Rspamd: [BUG] Stop fight against GnuPG MIME encrypted mails

[charlemagnelasse]

Describe the bug

I am so pissed that rspamd won't stop marking every gnupg encrypted+signed mail I receive with BOGUS_ENCRYPTED_AND_TEXT(10.00){pgp part;}. The senders are normal people which use MUAs like kmail and don't do anything special to deserve this handling.

I've also tried to avoid this by creating a file called /etc/rspamd/local.d/gpg.conf and adding the content

gnupg {
    priority = high;
    id = "gnupg";
    apply {
        BOGUS_ENCRYPTED_AND_TEXT = 0.0;
    }
}

But rspamd ignores this (after a restart) and still marks every gnupg encrypted MIME mail as BOGUS_ENCRYPTED_AND_TEXT(10.00){pgp part;}

Steps to Reproduce

1. Open kmail
2. send gnupg MIME encrypted+signed mail to server with rspamd installed
3. wonder where the mail is

Expected behavior

GnuPG MIME encrypted mail is parsed as it should be and not marked as BOGUS_ENCRYPTED_AND_TEXT(10.00){pgp part;}.

Versions

Rspamd daemon version 2.2

[charlemagnelasse]

I think I found at least a workaround. I've used as reference https://rspamd.com/doc/faq.html#how-to-change-score-for-some-symbol and changed the content of the file /etc/rspamd/local.d/groups.conf to

symbols {
  "BOGUS_ENCRYPTED_AND_TEXT" {
    weight = 0.0;
  }
}

[vstakhov]

Your issue subject is not relevant to it's content: it is likely kmail issue from what I see. Anyway, I cannot say anything without relevant messages samples.

[charlemagnelasse]

Example body (SMTP envelope dropped to reduce the size) from kmail:

From: Charlemagne Lasse <[email protected]>
To: [email protected]
Subject: test
Date: Wed, 08 Jan 2020 11:11:39 +0100
Message-ID: <2435841.lPEHJQrH1c@charlemagne>
MIME-Version: 1.0
Content-Type: multipart/encrypted; boundary="nextPart2302113.qGZtTGQmum"; protocol="application/pgp-encrypted"

--nextPart2302113.qGZtTGQmum
Content-Type: application/pgp-encrypted
Content-Disposition: attachment
Content-Transfer-Encoding: 7Bit

Version: 1
--nextPart2302113.qGZtTGQmum
Content-Type: application/octet-stream
Content-Disposition: inline; filename="msg.asc"
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP MESSAGE-----

dGhpcyBpcyBqdXN0IGEgcmFuZG9tIHRlc3QK
-----END PGP MESSAGE-----

--nextPart2302113.qGZtTGQmum--

rspamc results:

Results for file: test.eml (0.036 seconds)
[Metric: default]
Action: add header
Spam: true
Score: 12.40 / 100.00
Symbol: ARC_NA (0.00)
Symbol: BOGUS_ENCRYPTED_AND_TEXT (10.00)[pgp part]
Symbol: DMARC_POLICY_SOFTFAIL (0.10)[gmail.com : No valid SPF, No valid DKIM, none]
Symbol: ENCRYPTED_PGP (-0.50)
Symbol: FREEMAIL_ENVFROM (0.00)[gmail.com]
Symbol: FREEMAIL_ENVRCPT (0.00)[gmail.com]
Symbol: FREEMAIL_FROM (0.00)[gmail.com]
Symbol: FREEMAIL_TO (0.00)[gmail.com]
Symbol: FROM_HAS_DN (0.00)
Symbol: HAS_ATTACHMENT (0.00)
Symbol: HFILTER_HOSTNAME_UNKNOWN (2.50)
Symbol: MID_RHS_NOT_FQDN (0.50)
Symbol: MIME_GOOD (-0.20)[multipart/encrypted]
Symbol: MIME_TRACE (0.00)[0:+, 1:~, 2:~]
Symbol: NEURAL_SPAM (0.00)[0.305]
Symbol: RCPT_COUNT_ONE (0.00)[1]
Symbol: RCVD_COUNT_ZERO (0.00)[0]
Symbol: R_DKIM_NA (0.00)
Symbol: TO_DN_NONE (0.00)
Symbol: TO_EQ_FROM (0.00)
Message-ID: 2435841.lPEHJQrH1c@charlemagne

[vstakhov]

Fixed, thank you!

[ra1nb0w]

also fix s/mime. thank you