Allowlist does not seem to override glob

[remyabel2]

dnscrypt-proxy version 2.1.1

The blocklist local additions by default contains tracker.*, however even when I add domains like tracker.domain.com to domains-allowlist.txt, they still get blocked.

[ianbashford]

I'm not seeing that behaviour - I just double checked on 2.1.0 and 2.1.1
This is the configuration I used - perhaps you could try a similar minimal configuration to check:

# grep -e blocked-names -e allowed-names dnscrypt-proxy.toml
  blocked_names_file = '/etc/dnscrypt-proxy/blocked-names.txt'
  allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'

# cat blocked-names.txt
tracker.*

# cat allowed-names.txt
tracker.debian.org

# journalctl -b -u dnscrypt-proxy 
<snip>
Dec 22 17:50:04 router1 dnscrypt-proxy[31274]: [2021-12-22 17:50:04] [NOTICE] Source [public-resolvers] loaded
Dec 22 17:50:04 router1 dnscrypt-proxy[31274]: [2021-12-22 17:50:04] [NOTICE] Loading the set of allowed names from [/etc/dnscrypt-proxy/allowed-names.txt]
Dec 22 17:50:04 router1 dnscrypt-proxy[31274]: [2021-12-22 17:50:04] [NOTICE] Firefox workaround initialized
Dec 22 17:50:04 router1 dnscrypt-proxy[31274]: [2021-12-22 17:50:04] [NOTICE] Loading the set of blocking rules from [/etc/dnscrypt-proxy/blocked-names.txt]
Dec 22 17:50:04 router1 dnscrypt-proxy[31274]: [2021-12-22 17:50:04] [NOTICE] Loading the set of forwarding rules from [/etc/dnscrypt-proxy/forwarding-rules.txt]
<snip>

dig tracker.debian.org @192.168.3.8

; <<>> DiG 9.16.23 <<>> tracker.debian.org @192.168.3.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37395
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;tracker.debian.org.		IN	A

;; ANSWER SECTION:
tracker.debian.org.	3340	IN	A	209.87.16.64

;; Query time: 13 msec
;; SERVER: 192.168.3.8#53(192.168.3.8)
;; WHEN: Wed Dec 22 17:50:00 GMT 2021
;; MSG SIZE  rcvd: 63

[remyabel2]

Sorry, I was a little vague. I'm talking about the files in utils/generate-domains-blocklist/ (that is, I'm not using blocked-names.txt and allowed-names.txt in /etc/dnscrypt-proxy). So the relevant files would be: domains-allowlist.txt and domains-blocklist-local-additions.txt as well as the generate-domains-blocklist script. I have blocked_names_file set.

Inside domains-allowlist.txt:

tracker.debian.org  

Inside domains-blocklist-local-additions.txt:

tracker.*

From blocked.log:

127.0.0.1	tracker.debian.org	tracker.*

[ianbashford]

I understand...
The domains-blocklist-local-additions.txt contains an instruction to block everything with tracker.*

When you add tracker.debian.org to the domains-allowlist.txt you're expecting that to override tracker.*

I've thought about this, and I'm not sure that would be desirable behaviour -- my advice is to configure the allowed_names file as I described above. Let me try to explain why I think it's behaving correctly:

That python script is only generating a simple blocklist - one line one instruction. The domains-allowlist.txt isn't an instruction to dnscrypt-proxy at runtime; instead, if one of the configured sources in either domains-blocklist.conf or domains-blocklist-local-additions.txt contains a domain name that matches your allowlist, it won't put it in the blocklist it generates.

tracker.* as a blocking instruction will by necessity take priority over tracker.debian.org as an allow instruction because it can't refactor
block everything starting with tracker. except tracker.debian.org into a single instruction for a block list file

So you have a few choices -- you could remove tracker.* from the local additions or, simpler in my mind, you could configure an allowlist in dnscrypt-proxy which is a runtime instruction and will override anything in the generated blocklist