You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

merged-override.conf 8.8KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391
  1. antivirus {
  2. clam {
  3. attachments_only = false;
  4. symbol = "CLAM_VIRUS";
  5. type = "clamav";
  6. servers = "127.0.0.1:{= env.PORT_CLAM =}";
  7. }
  8. fprot {
  9. attachments_only = false;
  10. symbol = "FPROT_VIRUS";
  11. type = "fprot";
  12. servers = "127.0.0.1:{= env.PORT_FPROT =}";
  13. patterns {
  14. FPROT_EICAR = "^EICAR_Test_File$";
  15. }
  16. }
  17. fprot_duplicate {
  18. prefix = "fp_dupe";
  19. attachments_only = false;
  20. symbol = "FPROT2_VIRUS_DUPLICATE_DEFAULT";
  21. type = "fprot";
  22. servers = "127.0.0.1:{= env.PORT_FPROT2_DUPLICATE =}";
  23. patterns = [
  24. {FPROT2_VIRUS_DUPLICATE_PATTERN = "^E"},
  25. {FPROT2_VIRUS_DUPLICATE_NOPE1 = "^EI",
  26. FPROT2_VIRUS_DUPLICATE_NOPE2 = "^EIC",
  27. FPROT2_VIRUS_DUPLICATE_NOPE3 = "^EICA",
  28. FPROT2_VIRUS_DUPLICATE_NOPE4 = "^EICAR",
  29. FPROT2_VIRUS_DUPLICATE_NOPE5 = "^EICAR_"}
  30. ];
  31. }
  32. avast {
  33. attachments_only = false;
  34. symbol = "AVAST_VIRUS";
  35. type = "avast";
  36. servers = "127.0.0.1:{= env.PORT_AVAST =}";
  37. }
  38. }
  39. multimap {
  40. DNSBL_MAP {
  41. type = "dnsbl";
  42. map = "rspamd.com";
  43. }
  44. IP_MAP {
  45. type = "ip";
  46. map = "{= env.TESTDIR =}/configs/maps/ip.list";
  47. }
  48. FROM_MAP {
  49. type = "from";
  50. filter = "email:domain";
  51. map = "{= env.TESTDIR =}/configs/maps/domains.list";
  52. }
  53. FREEMAIL_CC {
  54. type = "header";
  55. header = "Cc";
  56. filter = "email:domain";
  57. map = "{= env.TESTDIR =}/configs/maps/domains.list.2";
  58. score = 1.0;
  59. }
  60. REGEXP_MAP {
  61. type = "from";
  62. filter = "email:addr";
  63. regexp = true;
  64. map = "{= env.TESTDIR =}/configs/maps/regexp.list";
  65. }
  66. DEPS_MAP {
  67. type = "from";
  68. filter = "email:addr";
  69. regexp = true;
  70. map = "{= env.TESTDIR =}/configs/maps/regexp.list";
  71. require_symbols = "(R_SPF_ALLOW|R_SPF_DNSFAIL) & REGEXP_MAP & !FROM_MAP";
  72. }
  73. RCPT_DOMAIN {
  74. type = "rcpt";
  75. filter = "email:domain";
  76. map = "{= env.TESTDIR =}/configs/maps/domains.list";
  77. }
  78. RCPT_USER {
  79. type = "rcpt";
  80. filter = "email:user";
  81. map = "{= env.TESTDIR =}/configs/maps/users.list";
  82. }
  83. RCPT_MAP {
  84. type = "rcpt";
  85. filter = "email:addr";
  86. symbols = ["SYM1"];
  87. map = "{= env.TESTDIR =}/configs/maps/multiple.list";
  88. score = 1.0;
  89. }
  90. RCPT_MAP_NOMULTISYM {
  91. type = "rcpt";
  92. filter = "email:addr";
  93. disable_multisymbol = true;
  94. map = "{= env.TESTDIR =}/configs/maps/multiple.list";
  95. score = 1.0;
  96. }
  97. HEADER_MAP {
  98. type = "header";
  99. header = "To";
  100. filter = "email:name";
  101. map = "{= env.TESTDIR =}/configs/maps/utf.list";
  102. regexp = true;
  103. }
  104. HOSTNAME_MAP {
  105. type = "hostname";
  106. map = "{= env.TESTDIR =}/configs/maps/domains.list";
  107. }
  108. HOSTNAME_TOP_MAP {
  109. type = "hostname";
  110. filter = "top";
  111. map = "{= env.TESTDIR =}/configs/maps/top.list";
  112. }
  113. CDB_HOSTNAME {
  114. type = "hostname";
  115. map = "cdb://{= env.TESTDIR =}/configs/maps/domains.cdb";
  116. }
  117. REDIS_HOSTNAME {
  118. type = "hostname";
  119. map = "redis://hostname";
  120. }
  121. REDIS_HOSTNAME_EXPANSION {
  122. type = "hostname";
  123. map = "redis://${ip}.${principal_recipient_domain}";
  124. }
  125. REDIS_IPADDR {
  126. type = "ip";
  127. map = "redis://ipaddr";
  128. }
  129. REDIS_FROMADDR {
  130. type = "from";
  131. filter = "email:addr";
  132. map = "redis://emailaddr";
  133. }
  134. REDIS_URL_TLD {
  135. type = "url";
  136. map = "redis://hostname";
  137. filter = "tld";
  138. }
  139. REDIS_URL_RE_FULL {
  140. type = "url";
  141. map = "redis://fullurlre";
  142. filter = "full:regexp:/(html)$/";
  143. }
  144. REDIS_URL_FULL {
  145. type = "url";
  146. map = "redis://fullurl";
  147. filter = "full";
  148. }
  149. REDIS_URL_PHISHED {
  150. type = "url";
  151. map = "redis://phishedurl";
  152. filter = "is_phished";
  153. }
  154. REDIS_URL_RE_TLD {
  155. type = "url";
  156. map = "redis://tldre";
  157. filter = "tld:regexp:/(net)$/";
  158. }
  159. REDIS_URL_RE_PLAIN {
  160. type = "url";
  161. map = "redis://urlre";
  162. filter = "regexp:/^(www)/";
  163. }
  164. REDIS_URL_NOFILTER {
  165. type = "url";
  166. map = "redis://urlnofilter";
  167. }
  168. REDIS_COUNTRY {
  169. type = "country";
  170. map = "redis://cc";
  171. }
  172. REDIS_ASN {
  173. type = "asn";
  174. map = "redis://asn";
  175. }
  176. REDIS_ASN_FILTERED {
  177. type = "mempool";
  178. variable = "asn";
  179. map = "redis://asn";
  180. filter = "regexp:/^([0-9]).*/";
  181. }
  182. RCVD_TEST_01 {
  183. type = "received";
  184. max_pos = 1;
  185. map = "{= env.TESTDIR =}/configs/maps/rcvd.list";
  186. }
  187. RCVD_TEST_02 {
  188. type = "received";
  189. min_pos = -1;
  190. map = "{= env.TESTDIR =}/configs/maps/rcvd.list";
  191. }
  192. RCVD_TEST_REDIS_01 {
  193. type = "received";
  194. map = "redis://RCVD_TEST";
  195. }
  196. RCVD_AUTHED_ONE {
  197. type = "received";
  198. map = "{= env.TESTDIR =}/configs/maps/rcvd2.list";
  199. flags = ["authenticated"];
  200. nflags = ["ssl"];
  201. }
  202. RCVD_AUTHED_TWO {
  203. type = "received";
  204. map = "{= env.TESTDIR =}/configs/maps/rcvd2.list";
  205. flags = ["authenticated", "ssl"];
  206. }
  207. COMBINED_MAP_AND {
  208. type = "combined";
  209. rules {
  210. ip = {
  211. type = "radix";
  212. map = "{= env.TESTDIR =}/configs/maps/ip.list";
  213. selector = "ip";
  214. }
  215. from {
  216. map = "{= env.TESTDIR =}/configs/maps/domains.list";
  217. selector = "from:domain";
  218. }
  219. }
  220. expression = "from & ip";
  221. score = 10;
  222. prefilter = true;
  223. }
  224. COMBINED_MAP_OR {
  225. type = "combined";
  226. rules {
  227. ip = {
  228. type = "radix";
  229. map = "{= env.TESTDIR =}/configs/maps/ip.list";
  230. selector = "ip";
  231. }
  232. from {
  233. map = "{= env.TESTDIR =}/configs/maps/domains.list";
  234. selector = "from:domain";
  235. }
  236. }
  237. expression = "from || ip"
  238. }
  239. }
  240. rbl {
  241. rbls {
  242. fake {
  243. from = true;
  244. ipv4 = true;
  245. ipv6 = true;
  246. rbl = "fake.rbl";
  247. symbol = "FAKE_RBL_UNKNOWN";
  248. received = true;
  249. symbols_prefixes = {
  250. received = 'FAKE_RECEIVED_RBL',
  251. from = 'FAKE_RBL',
  252. }
  253. unknown = true;
  254. returncodes = {
  255. "CODE_2" = "127.0.0.2";
  256. "CODE_3" = "127.0.0.3";
  257. }
  258. }
  259. fake_whitelist {
  260. from = true;
  261. ipv4 = true;
  262. ipv6 = true;
  263. received = true;
  264. is_whitelist = true;
  265. rbl = "fake.wl";
  266. symbol = "FAKE_WL_RBL_UNKNOWN";
  267. unknown = true;
  268. returncodes = {
  269. "FAKE_WL_RBL_CODE_2" = "127.0.0.2";
  270. "FAKE_WL_RBL_CODE_3" = "127.0.0.3";
  271. }
  272. }
  273. RSPAMD_EMAILBL {
  274. rbl = "test8.uribl";
  275. url_compose_map = "{= env.TESTDIR =}/configs/maps/url_compose_map_for_mails.list";
  276. ignore_defaults = true;
  277. emails = true;
  278. emails_domainonly = true
  279. returncodes = {
  280. RSPAMD_EMAILBL = "127.0.0.2";
  281. }
  282. }
  283. URIBL_NOCONTENT {
  284. rbl = "test9.uribl";
  285. ignore_defaults = true;
  286. urls = true;
  287. }
  288. URIBL_WITHCONTENT {
  289. rbl = "test9.uribl";
  290. ignore_defaults = true;
  291. urls = true;
  292. content_urls = true;
  293. }
  294. URIBL_CONTENTONLY {
  295. rbl = "test9.uribl";
  296. ignore_defaults = true;
  297. content_urls = true;
  298. no_ip = true;
  299. }
  300. RBL_SELECTOR_SINGLE {
  301. rbl = "test9.uribl";
  302. ignore_defaults = true;
  303. selector = "helo()";
  304. }
  305. RBL_SELECTOR_MULTIPLE {
  306. rbl = "test9.uribl";
  307. ignore_defaults = true;
  308. selector = {
  309. sel_from = "from('smtp'):domain";
  310. sel_helo = "helo()";
  311. }
  312. }
  313. }
  314. }
  315. surbl {
  316. "whitelist" = [
  317. "rspamd-test.com"
  318. ];
  319. rules {
  320. "RSPAMD_URIBL" {
  321. suffix = "test.uribl";
  322. check_dkim = true;
  323. check_emails = true;
  324. images = false;
  325. process_script =<<EOD
  326. function(url, suffix)
  327. local cr = require "rspamd_cryptobox_hash"
  328. local h = cr.create(url):base32():sub(1, 32)
  329. return string.format("%s.%s", h, suffix)
  330. end
  331. EOD;
  332. }
  333. "DBL" {
  334. suffix = "test2.uribl";
  335. no_ip = true;
  336. check_emails = true;
  337. check_dkim = true;
  338. ips = {
  339. # spam domain
  340. DBL_SPAM = "127.0.1.2";
  341. # phish domain
  342. DBL_PHISH = "127.0.1.4";
  343. }
  344. }
  345. "URIBL_MULTI" {
  346. suffix = "test3.uribl";
  347. check_dkim = true;
  348. check_emails = true;
  349. bits {
  350. URIBL_BLOCKED = 1;
  351. URIBL_BLACK = 2;
  352. URIBL_GREY = 4;
  353. URIBL_RED = 8;
  354. }
  355. }
  356. "SPAMHAUS_ZEN_URIBL" {
  357. suffix = "test4.uribl";
  358. resolve_ip = true;
  359. check_emails = true;
  360. ips {
  361. URIBL_SBL = "127.0.0.2";
  362. URIBL_SBL_CSS = "127.0.0.3";
  363. URIBL_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"];
  364. URIBL_PBL = ["127.0.0.10", "127.0.0.11"];
  365. URIBL_DROP = "127.0.0.9";
  366. }
  367. }
  368. "RSPAMD_URIBL_IMAGES" {
  369. suffix = "test.uribl";
  370. check_dkim = true;
  371. check_emails = false;
  372. images = true;
  373. process_script =<<EOD
  374. function(url, suffix)
  375. local cr = require "rspamd_cryptobox_hash"
  376. local h = cr.create(url):base32():sub(1, 32)
  377. return string.format("%s.%s", h, suffix)
  378. end
  379. EOD;
  380. }
  381. "BAD_SUBDOMAIN" {
  382. suffix = "test7.uribl";
  383. url_compose_map = "{= env.TESTDIR =}/configs/maps/url_compose_map.list";
  384. check_dkim = true;
  385. check_emails = false;
  386. }
  387. }
  388. }