Adding upstream version 3.8.1.upstream/3.8.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 347 insertions, 0 deletions

diff --git a/conf/modules.d/rbl.conf b/conf/modules.d/rbl.conf
new file mode 100644
index 0000000..79dfc84
--- /dev/null
+++ b/conf/modules.d/rbl.conf
@@ -0,0 +1,347 @@
+# Please don't modify this file as your changes might be overwritten with
+# the next update.
+#
+# You can modify 'local.d/rbl.conf' to add and merge
+# parameters defined inside this section
+#
+# You can modify 'override.d/rbl.conf' to strictly override all
+# parameters defined inside this section
+#
+# See https://rspamd.com/doc/faq.html#what-are-the-locald-and-overrided-directories
+# for details
+#
+# Module documentation can be found at  https://rspamd.com/doc/modules/rbl.html
+
+rbl {
+  default_exclude_users = true;
+  default_unknown = true;
+
+  url_whitelist = [
+    "https://maps.rspamd.com/rspamd/surbl-whitelist.inc.zst",
+    "$LOCAL_CONFDIR/local.d/maps.d/surbl-whitelist.inc.local",
+    "${DBDIR}/surbl-whitelist.inc.local",
+    "fallback+file://${CONFDIR}/maps.d/surbl-whitelist.inc"
+  ];
+
+  attached_maps = [
+    {
+      selector_alias = "surbl_hashbl_map",
+      description = "SURBL hashbl map",
+      url = "regexp;http://sa-update.surbl.org/rspamd/surbl-hashbl-map.inc",
+    }
+  ]
+
+  rbls {
+
+    spamhaus {
+      symbol = "SPAMHAUS"; # Augmented by prefixes
+      rbl = "zen.spamhaus.org";
+      # Check types
+      checks = ['received', 'from'];
+
+      symbols_prefixes = {
+        received = 'RECEIVED',
+        from = 'RBL',
+      }
+      returncodes {
+        SPAMHAUS_SBL = "127.0.0.2";
+        SPAMHAUS_CSS = "127.0.0.3";
+        SPAMHAUS_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"];
+        SPAMHAUS_PBL = ["127.0.0.10", "127.0.0.11"];
+        SPAMHAUS_DROP = "127.0.0.9";
+        SPAMHAUS_BLOCKED_OPENRESOLVER = "127.255.255.254";
+        SPAMHAUS_BLOCKED= "127.255.255.255";
+      }
+    }
+
+    mailspike {
+      symbol = "MAILSPIKE";
+      rbl = "rep.mailspike.net";
+      is_whitelist = true;
+      checks = ['from'];
+      whitelist_exception = "MAILSPIKE";
+      whitelist_exception = "RWL_MAILSPIKE_GOOD";
+      whitelist_exception = "RWL_MAILSPIKE_NEUTRAL";
+      whitelist_exception = "RWL_MAILSPIKE_POSSIBLE";
+      whitelist_exception = "RBL_MAILSPIKE_WORST";
+      whitelist_exception = "RBL_MAILSPIKE_VERYBAD";
+      whitelist_exception = "RBL_MAILSPIKE_BAD";
+      returncodes {
+        RBL_MAILSPIKE_WORST = "127.0.0.10";
+        RBL_MAILSPIKE_VERYBAD = "127.0.0.11";
+        RBL_MAILSPIKE_BAD = "127.0.0.12";
+        RWL_MAILSPIKE_NEUTRAL = ["127.0.0.16", "127.0.0.15", "127.0.0.14", "127.0.0.13"];
+        RWL_MAILSPIKE_POSSIBLE = "127.0.0.17";
+        RWL_MAILSPIKE_GOOD = "127.0.0.18";
+        RWL_MAILSPIKE_VERYGOOD = "127.0.0.19";
+        RWL_MAILSPIKE_EXCELLENT = "127.0.0.20";
+      }
+    }
+
+    senderscore {
+      symbol = "RBL_SENDERSCORE";
+      checks = ['from'];
+      rbl = "bl.score.senderscore.com";
+    }
+
+    sem {
+      symbol = "RBL_SEM";
+      rbl = "bl.spameatingmonkey.net";
+      ipv6 = false;
+      checks = ['from'];
+    }
+
+    semIPv6 {
+      symbol = "RBL_SEM_IPV6";
+      rbl = "bl.ipv6.spameatingmonkey.net";
+      ipv4 = false;
+      ipv6 = true;
+      checks = ['from'];
+    }
+
+    dnswl {
+      symbol = "RCVD_IN_DNSWL";
+      rbl = "list.dnswl.org";
+      ipv6 = true;
+      checks = ['from', 'received'];
+      is_whitelist = true;
+      returncodes_matcher = "luapattern";
+      whitelist_exception = "RCVD_IN_DNSWL";
+      whitelist_exception = "RCVD_IN_DNSWL_NONE";
+      whitelist_exception = "RCVD_IN_DNSWL_LOW";
+      whitelist_exception = "DNSWL_BLOCKED";
+      returncodes {
+        RCVD_IN_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"];
+        RCVD_IN_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"];
+        RCVD_IN_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"];
+        RCVD_IN_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"];
+        DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"];
+      }
+    }
+
+    # Provided by https://virusfree.cz
+    virusfree {
+      symbol = "RBL_VIRUSFREE_UNKNOWN";
+      rbl = "bip.virusfree.cz";
+      ipv6 = true;
+      checks = ['from'];
+      returncodes {
+        RBL_VIRUSFREE_BOTNET = "127.0.0.2";
+      }
+    }
+
+    nixspam {
+      symbol = "RBL_NIXSPAM";
+      rbl = "ix.dnsbl.manitu.net";
+      ipv6 = true;
+      checks = ['from'];
+    }
+
+    blocklistde {
+      symbols_prefixes = {
+        received = 'RECEIVED',
+        from = 'RBL',
+      }
+      symbol = "BLOCKLISTDE";
+      rbl = "bl.blocklist.de";
+      checks = ['from', 'received'];
+    }
+
+    # Dkim whitelist
+    dnswl_dwl {
+      symbol = "DWL_DNSWL";
+      rbl = "dwl.dnswl.org";
+      checks = ['dkim'];
+      ignore_whitelist = true;
+      returncodes_matcher = "luapattern";
+      unknown = false;
+
+      returncodes {
+        DWL_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"];
+        DWL_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"];
+        DWL_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"];
+        DWL_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"];
+        DWL_DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"];
+      }
+    }
+
+    RSPAMD_EMAILBL {
+      ignore_whitelist = true;
+      ignore_url_whitelist = true;
+      ignore_defaults = true;
+      exclude_users = false;
+      emails_delimiter = ".";
+      hash_format = "base32";
+      hash_len = 32;
+      rbl = "email.rspamd.com";
+      checks = ['emails', 'replyto'];
+      hash = "blake2";
+      returncodes = {
+        RSPAMD_EMAILBL = "127.0.0.2";
+      }
+    }
+
+    MSBL_EBL {
+      ignore_whitelist = true;
+      ignore_url_whitelist = true;
+      ignore_defaults = true;
+      exclude_users = false;
+      rbl = "ebl.msbl.org";
+      checks = ['emails', 'replyto'];
+      emails_domainonly = false;
+      hash = "sha1";
+      returncodes = {
+        MSBL_EBL = [
+          "127.0.0.2",
+          "127.0.0.3"
+        ];
+        MSBL_EBL_GREY = [
+          "127.0.1.2",
+          "127.0.1.3"
+        ];
+      }
+    }
+
+    "SURBL_MULTI" {
+      ignore_defaults = true;
+      rbl = "multi.surbl.org";
+      checks = ['emails', 'dkim', 'helo', 'rdns', 'replyto', 'urls'];
+      emails_domainonly = true;
+      exclude_users = false;
+
+      returnbits = {
+        CRACKED_SURBL = 128;
+        ABUSE_SURBL = 64;
+        MW_SURBL_MULTI = 16;
+        PH_SURBL_MULTI = 8;
+        SURBL_BLOCKED = 1;
+      }
+    }
+
+    SURBL_HASHBL {
+      rbl = "hashbl.surbl.org";
+      ignore_defaults = true;
+      random_monitored = true,
+      # TODO: make limit more configurable maybe?
+      selector = "specific_urls_filter_map('surbl_hashbl_map', {limit = 10}).apply_methods('get_host', 'get_path').join_tables('/')",
+      hash = 'md5';
+      hash_len = 32;
+      returncodes_matcher = "luapattern";
+      returncodes = {
+        SURBL_HASHBL_PHISH = "127.0.0.8";
+        SURBL_HASHBL_MALWARE = "127.0.0.16";
+        SURBL_HASHBL_ABUSE = "127.0.0.64";
+        SURBL_HASHBL_CRACKED = "127.0.0.128";
+        SURBL_HASHBL_EMAIL = "127.0.1.%d+";
+      }
+    }
+
+    "URIBL_MULTI" {
+      ignore_defaults = true;
+      rbl = "multi.uribl.com";
+      checks = ['emails', 'dkim', 'helo', 'rdns', 'replyto', 'urls'];
+      emails_domainonly = true;
+      exclude_users = false;
+
+      returnbits {
+        URIBL_BLOCKED = 1;
+        URIBL_BLACK = 2;
+        URIBL_GREY = 4;
+        URIBL_RED = 8;
+      }
+    }
+
+    "RSPAMD_URIBL" {
+      ignore_defaults = true;
+      rbl = "uribl.rspamd.com";
+      checks = ['emails', 'dkim', 'urls'];
+      emails_domainonly = true;
+      hash = 'blake2';
+      hash_len = 32;
+      hash_format = 'base32';
+      exclude_users = false;
+
+      returncodes = {
+        RSPAMD_URIBL = [
+          "127.0.0.2",
+        ];
+      }
+    }
+
+    "DBL" {
+      ignore_defaults = true;
+      rbl = "dbl.spamhaus.org";
+      no_ip = true;
+      checks = ['emails', 'dkim', 'helo', 'rdns', 'replyto', 'urls'];
+      emails_domainonly = true;
+      exclude_users = false;
+
+      returncodes = {
+        # spam domain
+        DBL_SPAM = "127.0.1.2";
+        # phish domain
+        DBL_PHISH = "127.0.1.4";
+        # malware domain
+        DBL_MALWARE = "127.0.1.5";
+        # botnet C&C domain
+        DBL_BOTNET = "127.0.1.6";
+        # abused legit spam
+        DBL_ABUSE = "127.0.1.102";
+        # abused spammed redirector domain
+        DBL_ABUSE_REDIR = "127.0.1.103";
+        # abused legit phish
+        DBL_ABUSE_PHISH = "127.0.1.104";
+        # abused legit malware
+        DBL_ABUSE_MALWARE = "127.0.1.105";
+        # abused legit botnet C&C
+        DBL_ABUSE_BOTNET = "127.0.1.106";
+        # error - IP queries prohibited!
+        DBL_PROHIBIT = "127.0.1.255";
+        # issue #3074
+        DBL_BLOCKED_OPENRESOLVER = "127.255.255.254";
+        DBL_BLOCKED = "127.255.255.255";
+      }
+    }
+
+    # Not enabled by default due to privacy concerns! (see also groups.d/surbl_group.conf)
+    "SPAMHAUS_ZEN_URIBL" {
+      enabled = false;
+      rbl = "zen.spamhaus.org";
+      checks = ['emails'];
+      resolve_ip = true;
+      returncodes = {
+        URIBL_SBL = "127.0.0.2";
+        URIBL_SBL_CSS = "127.0.0.3";
+        URIBL_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"];
+        URIBL_PBL = ["127.0.0.10", "127.0.0.11"];
+        URIBL_DROP = "127.0.0.9";
+      }
+    }
+
+    "SEM_URIBL_UNKNOWN" {
+      ignore_defaults = true;
+      rbl = "uribl.spameatingmonkey.net";
+      no_ip = true;
+      checks = ['emails', 'dkim', 'urls'];
+      emails_domainonly = true;
+      returnbits {
+        SEM_URIBL = 2;
+      }
+    }
+
+    "SEM_URIBL_FRESH15_UNKNOWN" {
+      ignore_defaults = true;
+      rbl = "fresh15.spameatingmonkey.net";
+      no_ip = true;
+      checks = ['emails', 'dkim', 'urls'];
+      emails_domainonly = true;
+      returnbits {
+        SEM_URIBL_FRESH15 = 2;
+      }
+    }
+  }
+
+  .include(try=true,priority=5) "${DBDIR}/dynamic/rbl.conf"
+  .include(try=true,priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/rbl.conf"
+  .include(try=true,priority=10) "$LOCAL_CONFDIR/override.d/rbl.conf"
+}