7 ms·

It's a shame /etc/hosts doesn't support wildcards 0.0.0.0 *.facebook.com

rbritton 9y ago
You could sort of work around that by just blocking their IP ranges: https://stackoverflow.com/a/11164738 https://stackoverflow.com/a/11164738
- topranks 9y ago
  The ranges could change over time. If you run your own DNS resolver you can use the wildcard trick. Something like this in an RPZ zone should do it: facebook.com IN CNAME . *.facebook.com IN CNAME . facebook.net IN CNAME . *.facebook.net IN CNAME . fbcdn.com IN CNAME . *.fbcdn.com IN CNAME . fbcdn.net IN CNAME . *.fbcdn.net IN CNAME . fb.com IN CNAME . *.fb.com IN CNAME . fb.me IN CNAME . *.fb.me IN CNAME . tfbnw.com IN CNAME . *.tfbnw.com IN CNAME .
  - zaarn 9y ago
    *.facebook.com IN CNAME . should be unnecessary since the DNS zone above it, facebook.com is already CNAME'd. Most resolvers will take a CNAME as "any further requests go to here", which to my experience usually includes NS servers. (This is also why you don't CNAME your root domain, CNAME conflicts with any other record type)
joeblau 9y ago
That would only slightly help considering they own so many TLD’s.
- topranks 9y ago
  Looking at that lists it'd be 16 wildcard entries vs. 895 hostnames. A significant improvement.
  - boardwaalk 9y ago
    It'd be more future-proof too.
  - joeblau 9y ago
    I don't use that list, I use Steven Black's [1] list has 1004 entries which is more complete than this list. It would be less, but more than 16. Even at that, you're right it would definitely reduce the size. - [1] https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/
vortico 9y ago
What software actually parses /etc/hosts, at least on Linux?
- kazinator 9y ago
  > What software actually parses /etc/hosts, at least on Linux? glibc resolver A good entry point for reading more about it: $ man nsswitch.conf If your /etc/nsswitch.conf file's "hosts" line contains the keyword "files", then it potentially uses /etc/hosts. If "files" is first (typical default config), it looks there first, before the other places listed. This is done under the hood when programs use resolver functions like gethostbyname or getaddrinfo.
  - asamarin 9y ago
    You can see this in action on musl source code, which is arguably a much more readily understandable implementation of libc: - Function that actually parses /etc/hosts is name_from_hosts(), implemented here: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n48 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is called by __lookup_name() on the same file: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n287 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is, in turn, called directly from getaddrinfo() [http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c#n49 http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...], the actual function exposed to you as libc user.
walrus01 9y ago
you can do this with a DNS zonefile at your local resolver, though.
strkek 9y ago
You might want to take a look at dnsmasq. It's a nice choice for when you want a DNS server but BIND is overkill.

You could sort of work around that by just blocking their IP ranges: https://stackoverflow.com/a/11164738 https://stackoverflow.com/a/11164738

topranks 9y ago
The ranges could change over time. If you run your own DNS resolver you can use the wildcard trick. Something like this in an RPZ zone should do it: facebook.com IN CNAME . *.facebook.com IN CNAME . facebook.net IN CNAME . *.facebook.net IN CNAME . fbcdn.com IN CNAME . *.fbcdn.com IN CNAME . fbcdn.net IN CNAME . *.fbcdn.net IN CNAME . fb.com IN CNAME . *.fb.com IN CNAME . fb.me IN CNAME . *.fb.me IN CNAME . tfbnw.com IN CNAME . *.tfbnw.com IN CNAME .
- zaarn 9y ago
  *.facebook.com IN CNAME . should be unnecessary since the DNS zone above it, facebook.com is already CNAME'd. Most resolvers will take a CNAME as "any further requests go to here", which to my experience usually includes NS servers. (This is also why you don't CNAME your root domain, CNAME conflicts with any other record type)

joeblau 9y ago

That would only slightly help considering they own so many TLD’s.

topranks 9y ago
Looking at that lists it'd be 16 wildcard entries vs. 895 hostnames. A significant improvement.
- boardwaalk 9y ago
  It'd be more future-proof too.
- joeblau 9y ago
  I don't use that list, I use Steven Black's [1] list has 1004 entries which is more complete than this list. It would be less, but more than 16. Even at that, you're right it would definitely reduce the size. - [1] https://github.com/StevenBlack/hosts/ https://github.com/StevenBlack/hosts/

vortico 9y ago

What software actually parses /etc/hosts, at least on Linux?

kazinator 9y ago
> What software actually parses /etc/hosts, at least on Linux? glibc resolver A good entry point for reading more about it: $ man nsswitch.conf If your /etc/nsswitch.conf file's "hosts" line contains the keyword "files", then it potentially uses /etc/hosts. If "files" is first (typical default config), it looks there first, before the other places listed. This is done under the hood when programs use resolver functions like gethostbyname or getaddrinfo.
- asamarin 9y ago
  You can see this in action on musl source code, which is arguably a much more readily understandable implementation of libc: - Function that actually parses /etc/hosts is name_from_hosts(), implemented here: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n48 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is called by __lookup_name() on the same file: http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c#n287 http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... - Which is, in turn, called directly from getaddrinfo() [http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c#n49 http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...], the actual function exposed to you as libc user.

walrus01 9y ago

you can do this with a DNS zonefile at your local resolver, though.

strkek 9y ago

You might want to take a look at dnsmasq. It's a nice choice for when you want a DNS server but BIND is overkill.