From 138186685a20afe1618f881094f3fb9e76a8b43a Mon Sep 17 00:00:00 2001 From: moisseev Date: Sun, 28 Jul 2024 18:26:38 +0300 Subject: [Conf] Add SenderScore RPBL return codes --- conf/modules.d/rbl.conf | 20 ++++++++++ conf/scores.d/rbl_group.conf | 92 +++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 111 insertions(+), 1 deletion(-) diff --git a/conf/modules.d/rbl.conf b/conf/modules.d/rbl.conf index c3594dbc9..104bfbe51 100644 --- a/conf/modules.d/rbl.conf +++ b/conf/modules.d/rbl.conf @@ -82,6 +82,26 @@ rbl { symbol = "RBL_SENDERSCORE"; checks = ['from']; rbl = "bl.score.senderscore.com"; + returncodes { + RBL_SENDERSCORE_BOT = "127.0.0.1"; + RBL_SENDERSCORE_NA = "127.0.0.2"; + RBL_SENDERSCORE_NA_BOT = "127.0.0.3"; + RBL_SENDERSCORE_PRST = "127.0.0.4"; + RBL_SENDERSCORE_PRST_BOT = "127.0.0.5"; + RBL_SENDERSCORE_PRST_NA = "127.0.0.6"; + RBL_SENDERSCORE_PRST_NA_BOT = "127.0.0.7"; + RBL_SENDERSCORE_SUS_ATT = "127.0.0.8"; + RBL_SENDERSCORE_SUS_ATT_NA = "127.0.0.10"; + RBL_SENDERSCORE_SUS_ATT_NA_BOT = "127.0.0.11"; + RBL_SENDERSCORE_SUS_ATT_PRST_NA = "127.0.0.14"; + RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT = "127.0.0.15"; + RBL_SENDERSCORE_SCORE = "127.0.0.16"; + RBL_SENDERSCORE_SCORE_NA = "127.0.0.18"; + RBL_SENDERSCORE_SCORE_PRST = "127.0.0.20"; + RBL_SENDERSCORE_SCORE_PRST_NA = "127.0.0.22"; + RBL_SENDERSCORE_SCORE_SUS_ATT_NA = "127.0.0.26"; + RBL_SENDERSCORE_BLOCKED = "127.255.255.255"; + } } sem { diff --git a/conf/scores.d/rbl_group.conf b/conf/scores.d/rbl_group.conf index ef29ed2fa..b22239d21 100644 --- a/conf/scores.d/rbl_group.conf +++ b/conf/scores.d/rbl_group.conf @@ -163,8 +163,98 @@ symbols = { } "RBL_SENDERSCORE" { + weight = 0.0; + description = "Unrecognised result from SenderScore RPBL"; + } + "RBL_SENDERSCORE_BOT" { + weight = 2.0; + description = "From address is listed in SenderScore RPBL - botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_NA_BOT" { + weight = 2.5; + description = "From address is listed in SenderScore RPBL - noauth+botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_PRST" { + weight = 1.0; + description = "From address is listed in SenderScore RPBL - pristine"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_PRST_BOT" { + weight = 2.0; + description = "From address is listed in SenderScore RPBL - pristine+botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_PRST_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - pristine+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_PRST_NA_BOT" { + weight = 2.5; + description = "From address is listed in SenderScore RPBL - pristine+noauth+botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SUS_ATT" { + weight = 1.0; + description = "From address is listed in SenderScore RPBL - suspect_attachments"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SUS_ATT_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SUS_ATT_NA_BOT" { + weight = 2.0; + description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth+botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SUS_ATT_PRST_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT" { weight = 2.0; - description = "From address is listed in senderscore.com BL"; + description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth+botnet"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SCORE" { + weight = 1.0; + description = "From address is listed in SenderScore RPBL - sender_score"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SCORE_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - sender_score+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SCORE_PRST" { + weight = 1.0; + description = "From address is listed in SenderScore RPBL - sender_score+pristine"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SCORE_PRST_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - sender_score+pristine+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_SCORE_SUS_ATT_NA" { + weight = 1.5; + description = "From address is listed in SenderScore RPBL - sender_score+suspect_attachments+noauth"; + groups = ["senderscore"]; + } + "RBL_SENDERSCORE_BLOCKED" { + weight = 0.0; + description = "Excessive number of queries to SenderScore RPBL, more info: https://knowledge.validity.com/hc/en-us/articles/20961730681243"; + groups = ["senderscore", "blocked"]; } "MAILSPIKE" { -- cgit v1.2.3 From f7cf3a4d8dc425ba031b56b72c1e6b96ec9a83ef Mon Sep 17 00:00:00 2001 From: moisseev Date: Mon, 29 Jul 2024 10:32:46 +0300 Subject: Set SenderScore RPBL scores --- conf/scores.d/rbl_group.conf | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/conf/scores.d/rbl_group.conf b/conf/scores.d/rbl_group.conf index b22239d21..e1ff8eace 100644 --- a/conf/scores.d/rbl_group.conf +++ b/conf/scores.d/rbl_group.conf @@ -172,32 +172,32 @@ symbols = { groups = ["senderscore"]; } "RBL_SENDERSCORE_NA" { - weight = 1.5; + weight = 0.0; description = "From address is listed in SenderScore RPBL - noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_NA_BOT" { - weight = 2.5; + weight = 1.0; description = "From address is listed in SenderScore RPBL - noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST" { - weight = 1.0; + weight = 2.0; description = "From address is listed in SenderScore RPBL - pristine"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_BOT" { - weight = 2.0; + weight = 3.0; description = "From address is listed in SenderScore RPBL - pristine+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_NA" { - weight = 1.5; + weight = 2.0; description = "From address is listed in SenderScore RPBL - pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_NA_BOT" { - weight = 2.5; + weight = 3.0; description = "From address is listed in SenderScore RPBL - pristine+noauth+botnet"; groups = ["senderscore"]; } @@ -207,47 +207,47 @@ symbols = { groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_NA" { - weight = 1.5; + weight = 1.0; description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_NA_BOT" { - weight = 2.0; + weight = 1.5; description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_PRST_NA" { - weight = 1.5; + weight = 3.0; description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT" { - weight = 2.0; + weight = 3.5; description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE" { - weight = 1.0; + weight = 2.0; description = "From address is listed in SenderScore RPBL - sender_score"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_NA" { - weight = 1.5; + weight = 2.0; description = "From address is listed in SenderScore RPBL - sender_score+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_PRST" { - weight = 1.0; + weight = 4.0; description = "From address is listed in SenderScore RPBL - sender_score+pristine"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_PRST_NA" { - weight = 1.5; + weight = 4.0; description = "From address is listed in SenderScore RPBL - sender_score+pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_SUS_ATT_NA" { - weight = 1.5; + weight = 3.0; description = "From address is listed in SenderScore RPBL - sender_score+suspect_attachments+noauth"; groups = ["senderscore"]; } -- cgit v1.2.3 From f272b899e74e3bedd9668c2ff833e06e0552130f Mon Sep 17 00:00:00 2001 From: moisseev Date: Mon, 29 Jul 2024 20:06:41 +0300 Subject: Rename unrecognized SenderScore RBL result symbol --- conf/modules.d/rbl.conf | 2 +- conf/scores.d/rbl_group.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/conf/modules.d/rbl.conf b/conf/modules.d/rbl.conf index 104bfbe51..d8db05ecc 100644 --- a/conf/modules.d/rbl.conf +++ b/conf/modules.d/rbl.conf @@ -79,7 +79,7 @@ rbl { } senderscore { - symbol = "RBL_SENDERSCORE"; + symbol = "RBL_SENDERSCORE_UNKNOWN"; checks = ['from']; rbl = "bl.score.senderscore.com"; returncodes { diff --git a/conf/scores.d/rbl_group.conf b/conf/scores.d/rbl_group.conf index e1ff8eace..741552a17 100644 --- a/conf/scores.d/rbl_group.conf +++ b/conf/scores.d/rbl_group.conf @@ -162,7 +162,7 @@ symbols = { groups = ["spamhaus", "blocked"]; } - "RBL_SENDERSCORE" { + "RBL_SENDERSCORE_UNKNOWN" { weight = 0.0; description = "Unrecognised result from SenderScore RPBL"; } -- cgit v1.2.3