view mod_firewall/scripts/spam-blocking.pfw @ 3902:341850e8866f

mod_muc_moderation: Broadcast retraction via method that saves it Otherwise the retraction is not saved to history, so that those who join after it was sent are unaware of the retraction
author Kim Alvefur <zash@zash.se>
date Sat, 22 Feb 2020 21:41:31 +0100
parents 8908d001faf3
children 879955a32a37
line wrap: on
line source

#### Anti-spam ruleset ###########################################
#
# This script provides some foundational anti-spam rules. It aims
# to PASS stanzas that are definitely not spam, and DROP stanzas
# that are very likely spam.
#
# It does not do any form of content filtering,
# but this can be implemented by other scripts and
# modules as desired using the chains documented below.
#
#
# The following chains are available as extension
# points:
#
# ::user/spam_check_custom
#   Apply additional rules to all stanzas before they are checked.
#   Mainly useful to PASS stanzas that you do not want to be
#   filtered.
#
# ::user/spam_check_message_custom
#   Apply additional rules to messages from strangers, aiming to
#   PASS stanzas that are not spam and jump to ::user/spam_reject
#   for stanzas that are considered spam.
#
# ::user/spam_check_message_content
#   Apply additional rules to messages that may be spam, based on
#   message content rules. These may contain more intensive rules,
#   so are executed after all other checks. Rules should jump to
#   ::user/spam_reject if a message is considered spam.
#
# ::user/spam_check_presence_custom
#   Apply additional rules to presence that may be spam.
#
# ::user/spam_check_subscription_request
#   Apply additional rules to subscription requests.
#
# ::user/spam_handle_unknown_custom
#   Override default handling of stanzas that weren't explicitly
#   passed or rejected by the anti-spam checks.
#
# ::user/spam_reject_custom
#   Override default handling of stanzas that have
#   been recognised as spam (default is to bounce
#   a policy-violation error). 
#
##################################################################

#### Entry point for all incoming stanzas ########################
::deliver

# Override this if you want to prevent certain stanzas going through
# the normal spam_check chain
JUMP_CHAIN=user/spam_check_custom

# Run the default spam_check chain
JUMP_CHAIN=user/spam_check

##################################################################

#### General spam-checking rules (all stanzas) ###################
::user/spam_check

# Pass stanzas that a user sends to their own account
TO SELF?
PASS.

# Pass stanzas that are addressed to a valid full JID
TO FULL JID?
PASS.

# Pass stanzas from contacts
SUBSCRIBED?
PASS.

# Run extra rules that apply to messages only
KIND: message
JUMP CHAIN=user/spam_check_message

# Run extra rules that apply to presence stanzas only
KIND: presence
JUMP CHAIN=user/spam_check_presence

JUMP CHAIN=user/spam_handle_unknown

# Default is to allow, override this with
# the 'user/spam_handle_unknown' chain
PASS.

#### Rules for messages ##########################################
::user/spam_check_message

JUMP CHAIN=user/spam_check_message_custom

# Type 'groupchat' messages addressed to an offline full JID are harmless,
# and should be routed normally to handle MUC 'ghosts' correctly
TO: <*>@<*>/<*>
TYPE: groupchat
PASS.

# Non-chat message types often generate pop-ups in clients,
# so we won't accept them from strangers
NOT TYPE: chat
JUMP CHAIN=user/spam_reject

# This chain can be used by other scripts
# and modules that analyze message content
JUMP CHAIN=user/spam_check_message_content

##################################################################

#### Rules for presence stanzas ##################################
::user/spam_check_presence

JUMP CHAIN=user/spam_check_presence_custom

# Presence to offline full JIDs is harmless, and should be routed
# normally to handle MUC 'ghosts' correctly
TO: <*>@<*>/<*>
PASS.

# These may be received if rosters get out of sync and are harmless
# because they will not be routed to the client unless necessary
TYPE: unsubscribe|unsubscribed
PASS.

# We don't want to receive presence from random strangers,
# but still allow subscription requests
NOT TYPE: subscribe
DROP.

# This chain can be used by other scripts
# and modules to filter subscription requests
JUMP CHAIN=user/spam_check_subscription_request

##################################################################

#### Stanzas reaching this chain will be rejected ################
::user/spam_reject

# This chain can be used by other scripts
# and modules to override the default behaviour
# when rejecting spam stanzas
JUMP CHAIN=user/spam_reject_custom

LOG=Rejecting suspected spam: $(stanza:top_tag())
BOUNCE=policy-violation

##################################################################

#### Stanzas that may be spam, but we're not sure either way######
::user/spam_handle_unknown

# This chain can be used by other scripts
# and modules to apply additional checks, or to
# override the default behaviour
JUMP CHAIN=user/spam_handle_unknown_custom

#LOG=[debug] Spam check allowing: $(stanza:top_tag())

##################################################################