diff options
| author | Alexander Moisseev <moiseev@mezonplus.ru> | 2017-04-17 11:51:21 +0300 |
|---|---|---|
| committer | Alexander Moisseev <moiseev@mezonplus.ru> | 2017-04-17 11:51:21 +0300 |
| commit | 57b22b82eb65ab513feb58083cca78d9540e165e (patch) | |
| tree | ad13ba859e4405754d9c9e550e4420db147e13c4 | |
| parent | fd118860a33aa1f16958fb18325263b9c8c78f21 (diff) | |
| download | rspamd-57b22b82eb65ab513feb58083cca78d9540e165e.tar.gz rspamd-57b22b82eb65ab513feb58083cca78d9540e165e.zip | |
[Minor] Suppress CTYPE_MIXED_BOGUS for yandex.ru web-mail
| -rw-r--r-- | conf/composites.conf | 3 | ||||
| -rw-r--r-- | rules/regexp/headers.lua | 10 |
2 files changed, 13 insertions, 0 deletions
diff --git a/conf/composites.conf b/conf/composites.conf index 8a00b2fd1..75f038eaa 100644 --- a/conf/composites.conf +++ b/conf/composites.conf @@ -57,6 +57,9 @@ composites { MAIL_RU_MAILER_BASE64 { expression = "MAIL_RU_MAILER & (FROM_EXCESS_BASE64 | REPLYTO_EXCESS_BASE64 | SUBJ_EXCESS_BASE64 | TO_EXCESS_BASE64)"; } + YANDEX_RU_MAILER_CTYPE_MIXED_BOGUS { + expression = "YANDEX_RU_MAILER & -HAS_ATTACHMENT & CTYPE_MIXED_BOGUS"; + } HACKED_WP_PHISHING { expression = "HAS_X_POS & HAS_WP_URI & PHISHING"; policy = "leave"; diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua index 68e540aee..0258ab42e 100644 --- a/rules/regexp/headers.lua +++ b/rules/regexp/headers.lua @@ -576,6 +576,16 @@ reconf['MAIL_RU_MAILER'] = { group = 'header' } +-- Detect yandex.ru web-mail +local xm_yandex_ru_mailer_5_0 = 'X-Mailer=/^Yamail \\[ http:\\/\\/yandex\\.ru \\] 5\\.0$/H' +local rcvd_web_yandex_ru = 'Received=/^by web\\d{1,2}[a-z]\\.yandex\\.ru with HTTP;/mH' +reconf['YANDEX_RU_MAILER'] = { + re = string.format('(%s) & (%s)', xm_yandex_ru_mailer_5_0, rcvd_web_yandex_ru), + score = 0.0, + description = 'Sent with yandex.ru web-mail', + group = 'header' +} + -- Two received headers with ip addresses local double_ip_spam_1 = 'Received=/from \\[\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\] by \\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3} with/H' local double_ip_spam_2 = 'Received=/from\\s+\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\s+by\\s+\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3};/H' |