stream find/replace expression with an exclude

Hi Nik,

You can check what the matched string was using STREAM::match in the STREAM_MATCHED event. However, if you set your STREAM::expression match to "a string" STREAM::match is only going to return 'a string' and you won't know the context of it. You could use a regex to match more of the string. Can you provide a more exact sample of what you do/don't want to match in the content?

Here's an example of customizing the replacement in STREAM_MATCHED:

 From http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression
when HTTP_REQUEST {
    Disable the stream filter for all requests
   STREAM::disable
}
when HTTP_RESPONSE {  
    Check if response type is text  
   if {[HTTP::header value Content-Type] contains "text"}{  
       Match an http://*example.com string and replace it with nothing yet
      STREAM::expression {&http://.*?example\.com&&}
       Enable the stream filter for this response only  
      STREAM::enable  
   }  
}   
when STREAM_MATCHED {  
    Check if the matched string meets some condition
   if {[STREAM::match] starts_with "host1"}{
       Replace http:// with https:// and do the replacement
      STREAM::replace "[string map {http:// https://} [STREAM::match]]"
      log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match], replaced with: [string map {http:// https://} [STREAM::match]]"  
   }
}

Aaron

the problem is i'm breaking internet explorer compatibility with a find/replace that i'm doing. here's a more specific example. again, three different strings:

 

 

 

 

 

 

 

 

now, if i do something like this, it replaces all three domain names with "/" however i only want to replace the second two, not the first since it breaks compatibility with internet explorer:

 

 

STREAM::expression {@http://forexforums.dailyfx.com/@/@}

 

 

using stream_matched might do the job, i was hoping there'd be something a little simpler though.

 

 

thanks.

Your post got munged. Can you edit it/reply again with the strings in [ code ] [ code ] blocks?

 

 

Thanks, Aaron

the problem is i'm breaking internet explorer compatibility with a find/replace that i'm doing. here's a more specific example. again, three different strings:

now, if i do something like this, it replaces all three domain names with "/" however i only want to replace the second two, not the first since it breaks compatibility with internet explorer:

STREAM::expression {@http://forexforums.dailyfx.com/@/@}

using stream_matched might do the job, i was hoping there'd be something a little simpler though.

thanks.

The examples were still stripped from your post. Can you add them as an attachment?

 

 

Aaron

attached

 

testing...

the problem is i'm breaking internet explorer compatibility with a find/replace that i'm doing.  here's a more specific example.  again, three different strings:







now, if i do something like this, it replaces all three domain names with "/" however i only want to replace the second two, not the first since it breaks compatibility with internet explorer:

STREAM::expression {@http://forexforums.dailyfx.com/@/@}

using stream_matched might do the job, i was hoping there'd be something a little simpler though.

thanks.

Aaron

...

I think this might work, if you only want to rewrite a href's:

when HTTP_REQUEST {
    Disable the stream filter for all requests
   STREAM::disable
}
when HTTP_RESPONSE {  

    Check if response type is text  
   if {[HTTP::header value Content-Type] contains "text"}{  

       Match a tags for http://www.domain.com/
      STREAM::expression {@