Forum Discussion
uni
Altostratus
Mar 27, 2006Question mark in regex
I have the following rule, which I've just moved over from a 4.5 system to 9.1.1:
rule JTS_olgc-prod_http_10 {
when HTTP_REQUEST {
if { [HTTP::host] == "xxx.com.au"
and ( [matchclass [HTTP::uri] ends_with $::JTS_FileTyp]
or [matchclass [HTTP::uri] equals $::JTS_AbsoluteURI]
or [HTTP::uri] starts_with "/images/"
or [HTTP::uri] matches_regex "^/default\.asp\?(action|menu|page|text_only)="
or [HTTP::uri] matches_regex "^/(general|gaming|pdf|calendar.html).*"
or [HTTP::uri] matches_regex "^/(splash|src/js)/.*\.js$" ) } {
}
else {
log local2.notice "Denied: Source: [HTTP::header value X-Forwarded-For] Method: [HTTP::method] Host: [HTTP::host] URI: [HTTP::uri]"
use pool jts-utility-pool
}
}
}
I am having problems with the line
or [HTTP::uri] matches_regex "^/default\.asp\?(action|menu|page|text_only)="
The expression will not match the question mark (?), whether I precede it with an escape \ or not. In the end I have replaced it with a dot (.).
An example of a URI which I thought should match, but doesn't, is/default.asp?page=casino.casino.htm&menu=casino
Is there a special meaning for the question mark in v9?
- Colin_Walker_12Historic F5 AccountThere shouldn't be anything preventing this usage that I know of. I'll try to reproduce and examine the results.
- Michael_Welch_6
Nimbostratus
I'm running into this too. Anybody have a solution? - Deb_Allen_18Historic F5 AccountI had to enclose the regex expression in {} and save as a variable, then reference that for a regsub I was working on for URI re-writes. You might try a similar approach:
set orig_string {/portal/.+\?} set new_string "&ID=$ID\\&" regsub -all $orig_string $payload $new_string payload
- Michael_Welch_6
Nimbostratus
Excellent - thanks for your help. - uni
Altostratus
Enclosing the character in square brackets works too...$uri matches_regex ".*/.*\.(JSP)\[?\]"
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects