<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Interesting.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is the allow-file used to allow domains that are in the block file?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Since you don't sort the entries how do you handle multiple block/allow files?</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Dnsmasq-discuss <dnsmasq-discuss-bounces@lists.thekelleys.org.uk> on behalf of Ercolino de Spiacico <bellocarico@hotmail.com><br>
<b>Sent:</b> Thursday, May 21, 2026 1:42 PM<br>
<b>To:</b> dnsmasq-discuss@lists.thekelleys.org.uk <dnsmasq-discuss@lists.thekelleys.org.uk><br>
<b>Subject:</b> [Dnsmasq-discuss] patch: block-file/allow-file - for review/feedback</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">In dnsmasq, domain filtering (for example, adblocking) currently relies
<br>
on built-in directives such as local and address. That approach works <br>
well up to a point, but it does not scale: around 15 MB (¡Ö700¨C800k <br>
domains) the process hangs regardless of available system resources.<br>
<br>
To take a different approach I developed this patch in attachment that <br>
adds two new directives: block-file and allow-file. Summary of the <br>
functionality:<br>
<br>
- Uses mmap() to load domain lists into RAM.<br>
<br>
- Multiple block-file directives are supported.<br>
<br>
- Multiple allow-file directives are supported.<br>
<br>
- Example syntax:<br>
<br>
block-file=/path/to/blockfile#NX,1<br>
<br>
NX is optional and can be replaced with any IP address to return instead <br>
of NX.<br>
<br>
The trailing ,1 is optional too, and enables logging when domains from <br>
that file are matched (useful to log only blocked domains).<br>
<br>
allow-file=/mnt/USB/blockfile-override,1<br>
<br>
- Mapped files must be pre-sorted (sorting is not included in this <br>
patch to keep the code minimal).<br>
<br>
- Blocking/allowing behaviour mimics dnsmasq¡¯s current semantics. For <br>
example:<br>
<br>
dnsmasq config:<br>
local=/example.com/ (blocked)<br>
server=/www.example.com/ (unblocked)<br>
<br>
After the patch:<br>
<br>
example.com ¡ú listed in block-file<br>
<a href="http://www.example.com">www.example.com</a> ¡ú listed in allow-file<br>
<br>
- Files are loaded one at a time and assesses against the amount of <br>
RAM available. If Current RAM usage + blockfile >= 80% of Total RAM, the <br>
loading is skipped and logged as a warning.<br>
<br>
- This code does not change DNS resolution itself; it performs a very <br>
fast name match to decide whether a query should proceed or be answered <br>
with NX or a custom IP.<br>
<br>
<br>
I developed this patch for FreshTomato router (dnsmasq v2.93rc1). On <br>
those small devices I performed a functional test loading 2.2M domains <br>
(55 MB blockfile) and reload the configuration without interruptions; no <br>
packet drops were observed during a config when reloading. This is <br>
already 3 time the current limit, but I haven't performed any proper <br>
capacity testing yet, which is expected to be much higher.<br>
<br>
<br>
Any comments or considerations are greatly appreciated.<br>
Thanks.</div>
</span></font></div>
</body>
</html>