Use of want_spam & actions (wblist) in rspamd yields unexpected results
Summary
User Block-/Allowlist config is generated with both "actions" and "want_spam" present.
The usage of "actions" renders "want_spam" obsolete und does not honor the function that "want_spam" is supposed to provide.
If "want_spam" is used rspamd is supposed to skip the evaluation of an email. The resulting config might provide the expected result because of "actions", but it still adds the "X-Spamd-Bar" header, which is unwanted behaviour because the header might be used in sieve rules and therefore should not be present (or at least present without a value) on emails that are handled by an entry in the allowlist.
Steps to reproduce
Using the stock template (slightly modified to also match the from header):
spamfilter_wblist-2046 {
priority = 26;
from = "sender@domain.tld";
rcpt = "recipient@domain.tld";
want_spam = yes;
apply {
actions {
reject = null;
"add header" = null;
greylist = null;
"rewrite subject" = null;
}
}
}
spamfilter_wblist-2046.2 {
priority = 26;
mime_from = "sender@domain.tld";
rcpt = "recipient@domain.tld";
want_spam = yes;
apply {
actions {
reject = null;
"add header" = null;
greylist = null;
"rewrite subject" = null;
}
}
}
the following is logged by rspamd:
2021-07-12 11:03:46 #930(normal) <24ddc3>; task; rspamd_task_write_log: id: <CAP03e=xDdfHS_j7N=7JdzSrOc3fiXA2Efk+oumGrzZ9ugWEwHw@mail.domain.tld>, qid: <4698E3BE9D>, ip: 209.85.160.171, from: <sender@domain.tld>, (default: F (no action): [-0.51/nan] [DMARC_POLICY_ALLOW(-0.50){domain.tld;none;},R_PARTS_DIFFER(0.50){100.0%;},R_DKIM_ALLOW(-0.20){domain.tld:s=20161025;},R_SPF_ALLOW(-0.20){+ip4:209.85.128.0/17;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},MX_GOOD(-0.01){},ALREADY_AV_CHECKED(0.00){},ARC_NA(0.00){},ASN(0.00){asn:15169, ipnet:209.85.128.0/17, country:US;},DKIM_TRACE(0.00){domain.tld:+;},FREEMAIL_ENVFROM(0.00){domain.tld;},FREEMAIL_FROM(0.00){domain.tld;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},MID_RHS_MATCH_FROMTLD(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},PREVIOUSLY_DELIVERED(0.00){recipient@domain.tld;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_TWO(0.00){2;},RCVD_TLS_ALL(0.00){},SENDER_REP_HAM(0.00){asn: 15169(-0.19), country: US(-0.00), ip: 0.0.0.0(-0.50);},TO_DN_ALL(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){},USER_REJECTS_BLACKLISTED_FILES(0.00){recipient@domain.tld;}]), len: 2555, time: 775.295ms, dns req: 21, digest: <4915ae6bed441b333c191c11653f0540>, rcpts: <recipient@domain.tld>, mime_rcpts: <recipient@domain.tld>, settings_id: spamfilter_wblist-2046.2
Correct behaviour
Skip evaluation of an email immediately.
Using a config without the actions stanza
spamfilter_wblist-2046 {
priority = 26;
from = "sender@domain.tld";
rcpt = "recipient@domain.tld";
want_spam = yes;
}
spamfilter_wblist-2046.2 {
priority = 26;
mime_from = "sender@domain.tld";
rcpt = "recipient@domain.tld";
want_spam = yes;
}
the following is logged:
2021-07-12 11:04:44 #1587(normal) <7a17ab>; task; rspamd_task_write_log: id: <CAP03e=wRW8By+3ONS3BcpcFF=EHqP0Ja9SpDV0gBqubzt2FiMQ@mail.domain.tld>, qid: <BCD863BFA5>, ip: 209.85.219.51, from: <sender@domain.tld>, (default: S (no action): [0.00/15.00] []), len: 2548, time: 1.217ms, dns req: 0, digest: <5eb295da1042112a088cf8f7958bcbe6>, rcpts: <recipient@domain.tld>, mime_rcpts: <recipient@domain.tld>, settings_id: spamfilter_wblist-2046.2
Therefore the evaluation is immediately skipped.
Environment
OS: irrelevant
ISPConfig up to 3.2.5.
Proposed fix
Remove "actions from the "rspamd_wblist.inc.conf.master" template.
(And add a second entry to match the "From header" - I already proposed that in #5419)