hyph/tr.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607

<?xml version="1.0" encoding="iso-8859-9"?>
<!DOCTYPE hyphenation-info SYSTEM "../hyph/hyphenation.dtd">
<!-- Constructed by Togan Muftuoglu from trhyphen.tex file
      toganm@users.sourceforge.net 26 March 2002
% A mechanically generated Turkish Hyphenation table for TeX,
% using the University of Washington diacritical coding
% developed by P. A. MacKay for the Ottoman Texts Project.
% Slightly modified by H. Turgut Uyar.
%
% The following commands ensure correct \catcodes, \lccodes and
% \uccodes if your TeX implementations uses these character codes.
%
%\catcode`\^^c7=11 \lccode`\^^c7=`\^^e7 \uccode`\^^c7=`\^^c7 % \c{C}
%\catcode`\^^e7=11 \lccode`\^^e7=`\^^e7 \uccode`\^^e7=`\^^c7 % \c{c}
%\catcode`\^^d6=11 \lccode`\^^d6=`\^^f6 \uccode`\^^d6=`\^^d6 % \"{O}
%\catcode`\^^f6=11 \lccode`\^^f6=`\^^f6 \uccode`\^^f6=`\^^d6 % \"{o}
%\catcode`\^^dc=11 \lccode`\^^dc=`\^^fc \uccode`\^^dc=`\^^dc % \"{U}
%\catcode`\^^fc=11 \lccode`\^^fc=`\^^fc \uccode`\^^fc=`\^^dc % \"{u}
%
%\catcode`\^^87=11 \lccode`\^^87=`\^^a7 \uccode`\^^87=`\^^87 % \u{G}
%\catcode`\^^a7=11 \lccode`\^^a7=`\^^a7 \uccode`\^^a7=`\^^87 % \u{g}
%\catcode`\^^9d=11 \lccode`\^^9d=`\^^Y  \uccode`\^^9d=`\^^9d % \.{I}
%\catcode`\^^Y=11  \lccode`\^^Y=`\^^Y   \uccode`\^^Y=`\^^9d  % \i{}
%\catcode`\^^83=11 \lccode`\^^83=`\^^b3 \uccode`\^^83=`\^^83 % \c{S}
%\catcode`\^^b3=11 \lccode`\^^b3=`\^^b3 \uccode`\^^b3=`\^^83 % \c{s}
%
-->
<hyphenation-info>
<hyphen-char value="-"/>
<hyphen-min before="3" after="2"/>
<classes>
<!-- @!$%^&*()_-+=~`{[}]:;'|<,.>?/0123456789 -->
aA
bB
cC
�� <!-- ccedilla -->
dD
eE
fF
gG
�� <!-- gbreve --> 
hH
�I <!-- idotless I -->
i� <!--i  Iabovedot -->
jJ
kK
lL
mM
nN
oO
�� <!--odiaeresis -->
pP
<!-- qQ -->
rR
sS
�� <!--scedilla-->
tT
uU
�� <!--Udiaeresis-->
vV
<!--wW-->
<!--xX-->
yY
zZ
<!--��-->
<!--��-->
</classes>
<patterns>
2a1
2e1
2^^Y1
2i1
2o1
2�1
2u1
2�1
1b1
1c1
1�1
1d1
1f1
1g1
1^^a71
1h1
1j1
1k1
1l1
1m1
1n1
1p1
1r1
1s1
1^^b31
1t1
1v1
1y1
1z1
2e2cek.
2bb
2bc
2b�
2bd
2bf
2bg
2b^^a7
2bh
2bj
2bk
2bl
2bm
2bn
2bp
2br
2bs
2b^^b3
2bt
2bv
2by
2bz
2cb
2cc
2c�
2cd
2cf
2cg
2c^^a7
2ch
2cj
2ck
2cl
2cm
2cn
2cp
2cr
2cs
2c^^b3
2ct
2cv
2cy
2cz
2�b
2�c
2��
2�d
2�f
2�g
2�^^a7
2�h
2�j
2�k
2�l
2�m
2�n
2�p
2�r
2�s
2�^^b3
2�t
2�v
2�y
2�z
2db
2dc
2d�
2dd
2df
2dg
2d^^a7
2dh
2dj
2dk
2dl
2dm
2dn
2dp
2dr
2ds
2d^^b3
2dt
2dv
2dy
2dz
2fb
2fc
2f�
2fd
2ff
2fg
2f^^a7
2fh
2fj
2fk
2fl
2fm
2fn
2fp
2fr
2fs
2f^^b3
2ft
2fv
2fy
2fz
2gb
2gc
2g�
2gd
2gf
2gg
2g^^a7
2gh
2gj
2gk
2gl
2gm
2gn
2gp
2gr
2gs
2g^^b3
2gt
2gv
2gy
2gz
2^^a7b
2^^a7c
2^^a7�
2^^a7d
2^^a7f
2^^a7g
2^^a7^^a7
2^^a7h
2^^a7j
2^^a7k
2^^a7l
2^^a7m
2^^a7n
2^^a7p
2^^a7r
2^^a7s
2^^a7^^b3
2^^a7t
2^^a7v
2^^a7y
2^^a7z
2hb
2hc
2h�
2hd
2hf
2hg
2h^^a7
2hh
2hj
2hk
2hl
2hm
2hn
2hp
2hr
2hs
2h^^b3
2ht
2hv
2hy
2hz
2jb
2jc
2j�
2jd
2jf
2jg
2j^^a7
2jh
2jj
2jk
2jl
2jm
2jn
2jp
2jr
2js
2j^^b3
2jt
2jv
2jy
2jz
2kb
2kc
2k�
2kd
2kf
2kg
2k^^a7
2kh
2kj
2kk
2kl
2km
2kn
2kp
2kr
2ks
2k^^b3
2kt
2kv
2ky
2kz
2lb
2lc
2l�
2ld
2lf
2lg
2l^^a7
2lh
2lj
2lk
2ll
2lm
2ln
2lp
2lr
2ls
2l^^b3
2lt
2lv
2ly
2lz
2mb
2mc
2m�
2md
2mf
2mg
2m^^a7
2mh
2mj
2mk
2ml
2mm
2mn
2mp
2mr
2ms
2m^^b3
2mt
2mv
2my
2mz
2nb
2nc
2n�
2nd
2nf
2ng
2n^^a7
2nh
2nj
2nk
2nl
2nm
2nn
2np
2nr
2ns
2n^^b3
2nt
2nv
2ny
2nz
2pb
2pc
2p�
2pd
2pf
2pg
2p^^a7
2ph
2pj
2pk
2pl
2pm
2pn
2pp
2pr
2ps
2p^^b3
2pt
2pv
2py
2pz
2rb
2rc
2r�
2rd
2rf
2rg
2r^^a7
2rh
2rj
2rk
2rl
2rm
2rn
2rp
2rr
2rs
2r^^b3
2rt
2rv
2ry
2rz
2sb
2sc
2s�
2sd
2sf
2sg
2s^^a7
2sh
2sj
2sk
2sl
2sm
2sn
2sp
2sr
2ss
2s^^b3
2st
2sv
2sy
2sz
2^^b3b
2^^b3c
2^^b3�
2^^b3d
2^^b3f
2^^b3g
2^^b3^^a7
2^^b3h
2^^b3j
2^^b3k
2^^b3l
2^^b3m
2^^b3n
2^^b3p
2^^b3r
2^^b3s
2^^b3^^b3
2^^b3t
2^^b3v
2^^b3y
2^^b3z
2tb
2tc
2t�
2td
2tf
2tg
2t^^a7
2th
2tj
2tk
2tl
2tm
2tn
2tp
2tr
2ts
2t^^b3
2tt
2tv
2ty
2tz
2vb
2vc
2v�
2vd
2vf
2vg
2v^^a7
2vh
2vj
2vk
2vl
2vm
2vn
2vp
2vr
2vs
2v^^b3
2vt
2vv
2vy
2vz
2yb
2yc
2y�
2yd
2yf
2yg
2y^^a7
2yh
2yj
2yk
2yl
2ym
2yn
2yp
2yr
2ys
2y^^b3
2yt
2yv
2yy
2yz
2zb
2zc
2z�
2zd
2zf
2zg
2z^^a7
2zh
2zj
2zk
2zl
2zm
2zn
2zp
2zr
2zs
2z^^b3
2zt
2zv
2zy
2zz
a3a2
a3e2
a3^^Y2
a3i2
a3o2
a3�2
a3u2
a3�2
e3a2
e3e2
e3^^Y2
e3i2
e3o2
e3�2
e3u2
e3�2
^^Y3a2
^^Y3e2
^^Y3^^Y2
^^Y3i2
^^Y3o2
^^Y3�2
^^Y3u2
^^Y3�2
i3a2
i3e2
i3^^Y2
i3i2
i3o2
i3�2
i3u2
i3�2
o3a2
o3e2
o3^^Y2
o3i2
o3o2
o3�2
o3u2
o3�2
�3a2
�3e2
�3^^Y2
�3i2
�3o2
�3�2
�3u2
�3�2
u3a2
u3e2
u3^^Y2
u3i2
u3o2
u3�2
u3u2
u3�2
�3a2
�3e2
�3^^Y2
�3i2
�3o2
�3�2
�3u2
�3�2
tu4r4k
m1t4rak
</patterns>
</hyphenation-info>
--[[
Copyright (c) 2011-2015, Vsevolod Stakhov <vsevolod@highsecure.ru>
Copyright (c) 2013-2015, Andrew Lewis <nerf@judo.za.org>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
]]--

if confighelp then
  return
end

local hash = require 'rspamd_cryptobox_hash'
local rspamd_logger = require 'rspamd_logger'
local rspamd_util = require 'rspamd_util'
local fun = require 'fun'
local lua_util = require 'lua_util'
local ts = require("tableshape").types
local selectors = require "lua_selectors"
local bit = require 'bit'
local lua_maps = require "lua_maps"

-- This plugin implements various types of RBL checks
-- Documentation can be found here:
-- https://rspamd.com/doc/modules/rbl.html

local E = {}
local N = 'rbl'

local local_exclusions
local white_symbols = {}
local black_symbols = {}
local monitored_addresses = {}
local known_selectors = {} -- map from selector string to selector id

local function get_monitored(rbl)
  local default_monitored = '1.0.0.127'
  local ret = {
    rcode = 'nxdomain',
    prefix = default_monitored,
    random = false,
  }

  if rbl.monitored_address then
    ret.prefix = rbl.monitored_address
  end

  if rbl.dkim or rbl.urls or rbl.emails then
    ret.random = true
  end

  lua_util.debugm(N, rspamd_config,
      'added monitored address: %s (%s random)',
      ret.prefix, ret.random)

  return ret
end

local function validate_dns(lstr)
  if lstr:match('%.%.') then
    -- two dots in a row
    return false
  end
  if not rspamd_util.is_valid_utf8(lstr) then
    -- invalid utf8 detected
    return false
  end
  for v in lstr:gmatch('[^%.]+') do
    if v:len() > 63 or v:match('^-') or v:match('-$') then
      -- too long label or weird labels
      return false
    end
  end
  return true
end

local function maybe_make_hash(data, rule)
  if rule.hash then
    local h = hash.create_specific(rule.hash, data)
    local s
    if rule.hash_format then
      if rule.hash_format == 'base32' then
        s = h:base32()
      elseif rule.hash_format == 'base64' then
        s = h:base64()
      else
        s = h:hex()
      end
    else
      s = h:hex()
    end

    if rule.hash_len then
      s = s:sub(1, rule.hash_len)
    end

    return s
  else
    return data
  end
end

local function is_excluded_ip(rip)
  if local_exclusions and local_exclusions:get_key(rip) then
    return true
  end
  return false
end

local function ip_to_rbl(ip)
  return table.concat(ip:inversed_str_octets(), '.')
end

local function gen_check_rcvd_conditions(rbl, received_total)
  local min_pos = tonumber(rbl['received_min_pos'])
  local max_pos = tonumber(rbl['received_max_pos'])
  local match_flags = rbl['received_flags']
  local nmatch_flags = rbl['received_nflags']
  local function basic_received_check(rh)
    if not (rh['real_ip'] and rh['real_ip']:is_valid()) then return false end
    if ((rh['real_ip']:get_version() == 6 and rbl['ipv6']) or
        (rh['real_ip']:get_version() == 4 and rbl['ipv4'])) and
        ((rbl['exclude_private_ips'] and not rh['real_ip']:is_local()) or
            not rbl['exclude_private_ips']) and ((rbl['exclude_local_ips'] and
        not is_excluded_ip(rh['real_ip'])) or not rbl['exclude_local_ips']) then
      return true
    else
      return false
    end
  end
  if not (max_pos or min_pos or match_flags or nmatch_flags) then
    return basic_received_check
  end
  return function(rh, pos)
    if not basic_received_check() then return false end
    local got_flags = rh['flags'] or E
    if min_pos then
      if min_pos < 0 then
        if min_pos == -1 then
          if (pos ~= received_total) then
            return false
          end
        else
          if pos <= (received_total - (min_pos*-1)) then
            return false
          end
        end
      elseif pos < min_pos then
        return false
      end
    end
    if max_pos then
      if max_pos < -1 then
        if (received_total - (max_pos*-1)) >= pos then
          return false
        end
      elseif max_pos > 0 then
        if pos > max_pos then
          return false
        end
      end
    end
    if match_flags then
      for _, flag in ipairs(match_flags) do
        if not got_flags[flag] then
          return false
        end
      end
    end
    if nmatch_flags then
      for _, flag in ipairs(nmatch_flags) do
        if got_flags[flag] then
          return false
        end
      end
    end
    return true
  end
end

local function rbl_dns_process(task, rbl, to_resolve, results, err, resolve_table_elt)
  local function make_option(ip)
    if ip then
      return string.format('%s:%s:%s',
          resolve_table_elt.orig,
          resolve_table_elt.what,
          ip)
    else
      return string.format('%s:%s',
          resolve_table_elt.orig,
          resolve_table_elt.what)
    end
  end

  local function insert_result(s, ip)
    if rbl.symbols_prefixes then
      local prefix = rbl.symbols_prefixes[resolve_table_elt.what]

      if not prefix then
        rspamd_logger.warnx(task, 'unlisted symbol prefix for %s', resolve_table_elt.what)
        task:insert_result(s, 1.0, make_option(ip))
      else
        task:insert_result(prefix .. '_' .. s, 1.0, make_option(ip))
      end
    else
      task:insert_result(s, 1.0, make_option(ip))
    end
  end

  if err and (err ~= 'requested record is not found' and
      err ~= 'no records with this name') then
    rspamd_logger.infox(task, 'error looking up %s: %s', to_resolve, err)
    task:insert_result(rbl.symbol .. '_FAIL', 1, string.format('%s:%s',
        resolve_table_elt.orig, err))
    return
  end

  if not results then
    lua_util.debugm(N, task,
        'DNS RESPONSE: label=%1 results=%2 error=%3 rbl=%4',
        to_resolve, false, err, rbl.symbol)
    return
  else
    lua_util.debugm(N, task,
        'DNS RESPONSE: label=%1 results=%2 error=%3 rbl=%4',
        to_resolve, true, err, rbl.symbol)
  end

  if rbl.returncodes == nil and rbl.returnbits == nil and rbl.symbol ~= nil then
    insert_result(rbl.symbol)
    return
  end

  for _,result in ipairs(results) do
    local ipstr = result:to_string()
    lua_util.debugm(N, task, '%s DNS result %s', to_resolve, ipstr)
    local foundrc = false
    -- Check return codes
    if rbl.returnbits then
      local ipnum = result:to_number()
      for s,bits in pairs(rbl.returnbits) do
        for _,check_bit in ipairs(bits) do
          if bit.band(ipnum, check_bit) == check_bit then
            foundrc = true
            insert_result(s)
            -- Here, we continue with other bits
          end
        end
      end
    elseif rbl.returncodes then
      for s, codes in pairs(rbl.returncodes) do
        for _,v in ipairs(codes) do
          if string.find(ipstr, '^' .. v .. '$') then
            foundrc = true
            insert_result(s)
            break
          end
        end
      end
    end

    if not foundrc then
      if rbl.unknown and rbl.symbol then
        insert_result(rbl.symbol, ipstr)
      else
        rspamd_logger.errx(task, 'RBL %1 returned unknown result: %2',
            rbl.rbl, ipstr)
      end
    end
  end

end

local function gen_rbl_callback(rule)
  local function is_whitelisted(task, req, req_str, whitelist, what)
    if rule.ignore_whitelist then return false end

    if rule.whitelist then
      if rule.whitelist:get_key(req) then
        lua_util.debugm(N, task,
            'whitelisted %s on %s',
            req_str, rule.symbol)

        return true
      end
    end

    -- Maybe whitelisted by some other rbl rule
    if whitelist then
      local wl_what = whitelist[req_str]
      if wl_what then
        lua_util.debugm(N, task,
            'whitelisted %s on %s by %s rbl rule (%s checked)',
            req_str, wl_what, what)
        return wl_what == what
      end
    end

    return false
  end

  local function add_dns_request(task, req, forced, is_ip, requests_table, what, whitelist)
    local req_str = req
    if is_ip then
      req_str = tostring(req)
    end

    if whitelist and is_whitelisted(task, req, req_str, whitelist, what) then
      return
    end

    if is_ip then
      req = ip_to_rbl(req)
    end

    if requests_table[req] then
      -- Duplicate request
      local nreq = requests_table[req]
      if forced and not nreq.forced then
        nreq.forced = true
      end

      return true,nreq -- Duplicate
    else
      local nreq

      local resolve_ip = rule.resolve_ip and not is_ip
      if rule.process_script then
        local processed = rule.process_script(req, rule.rbl, task, resolve_ip)

        if processed then
          nreq = {
            forced = forced,
            n = processed,
            orig = req_str,
            resolve_ip = resolve_ip,
            what = what,
          }
          requests_table[req] = nreq
        end
      else
        local to_resolve
        local orign = req

        if not resolve_ip then
          orign = maybe_make_hash(req, rule)
          to_resolve = string.format('%s.%s',
              orign,
              rule.rbl)
        else
          -- First, resolve origin stuff without hashing or anything
          to_resolve = orign
        end

        nreq = {
          forced = forced,
          n = to_resolve,
          orig = req_str,
          resolve_ip = resolve_ip,
          what = what,
        }
        requests_table[req] = nreq
      end
      return false, nreq
    end
  end

  -- Here, we have functional approach: we form a pipeline of functions
  -- f1, f2, ... fn. Each function accepts task and return boolean value
  -- that allows to process pipeline further
  -- Each function in the pipeline can add something to `dns_req` vector as a side effect
  local function is_alive(_, _)
    if rule.monitored then
      if not rule.monitored:alive() then
        return false
      end
    end

    return true
  end

  local function check_user(task, _)
    if task:get_user() then
      return false
    end

    return true
  end

  local function check_local(task, _)
    local ip = task:get_from_ip()

    if ip and not ip:is_valid() then
      ip = nil
    end

    if ip and ip:is_local() or is_excluded_ip(ip) then
      return false
    end

    return true
  end

  local function check_helo(task, requests_table, whitelist)
    local helo = task:get_helo()

    if not helo then
      return false
    end

    add_dns_request(task, helo, true, false, requests_table,
        'helo', whitelist)

    return true
  end

  local function check_dkim(task, requests_table, whitelist)
    local das = task:get_symbol('DKIM_TRACE')
    local mime_from_domain

    if das and das[1] and das[1].options then

      if rule.dkim_match_from then
        -- We check merely mime from
        mime_from_domain = ((task:get_from('mime') or E)[1] or E).domain
        if mime_from_domain then
          local mime_from_domain_tld = rspamd_util.get_tld(mime_from_domain)

          if rule.url_compose_map then
            mime_from_domain = rule.url_compose_map:process_url(task, mime_from_domain_tld, mime_from_domain)
          else
            mime_from_domain = mime_from_domain_tld
          end
        end
      end

      for _, d in ipairs(das[1].options) do

        local domain,result = d:match('^([^%:]*):([%+%-%~])$')

        -- We must ignore bad signatures, omg
        if domain and result and result == '+' then
          if rule.dkim_match_from then
            -- We check merely mime from
            local domain_tld = domain
            if not rule.dkim_domainonly then
              -- Adjust
              domain_tld = rspamd_util.get_tld(domain)

              if rule.url_compose_map then
                domain_tld = rule.url_compose_map:process_url(task, domain_tld, domain)
              end
            end

            if mime_from_domain and mime_from_domain == domain_tld then
              add_dns_request(task, domain_tld, true, false, requests_table,
              'dkim', whitelist)
            end
          else
            if rule.dkim_domainonly then
              local domain_tld = rspamd_util.get_tld(domain)
              if rule.url_compose_map then
                domain_tld = rule.url_compose_map:process_url(task, domain_tld, domain)
              end
              add_dns_request(task, domain_tld,
                  false, false, requests_table, 'dkim', whitelist)
            else
              add_dns_request(task, domain, false, false, requests_table,
                  'dkim', whitelist)
            end
          end
        end
      end
    end

    return true
  end

  local function check_urls(task, requests_table, whitelist)
    local esld_lim = 1

    if rule.url_compose_map then
      esld_lim = nil -- Avoid esld limit as we use custom composition rules
    end
    local ex_params = {
      task = task,
      limit = rule.requests_limit,
      ignore_redirected = true,
      ignore_ip = rule.no_ip,
      need_images = rule.images,
      need_emails = false,
      esld_limit = esld_lim,
      no_cache = true,
    }

    local urls = lua_util.extract_specific_urls(ex_params)

    for _,u in ipairs(urls) do
      local url_tld = u:get_tld()
      if rule.url_compose_map then
        url_tld = rule.url_compose_map:process_url(task, url_tld, u:get_host())
      end
      add_dns_request(task, url_tld, false,
          false, requests_table, 'url', whitelist)
    end

    return true
  end

  local function check_from(task, requests_table, whitelist)
    local ip = task:get_from_ip()

    if not ip or not ip:is_valid() then
      return true
    end
    if (ip:get_version() == 6 and rule.ipv6) or
        (ip:get_version() == 4 and rule.ipv4) then
      add_dns_request(task, ip, true, true,
          requests_table, 'from',
          whitelist)
    end

    return true
  end

  local function check_received(task, requests_table, whitelist)
    local received = fun.filter(function(h)
      return not h['flags']['artificial']
    end, task:get_received_headers()):totable()

    local received_total = #received
    local check_conditions = gen_check_rcvd_conditions(rule, received_total)

    for pos,rh in ipairs(received) do
      if check_conditions(rh, pos) then
        add_dns_request(task, rh.real_ip, false, true,
            requests_table, 'received',
            whitelist)
      end
    end

    return true
  end

  local function check_rdns(task, requests_table, whitelist)
    local hostname = task:get_hostname()
    if hostname == nil or hostname == 'unknown' then
      return false
    end

    add_dns_request(task, hostname, true, false,
        requests_table, 'rdns', whitelist)

    return true
  end

  local function check_selector(task, requests_table, whitelist)
    local res = rule.selector(task)

    if res then
      for _,r in ipairs(res) do
        add_dns_request(task, r, false, false, requests_table,
            'sel' .. rule.selector_id, whitelist)
      end
    end

    return true
  end

  local function check_email_table(task, email_tbl, requests_table, whitelist, what)
    lua_util.remove_email_aliases(email_tbl)
    email_tbl.addr = email_tbl.addr:lower()

    if rule.emails_domainonly then
      add_dns_request(task, email_tbl.domain, false, false, requests_table,
          what, whitelist)
    else
      -- Also check WL for domain only
      if is_whitelisted(task,
          email_tbl.domain,
          email_tbl.domain,
          whitelist,
          what) then
        return
      end
      local delimiter = '.'
      if rule.emails_delimiter then
        delimiter = rule.emails_delimiter
      else
        if rule.hash then
          delimiter = '@'
        end
      end
      add_dns_request(task, string.format('%s%s%s',
          email_tbl.user, delimiter, email_tbl.domain), false, false,
          requests_table, what, whitelist)
    end
  end

  local function check_emails(task, requests_table, whitelist)
    local ex_params = {
      task = task,
      limit = rule.requests_limit,
      filter = function(u) return u:get_protocol() == 'mailto' end,
      need_emails = true,
      prefix = 'rbl_email'
    }

    if rule.emails_domainonly then
      if not rule.url_compose_map then
        ex_params.esld_limit = 1
      end
      ex_params.prefix = 'rbl_email_domainonly'
    end

    local emails = lua_util.extract_specific_urls(ex_params)

    for _,email in ipairs(emails) do
      local domain
      if rule.emails_domainonly then
        if rule.url_compose_map then
          domain = rule.url_compose_map:process_url(task, email:get_tld(), email:get_host())
        else
          domain = email:get_tld()
        end
      else
        domain = email:get_host()
      end

      local email_tbl = {
        domain = domain,
        user = email:get_user(),
        addr = tostring(email),
      }
      check_email_table(task, email_tbl, requests_table, whitelist, 'email')
    end

    return true
  end

  local function check_replyto(task, requests_table, whitelist)
    local function get_raw_header(name)
      return ((task:get_header_full(name) or {})[1] or {})['value']
    end

    local replyto = get_raw_header('Reply-To')
    if replyto then
      local rt = rspamd_util.parse_mail_address(replyto, task:get_mempool())
      lua_util.debugm(N, task, 'check replyto %s', rt[1])

      if rt and rt[1] and (rt[1].addr and #rt[1].addr > 0) then
        check_email_table(task, rt[1], requests_table, whitelist, 'replyto')
      end
    end

    return true
  end

  -- Create function pipeline depending on rbl settings
  local pipeline = {
    is_alive, -- generic for all
  }
  local description = {
    'alive',
  }

  if rule.exclude_users then
    pipeline[#pipeline + 1] = check_user
    description[#description + 1] = 'user'
  end

  if rule.exclude_local or rule.exclude_private_ips then
    pipeline[#pipeline + 1] = check_local
    description[#description + 1] = 'local'
  end

  if rule.helo then
    pipeline[#pipeline + 1] = check_helo
    description[#description + 1] = 'helo'
  end

  if rule.dkim then
    pipeline[#pipeline + 1] = check_dkim
    description[#description + 1] = 'dkim'
  end

  if rule.emails then
    pipeline[#pipeline + 1] = check_emails
    description[#description + 1] = 'emails'
  end
  if rule.replyto then
    pipeline[#pipeline + 1] = check_replyto
    description[#description + 1] = 'replyto'
  end

  if rule.urls then
    pipeline[#pipeline + 1] = check_urls
    description[#description + 1] = 'urls'
  end

  if rule.from then
    pipeline[#pipeline + 1] = check_from
    description[#description + 1] = 'ip'
  end

  if rule.received then
    pipeline[#pipeline + 1] = check_received
    description[#description + 1] = 'received'
  end

  if rule.rdns then
    pipeline[#pipeline + 1] = check_rdns
    description[#description + 1] = 'rdns'
  end

  if rule.selector then
    pipeline[#pipeline + 1] = check_selector
    description[#description + 1] = 'selector'
  end

  local callback_f = function(task)
    -- DNS requests to issue (might be hashed afterwards)
    local dns_req = {}
    local whitelist = task:cache_get('rbl_whitelisted') or {}

    local function gen_rbl_dns_callback(resolve_table_elt)
      return function(_, to_resolve, results, err)
        rbl_dns_process(task, rule, to_resolve, results, err, resolve_table_elt)
      end
    end

    -- Execute functions pipeline
    for i,f in ipairs(pipeline) do
      if not f(task, dns_req, whitelist) then
        lua_util.debugm(N, task,
            "skip rbl check: %s; pipeline condition %s returned false",
            rule.symbol, i)
        return
      end
    end

    -- Now check all DNS requests pending and emit them
    local r = task:get_resolver()
    -- Used for 2 passes ip resolution
    local resolved_req = {}
    local nresolved = 0

    -- This is called when doing resolve_ip phase...
    local function gen_rbl_ip_dns_callback(orig_resolve_table_elt)
      return function(_, _, results, err)
        if not err then
          for _,dns_res in ipairs(results) do
            -- Check if we have rspamd{ip} userdata
            if type(dns_res) == 'userdata' then
              -- Add result as an actual RBL request
              local dup,nreq = add_dns_request(task, dns_res, false, true,
                  resolved_req, orig_resolve_table_elt.what)
              -- Add original name
              if not dup then
                nreq.orig = nreq.orig .. ':' .. orig_resolve_table_elt.n
              end
            end
          end
        end

        nresolved = nresolved - 1

        if nresolved == 0 then
          -- Emit real RBL requests as there are no ip resolution requests
          for name, req in pairs(resolved_req) do
            if validate_dns(req.n) then
              lua_util.debugm(N, task, "rbl %s; resolve %s -> %s",
                  rule.symbol, name, req.n)
              r:resolve_a({
                task = task,
                name = req.n,
                callback = gen_rbl_dns_callback(req),
                forced = req.forced
              })
            else
              rspamd_logger.warnx(task, 'cannot send invalid DNS request %s for %s',
                  req.n, rule.symbol)
            end
          end
        end
      end
    end

    for name, req in pairs(dns_req) do
      if validate_dns(req.n) then
        lua_util.debugm(N, task, "rbl %s; resolve %s -> %s",
            rule.symbol, name, req.n)

        if req.resolve_ip then
          -- Deal with both ipv4 and ipv6
          -- Resolve names first
          if r:resolve_a({
            task = task,
            name = req.n,
            callback = gen_rbl_ip_dns_callback(req),
            forced = req.forced
          }) then
            nresolved = nresolved + 1
          end
          if r:resolve('aaaa', {
            task = task,
            name = req.n,
            callback = gen_rbl_ip_dns_callback(req),
            forced = req.forced
          }) then
            nresolved = nresolved + 1
          end
        else
          r:resolve_a({
            task = task,
            name = req.n,
            callback = gen_rbl_dns_callback(req),
            forced = req.forced
          })
        end

      else
        rspamd_logger.warnx(task, 'cannot send invalid DNS request %s for %s',
            req.n, rule.symbol)
      end
    end
  end

  return callback_f,string.format('checks: %s', table.concat(description, ','))
end

local function add_rbl(key, rbl, global_opts)
  if not rbl.symbol then
    rbl.symbol = key:upper()
  end

  local flags_tbl = {'no_squeeze'}
  if rbl.is_whitelist then
    flags_tbl[#flags_tbl + 1] = 'nice'
  end

  -- Check if rbl is available for empty tasks
  if not (rbl.emails or rbl.urls or rbl.dkim or rbl.received or rbl.selector or rbl.replyto) or
      rbl.is_empty then
    flags_tbl[#flags_tbl + 1] = 'empty'
  end

  if rbl.selector then
    if known_selectors[rbl.selector] then
      lua_util.debugm(N, rspamd_config, 'reuse selector id %s',
          known_selectors[rbl.selector].id)
      rbl.selector = known_selectors[rbl.selector].selector
      rbl.selector_id = known_selectors[rbl.selector].id
    else
      -- Create a new flattened closure
      local sel = selectors.create_selector_closure(rspamd_config, rbl.selector, '', true)

      if not sel then
        rspamd_logger.errx('invalid selector for rbl rule %s: %s', key, rbl.selector)
        return false
      end

      rbl.selector = sel
      known_selectors[rbl.selector] = {
        selector = sel,
        id = #lua_util.keys(known_selectors) + 1,
      }
      rbl.selector_id = known_selectors[rbl.selector].id
    end

  end

  if rbl.process_script then
    local ret, f = lua_util.callback_from_string(rbl.process_script)

    if ret then
      rbl.process_script = f
    else
      rspamd_logger.errx(rspamd_config,
          'invalid process script for rbl rule %s: %s; %s',
          key, rbl.process_script, f)
      return false
    end
  end

  if rbl.whitelist then
    local def_type = 'set'
    if rbl.from or rbl.received then
      def_type = 'radix'
    end
    rbl.whitelist = lua_maps.map_add_from_ucl(rbl.whitelist, def_type,
        'RBL whitelist for ' .. rbl.symbol)
    rspamd_logger.infox(rspamd_config, 'added %s whitelist for RBL %s',
        def_type, rbl.symbol)
  end

  if rbl.url_compose_map then
    local lua_urls_compose = require "lua_urls_compose"
    rbl.url_compose_map = lua_urls_compose.add_composition_map(rspamd_config, rbl.url_compose_map)

    if rbl.url_compose_map then
      rspamd_logger.infox(rspamd_config, 'added url composition map for RBL %s',
          rbl.symbol)
    end
  end

  if not rbl.whitelist and global_opts.url_whitelist and
      (rbl.urls or rbl.emails or rbl.dkim or rbl.replyto) and
      not (rbl.from or rbl.received) then
    local def_type = 'set'
    rbl.whitelist = lua_maps.map_add_from_ucl(global_opts.url_whitelist, def_type,
        'RBL url whitelist for ' .. rbl.symbol)
    rspamd_logger.infox(rspamd_config, 'added URL whitelist for RBL %s',
        rbl.symbol)
  end

  local callback,description = gen_rbl_callback(rbl)

  if callback then
    local id

    if rbl.symbols_prefixes then
      id = rspamd_config:register_symbol{
        type = 'callback',
        callback = callback,
        name = rbl.symbol .. '_CHECK',
        flags = table.concat(flags_tbl, ',')
      }

      for _,prefix in pairs(rbl.symbols_prefixes) do
        -- For unknown results...
        rspamd_config:register_symbol{
          type = 'virtual',
          parent = id,
          name = prefix .. '_' .. rbl.symbol,
        }
      end
      if not rbl.is_whitelist and rbl.ignore_whitelist == false then
        table.insert(black_symbols, rbl.symbol .. '_CHECK')
      end
    else
      id = rspamd_config:register_symbol{
        type = 'callback',
        callback = callback,
        name = rbl.symbol,
        flags = table.concat(flags_tbl, ',')
      }
      if not rbl.is_whitelist and rbl.ignore_whitelist == false then
        table.insert(black_symbols, rbl.symbol)
      end
    end


    rspamd_logger.infox(rspamd_config, 'added rbl rule %s: %s',
        rbl.symbol, description)
    lua_util.debugm(N, rspamd_config, 'rule dump for %s: %s',
        rbl.symbol, rbl)

    if rbl.dkim then
      rspamd_config:register_dependency(rbl.symbol, 'DKIM_CHECK')
    end

    -- Failure symbol
    rspamd_config:register_symbol{
      type = 'virtual,nostat',
      name = rbl.symbol .. '_FAIL',
      parent = id,
      score = 0.0,
    }

    local function process_return_code(suffix)
      local function process_specific_suffix(s)
        if s ~= rbl.symbol then
          -- hack

          rspamd_config:register_symbol{
            type = 'virtual',
            parent = id,
            name = s,
          }
        end
        if rbl.is_whitelist then
          if rbl.whitelist_exception then
            local found_exception = false
            for _, e in ipairs(rbl.whitelist_exception) do
              if e == s then
                found_exception = true
                break
              end
            end
            if not found_exception then
              table.insert(white_symbols, s)
            end
          else
            table.insert(white_symbols, s)
          end
        else
          if rbl.ignore_whitelist == false then
            table.insert(black_symbols, s)
          end
        end
      end

      if rbl.symbols_prefixes then
        for _,prefix in pairs(rbl.symbols_prefixes) do
          process_specific_suffix(prefix .. '_' .. suffix)
        end
      else
        process_specific_suffix(suffix)
      end

    end

    if rbl.returncodes then
      for s,_ in pairs(rbl.returncodes) do
        process_return_code(s)
      end
    end

    if rbl.returnbits then
      for s,_ in pairs(rbl.returnbits) do
        process_return_code(s)
      end
    end

    -- Process monitored
    if not rbl.disable_monitoring then
      if not monitored_addresses[rbl.rbl] then
        monitored_addresses[rbl.rbl] = true
        rbl.monitored = rspamd_config:register_monitored(rbl.rbl, 'dns',
            get_monitored(rbl))
      end
    end
    return true
  end

  return false
end

-- Configuration
local opts = rspamd_config:get_all_opt(N)
if not (opts and type(opts) == 'table') then
  rspamd_logger.infox(rspamd_config, 'Module is unconfigured')
  lua_util.disable_module(N, "config")
  return
end

-- Plugin defaults should not be changed - override these in config
-- New defaults should not alter behaviour
local default_options = {
  ['default_enabled'] = true,
  ['default_ipv4'] = true,
  ['default_ipv6'] = true,
  ['default_received'] = false,
  ['default_from'] = true,
  ['default_unknown'] = false,
  ['default_rdns'] = false,
  ['default_helo'] = false,
  ['default_dkim'] = false,
  ['default_dkim_domainonly'] = true,
  ['default_emails'] = false,
  ['default_urls'] = false,
  ['default_emails_domainonly'] = false,
  ['default_exclude_private_ips'] = true,
  ['default_exclude_users'] = false,
  ['default_exclude_local'] = true,
  ['default_is_whitelist'] = false,
  ['default_ignore_whitelist'] = false,
  ['default_resolve_ip'] = false,
  ['default_no_ip'] = false,
  ['default_images'] = false,
  ['default_replyto'] = false,
  ['default_dkim_match_from'] = false,
}

opts = lua_util.override_defaults(default_options, opts)

if(opts['local_exclude_ip_map'] ~= nil) then
  local_exclusions = lua_maps.map_add(N, 'local_exclude_ip_map', 'radix',
    'RBL exclusions map')
end

local return_codes_schema = ts.map_of(
    ts.string / string.upper, -- Symbol name
    (
        ts.array_of(ts.string) +
            (ts.string / function(s)
              return { s }
            end) -- List of IP patterns
    )
)
local return_bits_schema = ts.map_of(
    ts.string / string.upper, -- Symbol name
    (
        ts.array_of(ts.number + ts.string / tonumber) +
            (ts.string / function(s)
              return { tonumber(s) }
            end) +
            (ts.number / function(s)
              return { s }
            end)
    )
)

local rule_schema_tbl = {
  enabled = ts.boolean:is_optional(),
  disabled = ts.boolean:is_optional(),
  rbl = ts.string,
  selector = ts.string:is_optional(),
  symbol = ts.string:is_optional(),
  returncodes = return_codes_schema:is_optional(),
  return_codes = return_codes_schema:is_optional(),
  returnbits = return_bits_schema:is_optional(),
  return_bits = return_bits_schema:is_optional(),
  whitelist_exception = (
      ts.array_of(ts.string) + (ts.string / function(s) return {s} end)
  ):is_optional(),
  whitelist = lua_maps.map_schema:is_optional(),
  url_compose_map = lua_maps.map_schema:is_optional(),
  local_exclude_ip_map = ts.string:is_optional(),
  hash = ts.one_of{"sha1", "sha256", "sha384", "sha512", "md5", "blake2"}:is_optional(),
  hash_format = ts.one_of{"hex", "base32", "base64"}:is_optional(),
  hash_len = (ts.integer + ts.string / tonumber):is_optional(),
  monitored_address = ts.string:is_optional(),
  requests_limit = (ts.integer + ts.string / tonumber):is_optional(),
  process_script = ts.string:is_optional(),
  emails_delimiter = ts.string:is_optional(),
  ignore_defaults = ts.boolean:is_optional(),
  disable_monitoring = ts.boolean:is_optional(),
  symbols_prefixes = ts.map_of(ts.string, ts.string):is_optional(),
}
-- Add default boolean flags to the schema
for def_k,_ in pairs(default_options) do
  rule_schema_tbl[def_k:sub(#('default_') + 1)] = ts.boolean:is_optional()
end

local rule_schema = ts.shape(rule_schema_tbl)

for key,rbl in pairs(opts.rbls or opts.rules) do
  if type(rbl) ~= 'table' or rbl.disabled == true or rbl.enabled == false then
    rspamd_logger.infox(rspamd_config, 'disable rbl "%s"', key)
  else
    -- Propagate default options from opts to rule
    if not rbl.ignore_defaults then
      for default_opt_key,_ in pairs(default_options) do
        local rbl_opt = default_opt_key:sub(#('default_') + 1)
        if rbl[rbl_opt] == nil then
          rbl[rbl_opt] = opts[default_opt_key]
        end
      end
    end

    if not rbl.requests_limit then
      rbl.requests_limit = rspamd_config:get_dns_max_requests()
    end

    local res,err = rule_schema:transform(rbl)
    if not res then
      rspamd_logger.errx(rspamd_config, 'invalid config for %s: %s, RBL is DISABLED',
          key, err)
    else
      -- Aliases
      if res.return_codes then res.returncodes = res.return_codes end
      if res.return_bits then res.returnbits = res.return_bits end
      add_rbl(key, res, opts)
    end
  end -- rbl.enabled
end

-- We now create two symbols:
-- * RBL_CALLBACK_WHITE that depends on all symbols white
-- * RBL_CALLBACK that depends on all symbols black to participate in depends chains
local function rbl_callback_white(task)
  local whitelisted_elements = {}
  for _, w in ipairs(white_symbols) do
    local ws = task:get_symbol(w)
    if ws and ws[1] then
      ws = ws[1]
      if not ws.options then ws.options = {} end
      for _,opt in ipairs(ws.options) do
        local elt,what = opt:match('^([^:]+):([^:]+)')
        lua_util.debugm(N, task,'found whitelist from %s: %s(%s)', w,
            elt, what)
        if elt and what then
          whitelisted_elements[elt] = what
        end
      end
    end
  end

  task:cache_set('rbl_whitelisted', whitelisted_elements)

  lua_util.debugm(N, task, "finished rbl whitelists processing")
end

local function rbl_callback_fin(task)
  -- Do nothing
  lua_util.debugm(N, task, "finished rbl processing")
end

rspamd_config:register_symbol{
  type = 'callback',
  callback = rbl_callback_white,
  name = 'RBL_CALLBACK_WHITE',
  flags = 'nice,empty,no_squeeze'
}

rspamd_config:register_symbol{
  type = 'callback',
  callback = rbl_callback_fin,
  name = 'RBL_CALLBACK',
  flags = 'empty,no_squeeze'
}

for _, w in ipairs(white_symbols) do
  rspamd_config:register_dependency('RBL_CALLBACK_WHITE', w)
end

for _, b in ipairs(black_symbols) do
  rspamd_config:register_dependency(b, 'RBL_CALLBACK_WHITE')
  rspamd_config:register_dependency('RBL_CALLBACK', b)
end