From 23ae0c3cc191ed54c224ab11f7397346dd8df33f Mon Sep 17 00:00:00 2001
From: andryyy <andre.peters@debinux.de>
Date: Wed, 28 Aug 2019 13:03:15 +0200
Subject: [PATCH] [Rspamd] Filter 'em bad words from 'em bad tlds

---
 data/conf/rspamd/custom/bad_words.map    | 18 ++++++
 data/conf/rspamd/custom/fishy_tlds.map   | 75 ++++++++++++++++++++++++
 data/conf/rspamd/local.d/composites.conf |  5 ++
 data/conf/rspamd/local.d/multimap.conf   | 17 ++++++
 4 files changed, 115 insertions(+)
 create mode 100644 data/conf/rspamd/custom/bad_words.map
 create mode 100644 data/conf/rspamd/custom/fishy_tlds.map

diff --git a/data/conf/rspamd/custom/bad_words.map b/data/conf/rspamd/custom/bad_words.map
new file mode 100644
index 00000000..2c46c728
--- /dev/null
+++ b/data/conf/rspamd/custom/bad_words.map
@@ -0,0 +1,18 @@
+sex
+vagina
+erotic
+erection
+sexy
+penis
+ass
+viagra
+tits
+titty
+titties
+cum
+sperm
+slut
+porn
+cock
+pharma
+pharmacy
diff --git a/data/conf/rspamd/custom/fishy_tlds.map b/data/conf/rspamd/custom/fishy_tlds.map
new file mode 100644
index 00000000..9e5be83d
--- /dev/null
+++ b/data/conf/rspamd/custom/fishy_tlds.map
@@ -0,0 +1,75 @@
+/.+\.accountant/i
+/.+\.ar/i
+/.+\.asia/i
+/.+\.bid/i
+/.+\.biz/i
+/.+\.care/i
+/.+\.cc/i
+/.+\.cf/i
+/.+\.cl/i
+/.+\.click/i
+/.+\.cloud/i
+/.+\.co/i
+/.+\.construction/i
+/.+\.country/i
+/.+\.cricket/i
+/.+\.cz/i
+/.+\.date/i
+/.+\.desi/i
+/.+\.download/i
+/.+\.estate/i
+/.+\.faith/i
+/.+\.fit/i
+/.+\.flights/i
+/.+\.ga/i
+/.+\.gdn/i
+/.+\.gq/i
+/.+\.guru/i
+/.+\.icu/i
+/.+\.id/i
+/.+\.in/i
+/.+\.info/i
+/.+\.in.net/i
+/.+\.ir/i
+/.+\.jetzt/i
+/.+\.kim/i
+/.+\.life/i
+/.+\.link/i
+/.+\.loan/i
+/.+\.me/i
+/.+\.mk/i
+/.+\.ml/i
+/.+\.ninja/i
+/.+\.online/i
+/.+\.ooo/i
+/.+\.party/i
+/.+\.pro/i
+/.+\.ps/i
+/.+\.pw/i
+/.+\.racing/i
+/.+\.review/i
+/.+\.rocks/i
+/.+\.rs/i
+/.+\.ru/i
+/.+\.ryukyu/i
+/.+\.science/i
+/.+\.se/i
+/.+\.si/i
+/.+\.space/i
+/.+\.stream/i
+/.+\.sucks/i
+/.+\.tk/i
+/.+\.top/i
+/.+\.topica.com/i
+/.+\.town/i
+/.+\.tr/i
+/.+\.trade/i
+/.+\.uno/i
+/.+\.us/i
+/.+\.vip/i
+/.+\.webcam/i
+/.+\.website/i
+/.+\.win/i
+/.+\.work/i
+/.+\.world/i
+/.+\.xyz/i
diff --git a/data/conf/rspamd/local.d/composites.conf b/data/conf/rspamd/local.d/composites.conf
index d49dbcf5..e40cc6ce 100644
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -26,3 +26,8 @@ OLEFY_MACRO {
   score = 20.0;
   policy = "remove_weight";
 }
+
+BAD_WORD_BAD_TLD {
+  expression = "FISHY_TLD & BAD_WORDS"
+  score = 20.0;
+}
diff --git a/data/conf/rspamd/local.d/multimap.conf b/data/conf/rspamd/local.d/multimap.conf
index f3db1a08..12420ccd 100644
--- a/data/conf/rspamd/local.d/multimap.conf
+++ b/data/conf/rspamd/local.d/multimap.conf
@@ -96,9 +96,26 @@ MAILCOW_DOMAIN_HEADER_FROM {
   filter = "email:domain";  
   map = "redis://DOMAIN_MAP"; 
 }
+
 IP_WHITELIST {
   type = "ip";
   map = "$LOCAL_CONFDIR/custom/ip_wl.map";
   prefilter = "true";
   action = "accept";
 }
+
+FISHY_TLD {
+  type = "from";
+  filter = "email:domain";
+  map = "${LOCAL_CONFDIR}/custom/fishy_tlds.map";
+  regexp = true;
+  score = 1.0;
+}
+
+BAD_WORDS {
+  type = "content";
+  filter = "text";
+  map = "${LOCAL_CONFDIR}/custom/bad_words.map";
+  regexp = true;
+  score = 0.7;
+}