Add $denyallow modifier support

[ameshkov]

This issue explains the need for it:
#2917

Here's the spec on $denyallow in content blockers: AdguardTeam/CoreLibs#1304 (comment)

@ainar-g I've assigned it to v0.106.0 since I am going to implement it myself, it shouldn't slow down the release.

See the spec below.

denyallow

(Since v0.106.0.)

You can use the $denyallow modifier to exclude domains from the blocking rule. To add multiple domains to one rule, use the | character as a separator.

The syntax is:

$denyallow=domain1|domain2|...

It allows avoiding creating unnecessary "exception" rules when our blocking rule covers too many domains. Here's a simple use-case, you may want to block everything save for a couple of TLD domains. You could use the standard approach, i.e. rules like this:

! Block everything
/.*/
! Unblock a couple of TLDs
@@||com^
@@||net^

The problem with this approach is that this way you will also unblock tracking domains that are located on those TLDs (i.e. google-analytics.com). Here's how to solve this with $denyallow:

*$denyallow=com|net

Examples

• *$denyallow=com|net — Block everything save for *.com and *.net.
• @@*$denyallow=com|net — Unblock everything save for *.com and *.net
• ||example.org^$denyallow=sub.example.org — Block example.org and *.example.org, but don't block sub.example.org

[ainar-g]

It seems like this is fully merged and documented, so I'll close the issue.

[kiwilad-nz]

Just recently installed in docker to trial AdguardHome. Have to say superb, everything appears to be working as intended but don't know if this new addition is working as intended or I am adding the entry wrong.

I am having issues trying to use this feature as resolving stops entirely once adding the below rule.

I was on the understanding that if I added the below, any other TLD (such as .cn) that isn't listed below would be blocked AND would also block any subdomains that were in blocklists that were found in the below TLD's?

*$denyallow=au|ca|cc|ch|co|de|eu|fm|fr|gg|gl|im|io|it|lt|ly|me|ms|nl|nz|sk|tk|to|tv|uk|us

Applying this rule and using the "Check the filtering" query:

test.cn
*$denyallow=au|ca|cc|ch|co|de|eu|fm|fr|gg|gl|im|io|it|lt|ly|me|ms|nl|nz|sk|tk|to|tv|uk|us
Custom filtering rules

test.nz
Not found in your filter lists

C:\Users\strut>nslookup trademe.co.nz
Server:  UnKnown
Address:  192.168.1.3

Non-authoritative answer:
Name:    trademe.co.nz
Address:  0.0.0.0

It appears the above works but resolving just simply stops until the rule is removed.

C:\Users\strut>nslookup trademe.co.nz
Server:  AnsibleNAS.kiwilad.nz
Address:  192.168.1.3

Non-authoritative answer:
Name:    trademe.co.nz
Addresses:  151.101.194.137
          151.101.130.137
          151.101.66.137
          151.101.2.137

[ameshkov]

Uh, I see the issue with it, nice bug.

The problem is that the rule is also applied to IP addresses in the responses and blocks them:
#3175

[kiwilad-nz]

Hi ameshkov,

I added your temporary fix which works but how come the server name now shows as unknown? Without the rule, the hostname then shows again.

Also, I can't have dual rules as this also appears to break dns resolution. Reason it would be nice is so I can add different lines for different TLD categories.

@@/^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$/
$denyallow=au|ca|cc|ch|co|de|eu|fm|fr|gg|gl|im|io|it|lt|ly|me|ms|nl|nz|sk|tk|to|tv|uk|us
$denyallow=com|net|org

C:\Users\strut>nslookup trademe.co.nz
Server:  UnKnown
Address:  192.168.1.3

Non-authoritative answer:
Name:    trademe.co.nz
Addresses:  151.101.66.137
          151.101.130.137
          151.101.2.137
          151.101.194.137

C:\Users\strut>nslookup trademe.co.cn
Server:  UnKnown
Address:  192.168.1.3

Non-authoritative answer:
Name:    trademe.co.cn
Address:  0.0.0.0

[ameshkov]

Also, I can't have dual rules as this also appears to break dns resolution

Well, these are two different rules with their different scopes, that's how it works.

how come the server name now shows as unknown

Tbh, no idea, I always thought this is some kind of a Windows-specific issue with nslookup.