Forum Discussion

Darren_21048's avatar
Darren_21048
Icon for Nimbostratus rankNimbostratus
Mar 18, 2011

Stream::expression & case insenitivity

I am trying to create a bit of a badword list and as a test intend to use this iRule. It works fine but I'm struggling to add case insensitivity to the mix. I've tried wrapping [string tolower] round it with no success and have read I may need to use a regex but wonder if there is a better way.

 

 

 

Any suggestions much appreciated.

 

 

 

Thanks.

 

 

 

when HTTP_RESPONSE {

 

HTTP::header remove server

 

 

 

foreach header {Server Date X-Powered-By} {

 

while { [HTTP::header exists $header] } {

 

log local0. "Removing- $header: [HTTP::header value $header]"

 

HTTP::header remove $header

 

}

 

}

 

 

Disable the stream filter by default

 

STREAM::disable

 

 

 

Check if response type is text

 

if {[HTTP::header value Content-Type] contains "text"}{

 

 

 

Replace content in STREAM expression

 

 

 

STREAM::expression "@badword@*****@ @badword2@*****@ @badword3@*****@" ]

 

Enable the stream filter for this response only

 

STREAM::enable

 

}

 

}

 

 

application delivery
dev
devops
iRules
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Mar 18, 2011
    Hi Darren,

     

     

    Unfortunately, the stream filter is case sensitive and doesn't accept the (?i) notation to set the expression as case insensitive. As a workaround, you can use character classes to match both cases:

     

     

    STREAM::expression "@[bB][aA][dD][wW][oO][rR][dD]@*****@"

     

     

    I think it would be useful for there to be a "case sensitive" checkbox on the stream profile (or via an iRule flag). If you agree, could you open a case with F5 Support and ask for an enhancement? If you end up doing this, could you reply with the RFE ID so others can reference it?

     

     

    Thanks, Aaron
  • Darren_21048's avatar
    Darren_21048
    Icon for Nimbostratus rankNimbostratus
    Mar 22, 2011
    Thanks Aaron, that works nicely. I've raised an RFE request with F5, if I get an RFE ID. I'll post it.
  • Darren_21048's avatar
    Darren_21048
    Icon for Nimbostratus rankNimbostratus
    Mar 23, 2011
    The RFE ID is C850367. Also for info, I had to make a slight amendment to the statement.

     

     

    STREAM::expression {[^A-Za-z][bB][aA][dD][wW][oO][rR][dD]1[^A-Za-z]@ ***** @ @[^A-Za-z][bB][aA][dD][wW][oO][rR][dD]2[^A-Za-z]@ ***** @"}

     

     

    I had to add the curly braces and have added [^A-Za-z] at the beginning and end to make sure it's just whole words I'm filtering. I hope that is of use.
    • ebeng_278441's avatar
      ebeng_278441
      Icon for Altocumulus rankAltocumulus
      Jul 10, 2017

      Any luck with the RFE? im also struggling at the moment with upper/lower case in the streams