We have released Rspamd 3.0 today. The decision to increase the major version number was taken because of the significant changes in the internal architecture Rspamd in many parts, specifically (but not limited) related to the HTML parsing. Rspamd now includes a CSS parser that can deal with the modern emails and properly extract data from them. New code is now written not in Plain C but in C++17 (might be extended to C++20 in future). Hence, to build Rspamd from the source code one would need a C++17 compatible compiler. This release includes contributions from many people, but I would like to say special thanks to the following persons:

• Anton Yuzhaninov for testing Rspamd and being patient when dealing with the bugs, as well as for the valuable feedback on almost all questions
• Andrew Lewis for constant work on Lua plugins and suggestions about Rspamd architecture
• Alexander Moisseev for WebUI support and rules testing

Here are the most important changes in this version explained.

Main changes

HTML parser rework

Rspamd now parses HTML using a DOM model, so it can build and construct a parsed tree of HTML tags instead of a simple ad-hoc parsing. Adding this feature was quite untrivial, as it required full rewrite of the HTML related code. However, we can see that the new parser can deal with emails in HTML format that were completely ruined by a previous parser. Furthermore, better representation of HTML could lead to more sophisticated rules that take HTML structure into account.

CSS parser

Rspamd now has an embedded CSS parser that is currently limited to simple selectors but it could be extended in future. In conjunction with the modern HTML parser, CSS support is very valuable to extract the content from emails and distinguish visible and invisible content precisely.

Amazon S3 support

Rspamd now includes AWS API support (e.g. their signatures schema) which allows to interact with Amazon cloud services directly from Lua API. A simple plugin that stores all messages in AWS S3 cloud has also been written.

DMARC reporting rework

Rspamd DMARC reporting has proven to be troublesome in the previous version. Therefore, I have decided to move reports sending logic to a dedicated tool called rspamadm dmarc_report. The usage of this tool and DMARC reports in principle is already documented.

DMARC munging support

From version 3.0, Rspamd supports DMARC munging for the mailing list. In this mode, Rspamd will change the From: header to some pre-defined address (e.g. a mailing list address) for those messages who have valid DMARC policy with reject/quarantine that would otherwise fail during mailing list forwarding. An example of this technique is defined here.

External relay plugin

Many plugins, such as SPF, are using IP address provided by an MTA to Rspamd directly. However, in many cases there is a trusted relay that do some initial processing and hides the actual sender’s IP address. With help of this new plugin, Rspamd can now ‘fix’ this issue by treating sender’s IP as it is reported by that trusted relay.

Bayes export tool

Rspamd now allows to save and restore bayes tokens using rspamadm bayes_dump subcommand. This feature allows to move tokens between instances of Rspamd, to merge them and to analyse them manually.

Pyzor support

Rspamd now supports Pyzor via external services plugin, thanks to @defkev for this work!

Monitoring rework

Monitoring tools are now awaken less frequently reducing load on the external modules.

Other fixes and improvements

Core and API

• Fixed retries on broken maps servers
• Fixed handling of spaces in MIME From domains
• Fixed handling of invalid IDN domains containing 8-bit characters
• Fixed if..else..elseif handling in Lupa templates

Plugins

• Neural: fixed profile filtering (offline) & unwanted retraining (online)
• Fixed escaping in Clickhouse plugin
• Fixed missing config schema & reconfigurability in RBL plugin (disabling RBLs; selectors)

Rules

• Fixed CTYPE_MIXED_BOGUS for text attachments
• Fixed PCRE-mode handling of BITCOIN_ADDR rule
• Fixed REPLYTO_ADDR_EQ_FROM for normalised addresses

### Controller

• OpenMetrics-compatible controller endpoint (@mrueg)
• Health and readiness endpoints for Kubernetes (@mrueg)

All changes

Here is the list of the important changes:

• [Conf] Align ARC scores with DKIM scores
• [CritFix] Neural: Fix sorting application
• [Feature] Add a simple dumper for bayes tokens
• [Feature] Add lua_maps.fill_config_maps function
• [Feature] Add preliminary exporter to AWS S3
• [Feature] Add preliminary restore bayes support
• [Feature] Add race condition protection against hs_helper restarts
• [Feature] Add rspamd_utf8_strcmp utility
• [Feature] Add zstd streaming API
• [Feature] Allow to log severity level explicitly
• [Feature] Allow to save and show attachment name when inserting AV scan results
• [Feature] Allow to sort urls for Lua
• [Feature] Allow to specify different timeouts/retransmits for fuzzy rules
• [Feature] Aws_s3: Allow to compress data stored
• [Feature] CMakeLists.txt: Change check and run-test to use rspamd-test-cxx * fixes #3807
• [Feature] Dmarc_report: allow sending reports in batches
• [Feature] Fuzzy_check: Allow to disable subject when making short text hash
• [Feature] Lua_cryptobox: Add keyed ssl hash functions via HMAC
• [Feature] Lua_task: Add get_urls_filtered method
• [Feature] Make monitored checks less frequent
• [Feature] Milter_headers: Add x-rspamd-pre-result header
• [Feature] Neural: Allow to balance FP/FN for the network
• [Feature] Ppopagate monitored errors from rbl module
• [Feature] Pyzor calculate score dynamically Count - WL-Count of default_score in percent
• [Feature] Rbl: Distinguish flattened and non-flattened selectors in RBL requests
• [Feature] Re-add pyzor support
• [Feature] Settings: add ip_map check and rework structure slightly
• [Feature] Spamassassin: Allow to set the default priority for SA scores
• [Feature] Strip smtp comments from message id
• [Feature] add SYSTEM_ZSTD cmake option To use the system zstd instead on the bundled version
• [Feature] external_relay plugin
• [Feature] rspamadm clickhouse neural_train subcommand
• Fix #3400 milter_headers: fix inverted logic for extended_headers_rcpt
• Fix ASN: fix _FAIL symbol for when main symbol is disabled
• Fix Add a special logic for text part with no text extraction
• Fix Add diacritics flag for several eu languages
• Fix Another FSM fix to accomodate possibility of multiple consequent ?
• Fix Avoid curse of dynamic array referencing
• Fix Avoid reinitialising neural settings
• Fix Check remain before processing TXT records
• Fix Enable error multiplier on http errors
• Fix Finally rework parsing entities logic
• Fix Fix ‘==’ parsing in the content type attributes parser
• Fix Fix IPv6 expansion for SPF macros
• Fix Fix Mozilla Message-ID detection
• Fix Fix an edge case in BITCOIN_ADDR rule
• Fix Fix brain-damaged behaviour when http request has a custom Host header
• Fix Fix check of limits in email address parsing
• Fix Fix copy&paste error and rework
• Fix Fix expressions logic for and/or and float values
• Fix Fix fuzzy retransmits
• Fix Fix http maps with no or invalid expires data
• Fix Fix last quote character parsing in the content-type state machine
• Fix Fix normalisation flags propagation
• Fix Fix overflow when appending many broken tags
• Fix Fix parsing of rfc2047 tokens with ‘?’ inside
• Fix Fix phishing flag set
• Fix Fix rfc2047 embedded into rfc2231 pieces in special headers
• Fix Fix round-robin rotation
• Fix Fix searching for symbols
• Fix Fix storing of the regexps inside variant
• Fix Fix tokenization near exceptions
• Fix Fix visibility calculations
• Fix Html: Attach inline tags to the structure
• Fix Html: Do not treat empty tags as block tags
• Fix Ical: Do not extract urls from all flags using merely specific ones
• Fix Initialise symcache even if it cannot be loaded properly
• Fix Lua_fuzzy: Remove text parts check when checking image dimensions
• Fix Lua_maps: Fix adjustments for the map type in the complex map definitions
• Fix Lua_task: Fix deleted symbols in has_symbol/get_symbol
• Fix Move metric and symcache link from validation to the init stage
• Fix Oletools: Another try to fix table sorting
• Fix One more default behaviour fix
• Fix Phishing: Rework urls processing
• Fix RBL: was missing some config schema
• Fix Replies: Fix ‘Reply-To’ handling in task:get_reply_sender
• Fix Rework metrics handling
• Fix Save symcache on exit
• Fix Selectors: Filter nil elements in lists
• Fix Selectors: Properly fix implicit tostring for nils
• Fix Try to fix some broken code in DMARC reporting plugin
• Fix Urls: Fix processing of html urls when it comes to the flags
• Fix Use proper buffer length
• Fix Various visibility fixes
• [Project] Add a simple css rule definition
• [Project] Add css style skeleton
• [Project] Add css syntax (adopted from ebnf)
• [Project] Add css_selectors
• [Project] Add doctest unit testing library
• [Project] Add expected library
• [Project] Add fmt library for simple string ops
• [Project] Add fu2 library to better functions abstractions
• [Project] Add hashing method
• [Project] Add parsers skeleton
• [Project] Add preliminary support of vcard parser
• [Project] Add process exceptions for invisible text
• [Project] Add some methods for css parser
• [Project] Allow static libstdc++
• [Project] Another whitespace hack
• [Project] CSS: Various fixes in the declarations and values parsing
• [Project] Cpp: Add robin-hood hash map library
• [Project] Css: Add AST debug
• [Project] Css: Add colors conversion functions
• [Project] Css: Add dimensions handling
• [Project] Css: Add display value support
• [Project] Css: Add frozen library from https://github.com/serge-sans-paille/frozen/
• [Project] Css: Add opacity support
• [Project] Css: Add parser helpers to simplify debugging
• [Project] Css: Add preliminary stylesheet support
• [Project] Css: Add rules processing functions and tests
• [Project] Css: Add simple selectors unit tests
• [Project] Css: Add some c++ unit tests
• [Project] Css: Add some debug methods
• [Project] Css: Add some debug statements for the css parser
• [Project] Css: Add some logical skeleton for declarations parser
• [Project] Css: Add url/function tokens
• [Project] Css: Allow at rules parsing
• [Project] Css: Declarations parsing logic skeleton
• [Project] Css: Enable conditional css parsing support from the HTML parser
• [Project] Css: Finish generic lexer cases
• [Project] Css: Fix HSL conversion
• [Project] Css: Fix minus parsing
• [Project] Css: Fix parser consumers nesting
• [Project] Css: Fix parsing of the qualified rules
• [Project] Css: Fix rules merging
• [Project] Css: Further fixes to lexer
• [Project] Css: Further steps to parse css colors + rework
• [Project] Css: Further work on parser’s methods
• [Project] Css: Implement backlog of css tokens
• [Project] Css: Implement numbers and ident parsers
• [Project] Css: Implement simple css selectors lookup
• [Project] Css: Implement styles merging
• [Project] Css: Make debug strings json like to simplify tests
• [Project] Css: Minor adjustments
• [Project] Css: More meat to the lexer
• [Project] Css: Move some of the tests to the doctest
• [Project] Css: Projected a parser
• [Project] Css: Properties attachment logic
• [Project] Css: Remove ragel from build targets (maybe keep for reference)
• [Project] Css: Rework css block structure
• [Project] Css: Rework flags of css properties
• [Project] Css: Rework tokens structure
• [Project] Css: Several fixes + tests
• [Project] Css: Simplify checks
• [Project] Css: Simplify debug code
• [Project] Css: Start css selectors parsing logic
• [Project] Css: Start semantic parsing for rules
• [Project] Css: Start stylesheet implementation
• [Project] Css: Tidy up lambdas
• [Project] Css: rework tokeniser
• [Project] Dmarc: Add dmarc report tool (WIP)
• [Project] Dmarc: Add munging configuration
• [Project] Dmarc: Add preliminary munging logic
• [Project] Dmarc: Fix header removal
• [Project] Dmarc: Fix munging logic
• [Project] Dmarc: Use full recipient address instead of a domain map
• [Project] Dmarc: Use zlists for dmarc reports
• [Project] Dmarc_report: Add message generation logic
• [Project] Dmarc_report: Add preliminary sending support
• [Project] Fix lua bindings
• [Project] Fix xml/sgml tags processing
• [Project] Handle new modification
• [Project] Html/CSS: Add transform from a CSS rule to html block
• [Project] Html/CSS: Link html and css styles
• [Project] Html/CSS: Switch styles parsing to css parser
• [Project] Html/Css: Fix some issues found
• [Project] Html/Css: Implement visibility rules for a block
• [Project] Html: Add more tests cases and fix some more corner issues
• [Project] Html: Add rows display type support
• [Project] Html: Allow decode entities function to normalise spaces + unit tests
• [Project] Html: Another rework of the tags structure
• [Project] Html: Another try to fix unbalanced cases
• [Project] Html: Fix crossing spans
• [Project] Html: Fix parent propagation
• [Project] Html: Further rework of the html parsing stuff
• [Project] Html: Implement logic for tags pairing
• [Project] Html: Implement rawtext state machine
• [Project] Html: Insert closing tags as well :(
• [Project] Html: More fixes
• [Project] Html: More fixes
• [Project] Html: More spaces logic fixes
• [Project] Html: One more attempt to write text content
• [Project] Html: Replace \0 in html content
• [Project] Html: Rework img/a tags handling
• [Project] Html: Rework propagation method
• [Project] Html: Rework tags placement
• [Project] Html: Rework transparency logic
• [Project] Html: Support ‘hidden’ attribute
• [Project] Html: Try another approach to append tags content
• [Project] Html: Try to deal with bad unknown tags properly
• [Project] Lua_aws: Add canonicalisation utility
• [Project] Lua_aws: Add function to produce AWS Authorisation header
• [Project] Lua_aws: Implement request signing
• [Project] Lua_mime: Add lua_mime.modify_headers routine
• [Project] Lua_task: Add modify_header method
• [Project] Lua_task: Allow to extract modified headers
• [Project] Make unescape code public for unit testing
• [Project] More fixes for closed tags
• [Project] More fixes to calculations
• [Project] Rework API for the modified headers
• [Project] Rework html visibility rule
• [Project] Skeleton of the css library
• [Project] Start headers modification API structure
• [Project] Start working on AWS Lua API
• [Project] Use lua_mime to modify headers
• [Project] Use modified headers on dkim signing
• [Project] Use string_view to constexpr variant unpacking
• [Rework] Add composites manager concept
• [Rework] Add tags definitions
• [Rework] Allow C code to be compiled with C++ compiler
• [Rework] Clickhouse: Store url flags
• [Rework] Composites: Rewrite the composites logic
• [Rework] Composites: Start rework of the composites framework
• [Rework] Dmarc: Move check policy function to the common utils
• [Rework] Dmarc: Rework reports keys structure
• [Rework] Further work to make html content private
• [Rework] Html/CSS: Remove css C bindings as they are useless now
• [Rework] Html/CSS: Rework Lua bindings
• [Rework] Html/Css: Start rework of the html blocks
• [Rework] Html: Add images processing logic
• [Rework] Html: Add traverse function
• [Rework] Html: Another steps to get rid of gnode
• [Rework] Html: Convert to variant
• [Rework] Html: Deal with the utf_content part
• [Rework] Html: Final rework part for the html processing code
• [Rework] Html: Fix Lua bindings
• [Rework] Html: Forgot to add the internal include
• [Rework] Html: Further html urls rework
• [Rework] Html: Further rework of the tags content extraction
• [Rework] Html: Make parameters as a vector again
• [Rework] Html: Move blocks part
• [Rework] Html: Move images processing stuff
• [Rework] Html: Rework lua bindings
• [Rework] Html: Start html text extraction rework
• [Rework] Html: Start refactoring of the html tags handling
• [Rework] Html: Start removing of GNode stuff
• [Rework] Html: Start rework of the html content structure
• [Rework] Lua_magic: Try to detect text parts with 8bit characters for non-utf8 encodings
• [Rework] Move HTML url functions and rework them
• [Rework] Move and adopt entities handling logic
• [Rework] Move common and rarely used dmarc code to the library
• [Rework] Move compression routines outside of rspamd_util library
• [Rework] Move entities/tags handling
• [Rework] Phishing: Split from redirectors usage
• [Rework] Redesign html blocks propagation logic
• [Rework] Remove tag name string
• [Rework] Rename phished url to a linked url
• [Rework] Reorganize dmarc plugin and remove unsupported reporting code
• [Rework] Reputation: Use more flexible types in get/set functions
• [Rework] Require proper C++ environment for Rspamd build
• [Rework] Rework extended urls output
• [Rework] Rework tags parsing machine
• [Rework] Slightly improve old regexp API
• [Rework] Start conversion of the redis pool code to c++
• [Rework] Try to resolve failed upstreams more agressively
• [Rework] Use C++ utf8 library with unit tests to trim whitespaces
• [Rework] Use C++ version for unicode normalisation
• [Rework] Use C++ version of the lua threads pool
• [Rules] Add raw addresses to MULTIPLE_FROM options
• [Rules] Another fix to HTTP_TO_HTTPS rule
• [Rules] Do not trigger HTML_SHORT_LINK_IMG on external images
• [Rules] Extend FORGED_X_MAILER
• [Rules] Extend OLD_X_MAILER
• [Rules] Fix CTYPE_MIXED_BOGUS for text attachments
• [Rules] Fix FPs for CTYPE_MIXED_BOGUS
• [Rules] Fix HTTP_TO_HTTPS rule
• [Rules] Fix HTTP_TO_HTTPS rule
• [Rules] Fix zerofont rule (partially)
• [Rules] Micro-optimize X_PHP_EVAL
• [Rules] Reduce default weight for R_MISSING_CHARSET

We have released Rspamd 2.7 today.

This is mostly a bug-fix release with no incompatible changes.

Here is a list of the major projects and serious bugfixes where applicable.

Fixed issues with DKIM and ARC verification

It was possible for some DKIM checks to fail where multiple signatures are present due to a canonicalisation bug. This issue has now been fixed. Arc plugin has also been fixed to support certain CV values.

Added support for S/MIME containers

From this version, Rspamd supports .p7 containers and extracting signed parts during the checks. For details see the following issue.

Several important rules rework

Anton Yuzhaninov has reworked many old rules in Rspamd improving their quality and has removed several outdated rules as well.

Support of caching for regexp multimaps

Regexp maps can now be cached on disk which should improve loading speed of large maps on reload/restart of Rspamd if they are unchanged.

Neural plugin offline learning

In this mode, Rspamd can train neural network from Clickhouse so it is possible to define better training conditions and manage learning for large systems with more fine grained control. Please refer to the corresponding documentation section for more details. Thanks to Andrew Lewis for implementing this functionality.

Other changes

Here is the list of the important changes:

• [Conf] Add R_DKIM_PERMFAIL to the metric
• [CritFix] Dkim: Fix simple canonicalisation if multiple signatures are presented
• [CritFix] Fix controller paths normalisation
• [Feature] Add INVALID_DATE rule
• [Feature] Add controller endpoint for training neural
• [Feature] Add sanity checks for actions thresholds
• [Feature] Add support of ‘==’ and ‘!=’ in Rspamd expressions
• [Feature] Composites: Improve composite atoms parser
• [Feature] Docker: use Debian slim variant
• [Feature] Elastic: Add some missing fields
• [Feature] Extract text from img alt attributes
• [Feature] Improve charset detection logic
• [Feature] Lua_clickhouse: Add optional row callback for large selections
• [Feature] Lua_dns_resolver: Add idna_convert_utf8 method
• [Feature] Lua_mime: Add ability to do multipattern replacement
• [Feature] Lua_trie: Allow to report start of the match
• [Feature] Multimap: support adding map values as extra options
• [Feature] Neural: Move PCA learning to a subprocess
• [Feature] RBL: support matching content/image URLs only
• [Feature] RBL: support use of multiple selectors
• [Feature] Reputation: Allow to specify ip masks
• [Feature] Support SMIME signed messages container
• [Feature] Support multiple conditions for symbols
• [Feature] Support ping in milter mode
• [Feature] Support rspamd_text in selector regexps
• [Feature] Use own daemonization routine
• [Feature] Vadesecure: Implement settings_outbound feature as recommended by Vade
• [Feature] rspamadm clickhouse command
• [Feature] allow hyperscan for aarch64
• [Fix] Allow to set priorities between post init scripts
• [Fix] Allow to use maps for strings that are not zero terminated
• [Fix] Apply max_lua_urls limit for emails as well
• [Fix] Arc: Fix CV check on signing
• [Fix] Arc: Fix signing of the broken ARC chains
• [Fix] Clickhouse: escape carriage return
• [Fix] Composites: Allow partial match
• [Fix] Deduct type of a table methods
• [Fix] Do not load errored hyperscan database
• [Fix] Do not process links in ignored html tags
• [Fix] Fix ClamAV result for cached encrypted file (#3395)
• [Fix] Fix canonicalisation when l= tag is presented
• [Fix] Fix flag shift
• [Fix] Fix handling of skip/skip_process http flags
• [Fix] Fix html attachments checks
• [Fix] Fix issue with pushing binary formats to Lua strings
• [Fix] Fix logging for rspamadm
• [Fix] Fix off-by-one with init check
• [Fix] Fix parsing of escape characters in quoted pairs
• [Fix] Fix pushing ucl strings with \0 inside
• [Fix] Fix quoted-printable soft newlines bugged case
• [Fix] Fix settings in case actions are set to null (#3415)
• [Fix] Fix several issues with auth results producing
• [Fix] Fix smtp comments exclusion
• [Fix] Fix smtp date syntax definition
• [Fix] Fix substring search in case if srchlen == inlen
• [Fix] Fix text selectors
• [Fix] Honour systemd setting when logging to console (#3514)
• [Fix] Html: Add entities collisions prevention logic (e.g. for mathml entities)
• [Fix] Lua_auth_results: Quote potentially bad values in AR header
• [Fix] Multimap: Fix flags usage
• [Fix] Multimap: Fix scoring for combined maps
• [Fix] Plug GList * leak in redis pool
• [Fix] RBL: allow for multiple matches of the same label if types are different
• [Fix] Rely on libev checks for file maps
• [Fix] Restore simple dkim canonicalisation mode
• [Fix] Return MimeCharset as we work with emails…
• [Fix] Spamassassin: Fix pcre_only flags
• [Fix] Spamassassin: Preserve ‘pcre_only’ flag when dealing with regexp replacements
• [Fix] Try to fix GError leak
• [Fix] Try to fix a mess with settings loading by adding priorities
• [Fix] Try to move setings initialisation to a later stage
• [Fix] Use dup fd in milter handler to avoid races with the proxy
• [Fix] Use message pointer to avoid obsolete data to be cached
• [Project] Rbl: Migrate to checks
• [Project] Rbl: Move config code outside of the plugin
• [Project] Ressurect empty prefilters as connection filters
• [Project] Support connection filters registration from Lua
• [Rework] Add final cleanup logic
• [Rework] Add preliminary support of hyperscan caching for re maps
• [Rework] Add stale cache removal
• [Rework] Clickhouse: Improve performance
• [Rework] Distinguish between strict config test mode
• [Rework] Furhter logging improvements
• [Rework] Milter_headers: improve extended_headers_rcpt support
• [Rework] Move parsers to a separate lua library
• [Rework] Neural: Skip composite symbols
• [Rework] Rbl: Rework defaults logic
• [Rework] Some tunes to cache saving
• [Rework] Track maps origins
• [Rework] Use full crypto hash for regexp maps
• [Rules] Remove broken rule

We have released Rspamd 2.6 today.

There are several major projects in this release: neural network plugin various improvements, better bitcoin scam detection, conditional regular expressions and other reworks of the code, such as shadow results support has been done. Numerous of the bug fixes, including some critical ones have also been applied during this release cycle.

Here is a list of the major projects and serious bugfixes where applicable.

Neural network plugin rework

Rspamd now includes PCA method to reduce the input space dimentionality in the heavily customised environments with many rules. This method allows to transform all rules set to a fixed number of inputs for neural network using linear transformation. There are also other improvements for neural network plugin that have been added in this release, including the following:

• Probabilistic learn method where spam and ham samples could be not balanced (useful for the cases where spam/ham amounts are significantly different)
• Allowing to set a maximum number of inputs for ANN (via PCA prefiltering)
• Reworked the internal structure of ANN (more hidden layers and fixed the output function)
• Low level tensors library for speeding up the matrices operations
• BLIS algebra library support

Reworked bitcoin detection library

Rspamd now supports lua filters for regular expressions. The idea is to allow fast pre-filter with regular expressions and slow Lua postprocessing for the cases where this processing is needed. Here is how it’s used in bitcoin library:

config.regexp['RE_POSTPROCESS'] = {
  description = 'Example of postprocessing for regular expressions',
  re = string.format('(%s) || (%s)', re1, re2),
  re_conditions = {
    [re1] = function(task, txt, s, e)
      if e - s <= 2 then
        return false
      end

      if check_re1(task, txt:sub(s + 1, e)) then
        return true
      end
    end,
    [re2] = function(task, txt, s, e)
      if e - s <= 2 then
        return false
      end

      if check_re2(task, txt:sub(s + 1, e)) then
        return true
      end
    end,
  },
}

This allows to add accelerated rules that are enabled merely if some relatively rare regular expression matches. In this particular case this feature is used to do BTC wallet verification and validation.

IDNA bugs are fixed

Dr. Hajime Shimada and Mr. Shirakura from Nagoya University have investigated that it is possible to bypass Rspamd URLs detection by using of a special Unicode characters. We have changed this behaviour so now full IDNA validation/normalisation is performed. I would like to thank the researchers for sharing that with us.

Fuzzy module telemetry

Rspamd will now send more data when checking for fuzzy hashes: it will send the source IP address of email being scanned and the domain name of a sender. This data is end-to-end encrypted between you and Rspamd public fuzzy storage and I plan to use it for better spam detection. If you don’t want this data to be shared then please stop using of the public fuzzy storage or set no_share flag to true.

Other major improvements

• Use google-ced instead of libicu character detection
• Rework and refactor forged recipients plugin
• Added SO_REUSEPORT support for UDP sockets on Linux
• Better Spamhaus DQS service support (e.g. hashbl)
• Added secretbox Lua API for symmetric encryption (AEAD)
• More bitcoin addresses support (Bitcoincash, new BTC addresses etc)
• Timeouts for PDF processing
• Many improvements to the tests and build systems

Critical/important fixes

• Arc: Fix ARC validation for chains of signatures
• Fix IDNA dots parsing
• Fix usage of crypto_sign it should be crypto_sign_detached!

Here is the list of the important changes:

• [Conf] Add missing symbols
• [Conf] Add missing symbols
• [Conf] Fix fat-fingers typo
• [Conf] Fix wrong comment in options.inc
• [Conf] Neural: Fix the default name for max_trains
• [Conf] Register a known symbol
• [Conf] Spf: Add R_SPF_PERMFAIL symbol
• [CritFix] Arc: Fix ARC validation for chains of signatures
• [CritFix] Distinguish socketpairs between different fuzzy workers
• [CritFix] Fix IDNA dots parsing
• [CritFix] Fix test assertion method
• [CritFix] Fix usage of crypto_sign it should be crypto_sign_detached!
• [Feature] Add BOUNCE rule
• [Feature] Add controller plugins support and selectors plugin
• [Feature] Add maps query method
• [Feature] Add minimal delay to fuzzy storage
• [Feature] Add multiple base32 alphabets for decoding
• [Feature] Add preliminary support of BCH addresses
• [Feature] Add query_specific endpoint
• [Feature] Allow multiple base32 encodings in Lua API
• [Feature] Allow to specify nonces manually
• [Feature] Controller: Allow to pass query arguments to the lua webui plugins
• [Feature] Fuzzy_check: Add gen_hashes command
• [Feature] Fuzzy_check: Add weight_threshold option for fuzzy rules
• [Feature] Implement address retry on connection failure
• [Feature] Improve limits in pdf scanning
• [Feature] Initial support of subscribe command in lua_redis
• [Feature] Lua_cryptobox: Add secretbox API
• [Feature] Lua_text: Add encoding methods
• [Feature] Milter_headers: Allow to activate routines via users settings
• [Feature] PDF: Add timeouts for expensive operations
• [Feature] Preliminary maps addon for controller
• [Feature] Split pdf processing object and output object to allow GC
• [Feature] Support BLIS blas library
• [Feature] Support input vectorisation by recvmmsg call
• [Feature] Support multiple base32 alphabets
• [Feature] add queueid, uid, messageid and specific symbols to selectors [Minor] use only selectors to fill vars in force_actions message
• [Feature] allow variables in force_actions messages
• [Feature] extend lua api
• [Fix] #3249
• [Fix] Allow to adjust neurons in the hidden layer
• [Fix] Another try to fix email names parsing
• [Fix] Arc: Allow to reuse authentication results when doing multi-stage signing
• [Fix] Arc: Fix bug with arc chains verification where i>1
• [Fix] Arc: Sort headers by their i= value
• [Fix] Change neural plugin’s loss function
• [Fix] Deal with double eqsigns when decoding headers
• [Fix] Default ANN names in clickhouse
• [Fix] Disable reuseport for TCP sockets as it causes too many troubles
• [Fix] Disable text detection heuristics for encrypted parts
• [Fix] Distinguish DKIM keys by md5
• [Fix] Distinguish type from flags in register_symbol
• [Fix] Dmarc: Unbreak reporting after cf2ae3292ac93da8b6e0624b48a62828a51803c9
• [Fix] Do not flag pre-result of virus scanners as least if action is reject
• [Fix] Do not use GC64 workaround on 32bit platforms, omg
• [Fix] Exclude damaged urls from html parser
• [Fix] Fix FREEMAIL_REPLYTO_NEQ_FROM_DOM
• [Fix] Fix FROM_NEQ_ENVFROM
• [Fix] Fix FWD_GOOGLE rule (#1815)
• [Fix] Fix adding of the empty archive file for gzip
• [Fix] Fix aliases in forged recipients and limit number of iterations
• [Fix] Fix authentication results insertion
• [Fix] Fix calling of methods in selectors
• [Fix] Fix clen length for hiredis…
• [Fix] Fix endless loop if broken arc chain has been found
• [Fix] Fix false - operation
• [Fix] Fix get_urls table invocation
• [Fix] Fix group based composites
• [Fix] Fix headers passing in rspamd_proxy
• [Fix] Fix incomplete utf8 sequences handling
• [Fix] Fix lua_next invocation
• [Fix] Fix lua_parse_symbol_type function logic
• [Fix] Fix multiple listen configuration
• [Fix] Fix occasional encryption of the cached data
• [Fix] Fix parsing boundaries with spaces
• [Fix] Fix passing of methods arguments
• [Fix] Fix poor man allocator algorithm
• [Fix] Fix regexp selector and add flattening
• [Fix] Fix rfc base32 encode ordering (skip inverse bits)
• [Fix] Fix rfc based base32 decoding
• [Fix] Fix sockets leak in the client
• [Fix] Fix storing of the original smtp from
• [Fix] Fix types check and types usage in lua_cryptobox
• [Fix] Fix unused results
• [Fix] Fuzzy_check: Disable shingles for short texts (really)
• [Fix] Ical: Fix identation grammar
• [Fix] Improve part:is_attachment logic
• [Fix] Mmap return value must be checked versus MAP_FAILED
• [Fix] One more fix to skip images that are not urls
• [Fix] Pdf: Support some weird objects with no newline before endobj
• [Fix] Rbl: Fix ignore_defaults in conjunction with ignore_whitelists
• [Fix] Restore support for for and id parts in received headers
• [Fix] Segmentation fault in contrib/lua-lpeg/lpvm.c on ppc64el
• [Fix] Skip spaces at the boundary end
• [Fix] Slashing fix: fix captures matching API
• [Fix] Spamassassin: Rework metas processing
• [Fix] Store reference of upstream list in upstreams objects
• [Fix] Understand utf8 in content-disposition parser
• [Fix] Unify selectors digest functions
• [Fix] Use abs value when checking composites
• [Fix] Use strict IDNA for utf8 DNS names + add sanity checks for DNS names
• [Fix] Use unsigned char and better support of utf8 in ragel parser
• [Fix] add missing selector_cache declaration
• [Project] Add L flag for regexps to save start of the match in Hyperscan
• [Project] Add lower method to lua_text
• [Project] Add a simple matrix Lua library
• [Project] Add implicit bitcoincash prefix
• [Project] Add linalg ffi library for prototyping
• [Project] Add methods to append data to fuzzy requests
• [Project] Add routine to call a generic lua function
• [Project] Add ssyev method interface
• [Project] Add tensors index method
• [Project] Add text:sub method
• [Project] Allow rspamd_text based selectors
• [Project] Allow to specify re_conditions for regular expressions
• [Project] Attach extensions to the binary fuzzy commands
• [Project] Bitcoin: BTC cash addresses needs some checksum validation
• [Project] Cleanup the redis script
• [Project] Convert bitcoin rules to the new regexp conditions feature
• [Project] Detect memrchr in systems that supports it
• [Project] Do not listen sockets in the main process
• [Project] Implement ‘probabilistic’ learn mode for ANN
• [Project] Implement BTC polymod in C as it requires 64 bit ops
• [Project] Implement bitcoin cash validation in a proper way
• [Project] Implement extensions logic for fuzzy storage
• [Project] Implement symbols insertion in multiple results mode
• [Project] Lua_text: Add method memchr
• [Project] Neural: Add PCA loading logic
• [Project] Neural: Fix PCA based learning
• [Project] Neural: Fix matrix gemm
• [Project] Neural: Further PCA fixes
• [Project] Neural: Implement PCA in learning
• [Project] Neural: Implement PCA learning
• [Project] Neural: Implement PCA on ANN forward
• [Project] Neural: Implement PCA serialisation
• [Project] Neural: Start PCA implementation
• [Project] Neural: Use C version of scatter matrix producing
• [Project] Preliminary support of lua conditions for regexps
• [Project] Preliminary usage of the reuseport
• [Project] Process composites separately for each shadow result
• [Project] Remove old code
• [Project] Rework scan result functions to support shadow results
• [Project] Rework some more functions to work with shadow results
• [Project] Some more fixes
• [Project] Start results chain implementation
• [Project] Support fun iterators on rspamd_text objects
• [Project] Support multiply, minus and divide operators in expressions
• [Project] Tensor: Move scatter matrix calculation to C
• [Rework] Allow to specify exat metric result when adding a symbol
• [Rework] Change and improve openblas detection and usage
• [Rework] Close listen sockets in main after fork
• [Rework] Further rework of lua urls extraction API
• [Rework] Lua_cryptobox: Allow to store output of the hash function
• [Rework] Lua_task: Add more methods to deal with shadow results
• [Rework] Modernize logging for expressions
• [Rework] Remove empty prefilters feature - we are not prepared…
• [Rework] Remove old FindLua module, disable lua fallback when LuaJIT is enabled
• [Rework] Rework and refactor forged recipients plugin
• [Rework] Rework expressions processing
• [Rework] Rework fuzzy commands processing
• [Rework] Rework url flags handling API
• [Rework] Rework urls extraction
• [Rework] Split operations processing and add more debug logs
• [Rework] Update zstd to 1.4.5
• [Rework] Use google-ced instead of libicu chardet as the former sucks
• [Rework] add alias util:parse_addr for util:parse_mail_address
• [Rework] get rid of util:parse_addr duplicating the util:parse_mail_address, replace where used
• [Rules] Allow prefix for bitcoin cash addresses
• [Rules] More fixes for bitcoin cash addresses decoding
• [Rules] Refactor bleach32 addresses handling

We have released Rspamd 2.5 today.

You can find that the first start of Rspamd will take more time than usually (around 10-30 seconds). That is intended as Rspamd has to recompile some of the url pattern matchers. It will not happen on subsequent restarts nor to the subsequent updates. It should also not happen if you have used Release Candidates for this version.

There are 3 major projects in this release:

• URL extraction rework: the URL extraction logic in Rspamd has been significantly reworked to provide better DoS resistance, better matching and lower false positives.
• URL structure update: the URL storage structures have been reworked to occupy less memory and use a more efficient storage
• Hyperscan early load: since PCRE is a backtracking RE engine it is not very safe to use in conjunction with complicated rules and untrusted data, in this release, Rspamd will load hyperscan database on early stages to avoid PCRE fallback if possible

Several major fixes:

• Base64 detection has been fixed and improved to reduce FP rate
• Query urls are now fully processed
• Bundled libev has been updated to 4.33 (fixing many issues with FD closing race conditions)
• Fixed ANN normalisation
• Fixed redis backend leaks

Useful features:

• Added whitelisted_signers_map in ARC module
• Implemented /etc/hosts files processing

Here is the list of the most important changes:

• [Conf] Mark Rspamd emailbl as ignore whitelist
• [Conf] RBL: Add missing emails = true option
• [Feature] Add support for scripts in fuzzy storage
• [Feature] Arc: Add whitelisted_signers_map option
• [Feature] Implement hosts file processing
• [Feature] Neural: Introduce classes bias that allows non-equal classes learning
• [Feature] Update libev to 4.33
• [Fix] Another brain damage html standard adoptions
• [Fix] Another fix for brain damaged obs-fws state
• [Fix] Fix flags that caused force_actions failure
• [Fix] Fix logging issue
• [Fix] Fix lua symbols scores registration when config does not define scores
• [Fix] Fix opaque maps logic
• [Fix] Fix parsing of the html tags with no spaces after attributes
• [Fix] Fix some corner cases in urls parsing, add limits
• [Fix] Fix tlds extraction if custom composition rules are used
• [Fix] Fix variables replacement in mempool
• [Fix] Improve base64 detection
• [Fix] Normalize dynamic scores in ANN correctly
• [Fix] Plug memory leak introduced by #3153
• [Fix] Stat_redis_backend: Fix memory leak and simplify learn path
• [Fix] Try hard to deal with ghost workers
• [Fix] metadata_exporter default formatter
• [Rework] Change the way to extract URLs when dealing with alternative parts
• [Rework] Fix various url extraction issues
• [Rework] Re cache: Load compiled hyperscan in the main process as well
• [Rework] Re cache: Load hyperscan early
• [Rework] Rework URL structure: adjust tld part
• [Rework] Rework URL structure: host field
• [Rework] Rework URL structure: more structure optimisations
• [Rework] Rework URL structure: user field
• [Rework] URL: Another update for urls extraction logic
• [Rework] Urls: Improve query urls handling
• [Rework] Urls: adopt html related stuff
• [Rework] Urls: more rework of the urls sets
• [Rework] Urls: process query urls in HTML urls correctly
• [Rework] Urls: rework urls hash structure
• [Rework] Urls: update lua libraries
• [Rework] Use multiple search tries for different url extraction types

We have released Rspamd 2.4 today.

This is a bug fixes release mainly.

3 major projects in this release:

• Logger system rework: fixed syslog logging, improved architecture, improved logging reload
• URL composition library (similar to old 2tld map for surbl module), use this library in RBL module for all URL like objects: urls, emails, dkim domains
• Implemented SSL client caching: it should improve client SSL connections: Clickhouse, SMTPS, maps check and so on for both client and a server.

Several major fixes:

• Parsing of the content type attributes
• Avoid collisions in mempool variables
• Fixed Redis Sentinel support
• Fixed IPv6 listening
• Fixed mime modifications for 7bit parts
• Fixed passthrough result and smtp message
• Important eSLD url composition fixes
• Various neural network plugin fixes

Useful features:

• Custom additional columns in Clickhouse plugin
• Support of CDB maps everywhere to share huge maps across workers with no extra cost

Here is the list of the most important changes:

• [CritFix] Fix parsing of the content type attributes
• [Feature] Clickhouse: Add extra columns support
• [Feature] Rbl: Add url_compose_map option for RBL rules
• [Fix] ‘R’ flag is for all headers regexp
• [Fix] Allow to reset settings id from Lua (e.g. because of the priority)
• [Fix] Avoid collisions in mempool variables by changing fuzzy caching logic
• [Fix] Avoid strdup usage for symbols options
• [Fix] Do not trust stat(2) it lies
• [Fix] Filter all options for symbols to have sane characters
• [Fix] Fix all headers iteration
• [Fix] Fix allowed_settings for neural
• [Fix] Fix listen socket parsing
• [Fix] Fix maps expressions evaluation
• [Fix] Fix sentinel connections leak by using async connections
• [Fix] Fix smtp message on passthrough result
• [Fix] Fix tld compositon rules
• [Fix] Fuzzy_storage: Do not check for shingles if a direct hash has been found
• [Fix] Lua_mime: Do not perform QP encoding for 7bit parts
• [Fix] Neural: Distinguish missing symbols from symbols with low scores
• [Fix] Support listening on systemd sockets by name
• [Project] Add lua_urls_compose library
• [Project] Allow to set a custom log function to the logger
• [Project] CDB maps: Start making cdb a first class citizen
• [Project] Clickhouse: Add extra columns concept
• [Project] Fix urls composition rules, add unit tests
• [Project] Unify cdb maps
• [Rework] Logger infrastructure rework
• [Rework] Refactor libraries structure
• [Rework] Rework SSL caching
• [Rework] Update snowball stemmer to 2.0 and remove all crap aside of UTF8