Skip to main content
A
Anonymous_User
Contributor
January 23, 2008
Question

regex issue

  • January 23, 2008
  • 5 replies
  • 5047 views
Log entry: 
  type=virus subtype=filename pri=warning dst=204.160.99.125 dport=80 dst_int=" wan1"  service=" http"  status=blocked file=" windowsxp-kb892130-enu-x86_eebc1bd82ff4bc7b8eb46773704ffd5f8eef14aa.exe"  url=" http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/windowsxp-kb892130-enu-x86_eebc1bd82ff4bc7b8eb46773704ffd5"  ref=" n/a"  msg=" File is blocked."
As you can see the AV is blocking .EXE files. I have exempted in URL filter of the same profile the following site: 
  /\b.*windowsupdate\.com(.ar)*/i
and still doesnt allow downloading from that site If I add an entry in simple mode (not regex) of " windowsupdate.com" it goes OK How should I type it in regex? Thanks

    5 replies

    rwpatterson
    rwpatterson
    New Member
    January 23, 2008
    I went about this another way. I created a custom a local rating (under Fortiguard - Web Filter, I called it ' Windows Update' ) with the following entries:
      1 	adobe.com  2 	fpdownload.macromedia.com/get/flashplayer/current/install_flash_player.exe  3 	mozilla.com  4 	mozilla.org  5 	office.microsoft.com  6 	update.microsoft.com  7 	windowsupdate.com   8 	windowsupdate.microsoft.com
    I then made sure that every protection profile was allowed access to these sites (under Fortiguard Web Filtering > local ratings > ' Windows Updates' ). Only the last three are required for Windows Updates. The rest are for other software my organization deems useful... These regexs will do the same thing: /download\.windowsupdate\.com.*/ /update\.microsoft\.com.*/ /windowsupdate\.com.*/
    A
    Anonymous_UserAuthor
    Contributor
    January 23, 2008
    The weird issue is that regular expressions seem not to work in urlfilter i.e. regex /\b.*freelotto.*/i doesnt match simple freelotto.com match I would like to use regex to avoid several entries with different TLD (freelotto.com, freelotto.net, freelotto.us, ...) Regarding using custom local ratings, those are not feasible to be used as exempted URLs (exempted from AV/File Blocking)
    rwpatterson
    rwpatterson
    New Member
    January 23, 2008
    regex /\b.*freelotto.*/i doesnt match simple freelotto.com
    simple freelotto.com matches regex /\bfreelotto\.(com|org|net|au|etc.)/i or better yet /\bfreelotto\..*/i
    A
    Anonymous_UserAuthor
    Contributor
    January 24, 2008
    Even if I dont to do of it a regex forum, I' m still a little disappointed because not even the expression " /freelotto\.(com|net)/i" works as expected (try it yourself) Beyond this little sample, I would like to ask how to set metacharacters in the beginning of the expression, say how to include all possible variants of a single string. ie. not only freelotto.com, but also winfreelotto.com playfreelotto.net freelottoonline.com (dont know if these domains indeed exist, and are solely listed as samples)
    rwpatterson
    rwpatterson
    New Member
    January 24, 2008
    Even if I dont to do of it a regex forum, I' m still a little disappointed because not even the expression " /freelotto\.(com|net)/i" works as expected (try it yourself) Beyond this little sample, I would like to ask how to set metacharacters in the beginning of the expression, say how to include all possible variants of a single string. ie. not only freelotto.com, but also winfreelotto.com playfreelotto.net freelottoonline.com
    " /freelotto\.(com|net)/i" will not work if anything follows the ' .com|.net' . A ' .*' combination would have to follow to allow anything else. Same for the beginning, another ' .*' would need to be there. Problem here is if someone types in something like www.freeproxy.net/(bypass site here)?freelotto.com, the url would pass, and they would get to the proxy site. Not sure if the reply would still pass, but it' s a start. A safer beginning would be ' .{5}' , which would indicate only 5 characters before, not any number. Could also be {min, max}.
    A
    Anonymous_UserAuthor
    Contributor
    January 24, 2008
    " /freelotto\.(com|net)/i" will not work if anything follows the ' .com|.net' . A ' .*' combination would have to follow to allow anything else. Same for the beginning, another ' .*' would need to be there.
    That' s precisely what I am trying to say When i set the regex " /\b.*freelotto.*/i" none of the above match positively
    rwpatterson
    rwpatterson
    New Member
    January 24, 2008
    Try without the leading boundary (\b) clarifier. You don' t care how many precede, so why on a boundary? I have no way of testing here, and no time. Sorry...
    A
    Anonymous_UserAuthor
    Contributor
    January 28, 2008
    Just for the records " .*freelotto.*" (without quotes) works ok! It matches the following urls: something.freelotto.somedomain.tld something.freelotto.subdomain.somedomain.tld somethingfreelotto.somedomain.tld freelottosomething.somedomain.tld somethingfreelottosomething.somedomain.tld something.somethingfreelottosomething.somedomain.tld something123.somethingfreelottosomething.somedomain.tld
    Terms & ConditionsAccessibility statement