Rspamd: whitelist/blacklist enhancement #5940
Labels
verified
All test cases were verified successfully
Comments
|
Added section Docs changes
|
stephdl
added a commit
to NethServer/nethserver-mail
that referenced
this issue
Nov 22, 2019
Whitelist/Blacklist sub.domain and domain NethServer/dev#5940
|
in
|
|
QA The
you can trigger manually email with curl |
|
Testing cases (1-3):
|
|
Testing cases (4-6):
|
|
Tested and verified. |
|
thank @federicoballarini I really appreciated you job |
DavidePrincipi
removed
the
testing
|
in
|
stephdl
added
testing
DavidePrincipi
removed
the
testing
|
NOT VERIFIED It seems the pre-filter symbols are evaluated in the same order provided by --- rules.old 2019-11-26 16:27:27.005235429 +0100
+++ rules.new 2019-11-26 16:27:35.413229327 +0100
@@ -1,7 +1,10 @@
TO_DOMAINS_WHITELIST {
+ FROM_SUBDOMAINS_WHITELIST {
+ TO_SUBDOMAINS_WHITELIST {
FROM_BLACKLIST {
FROM_WHITELIST {
IP_WHITELIST {
FROM_DOMAINS_BLACKLIST {
+ FROM_SUBDOMAINS_BLACKLIST {
FROM_DOMAINS_WHITELIST {
TO_WHITELIST {An element falling into It seems we have no control over rules priority. We could ask Rspamd developers for that. Furthermore I expect the Blocks #5951 |
|
issue done upstream rspamd/rspamd#3165 |
|
in
|
Closed
|
in
|
|
in
|
|
in
|
DavidePrincipi
added a commit
to NethServer/nethserver-mail
that referenced
this issue
Dec 6, 2019
Avoid rule evaluation order conflicts - Evaluate sender blacklist later in filter stage - Eval domain matches with and without :tld filter - Start Bayes autolearn only if the score is out of the static range [-5,25], to avoid spam training with a good message just hitting FROM_BLACKLIST NethServer/dev#5940
|
in
|
|
Useful QA commands Inspect currently expanded whitelist and blacklist rules: Sample curl invocation Test case 0 - sender blacklist
Test case 1 - sender whitelist vs sender blacklist With the blacklist from test case 0:
Test case 2 - recipient whitelist vs sender blacklist Check that by setting a recipient whitelist rule it always wins against the blacklist sender rule. Test case 3 - IP whitelist vs sender blacklist Check that by setting an IP client whitelist in Relay > Configuration > |
|
QA FAILED you can find the QA LOG at https://gist.github.com/stephdl/c8eeb58f2e11ed66847e9cb6cb6b6cce for me the QA has failed, even if the blacklist/whitelist works, because when you blacklist a domain.org you find two symbols (domains and subdomains), when you whitelist a domain.org you match the symbol of the sub.domain.org I did a PR to use only one symbol, whether you match a domain.org or a sub.domain.org |
stephdl
added a commit
to NethServer/nethserver-mail
that referenced
this issue
Dec 6, 2019
Same symbol for domain|sub.domain WL|BL NethServer/dev#5940
|
in
|
|
Test case 4 Check the
The maillog must not match any of |
|
QA FAILED The maps for domain_blacklist & domain_whitelist doesn't work anymore because the symbol is already registered for sub_domain_blacklist & sub_domain_whitelist in short the maps for sub_domain{blacklist,whitelist} are workable because first declared, but domains map are broken |
|
in
|
|
Go back to QA installed rpm
but something fun if I set a SenderWhiteList the IP map is no more matched |
|
set verified |
stephdl
added
verified
|
in
|
|
TODO: PR for admin's manual |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The whitelist/blacklist of rspamd is designed to work with the second domain level, eg
domain.org, so you blacklist or whitelist the domain and all subdomains:email:domain:tldhttps://rspamd.com/doc/modules/multimap.html#from-rcpt-and-header-filters
However when you try to blacklist/whitelist a subdomain, it won't work because rspamd extracts only the second level of the domain name
Proposed solution
In rules evaluation, try to match both the eSLD (effective second level domain - rspamd
:tldfilter) and the whole domain suffix against the email address of the sender/recipient.Whitelist rules are always processed before the blacklist, thus allowing a subdomain (e.g. myhost.domain.com) to be whitelisted if a more generic rule wants to blacklist the entire domain (e.g. domain.com).
Docs changes
Alternative solutions
as an alternative we could make a validator and refuse subdomain, asking or top level domain
See also
https://community.nethserver.org/t/whitelist-in-mail-server-not-working/13911/
thank jfernandez
The text was updated successfully, but these errors were encountered: