Proxy blacklist does block domain with subdomain

[gitdevmod]

If I select audio-video blacklist from UT1 blacklist, "youtube.com" is denied but "www.youtube.com" is allowed.
Maybe squid acl should use dstdom_regex ?

[AdSchellevis]

no, it shouldn't, can you inspect your list first? if there is another subdomain of .youtube.com allowed, it won't deny all on youtube.com, because of overlap.
You can easily grep the list in /usr/local/etc/squid/acl/ to see if that's the case here.

[gitdevmod]

I think it's because there is no "." before the domain
With the blacklist http://dsi.ut-capitole.fr/blacklists/download/audio-video.tar.gz

# grep youtube.com audio-video/domains
amazingyoutube.com
bannedfromyoutube.com
youtube.com

[AdSchellevis]

it probably misses a "." before youtube.com, but not before the other two above this. it should match .youtube.com here. I will look into this.

[fichtner]

See also: https://forum.opnsense.org/index.php?topic=2419.0

[AdSchellevis]

This commit b1034aa solves the missing dot in the processed list.

In case you want to try before any release, you can easily download the script from github using:

curl -o /usr/local/opnsense/scripts/proxy/fetchACLs.py https://raw.githubusercontent.com/opnsense/core/master/src/opnsense/scripts/proxy/fetchACLs.py

The processed output looks like this on my machine:

# grep youtube /usr/local/etc/squid/acl/audiovideo
.mp3indir.youtube89.net
.youtube.youtube89.net
.youtube.fr
.topyoutubevideos.com
.youtubegoo.com
.bannedfromyoutube.com
.amazingyoutube.com
.youtube.com
.youtubevideos.biz

[gitdevmod]

After "Download ACLs & Apply" it works as expected 👍 Thanks