Vsevolod Stakhov
e50a30ca35
[Minor] Use floating point ts instead of microseconds
2 years ago
Vsevolod Stakhov
52c535ad6a
[Feature] Escape JSON when needed
2 years ago
Vsevolod Stakhov
5a56747242
[Minor] Fix some minor issues
2 years ago
Vsevolod Stakhov
bae5cd020f
[Project] Preliminary support of JSON logging
2 years ago
Vsevolod Stakhov
81412f8b22
[Minor] Update version
2 years ago
Vsevolod Stakhov
23ed02bcac
Release 3.7.3
* [Fix] Emergency fix for the hyperscan path error
2 years ago
Vsevolod Stakhov
ae8621d2fb
[Minor] Really fix the issue
2 years ago
Vsevolod Stakhov
8d70c4a501
[Fix] A workaround for brain-damaged std::filesystem behaviour
Issue: #4665
2 years ago
Vsevolod Stakhov
1112ad8b30
[Minor] Update version
2 years ago
Vsevolod Stakhov
b5bbeaa5d9
Release 3.7.2
* [Feature] rbl: support checking returncodes by CIDR
* [Feature] rbl: support checking returncodes by regex
* [Feature] rbl: support globbed return codes
* [Fix] DMARC reporting: fix reporting for subdomains
* [Fix] Deal with fmtlib exceptions properly
* [Fix] backport fix for dlfcn.h from backward-cpp
* [Rules] Blank spam detection
2 years ago
Vsevolod Stakhov
d2f250ae1e
Merge pull request #4657 from fatalbanana/rbl_matchers
[Feature] rbl: support use of different matchers for return codes
2 years ago
Andrew Lewis
15e3f277fa
[Minor] Reiterate on the previous changes
- Demote message to info level
- Name it returncodes_matcher for better specificity
2 years ago
Vsevolod Stakhov
6491804e19
Merge pull request #4656 from twesterhever/temp-tighten-attachment-policy
Tighten rspamd's attachment policy
2 years ago
Vsevolod Stakhov
b48547358d
Merge pull request #4661 from moisseev/webui
[WebUI] Fix history table vanishing
2 years ago
Andrew Lewis
5ef8dfff5d
[Feature] rbl: support globbed return codes
2 years ago
twesterhever
b135022759
[Minor] Remove duplicate *.app attachment type
Reported by @fatalbanana .
2 years ago
Andrew Lewis
3d17d2d857
[Feature] rbl: support checking returncodes by CIDR
2 years ago
moisseev
95664f9855
[WebUI] Fix history table vanishing
on repeated rows per page input
2 years ago
Vsevolod Stakhov
6b81b812a7
[Minor] Improve diagnostics
2 years ago
twesterhever
15548d3dec
Revert "[Minor] Increase scoring of *.exe attachments"
Reverted based on feedback by @moisseev .
This reverts commit 8171424d84 .
2 years ago
Andrew Lewis
06618f8a52
[Feature] rbl: support checking returncodes by regex
2 years ago
Andrew Lewis
fea6bf4c35
[Minor] rbl: support use of different matchers for return codes
2 years ago
Vsevolod Stakhov
9873ef954f
[Fix] Deal with fmtlib exceptions properly
2 years ago
twesterhever
fab67cebb9
[Minor] Add additional bad attachment types
- app: Executable Application, blocked in Outlook by default
- aspx: Active Server Page Extended, blocked in Outlook by default
- dll: Dynamic-link Library
- dqy: Microsoft Query File, blocking recommended in MS365
- iqy: ditto
- mht: MHTML File, often abused for phishing and exploit attempts
- mhtml: ditto
- oqy: Microsoft Query File, blocking recommended in MS365
- rqy: ditto
- slk: Microsoft Symbolic Link
- wim: Windows Imaging Format
2 years ago
twesterhever
8171424d84
[Minor] Increase scoring of *.exe attachments
These are already banned in most environments, including GMail and
Outlook. We may as well bump this score up to 4 eventually.
2 years ago
twesterhever
e484b311bb
[Minor] Incorporate additional bad attachments from Microsoft
These are as follows:
- htc: HTML Component File
- pyc: Compiled Python Script
- pyo: Optimized Compiled Python Module
- pyw: Python Script To Be Executed With Suppressed Terminal Window
- pyz: Python Zip Application
- pyzw: Python Zip Application
- vhd: Virtual Hard Disk
- vhdx: Virtual Hard Disk Extended
- wsf: Windows Script File
Note that the Python file types remain unscored in archives, so
distribution of these in source tarballs and the like is not affected by
this commit.
Source: https://support.microsoft.com/en-us/office/blocked-attachments-in-outlook-434752e1-02d3-4e90-9124-8b81e49a8519?ui=en-us&rs=en-us&ad=us
2 years ago
twesterhever
7379c8b283
[Minor] Refer to third parties for attachment handling whenever possible
This avoids confusion and enqueries to the rspamd project, if it is made
clear that the decision to score certain attachments high has been
incorporated from a well-known third party, such as Google's or
Microsoft's attachment handling policy.
2 years ago
Vsevolod Stakhov
5c91867091
[Minor] Try to fix ICAP scanners by adding use_specific_content_type parameter
Issue: #4643
2 years ago
Vsevolod Stakhov
48fffd3548
[Minor] Simplify by using <filesystem>
2 years ago
Vsevolod Stakhov
78f91465d1
Merge pull request #4649 from fatalbanana/rspamd_sharedir
[Minor] RSPAMD_SHAREDIR is called SHAREDIR in configuration
2 years ago
Andrew Lewis
9ac6d71006
[Minor] RSPAMD_SHAREDIR is called SHAREDIR in configuration
2 years ago
Vsevolod Stakhov
d6487129d7
Merge pull request #4648 from fatalbanana/luacheck
[Test] Banish luacheck from functional tests
2 years ago
Andrew Lewis
80b0d44da4
[Test] Banish luacheck from functional tests
- Use luacheck from GitLab
2 years ago
Vsevolod Stakhov
d76d9cb4e3
Merge pull request #4587 from fatalbanana/dmarc_subdomains
[Fix] DMARC reporting: fix reporting for subdomains
2 years ago
Andrew Lewis
c1c106a5b1
[Fix] DMARC reporting: fix reporting for subdomains
- Reported by: @bilym
2 years ago
Vsevolod Stakhov
508fe8a626
Merge pull request #4645 from moisseev/webui
[WebUI] Add control to invert action filter
2 years ago
moisseev
c290eece13
[WebUI] Add control to invert action filter
to scan results and history tables
Issue: #4098
2 years ago
Vsevolod Stakhov
d6abbee4d1
[Minor] Do not use `setproctitle` on Linux
Issue: #4634
2 years ago
Vsevolod Stakhov
3f031b071c
Merge pull request #4640 from dzjaivnt/dzjaivnt-patch-1
Dzjaivnt patch 1
2 years ago
Vsevolod Stakhov
452bf19ced
Merge pull request #4642 from twesterhever/temp-cue-attachments
[Minor] Treat *.cue attachments as harmful
2 years ago
Vsevolod Stakhov
e529fac356
Merge pull request #4644 from fatalbanana/blankspam
[Rules] Blank spam detection
2 years ago
Andrew Lewis
c17ffcd4e5
[Rules] Blank spam detection
2 years ago
twesterhever
1840802dbd
[Minor] Treat *.cue attachments as harmful
Rationale: https://arstechnica.com/information-technology/2023/10/one-click-remote-code-exploit-in-cd-cue-files-affects-most-gnome-based-linux-distros/
2 years ago
Vsevolod Stakhov
79edca0b0a
[Minor] Fix build on some systems
2 years ago
Vsevolod Stakhov
81032871e5
Merge pull request #4639 from a16bitsysop/backward
[Minor] Make compiling with backward-cpp optional
2 years ago
dzjaivnt
494078bf59
Update dmarc.lua
With name:
dmarc; dmarc.lua:191: munging debug: {[domain] = domain.tld [flags] = {[valid] = true, [braced] = true}, [name] = Name [domain.tld], [raw] = <user@domain.tld>, [addr] = user@domain.tld, [user] = user}
dmarc; dmarc.lua:234: munged DMARC header for domain.tld: Name [domain.tld] via mark <otheruser@otherdomain.tld> -> user@domain.tld
Without name:
dmarc; dmarc.lua:191: munging debug: {[domain] = domain.tld [flags] = {[valid] = true, [braced] = true}, [name] = , [raw] = <user@domain.tld>, [addr] = user@domain.tld, [user] = user}
dmarc.lua:234: munged DMARC header for domain.tld: user via otheruser <otheruser@otherdomain.tld> -> user@domain.tld
2 years ago
dzjaivnt
4127a61ee7
Update dmarc.lua
When from.name is Nil its still show up, with != "" not
Then you get
From: via user <user@domain.tld>
Instead of
From: otheruser via user <user@domain.tld>
Debug:
2023-10-12 12:08:15 #725504(normal) <0b948d>; dmarc; dmarc.lua:191: munging debug: {[user] = user, [domain] = domain.tld, [flags] = {[valid] = true}, [name] = , [raw] = user@domain.tld, [addr] = user@domain.tld}
2 years ago
Duncan Bellamy
112bedbaa9
[Fix] backport fix for dlfcn.h from backward-cpp
65fc89e210
backport fix for powerpc as well
4bec538c99
2 years ago
Duncan Bellamy
6d16d5e9ef
[Minor] Make compiling with backward-cpp optional
2 years ago
dzjaivnt
a6bd9c893a
Update dmarc.lua
Debug logs where broken, so muning functionality not working at all.
2 years ago