I just tested with a simple STREAM::expression rule which matches across new lines:
when HTTP_REQUEST {
STREAM::disable
}
when HTTP_RESPONSE {
if {[HTTP::header content-type] starts_with "text"}{
STREAM::expression {@This.*yet@@}
STREAM::enable
}
}
when STREAM_MATCHED {
log local0. "[STREAM::match]"
}
Here is a request direct to the web server (with spaces inserted in the HTML tags to prevent the forum code from removing them):
curl 10.1.0.100
< html >< body >< h1 >It works!< /h1 >
< p >This is the default web page for this server.< /p >
< p >The web server software is running but no content has been added, yet.< /p >
< /body >< /html >
And here is a request through the VS and iRule:
curl 10.1.0.15
< html >< body >< h1 >It works!< /h1 >
< p >.< /p >
< /body >< /html >
And the debug log from STREAM::match:
< STREAM_MATCHED >: This is the default web page for this server. The web server software is running but no content has been added, yet
Aaron