rspamd: add Reply-To rules for sender blacklist

Author: jnorell

install/tpl/rspamd_force_actions.conf.master

@@ -1,12 +1,15 @@
 rules {
 
+  # ISPConfig whitelist/blacklist passthrough actions
+  # (always combine authentication tests (dkim/spf) with sender whitelisting).
+
   ISPC_WHITELIST_SENDER {
     expression = "(ISPC_WHITELIST_ENVFROM and (R_DKIM_ALLOW or R_SPF_ALLOW)) or (ISPC_WHITELIST_FROM and R_DKIM_ALLOW) and !CLAM_VIRUS and !JUST_EICAR";
     action = "no action";
   }
 
   ISPC_BLACKLIST_SENDER {
-    expression = "(ISPC_BLACKLIST_FROM or ISPC_BLACKLIST_FROM_DOMAIN) and R_DKIM_ALLOW and !ISPC_WHITELIST_SENDER and !ISPC_WHITELIST_SENDER_DOMAIN and !ISPC_WHITELIST_RECIPIENT";
+    expression = "(ISPC_BLACKLIST_FROM or ISPC_BLACKLIST_FROM_DOMAIN or ISPC_BLACKLIST_REPLYTO or ISPC_BLACKLIST_REPLYTO_DOMAIN) and !ISPC_WHITELIST_SENDER and !ISPC_WHITELIST_SENDER_DOMAIN and !ISPC_WHITELIST_RECIPIENT";
     action = "reject";
   }
 
@@ -15,6 +18,8 @@ rules {
     action = "no action";
   }
 
+  # test multiple recipients, does forced action only apply to the whitelisted recipient or all?
+  # if all, combine this with RCPT_COUNT_ONE
   ISPC_WHITELIST_RECIPIENT {
     expression = "ISPC_WHITELIST_ENVRCPT and !CLAM_VIRUS and !JUST_EICAR";
     action = "no action";

install/tpl/rspamd_multimap.conf.master

@@ -69,6 +69,26 @@ ISPC_BLACKLIST_FROM_DOMAIN {
   score = 12.0;
 }
 
+ISPC_BLACKLIST_REPLYTO {
+  group = "ISPConfig";
+  description = "Reply-To: header address in sender blacklist.";
+  type = "header";
+  header = "Reply-To";
+  filter = "email";
+  map = [ "$LOCAL_CONFDIR/local.d/maps.d/sender_blacklist.inc.ispc", "$LOCAL_CONFDIR/local.d/maps.d/sender_blacklist.inc.local" ];
+  score = 12.0;
+}
+
+ISPC_BLACKLIST_REPLYTO_DOMAIN {
+  group = "ISPConfig";
+  description = "Reply-To: header domain in sender blacklist.";
+  type = "header";
+  header = "Reply-To";
+  filter = "email:domain";
+  map = [ "$LOCAL_CONFDIR/local.d/maps.d/sender_domain_blacklist.inc.ispc", "$LOCAL_CONFDIR/local.d/maps.d/sender_domain_blacklist.inc.local" ];
+  score = 12.0;
+}
+
 # Reminder: test if whitelisted sender bypasses dkim signing for sender
 # Reminder: test if whitelisted recipient address bypasses dkim signing for sender