rule.log_spamcause and obj.spamcause then if rule.log_spamcause and obj.spamcause then
rspamd_logger.infox(task, 'vadesecure returned verdict="%s", score=%s, spamcause="%s"', rspamd_logger.infox(task, 'vadesecure returned verdict="%s", score=%s, spamcause="%s"',
verdict, obj.score, obj.spamcause) verdict, obj.score, obj.spamcause)
else
lua_util.debugm(rule.name, task, 'vadesecure returned verdict="%s", score=%s, spamcause="%s"',
verdict, obj.score, obj.spamcause)
end end


if #vparts > 0 then if #vparts > 0 then
table.insert(opts, 'verdict=' .. verdict .. ';' .. table.concat(vparts, ':')) table.insert(opts, 'verdict=' .. verdict .. ';' .. table.concat(vparts, ':'))
end end


task:insert_result(sym, 1.0, opts)
task:insert_result(sym.symbol, 1.0, opts)
end end
end end


symbol_fail = 'VADE_FAIL', symbol_fail = 'VADE_FAIL',
symbol = 'VADE_CHECK', symbol = 'VADE_CHECK',
symbols = { symbols = {
clean = 'VADE_CLEAN',
clean = {
symbol = 'VADE_CLEAN',
score = -0.5,
description = 'VadeSecure decided message to be clean'
},
spam = { spam = {
high = 'VADE_SPAM_HIGH',
medium = 'VADE_SPAM_MEDIUM',
low = 'VADE_SPAM_LOW'
high = {
symbol = 'VADE_SPAM_HIGH',
score = 8.0,
description = 'VadeSecure decided message to be clearly spam'
},
medium = {
symbol = 'VADE_SPAM_MEDIUM',
score = 5.0,
description = 'VadeSecure decided message to be highly likely spam'
},
low = {
symbol = 'VADE_SPAM_LOW',
score = 2.0,
description = 'VadeSecure decided message to be likely spam'
},
},
malware = {
symbol = 'VADE_MALWARE',
score = 8.0,
description = 'VadeSecure decided message to be malware'
},
scam = {
symbol = 'VADE_SCAM',
score = 7.0,
description = 'VadeSecure decided message to be scam'
},
phishing = {
symbol = 'VADE_PHISHING',
score = 8.0,
description = 'VadeSecure decided message to be phishing'
},
commercial = {
symbol = 'VADE_COMMERCIAL',
score = 0.0,
description = 'VadeSecure decided message to be commercial message'
},
community = {
symbol = 'VADE_COMMUNITY',
score = 0.0,
description = 'VadeSecure decided message to be community message'
},
transactional = {
symbol = 'VADE_TRANSACTIONAL',
score = 0.0,
description = 'VadeSecure decided message to be transactional message'
},
suspect = {
symbol = 'VADE_SUSPECT',
score = 3.0,
description = 'VadeSecure decided message to be suspicious message'
},
bounce = {
symbol = 'VADE_BOUNCE',
score = 0.0,
description = 'VadeSecure decided message to be bounce message'
}, },
malware = 'VADE_MALWARE',
scam = 'VADE_SCAM',
phishing = 'VADE_PHISHING',
['commercial:dce'] = 'VADE_DCE',
suspect = 'VADE_SUSPECT',
bounce = 'VADE_BOUNCE',
other = 'VADE_OTHER', other = 'VADE_OTHER',
} }
} }

+ 19
- 1
src/plugins/lua/external_services.lua View File

group = N group = N
}) })
elseif type(sym) == 'table' then elseif type(sym) == 'table' then
reg_symbols(sym)
if sym.symbol then
rspamd_config:register_symbol({
type = 'virtual',
name = sym.symbol,
parent = id,
group = N
})

if sym.score then
rspamd_config:set_metric_symbol({
name = sym.symbol,
score = sym.score,
description = sym.description,
group = sym.group or N,
})
end
else
reg_symbols(sym)
end
end end
end end
end end

Loading…
Cancel
Save