Regular expressions are familiar to those who have worked extensively with UNIX command-line tools. They form complex rules, or pattern descriptions which are used to match patterns against a string. Regular expressions are built by combining simple, small expressions, the simplest being a single character, such as "a", that matches itself. Simple regular expressions can be combined to form strings, such as "hello", which matches "hello" or "hihellothere".
Regular expression matches compare a specified string against each pattern until a match occurs. When a match occurs, the function returns true. If no match occurs, the function is false. Rules are executed only when a pattern-matching expression is true.
Note
NetCache uses POSIX-standard extended regular expression syntax, fully described by IEEE POSIX 1003.2.
Regular expressions can be used to perform a variety of restrictions. However, rule complexity and the number of matches that are checked before servicing each request can affect performance. For this reason, regular expressions, or expressions that contain the word "matches", should be cautiously applied and used only when necessary.
Values returned match any pattern that ends with netapp.com.
server-name matches ".*\.netapp\.com$"
In comparison, an equivalent but more efficient expression produces the same result.
deny server-domain netapp.com
Complex regular expressions or expressions that perform extensive character matching consume the greatest amount of system resources, followed by simple expressions and exact matches. To optimize performance when expression matching is necessary, be sure that you form expressions using the correct variables. Often, a complex expression can be simplified to an exact match. For example, the following sets of expressions achieve the same goal.
In the following example, url matches can be replaced with the server-name variable to achieve the same result.
In the following example, url matches can be replaced with the server-domain variable to achieve the same result.
deny url matches "^[a-z]*://[^/]*jobs\.(com | net)" |
In the following example, url matches can be replaced with either server-name or url-prefix variables to achieve the same result.
Regular expressions are commonly used to match simple substrings in URLs. Alternatively, you can use the ACL contains and contains-case operators. These operators provide a more efficient method for matching URL substrings.
For example, the following regex expression denies any URL matches that contain the string "sports".
deny url matches ".*sports.*"
In comparison, either of the following ACL rules produces the same result as the preceding regex matching expression.
deny url contains sports
deny url contains-case SporTS
The contains and contains-case operators support URL substring matching for the following ACL variables:
Characters that are commonly used to form regular expressions are shown in the following table.
Note
For more information, see the UNIX man page on regular expression handling (man 5 regexp). In addition, see the man pages for the UNIX ed editor (man ed) for descriptions of regular expressions.
The following table provides a variety of operators that can be used in creating complex expressions. Parsing is performed in a case-insensitive manner.
Copyright © 1994-2002, Network Appliance, Inc. All rights
reserved.
Part No. 210-00370
File: acls4.htm
Last updated: 11/12/02 11:23:23