Forum Discussion
hooleylist
Jul 21, 2008Cirrostratus
I would have thought you could use a stream expression with a single token. Here is a more tested example with the unnecessary backreference in the regex removed:
when HTTP_RESPONSE {
Disable the stream filter by default
STREAM::disable
Check if response type is text
if {[HTTP::header value Content-Type] contains "text"}{
Match any http:// instance and replace it with nothing
STREAM::expression {@http://.*?example\.com@@}
Enable the stream filter for this response only
STREAM::enable
}
}
when STREAM_MATCHED {
log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match], replaced with: [string map {http:// https://} [STREAM::match]]"
STREAM::replace "[string map {http:// https://} [STREAM::match]]"
}
And the output:
Rule stream_expression_rule : 10.0.0.1:3413: matched: http://test.example.com, replaced with: https://test.example.com
Rule stream_expression_rule : 10.0.0.1:3413: matched: http://example.com, replaced with: https://example.com
Aaron