Interpret existing symbols in own lua code

114 views
Skip to first unread message

Jochen F.

unread,
Sep 23, 2018, 2:17:34 AM9/23/18
to rspamd
Hi,
I found that many spam, that cannot be rejected by postscreen and rbls, has a unique feature: they are sent through freemailers (mainly gmail in my case) with a freemail From: and a different freemail Reply-To:

So I wrote my own lua rule to compare From: and Reply-To: addresses. The function FREEMAIL_REPLYTO_NEQ_FROM_DOM does a similar thing, but only compares the domain, not the entire address. Inspired by that I wrote a similar function:

-- Requires freemail maps loaded in multimap
local function freemail_reply_neq_from_addr(task)
 
local frt = task:get_symbol('FREEMAIL_REPLYTO')
 
local ff  = task:get_symbol('FREEMAIL_FROM')
 
local reply_to = task:get_header('Reply-To')
 
local mail_from = task:get_from()
 
if (frt and ff and reply_to ~= mail_from)
 
then
   
return true
 
end
 
return false
end




rspamd_config
:register_symbol({
  name
= 'FREEMAIL_REPLYTO_NEQ_FROM',
  callback
= freemail_reply_neq_from_addr,
  description
= 'Freemail From and Reply-To, but to different Freemail addresses',
  score
= 10.0,
 
group = 'headers',
})
rspamd_config
:register_dependency('FREEMAIL_REPLYTO_NEQ_FROM', 'FREEMAIL_REPLYTO')
rspamd_config
:register_dependency('FREEMAIL_REPLYTO_NEQ_FROM', 'FREEMAIL_FROM')


But I'm asking me, if I could not get the Reply-To-address from the HAS_REPLYTO symbol the same way like the "task:get_symbol('FREEMAIL_REPLYTO')"? I don't know what the "task:get_header('Reply-To')" exactly returns. Propably it will also contain a display name if there, but I need the native mail address for the compare.

Is it possible to get the mail address form the FREEMAIL_REPLYTO symbol? How? How must the code rewritten?
Reply all
Reply to author
Forward
0 new messages