For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

3 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 22, 2011

    if you are looking for case insensitive in stream expression, it is not supported yet.

     

     

    there is request for enhancement which will be implemented.

     

     

    ID355904 - Unable to specify ignore case (?i) to STREAM search expressions

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 27, 2011
    I think these are the matches Russell is trying to match/replace:

     

     

    http://csweb -> https://csweb

     

    http://www.quantum.com(?!http://www.quantum.com/ProductAwareTandC.aspx) -> https://www.quantum.com

     

    http://maps.google.com -> https://maps.google.com

     

     

    The second one is possibly causing the issue. I think you want this regex instead:

     

     

    @http://www\.quantum\.com(?!/ProductAwareTandC\.aspx)@https://www.quantum.com@

     

     

    If you want to do this without case sensitivity on the capitalized letters, you can use a character set:

     

     

    @http://www\.quantum\.com(?!/[pP]roduct[aA]ware[tT]and[cC]\.aspx)@https://www.quantum.com@

     

     

    If that regex doesn't work and you can't do this with negative lookaheads, you might try a more generic stream expression like @http://www\.quantum\.com[a-zA-Z0-9/?_-]*@@ and then check the matched string using STREAM::match in STREAM_MATCHED to determine whether to rewrite the protocol.

     

     

    There's an example of this on the STREAM::expression wiki page:

     

     

     

    http://devcentral.f5.com/wiki/iRules.STREAM__expression.ashx

     

     

    This example shows how you can use in the event to check if the matched string meets some condition that can't easily be checked for using a single regex in .

     

     

     

    Note that you should escape the periods in the "find" portion of the stream expression so they match on a literal period instead of any single character.

     

     

    Aaron
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 28, 2011
    [root@ve1023:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      stream {}
      tcp {}
   }
}
[root@ve1023:Active] config  b pool foo list
pool foo {
   members {
      200.200.200.101:80 {}
      200.200.200.102:80 {}
   }
}
[root@ve1023:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
        STREAM::disable
}

when HTTP_RESPONSE {
        if {[HTTP::header value Content-Type] contains "text"}{
                STREAM::expression {@http://csweb@https://csweb@ @@http://www\.quantum\.com(?!/ProductAwareTandC\.aspx)@https://www.quantum.com@ @http://maps\.google\.com@https://maps.google.com@}
                STREAM::enable
        }
}
}

[root@ve1023:Active] config  curl http://200.200.200.101/test.html



this is host 101.

http://www.yahoo.com/test
http://csweb/test
http://www.quantum.com(?!http://www.quantum.com/ProductAwareTandC.aspx)/test
http://maps.google.com/test
http://www.f5.com/test



[root@ve1023:Active] config  curl http://172.28.19.79/test.html



this is host 101.

http://www.yahoo.com/test
http://csweb/test
http://www.quantum.com(?!http://www.quantum.com/ProductAwareTandC.aspx)/test
http://maps.google.com/test
http://www.f5.com/test


[root@ve1023:Active] config  
Dec 28 02:02:30 local/tmm err tmm[26866]: 01220005:3: Can't compile regular expression - (http://csweb)|()|(couldn't compile regular expression pattern: invalid escape \ sequence)|()couldn't compile regular expression pattern: invalid escape \ sequence) (Server side: vip=bar profile=stream pool=foo)
Dec 28 02:02:30 local/tmm err tmm[26866]: 01220001:3: TCL error: myrule  - couldn't compile regular expression pattern: parentheses () not balancedIllegal argument (line 2)     invoked from within "STREAM::expression {@http://csweb@https://csweb@ @@http://www\.quantum\.com(?!/ProductAwareTandC\.aspx)@https://www.quantum.com@ @http://maps\.google\..."