From d4cdf447b822835ee16947f88d88b9b7231d7995 Mon Sep 17 00:00:00 2001 From: Andrew Lewis Date: Mon, 13 Feb 2017 14:41:16 +0200 Subject: [Minor] Yield matched title in FROM_NAME_HAS_TITLE rule --- rules/misc.lua | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'rules') diff --git a/rules/misc.lua b/rules/misc.lua index 56de79a6b..2685e3826 100644 --- a/rules/misc.lua +++ b/rules/misc.lua @@ -477,8 +477,14 @@ local check_from_id = rspamd_config:register_callback_symbol('CHECK_FROM', 1.0, task:insert_result('FROM_HAS_DN', 1.0) -- Look for Mr/Mrs/Dr titles local n = from[1].name:lower() - if (n:find('^mrs?[%.%s]') or n:find('^dr[%.%s]')) then - task:insert_result('FROM_NAME_HAS_TITLE', 1.0) + local match, match_end + match, match_end = n:find('^mrs?[%.%s]') + if match then + task:insert_result('FROM_NAME_HAS_TITLE', 1.0, n:sub(match, match_end-1)) + end + match, match_end = n:find('^dr[%.%s]') + if match then + task:insert_result('FROM_NAME_HAS_TITLE', 1.0, n:sub(match, match_end-1)) end end if (envfrom and from and envfrom[1] and from[1] and -- cgit v1.2.3 From 9369163b3ff393da1ebd28908a47aad483ea3b0a Mon Sep 17 00:00:00 2001 From: Andrew Lewis Date: Mon, 13 Feb 2017 15:25:44 +0200 Subject: [Feature] Add REPLYTO_EMAIL_HAS_TITLE rule --- rules/misc.lua | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'rules') diff --git a/rules/misc.lua b/rules/misc.lua index 2685e3826..df9377101 100644 --- a/rules/misc.lua +++ b/rules/misc.lua @@ -16,6 +16,7 @@ limitations under the License. -- This is main lua config file for rspamd +local E = {} local util = require "rspamd_util" local rspamd_regexp = require "rspamd_regexp" @@ -628,6 +629,18 @@ local check_replyto_id = rspamd_config:register_callback_symbol('CHECK_REPLYTO', return false else task:insert_result('HAS_REPLYTO', 1.0) + local rta = rt[1].addr + if rta then + -- Check if Reply-To address starts with title seen in display name + local sym = task:get_symbol('FROM_NAME_HAS_TITLE') + local title = (((sym or E)[1] or E).options or E)[1] + if title then + rta = rta:lower() + if rta:find('^' .. title) then + task:insert_result('REPLYTO_EMAIL_HAS_TITLE', 1.0) + end + end + end end -- See if Reply-To matches From in some way @@ -672,6 +685,9 @@ rspamd_config:register_virtual_symbol('REPLYTO_DOM_NEQ_FROM_DOM', 1.0, check_rep rspamd_config:set_metric_symbol('REPLYTO_DOM_NEQ_FROM_DOM', 0, 'Reply-To domain does not match the From domain') rspamd_config:register_virtual_symbol('REPLYTO_DN_EQ_FROM_DN', 1.0, check_replyto_id) rspamd_config:set_metric_symbol('REPLYTO_DN_EQ_FROM_DN', 0, 'Reply-To display name matches From') +rspamd_config:register_virtual_symbol('REPLYTO_EMAIL_HAS_TITLE', 1.0, check_replyto_id) +rspamd_config:set_metric_symbol('REPLYTO_EMAIL_HAS_TITLE', 2.0, check_replyto_id) +rspamd_config:register_dependency(check_replyto_id, check_from_id) local check_mime_id = rspamd_config:register_callback_symbol('CHECK_MIME', 1.0, function (task) -- cgit v1.2.3 From 05b34a3daca7afa635e99816b04922eb46bdb799 Mon Sep 17 00:00:00 2001 From: Andrew Lewis Date: Mon, 13 Feb 2017 14:59:48 +0200 Subject: [Feature] Add FROM_NAME_EXCESS_SPACE rule --- rules/misc.lua | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'rules') diff --git a/rules/misc.lua b/rules/misc.lua index df9377101..9127f68c9 100644 --- a/rules/misc.lua +++ b/rules/misc.lua @@ -487,6 +487,10 @@ local check_from_id = rspamd_config:register_callback_symbol('CHECK_FROM', 1.0, if match then task:insert_result('FROM_NAME_HAS_TITLE', 1.0, n:sub(match, match_end-1)) end + -- Check for excess spaces + if n:find('%s%s') then + task:insert_result('FROM_NAME_EXCESS_SPACE', 1.0) + end end if (envfrom and from and envfrom[1] and from[1] and envfrom[1].addr:lower() == from[1].addr:lower()) @@ -514,6 +518,8 @@ rspamd_config:register_virtual_symbol('FROM_DN_EQ_ADDR', 1.0, check_from_id) rspamd_config:set_metric_symbol('FROM_DN_EQ_ADDR', 1.0, 'From header display name is the same as the address') rspamd_config:register_virtual_symbol('FROM_HAS_DN', 1.0, check_from_id) rspamd_config:set_metric_symbol('FROM_HAS_DN', 0, 'From header has a display name') +rspamd_config:register_virtual_symbol('FROM_NAME_EXCESS_SPACE', 1.0, check_from_id) +rspamd_config:set_metric_symbol('FROM_NAME_EXCESS_SPACE', 1.0, 'From header display name contains excess whitespace') rspamd_config:register_virtual_symbol('FROM_NAME_HAS_TITLE', 1.0, check_from_id) rspamd_config:set_metric_symbol('FROM_NAME_HAS_TITLE', 1.0, 'From header display name has a title (Mr/Mrs/Dr)') rspamd_config:register_virtual_symbol('FROM_EQ_ENVFROM', 1.0, check_from_id) -- cgit v1.2.3