Can't block a domain name !

[gcpmusic]

I can't manage to completely block sentry.io domain even with .sentry. as show below. Any suggestion?
Thank you in advance.

[lifenjoiner]

By my test on Windows:

1. Uncomment this line (your config file)
   

   dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

   Line 510 in 31f4d7a

   # blocked_names_file = 'blocked-names.txt'

   
   to

     blocked_names_file = 'blocked-names.txt'
   

2. Remane https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-blocked-names.txt to blocked-names.txt
3. Append sentry.io to blocked-names.txt

It is blocked!

[gcpmusic]

Many thanks for the reply. What you suggest, is what I am doing successfully from years and all domain have always been blocked as expected. However, sentry.io is a little devil, as my screenshot above show, in some way sometimes manage to slip away.

What I don't understand is why the domain is marked with different entry such HTTPS and A . Probably because are a different kind of connections?

In my blocked-names.txt filter, is appended as this:
x.sentry.x (x stands for asterisk)
sentry.io HTTPS
sentry.io A

and this is my new log!!

[2021-05-11 13:25:57] 127.0.0.54 sentry.io HTTPS
PASS 172ms cs-rome
[2021-05-11 13:25:57] 127.0.0.54 sentry.io A
PASS 202ms cs-rome
[2021-05-11 13:44:36] 127.0.0.54 o36975.ingest.sentry.io A
REJECT 1ms -

Also to note, this connection is called from some of the application in my computer as I never browse the website.

[lifenjoiner]

Oops! If it is a special case, you'd better provide your configs first as more as possible, to let others reproduce and/or diagnose what the problem really is.

In my blocked-names.txt filter, is appended as this:
x.sentry.x (x stands for asterix)
sentry.io HTTPS
sentry.io A

I think maybe it's because of the syntaxes are only:

dnscrypt-proxy/dnscrypt-proxy/example-blocked-names.txt

Lines 6 to 16 in 31f4d7a

	## Rules for name-based query blocking, one per line
	##
	## Example of valid patterns:
	##
	## ads.* | matches anything with an "ads." prefix
	## *.example.com | matches example.com and all names within that zone such as www.example.com
	## example.com | identical to the above
	## =example.com | block example.com but not *.example.com
	## *sex* | matches any name containing that substring
	## ads[0-9]* | matches "ads" followed by one or more digits
	## ads*.example* | *, ? and [] can be used anywhere, but prefixes/suffixes are faster

[gcpmusic]

Thanks for the reply. The syntax is correct, everything is working perfectly here a part for sentry.io block.
As here the asterisk seem not allowed, I replaced with x as explained in the brackets but just created confusion.

A screenshot of my blocked-names.txt is better:

This is my full .toml config as request.
dnscrypt-proxy.toml.zip

Thank you for the help. Really appreciated.

[lifenjoiner]

After reading

dnscrypt-proxy/dnscrypt-proxy/plugin_block_name.go

Lines 95 to 122 in eda8dd5

	for lineNo, line := range strings.Split(string(bin), "\n") {
	line = TrimAndStripInlineComments(line)
	if len(line) == 0 {
	continue
	}
	parts := strings.Split(line, "@")
	timeRangeName := ""
	if len(parts) == 2 {
	line = strings.TrimSpace(parts[0])
	timeRangeName = strings.TrimSpace(parts[1])
	} else if len(parts) > 2 {
	dlog.Errorf("Syntax error in block rules at line %d -- Unexpected @ character", 1+lineNo)
	continue
	}
	var weeklyRanges *WeeklyRanges
	if len(timeRangeName) > 0 {
	weeklyRangesX, ok := (*xBlockedNames.allWeeklyRanges)[timeRangeName]
	if !ok {
	dlog.Errorf("Time range [%s] not found at line %d", timeRangeName, 1+lineNo)
	} else {
	weeklyRanges = &weeklyRangesX
	}
	}
	if err := xBlockedNames.patternMatcher.Add(line, weeklyRanges, lineNo+1); err != nil {
	dlog.Error(err)
	continue
	}
	}

and
https://github.com/DNSCrypt/dnscrypt-proxy/blob/eda8dd51817cb82fc32d42e18c50d667c4b9f6a8/dnscrypt-proxy/pattern_matcher.go

It seems only @weeklyRanges is possible as the 2nd part of an entry; neither HTTPS, nor A.
You can also see the examples at the end of example-blocked-names.txt.

[gcpmusic]

Yes I know. I only added later

sentry.io HTTPS
and
sentry.io A

in the blocked-names.txt as showed in the log just because the correct pattern asterisk.sentry.asterisk doesn't work. Note that only for this domain this pattern doesn't work. For other hundreds domain this and all other patterns works perfectly.
Thanks

[jedisct1]

*.sentry.* should work like any other pattern.

Check that all characters are correct, thank you don't have a , instead of a dot, or a unicode character like ⁎ instead of * . Maybe delete the line and type it again.

Also check that it's not overridden by a rule in the allow list.

Or share the actual block file, since screenshots are not very helpful to reproduce this.

[ghost]

Hi!
Am I missing something? From the code it seems like the asterisks are trimmed and then it is checked if "sentry.io" contains ".sentry." which it doesn't. So everything seems to work as expected.

[jedisct1]

Ah, of course. I didn't look at the code, but obviously if you want to match yz, blocking *xyz* is not going to do anything.
Same thing for sentry vs *.sentry*. If you're matching substrings, a dot character is just the same thing as any other character.

[gcpmusic]

livingentity,
Yes the asterisks are trimmed here but are properly in place in the blocked-names.txt and everything isnt fine, works partially.

jedisct1,
I already did all the check you suggested. Thanks
Here is the actual block file log as requested:
query.log.zip

Anyway I just realised that this happen only on Big Sur. On Mojave is fine but I think only because there is not app in my Mojave that trigger the sentry.io DNS call.

I suspect is the LuLu firewall requesting the connection but the issue still remains as should block it anyway fully and not partially as the log show.

[gcpmusic]

jedisct1 thank you. I am not sure to understand.

The - HTTPS - and the - A - next to sentry.io show up only for some of the sentry.io query on the log file and these are the only non rejected query.

All the other query are blocked such:
www.sentry.io
www.sentry.dev
o36975.ingest.sentry.io

I don't know what the added - HTTPS - and the - A - mean. However, I notice that they also appears on other domain that actually I don't block, on some that I do block and on all the nx.log which, for my understanding, don't go anywhere. Am I correct?

Totally confused 🤔

[jedisct1]

All the other query are blocked such:
www.sentry.io
www.sentry.dev
o36975.ingest.sentry.io

You are blocking .sentry.

The names above contain .sentry.

sentry.io, without any . before sentry doesn't contain .sentry..

[gcpmusic]

I see, many many thanks. sentry.* works 👍 and together *.sentry.* all sentry.io are finally blocked.
Cheers

[jedisct1]

*🍉* does the same thing as the "search" function of your text editor when searching for 🍉

Open a text editor.

Type:

sentry.io
foo.sentry.bar

Then use the search function to search for .sentry. - The text editor says that there is no match on the first line, only on the second.

[gcpmusic]

Great tip thanks. In the future I will use a text editor as debugger :-)