Rspamd doesn't rewrite subject with getmail

[stephdl]

Steps to reproduce

• Install nethserver-mail2-getmail & nethserver-mail2-filter
• configure to retrieve email from a remote account with pop or imap
• activate to filter email with antispam
• email tagged as spam (score over spam threshold) have not the subject rewritten
• email are not moved to junk if enabled
• email are not rejected by rspamd if the score exceed the reject maximum score

Expected behavior

I expect the email could have the subject rewritten/moved to junk or to be rejected if the scores are exceeded.

Actual behavior

The documentation of rspamd states clearly in https://rspamd.com/doc/integration.html#lda-mode

In this mode, rspamc cannot reject or greylist messages, but it appends the following headers that can be used for further filtering by means of the LDA (for example, sieve or procmail):

In fact rspamd marks the email in the header with but does nothing more, we must use sieve with a script in before.sieve

the new tags in the header are

X-getmail-filter-classifier: Action: greylist -> proposal: we do nothing
X-getmail-filter-classifier: Action: no action -> email is good, go to in box
X-getmail-filter-classifier: Action: add header -> this spam must go to junkmail if enabled
X-getmail-filter-classifier: Action: rewrite subject -> this spam must be subject rewritten  and go to junk if enabled
X-getmail-filter-classifier: Action: reject -> this spam should not go to inbox

In the case reject we have two possibilities with sieve, either reject (reject email with error message) or discard (reject silently) which makes a better sense for me. Why to answer to a remote imap/pop server . The prudent approach could be move to junk, the email would be never lost.

one idea of what will be the sieve script is : https://gist.github.com/stephdl/6df6a1ff271ed5d0f32da1829b8c04b5

Components

nethserver-mail2-common-2.2.7-1.ns7.noarch
nethserver-mail2-disclaimer-2.2.7-1.ns7.noarch
nethserver-mail2-server-2.2.7-1.ns7.noarch
nethserver-mail2-filter-2.2.7-1.ns7.noarch
nethserver-mail2-getmail-2.2.7-1.ns7.noarch

See also

https://community.nethserver.org/t/getmail-spam-subject-is-not-rewritten-with-rspamd/10561/1

---

thank thorsen

[DavidePrincipi]

The getmail configuration was fixed by #5513. It adds an rspamc wrapper script that does the Filter_classifier job.

As we need to alter the message headers to retain backward compatibility with Amavisd, Filter_external seems more appropriate IMO. I want to check it out: I'll report back here.

[DavidePrincipi]

It seems Rspamd does not rewrite the subject when invoked as rspamc --mime. It only appends the X-Spam-* headers.

So, if we go with Filter_external, we have to rewrite the Subject header by hand. I think it can be possible to prefix our *** SPAM *** ASCII string to the Subject value, without breaking RFC2047 syntax.

I prefer the Filter_external solution because it is self-contained as a getmail Bash helper. We need to modify the existing wrapper. A PR is coming.

[stephdl]

@DavidePrincipi let me this issue for me, I would like to fix it

[nethbot]

in 7.5.1804/testing:

• nethserver-mail2-common-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-disclaimer-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-filter-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-getmail-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-ipaccess-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-p3scan-2.2.8-1.2.g16733b7.ns7.noarch.rpm
• nethserver-mail2-server-2.2.8-1.2.g16733b7.ns7.noarch.rpm

[nethbot]

in 7.5.1804/testing:

• nethserver-mail2-common-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-disclaimer-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-filter-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-getmail-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-ipaccess-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-p3scan-2.2.8-1.3.g2714ef8.ns7.noarch.rpm
• nethserver-mail2-server-2.2.8-1.3.g2714ef8.ns7.noarch.rpm

[stephdl]

QA

install from nethserver-testing
yum install nethserver-mail2-common nethserver-mail2-filter nethserver-mail2-getmail nethserver-mail2-server --enablerepo=nethserver-testing

• configure with getmail to retrieve a remote email account to a local email account

• check Scan messages with email filter

• email higher than the Deny message spam threshold will be rejected silently

• email higher than the Spam threshold will be moved to spam if enabled Move to "Junk" folder.If the Move to "Junk" folder is not enabled, this spam is delivery to INBOX

• email higher than the Spam threshold will have the subject renamed with the spam prefix (default is ***SPAM***) if enabled Add a prefix to spam messages subject. If the Move to "Junk" folder is not enabled, this spam is delivery to INBOX

• other email (no action or greylisting) will be delivered in INBOX

Tricks

See the maillog output of different cases (grey listing, no action, add header, rewrite rule, reject)
https://gist.github.com/stephdl/05dd2239ea094e3a7c0c3bc6cd124816

You can check the email code source and find this output

X-Spam-Scanner: rspamc 1.7.9
X-Spam-Scan-Time: 0.132
X-Spam: yes     # rspamd tag for spam
X-Spam-Action: add header # could be no action, greylisting, rewrite subject, reject is impossible 
X-Spam-Score: 12.19 / 19.90
X-Spam-Level: *************
X-Spam-Symbols: R_SUSPICIOUS_URL,
	R_DKIM_ALLOW,
	FROM_HAS_DN,
	FREEMAIL_ENVRCPT,
	TAGGED_RCPT,
	MIME_GOOD,
	TO_DN_NONE,
	URIBL_GREY,
	URI_COUNT_ODD,
	RCPT_COUNT_ONE,
	RCVD_COUNT_THREE,
	DMARC_NA,
	DKIM_TRACE,
	MX_GOOD,
	FREEMAIL_TO,
	RCVD_NO_TLS_LAST,
	MID_RHS_NOT_FQDN,
	DATE_IN_PAST,
	FROM_NEQ_ENVFROM,
	HFILTER_HOSTNAME_UNKNOWN

you can launch manually the cron job, check cat /etc/cron.d/getmail and remove --quiet at the end of line

[nethbot]

in 7.5.1804/testing:

• nethserver-mail2-common-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-disclaimer-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-filter-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-getmail-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-ipaccess-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-p3scan-2.2.8-1.4.g369d380.ns7.noarch.rpm
• nethserver-mail2-server-2.2.8-1.4.g369d380.ns7.noarch.rpm