to option

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [Unreleased]
+
+### Added
+- Support `$to=` option on network filters. Destination hostnames are stored as hashes and checked at match time via mapped domain lookups (bucketing unchanged).
+
+### Changed
+- DAT format version bumped to v6.
+
 ## [0.13.0] - 2026-07-09
 
 ### Added

Cargo.toml

@@ -95,6 +95,8 @@ default = ["embedded-domain-resolver", "full-regex-handling", "single-thread"]
 full-regex-handling = []
 single-thread = [] # disables `Send` and `Sync` on `Engine`.
 debug-info = []
+# Thread-local counters for network match funnel debugging (filters checked / reject stage).
+match-debug-stats = []
 css-validation = ["cssparser", "selectors"]
 content-blocking = []
 embedded-domain-resolver = ["addr"] # Requires setting an external domain resolver if disabled.

src/content_blocking.rs

@@ -199,6 +199,8 @@ pub enum CbRuleCreationFailure {
     NetworkCspUnsupported,
     /// Network rules with removeparam options cannot be supported in content blocking syntax.
     NetworkRemoveparamUnsupported,
+    /// Network rules with to= options cannot be supported in content blocking syntax.
+    NetworkToUnsupported,
     /// Content blocking syntax only supports a subset of regex features, namely:
     /// - Matching any character with “.”.
     /// - Matching ranges with the range syntax [a-b].
@@ -332,6 +334,9 @@ impl TryFrom<NetworkFilter<'_>> for CbRuleEquivalent {
             if v.is_removeparam() {
                 return Err(CbRuleCreationFailure::NetworkRemoveparamUnsupported);
             }
+            if v.opt_to_domains.is_some() || v.opt_not_to_domains.is_some() {
+                return Err(CbRuleCreationFailure::NetworkToUnsupported);
+            }
 
             let load_type = if v
                 .mask

src/data_format/mod.rs

@@ -17,7 +17,7 @@ const ADBLOCK_RUST_DAT_MAGIC: [u8; 4] = [0xd1, 0xd9, 0x3a, 0xaf];
 
 /// The version of the data format.
 /// If the data format version is incremented, the data is considered as incompatible.
-const ADBLOCK_RUST_DAT_VERSION: u8 = 5;
+const ADBLOCK_RUST_DAT_VERSION: u8 = 6;
 
 /// The total length of the header prefix (magic + version + seahash)
 const HEADER_PREFIX_LENGTH: usize = 4 + 1 + 8;

src/filters/abstract_network.rs

@@ -44,6 +44,7 @@ pub(crate) enum HttpMethod {
 #[derive(Clone)]
 pub(crate) enum NetworkFilterOption<'a> {
     Domain(Vec<(bool, &'a str)>),
+    To(Vec<(bool, &'a str)>),
     Badfilter,
     Important,
     MatchCase,
@@ -198,6 +199,23 @@ fn parse_filter_options<'a>(
                 }
                 NetworkFilterOption::Domain(domains)
             }
+            ("to", _) => {
+                let domains: Vec<(bool, &'a str)> = value
+                    .split('|')
+                    .map(|domain| {
+                        if let Some(negated_domain) = domain.strip_prefix('~') {
+                            (false, negated_domain)
+                        } else {
+                            (true, domain)
+                        }
+                    })
+                    .filter(|(_, d)| !(d.starts_with('/') && d.ends_with('/')))
+                    .collect();
+                if domains.is_empty() {
+                    return Err(NetworkFilterError::NoSupportedDomains);
+                }
+                NetworkFilterOption::To(domains)
+            }
             ("badfilter", true) => return Err(NetworkFilterError::NegatedBadFilter),
             ("badfilter", false) => NetworkFilterOption::Badfilter,
             ("important", true) => return Err(NetworkFilterError::NegatedImportant),

src/filters/fb_network.rs

@@ -143,6 +143,20 @@ impl<'a> FlatNetworkFilter<'a> {
             .map(|data| fb_vector_to_slice(data))
     }
 
+    #[inline(always)]
+    pub fn include_to_domains(&self) -> Option<&[u32]> {
+        self.fb_filter
+            .opt_to_domains()
+            .map(|data| fb_vector_to_slice(data))
+    }
+
+    #[inline(always)]
+    pub fn exclude_to_domains(&self) -> Option<&[u32]> {
+        self.fb_filter
+            .opt_not_to_domains()
+            .map(|data| fb_vector_to_slice(data))
+    }
+
     #[inline(always)]
     pub fn hostname(&self) -> Option<&'a str> {
         if self.mask.is_hostname_anchor() {
@@ -252,33 +266,82 @@ impl NetworkFilterMaskHelper for FlatNetworkFilter<'_> {
 impl NetworkMatchable for FlatNetworkFilter<'_> {
     fn matches(&self, request: &Request, regex_manager: &mut RegexManager) -> bool {
         use crate::filters::network_matchers::{
-            check_excluded_domains_mapped, check_included_domains_mapped, check_options,
+            check_excluded_domains_mapped, check_excluded_to_domains_mapped,
+            check_included_domains_mapped, check_included_to_domains_mapped, check_options,
             check_pattern,
         };
+        #[cfg(feature = "match-debug-stats")]
+        crate::match_debug_stats::record_checked();
+
         if !check_options(self.mask, request) {
+            #[cfg(feature = "match-debug-stats")]
+            crate::match_debug_stats::record_reject(crate::match_debug_stats::MatchStage::Options);
             return false;
         }
         if !check_included_domains_mapped(
             self.include_domains(),
             request,
             &self.filter_data_context.unique_domains_hashes_map,
         ) {
+            #[cfg(feature = "match-debug-stats")]
+            crate::match_debug_stats::record_reject(
+                crate::match_debug_stats::MatchStage::IncludedDomains,
+            );
             return false;
         }
         if !check_excluded_domains_mapped(
             self.exclude_domains(),
             request,
             &self.filter_data_context.unique_domains_hashes_map,
         ) {
+            #[cfg(feature = "match-debug-stats")]
+            crate::match_debug_stats::record_reject(
+                crate::match_debug_stats::MatchStage::ExcludedDomains,
+            );
             return false;
         }
-        check_pattern(
+        if !check_included_to_domains_mapped(
+            self.include_to_domains(),
+            request,
+            &self.filter_data_context.unique_domains_hashes_map,
+        ) {
+            #[cfg(feature = "match-debug-stats")]
+            crate::match_debug_stats::record_reject(
+                crate::match_debug_stats::MatchStage::IncludedToDomains,
+            );
+            return false;
+        }
+        if !check_excluded_to_domains_mapped(
+            self.exclude_to_domains(),
+            request,
+            &self.filter_data_context.unique_domains_hashes_map,
+        ) {
+            #[cfg(feature = "match-debug-stats")]
+            crate::match_debug_stats::record_reject(
+                crate::match_debug_stats::MatchStage::ExcludedToDomains,
+            );
+            return false;
+        }
+        let matched = check_pattern(
             self.mask,
             self.patterns().iter(),
             self.hostname(),
             self.key,
             request,
             regex_manager,
-        )
+        );
+        #[cfg(feature = "match-debug-stats")]
+        {
+            if matched {
+                crate::match_debug_stats::record_match(
+                    crate::match_debug_stats::MatchStage::Pattern,
+                );
+            } else {
+                crate::match_debug_stats::record_reject(
+                    crate::match_debug_stats::MatchStage::Pattern,
+                );
+            }
+        }
+        matched
     }
 }

src/filters/fb_network_builder.rs

@@ -92,6 +92,26 @@ impl<'a, 'f> FlatSerialize<'a, EngineFlatBuilder<'a>>
             FlatSerialize::serialize(o, builder)
         });
 
+        let opt_to_domains = network_filter.opt_to_domains.as_ref().map(|v| {
+            let mut o: Vec<u32> = v
+                .iter()
+                .map(|x| builder.get_or_insert_unique_domain_hash(x))
+                .collect();
+            o.sort_unstable();
+            o.dedup();
+            FlatSerialize::serialize(o, builder)
+        });
+
+        let opt_not_to_domains = network_filter.opt_not_to_domains.as_ref().map(|v| {
+            let mut o: Vec<u32> = v
+                .iter()
+                .map(|x| builder.get_or_insert_unique_domain_hash(x))
+                .collect();
+            o.sort_unstable();
+            o.dedup();
+            FlatSerialize::serialize(o, builder)
+        });
+
         let modifier_option = network_filter
             .modifier_option
             .map(|s| builder.create_string(s));
@@ -135,6 +155,8 @@ impl<'a, 'f> FlatSerialize<'a, EngineFlatBuilder<'a>>
                 modifier_option,
                 opt_domains,
                 opt_not_domains,
+                opt_to_domains,
+                opt_not_to_domains,
                 hostname,
                 tag,
                 raw_line,

src/filters/network.rs

@@ -408,6 +408,8 @@
     pub filter: FilterPart<'a>,
     pub opt_domains: Option<Vec<Hash>>,
     pub opt_not_domains: Option<Vec<Hash>>,
+    pub opt_to_domains: Option<Vec<Hash>>,
+    pub opt_not_to_domains: Option<Vec<Hash>>,
     /// Used for `$redirect`, `$redirect-rule`, `$csp`, and `$removeparam` - only one of which is
     /// supported per-rule.
     pub modifier_option: Option<&'a str>,
@@ -501,6 +503,8 @@
 
         let mut opt_domains: Option<Vec<Hash>> = None;
         let mut opt_not_domains: Option<Vec<Hash>> = None;
+        let mut opt_to_domains: Option<Vec<Hash>> = None;
+        let mut opt_not_to_domains: Option<Vec<Hash>> = None;
 
         let mut modifier_option: Option<&'a str> = None;
         let mut tag: Option<&'a str> = None;
@@ -560,6 +564,30 @@
                             opt_not_domains = Some(opt_not_domains_array);
                         }
                     }
+                    NetworkFilterOption::To(domains) => {
+                        let mut opt_to_domains_array: Vec<Hash> = vec![];
+                        let mut opt_not_to_domains_array: Vec<Hash> = vec![];
+
+                        for (enabled, domain) in domains {
+                            let domain_hash = utils::fast_hash(domain);
+                            if !enabled {
+                                opt_not_to_domains_array.push(domain_hash);
+                            } else {
+                                opt_to_domains_array.push(domain_hash);
+                            }
+                        }
+
+                        if !opt_to_domains_array.is_empty() {
+                            opt_to_domains_array.sort_unstable();
+                            opt_to_domains_array.dedup();
+                            opt_to_domains = Some(opt_to_domains_array);
+                        }
+                        if !opt_not_to_domains_array.is_empty() {
+                            opt_not_to_domains_array.sort_unstable();
+                            opt_not_to_domains_array.dedup();
+                            opt_not_to_domains = Some(opt_not_to_domains_array);
+                        }
+                    }
                     NetworkFilterOption::Badfilter => {
                         features_mask.set(NetworkFilterFeaturesMask::BAD_FILTER, true)
                     }
@@ -878,6 +906,8 @@
             features_mask,
             opt_domains,
             opt_not_domains,
+            opt_to_domains,
+            opt_not_to_domains,
             tag,
             raw_line: if debug {
                 Some(Cow::Borrowed(line))
@@ -931,6 +961,8 @@
             features_mask: Default::default(),
             opt_domains: None,
             opt_not_domains: None,
+            opt_to_domains: None,
+            opt_not_to_domains: None,
             tag: None,
             raw_line: if debug { Some(Cow::Owned(rule)) } else { None },
             modifier_option: None,
@@ -947,6 +979,8 @@
             self.hostname.as_deref(),
             self.opt_domains.as_ref(),
             self.opt_not_domains.as_ref(),
+            self.opt_to_domains.as_ref(),
+            self.opt_not_to_domains.as_ref(),
         )
     }
 
@@ -1114,7 +1148,7 @@
     hasher.write(s.as_bytes());
 }
 
 fn compute_filter_id(
     modifier_option: Option<&str>,
     mask: NetworkFilterMask,
     features_mask: NetworkFilterFeaturesMask,
@@ -1122,6 +1156,8 @@
     hostname: Option<&str>,
     opt_domains: Option<&Vec<Hash>>,
     opt_not_domains: Option<&Vec<Hash>>,
+    opt_to_domains: Option<&Vec<Hash>>,
+    opt_not_to_domains: Option<&Vec<Hash>>,
 ) -> Hash {
     let mut hasher = FxHasher::default();
 
@@ -1147,6 +1183,18 @@
         }
     }
 
+    if let Some(domains) = opt_to_domains {
+        for d in domains {
+            hasher.write_u64(*d);
+        }
+    }
+
+    if let Some(domains) = opt_not_to_domains {
+        for d in domains {
+            hasher.write_u64(*d);
+        }
+    }
+
     match filter {
         FilterPart::Empty => {}
         FilterPart::Simple(s) => write_str_to_hasher(&mut hasher, s.as_ref()),

src/filters/network_matchers.rs

@@ -467,6 +467,51 @@ pub fn check_excluded_domains_mapped(
     true
 }
 
+#[inline]
+pub fn check_included_to_domains_mapped(
+    opt_to_domains: Option<&[u32]>,
+    request: &request::Request,
+    mapping: &HashMap<Hash, u32>,
+) -> bool {
+    if let Some(included_domains) = opt_to_domains.as_ref() {
+        if let Some(hostname_hashes) = request.hostname_hashes.as_ref() {
+            if hostname_hashes.iter().all(|h| {
+                mapping
+                    .get(h)
+                    .is_none_or(|index| !utils::bin_lookup(included_domains, *index))
+            }) {
+                return false;
+            }
+        } else {
+            return false;
+        }
+    }
+    true
+}
+
+#[inline]
+pub fn check_excluded_to_domains_mapped(
+    opt_not_to_domains: Option<&[u32]>,
+    request: &request::Request,
+    mapping: &HashMap<Hash, u32>,
+) -> bool {
+    if let Some(excluded_domains) = opt_not_to_domains.as_ref() {
+        if let Some(hostname_hashes) = request.hostname_hashes.as_ref() {
+            if hostname_hashes.iter().any(|h| {
+                mapping
+                    .get(h)
+                    .is_some_and(|index| utils::bin_lookup(excluded_domains, *index))
+            }) {
+                return false;
+            }
+        } else {
+            return true;
+        }
+    }
+
+    true
+}
+
 #[cfg(test)]
 #[path = "../../tests/unit/filters/network_matchers.rs"]
 mod unit_tests;

src/flatbuffers/fb_network_filter.fbs

@@ -32,6 +32,10 @@ table NetworkFilter {
   raw_line: string;
   source_index: uint32 = 4294967295; // 0xFFFFFFFF
   line_number: uint32 = 4294967295;  // 0xFFFFFFFF
+
+  /// Same representation as |opt_domains|, for the `$to=` option.
+  opt_to_domains: [uint32];
+  opt_not_to_domains: [uint32];
 }
 
 table NetworkFilterList {