The rule of block quic but with some exceptions.

[JerryWn12]

In default, I want block quic but there is some apps have problems on it, such as youtube music, it can't play some music when quic is blocked.
So I write these rules (minimized):

rules:
  - PROCESS-NAME,music.exe,Proxy
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - RULE-SET,adblock,REJECT

But, there is another problem: the music.exe can not have adblock.
Of course we can move adblock to top like this:

rules:
  - RULE-SET,adblock,REJECT
  - PROCESS-NAME,music.exe,Proxy
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT

But what if there is some traffic from music.exe need to be direct?
Hola, here is the solution:

rules:
  - RULE-SET,direct,DIRECT
  - PROCESS-NAME,music.exe,Proxy
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - RULE-SET,adblock,REJECT

And there is a final question: how to block quic of direct traffic?
Of course we can have logic rules in it:

rules:
  - AND,((RULE-SET,direct),(AND,((NETWORK,UDP),(DST-PORT,443)))),REJECT
  - RULE-SET,direct,DIRECT
  - PROCESS-NAME,music.exe,Proxy
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - RULE-SET,adblock,REJECT

But we can find that we messed up these rules, its unreadable and have huge changes just because we want skip an exe from a rule. And we need music.exe still check all the rules.

So the rule should be like this:

rules:
  - PROCESS-NAME,music.exe,SKIP-NEXT
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - RULE-SET,adblock,REJECT
  - RULE-SET,direct,DIRECT

There is no such keyword. But I found the SUB-RULE, it's like switch statement in programing language:

rules:
  - SUB-RULE,(PROCESS-NAME,music.exe),allow-quic
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - SUB-RULE,(MATCH),allow-quic
sub-rules:
  allow-quic:
    - RULE-SET,adblock,REJECT
    - RULE-SET,direct,DIRECT

But it shows the error message: Parse config error: rules[2] [SUB-RULE,(MATCH),allow-quic] error: [MATCH] format is error.

And we can have a workaround that match any process: SUB-RULE,(PROCESS-NAME-REGEX,*),allow-quic, but it may affect performance.

So I duplicated rules 2 times and here is the final solution:

rules:
  - SUB-RULE,(PROCESS-NAME,music.exe),allow-quic
  - AND,((NETWORK,UDP),(DST-PORT,443)),REJECT
  - RULE-SET,adblock,REJECT
  - RULE-SET,direct,DIRECT
sub-rules:
  allow-quic:
    - RULE-SET,adblock,REJECT (same as above)
    - RULE-SET,direct,DIRECT (same as above)

And my question is: how to achieve this and don't have such workarounds?

[JerryWn12]

Ok, it should be the solution:

rule-providers:
  allow-quic:
    type: file
    format: yaml
    path: allow-quic.yaml
    behavior: classical
rules:
  - AND,((AND,((NETWORK,UDP),(DST-PORT,443))),(NOT,((RULE-SET,allow-quic)))),REJECT
  - RULE-SET,adblock,REJECT
  - RULE-SET,direct,DIRECT

allow-quic.yaml:

payload:
  - PROCESS-NAME,music.exe