]> git.ipfire.org Git - thirdparty/rspamd.git/commit
[Feature] Add URL deep processing architecture
authorVsevolod Stakhov <vsevolod@rspamd.com>
Fri, 14 Nov 2025 12:27:21 +0000 (12:27 +0000)
committerVsevolod Stakhov <vsevolod@rspamd.com>
Fri, 14 Nov 2025 12:27:21 +0000 (12:27 +0000)
commit8392a71f22770dfbd82a3f7085d71712aaed34d4
tree5ca899ce1e6efa32c8051b461daf8599e62e193f
parent75534c42be3617cce9412e6c15e20d984c50bc57
[Feature] Add URL deep processing architecture

This commit implements a two-level URL processing system that addresses
issue #5731 and provides flexible URL analysis with multiple specific symbols.

Core changes:
* Modified src/libserver/url.c to handle oversized user fields (fixes #5731)
* Added lualib/lua_url_filter.lua - Fast library filter during parsing
* Added src/plugins/lua/url_suspect.lua - Deep inspection plugin
* Added conf/modules.d/url_suspect.conf - Plugin configuration
* Added conf/scores.d/url_suspect_group.conf - Symbol scores

Key features:
* No new C flags - uses existing URL flags (has_user, numeric, obscured, etc.)
* Works without maps - built-in logic for common cases
* 15+ specific symbols instead of generic R_SUSPICIOUS_URL
* Backward compatible - keeps R_SUSPICIOUS_URL working
* User extensible - custom filters and checks supported

Optional features:
* Example map files for advanced customization (disabled by default)
* Whitelist, pattern matching, TLD lists

Issue: #5731
conf/maps.d/url_suspect/README.md [new file with mode: 0644]
conf/maps.d/url_suspect/suspicious_ports.map.example [new file with mode: 0644]
conf/maps.d/url_suspect/suspicious_tlds.map.example [new file with mode: 0644]
conf/maps.d/url_suspect/user_patterns.map.example [new file with mode: 0644]
conf/maps.d/url_suspect/whitelist_domains.map.example [new file with mode: 0644]
conf/modules.d/url_suspect.conf [new file with mode: 0644]
conf/scores.d/url_suspect_group.conf [new file with mode: 0644]
local.d/url_filter.lua [new file with mode: 0644]
lualib/lua_url_filter.lua [new file with mode: 0644]
src/libserver/url.c
src/plugins/lua/url_suspect.lua [new file with mode: 0644]