1"use strict";(self.webpackChunkrspamd_docs=self.webpackChunkrspamd_docs||[]).push([[6016],{28453:(e,n,s)=>{s.d(n,{R:()=>i,x:()=>t});var r=s(96540);const d={},l=r.createContext(d);function i(e){const n=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function t(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(d):e.components||d:i(e.components),r.createElement(l.Provider,{value:n},e.children)}},44815:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>o,contentTitle:()=>t,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>c});const r=JSON.parse('{"id":"modules/asn","title":"ASN module","description":"The ASN module retrieves Autonomous System Number (ASN) information and related data for the sender\'s IP address. This includes the ASN, country code of the ASN owner, and the IP\'s announced subnet (network prefix).","source":"@site/docs/modules/asn.md","sourceDirName":"modules","slug":"/modules/asn","permalink":"/modules/asn","draft":false,"unlisted":false,"editUrl":"https://github.com/rspamd/docs.rspamd.com/edit/master/docs/modules/asn.md","tags":[],"version":"current","frontMatter":{"title":"ASN module"},"sidebar":"docs","previous":{"title":"ARC module","permalink":"/modules/arc"},"next":{"title":"Bayes expiry module","permalink":"/modules/bayes_expiry"}}');var d=s(74848),l=s(28453);const i={title:"ASN module"},t="ASN module",o={},c=[{value:"How it works",id:"how-it-works",level:2},{value:"Exported variables",id:"exported-variables",level:2},{value:"Symbols",id:"symbols",level:2},{value:"Configuration",id:"configuration",level:2},{value:"Provider info defaults",id:"provider-info-defaults",level:3},{value:"Example configuration",id:"example-configuration",level:2},{value:"Using ASN data in Lua",id:"using-asn-data-in-lua",level:2},{value:"Using ASN data in multimap",id:"using-asn-data-in-multimap",level:2}];function a(e){const n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,l.R)(),...e.components};return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(n.header,{children:(0,d.jsx)(n.h1,{id:"asn-module",children:"ASN module"})}),"\n",(0,d.jsx)(n.p,{children:"The ASN module retrieves Autonomous System Number (ASN) information and related data for the sender's IP address. This includes the ASN, country code of the ASN owner, and the IP's announced subnet (network prefix)."}),"\n",(0,d.jsx)(n.p,{children:"The retrieved information is stored as mempool variables and made available to other plugins and modules for use in filtering rules."}),"\n",(0,d.jsx)(n.h2,{id:"how-it-works",children:"How it works"}),"\n",(0,d.jsxs)(n.p,{children:["The module performs DNS TXT lookups against a DNSBL-style service. The IP octets are reversed before the lookup, so for an IP address like ",(0,d.jsx)(n.code,{children:"1.2.3.4"})," the query is ",(0,d.jsx)(n.code,{children:"4.3.2.1.asn.rspamd.com"}),". For example, querying ",(0,d.jsx)(n.code,{children:"1.2.3.4"})," receives a response like:"]}),"\n",(0,d.jsx)(n.pre,{children:(0,d.jsx)(n.code,{children:"1234 | 1.2.3.0/24 | DE | ripe |\n"})}),"\n",(0,d.jsx)(n.p,{children:"This is parsed to extract:"}),"\n",(0,d.jsxs)(n.ul,{children:["\n",(0,d.jsxs)(n.li,{children:[(0,d.jsx)(n.strong,{children:"ASN"}),": ",(0,d.jsx)(n.code,{children:"1234"})," (the AS number)"]}),"\n",(0,d.jsxs)(n.li,{children:[(0,d.jsx)(n.strong,{children:"IP Network"}),": ",(0,d.jsx)(n.code,{children:"1.2.3.0/24"})," (the announced subnet)"]}),"\n",(0,d.jsxs)(n.li,{children:[(0,d.jsx)(n.strong,{children:"Country"}),": ",(0,d.jsx)(n.code,{children:"DE"})," (country code)"]}),"\n"]}),"\n",(0,d.jsx)(n.h2,{id:"exported-variables",children:"Exported variables"}),"\n",(0,d.jsx)(n.p,{children:"The module exports the following mempool variables, available to Lua plugins after the prefilters stage:"}),"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",(0,d.jsxs)(n.table,{children:[(0,d.jsx)(n.thead,{children:(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.th,{children:"Variable"}),(0,d.jsx)(n.th,{children:"Description"}),(0,d.jsx)(n.th,{children:"Example"})]})}),(0,d.jsxs)(n.tbody,{children:[(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"asn"})}),(0,d.jsx)(n.td,{children:"Autonomous System Number"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"15169"})})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"ipnet"})}),(0,d.jsx)(n.td,{children:"Announced IP network/subnet"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"8.8.8.0/24"})})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"country"})}),(0,d.jsx)(n.td,{children:"Country code of ASN owner"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"US"})})]})]})]}),"\n",(0,d.jsx)(n.h2,{id:"symbols",children:"Symbols"}),"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",(0,d.jsxs)(n.table,{children:[(0,d.jsx)(n.thead,{children:(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.th,{children:"Symbol"}),(0,d.jsx)(n.th,{children:"Score"}),(0,d.jsx)(n.th,{children:"Description"})]})}),(0,d.jsxs)(n.tbody,{children:[(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"ASN"})}),(0,d.jsx)(n.td,{children:"0.0"}),(0,d.jsx)(n.td,{children:"Informational symbol with ASN lookup results"})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"ASN_FAIL"})}),(0,d.jsx)(n.td,{children:"0.0"}),(0,d.jsx)(n.td,{children:"DNS lookup failed"})]})]})]}),"\n",(0,d.jsx)(n.h2,{id:"configuration",children:"Configuration"}),"\n",(0,d.jsxs)(n.p,{children:["The ASN module is enabled by default. Settings can be added to ",(0,d.jsx)(n.code,{children:"/etc/rspamd/local.d/asn.conf"}),"."]}),"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",(0,d.jsxs)(n.table,{children:[(0,d.jsx)(n.thead,{children:(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.th,{children:"Option"}),(0,d.jsx)(n.th,{children:"Type"}),(0,d.jsx)(n.th,{children:"Default"}),(0,d.jsx)(n.th,{children:"Description"})]})}),(0,d.jsxs)(n.tbody,{children:[(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"provider_type"})}),(0,d.jsx)(n.td,{children:"string"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"rspamd"})}),(0,d.jsxs)(n.td,{children:["Provider type (currently only ",(0,d.jsx)(n.code,{children:"rspamd"})," is supported)"]})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"provider_info"})}),(0,d.jsx)(n.td,{children:"object"}),(0,d.jsx)(n.td,{children:"(see below)"}),(0,d.jsx)(n.td,{children:"Provider-specific settings"})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"symbol"})}),(0,d.jsx)(n.td,{children:"string"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"ASN"})}),(0,d.jsx)(n.td,{children:"Symbol to insert with lookup results"})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"check_local"})}),(0,d.jsx)(n.td,{children:"boolean"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"false"})}),(0,d.jsx)(n.td,{children:"Perform lookups for local/private IP addresses"})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"check_authed"})}),(0,d.jsx)(n.td,{children:"boolean"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"true"})}),(0,d.jsx)(n.td,{children:"Perform lookups for authenticated users"})]}),(0,d.jsxs)(n.tr,{children:[(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"symbol_fail"})}),(0,d.jsx)(n.td,{children:"string"}),(0,d.jsx)(n.td,{children:(0,d.jsx)(n.code,{children:"ASN_FAIL"})}),(0,d.jsx)(n.td,{children:"Symbol to insert when the DNS lookup fails"})]})]})]}),"\n",(0,d.jsx)(n.h3,{id:"provider-info-defaults",children:"Provider info defaults"}),"\n",(0,d.jsx)(n.pre,{children:(0,d.jsx)(n.code,{className:"language-hcl",children:'provider_info {\n ip4 = "asn.rspamd.com";\n ip6 = "asn6.rspamd.com";\n}\n'})}),"\n",(0,d.jsx)(n.h2,{id:"example-configuration",children:"Example configuration"}),"\n",(0,d.jsx)(n.pre,{children:(0,d.jsx)(n.code,{className:"language-hcl",children:'# local.d/asn.conf\n\n# Provider type (only "rspamd" currently supported)\nprovider_type = "rspamd";\n\n# DNS servers for lookups\nprovider_info {\n ip4 = "asn.rspamd.com";\n ip6 = "asn6.rspamd.com";\n}\n\n# Symbol name for results\nsymbol = "ASN";\n\n# Skip lookups for local IPs (default)\ncheck_local = false;\n'})}),"\n",(0,d.jsx)(n.h2,{id:"using-asn-data-in-lua",children:"Using ASN data in Lua"}),"\n",(0,d.jsx)(n.p,{children:"The ASN data can be accessed from Lua plugins after the prefilters stage:"}),"\n",(0,d.jsx)(n.pre,{children:(0,d.jsx)(n.code,{className:"language-lua",children:"local function my_callback(task)\n local asn = task:get_mempool():get_variable('asn')\n local country = task:get_mempool():get_variable('country')\n local ipnet = task:get_mempool():get_variable('ipnet')\n \n if asn then\n rspamd_logger.infox(task, 'ASN: %s, Country: %s, Network: %s', \n asn, c
1ountry or 'unknown', ipnet or 'unknown')\n end\nend\n"})}),"\n",(0,d.jsx)(n.h2,{id:"using-asn-data-in-multimap",children:"Using ASN data in multimap"}),"\n",(0,d.jsxs)(n.p,{children:["The ASN data can be used with the ",(0,d.jsx)(n.a,{href:"/modules/multimap",children:"multimap"})," module:"]}),"\n",(0,d.jsx)(n.pre,{children:(0,d.jsx)(n.code,{className:"language-hcl",children:'# local.d/multimap.conf\n\n# Check ASN against a list\nASN_BLACKLIST {\n type = "asn";\n map = "/etc/rspamd/asn_blacklist.map";\n score = 5.0;\n description = "ASN is in blacklist";\n}\n\n# Check country code\nCOUNTRY_BLACKLIST {\n type = "country";\n map = "/etc/rspamd/country_blacklist.map";\n score = 2.0;\n description = "Sender country is blacklisted";\n}\n'})})]})}function h(e={}){const{wrapper:n}={...(0,l.R)(),...e.components};return n?(0,d.jsx)(n,{...e,children:(0,d.jsx)(a,{...e})}):a(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.