(program (programItem (section (varSection VARS { (variables (variablesItem (commentLine # Boolean and integer state you can flip/use across sections)) (variablesItem (variableDecl FlagA : bool ;)) (variablesItem (variableDecl FlagB : bool ;)) (variablesItem (variableDecl Cnt8 : int8 ;)) (variablesItem (variableDecl Big16 : int16 ;))) }))) (programItem (section REMAP { (sectionBody (commentLine # Plugin controls)) (sectionBody (statement http.cntl.TXN_DEBUG = (value true) ;)) (sectionBody (statement http.cntl.LOGGING = (value true) ;)) (sectionBody (statement http.cntl.REQ_CACHEABLE = (value true) ;)) (sectionBody (statement http.cntl.RESP_CACHEABLE = (value true) ;)) (sectionBody (statement http.cntl.SERVER_NO_STORE = (value false) ;)) (sectionBody (statement http.cntl.SKIP_REMAP = (value false) ;)) (sectionBody (statement http.cntl.INTERCEPT_RETRY = (value false) ;)) (sectionBody (commentLine # allow intercept retry)) (sectionBody (commentLine # Plugin-level knobs)) (sectionBody (statement (functionCall set-plugin-cntl ( (argumentList (value "TIMEZONE") , (value "GMT")) )) ;)) (sectionBody (statement (functionCall set-plugin-cntl ( (argumentList (value INBOUND_IP_SOURCE) , (value "PEER")) )) ;)) (sectionBody (statement (functionCall set-config ( (argumentList (value "proxy.config.http.allow_multi_range") , (value 1)) )) ;)) (sectionBody (commentLine # Connection marks (client side))) (sectionBody (statement inbound.conn.dscp = (value 8) ;)) (sectionBody (statement inbound.conn.mark = (value 1734) ;)) (sectionBody (commentLine # Initialize and twiddle user vars)) (sectionBody (statement FlagA = (value true) ;)) (sectionBody (statement FlagB = (value false) ;)) (sectionBody (statement Cnt8 = (value 7) ;)) (sectionBody (statement Big16 = (value 1024) ;)) (sectionBody (commentLine # Simple demo: count every transaction seen)) (sectionBody (statement (functionCall counter ( (argumentList (value "txn_start_count")) )) ;)) })) (programItem (section PRE_REMAP { (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (term (factor (comparison (comparable inbound.method) == (value "GET") (modifier with (modifierList NOCASE))))) && (factor ( (expression (expression (term (factor (comparison (comparable inbound.url.path) in (set [ (value "mp3") , (value "m3u") , (value "m3u8") ]) (modifier with (modifierList EXT , NOCASE)))))) || (term (factor (comparison (comparable inbound.url.host) ~ (regex /(?i)^api\./))))) )))) ))))) (block { (blockItem (statement inbound.req.X-Prefilter = (value "static-or-api") ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (expression (term (factor (functionCall access ( (argumentList (value "/var/developertesting")) ))))) || (term (factor (functionCall internal ( ))))) ))))) (block { (blockItem (statement inbound.req.X-Prefilter = (value "dev-or-internal") ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (term (factor (comparison (comparable (functionCall random ( (argumentList (value 100)) ))) > (value 50))))) ))))) (block { (blockItem (statement inbound.req.X-Prefilter = (value "coinflip") ;)) })) (elseClause else (block { (blockItem (statement (functionCall no-op ( )) ;)) })))) (sectionBody (commentLine # Show CIDR and ID usage; also demonstrate list membership on method)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (expression (term (factor (comparison (comparable (functionCall cidr ( (argumentList (value 16) , (value 48)) ))) == (value "10.0.0.0"))))) || (term (factor (comparison (comparable (functionCall cidr ( (argumentList (value 8) , (value 8)) ))) == (value "fd00::"))))) ))))) (block { (blockItem (statement inbound.req.X-Network = (value "private") ;)) })))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.method) in (set [ (value "POST") , (value "PUT") ]))))) ))))) (block { (blockItem (statement FlagB = (value true) ;)) })))) })) (programItem (section REMAP { (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable from.url.host) == (value "old.example.com") (modifier with (modifierList NOCASE)))))) ))))) (block { (blockItem (statement inbound.url.host = (value "new.example.com") ;)) (blockItem (statement (functionCall keep_query ( (argumentList (value "id,utm_campaign")) )) ;)) })))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable to.url.path) ~ (regex /(?i)^\/legacy\//))))) ))))) (block { (blockItem (statement inbound.url.path = (value "/v2/") ;)) (blockItem (statement (functionCall remove_query ( (argumentList (value "debug,trace")) )) ;)) })))) (sectionBody (statement inbound.req.X-foo = (value inbound.conn.client-cert.SAN) ;)) (sectionBody (commentLine # Run a remap plugin conditionally (args are pass-through))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.url.host) == (value "plugins.example"))))) ))))) (block { (blockItem (statement (functionCall run-plugin ( (argumentList (value "regex_remap.so") , (value "in:^/foo/(.*)$") , (value "out:/bar/$1")) )) ;)) })))) (sectionBody (commentLine # Demonstrate last-rule behavior)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.req.X-Bypass) == (value "1"))))) ))))) (block { (blockItem (statement (functionCall skip-remap ( (argumentList (value true)) )) ;)) (blockItem (statement break ;)) (blockItem (commentLine # like [L])) })))) })) (programItem (section READ_REQUEST { (sectionBody (commentLine # Header presence / equality and capture groups)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor inbound.req.Strict-Transport-Security))) ))))) (block { (blockItem (statement inbound.req.X-HSTS-Present = (value "1") ;)) })))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.req.User-Agent) ~ (regex /(?i)foo-(\d+)/))))) ))))) (block { (blockItem (statement inbound.req.X-UA-Capture = (value "{capture.1}") ;)) })))) (sectionBody (commentLine # Cookies: read, set, and remove)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.cookie.session) == (value "admin") (modifier with (modifierList NOCASE)))))) ))))) (block { (blockItem (statement inbound.cookie.role = (value "super") ;)) })) (elseClause else (block { (blockItem (statement inbound.cookie.role = (value "guest") ;)) })))) (sectionBody (statement inbound.cookie.obsolete = (value "") ;)) (sectionBody (commentLine # IP and URL string expansions in values)) (sectionBody (statement inbound.req.X-Client = (value "{inbound.ip} : {inbound.url.port}") ;)) (sectionBody (statement inbound.req.X-Req-Id = (value "{id.UNIQUE}") ;)) (sectionBody (commentLine # Geo lookups as values)) (sectionBody (statement inbound.req.X-Geo = (value "{geo.country}-{geo.asn}") ;)) (sectionBody (commentLine # Example of counters + vars interplay)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor FlagB))) ))))) (block { (blockItem (statement (functionCall counter ( (argumentList (value "write_methods_seen")) )) ;)) (blockItem (statement Cnt8 = (value 42) ;)) (blockItem (commentLine # assign int8)) (blockItem (statement Big16 = (value 6553) ;)) (blockItem (commentLine # assign int16)) })))) })) (programItem (section SEND_REQUEST { (sectionBody (commentLine # Use server URL information to adjust Host header)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable outbound.url.host) == (value "www.firstparent.com"))))) ))))) (block { (blockItem (statement outbound.req.Host = (value "vhost.firstparent.com") ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (term (factor (comparison (comparable outbound.url.host) == (value "www.secondparent.com"))))) ))))) (block { (blockItem (statement outbound.req.Host = (value "vhost.secondparent.com") ;)) })))) (sectionBody (commentLine # Demonstrate HTTP control read and write)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor ! (factor http.cntl.LOGGING)))) ))))) (block { (blockItem (statement http.cntl.LOGGING = (value true) ;)) })))) })) (programItem (section REMAP { (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.req.X-Bar) == (value "fie") (modifier with (modifierList MID))))))) (block { })))) })) (programItem (section READ_RESPONSE { (sectionBody (commentLine # Cache lookup status checks)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (factor (comparison (comparable (functionCall cache ( ))) == (value "hit-stale"))))) ))))) (block { (blockItem (statement outbound.resp.X-Cache = (value "stale") ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (term (factor (comparison (comparable (functionCall cache ( ))) == (value "hit-fresh"))))) ))))) (block { (blockItem (statement outbound.resp.X-Cache = (value "fresh") ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (term (factor (comparison (comparable (functionCall cache ( ))) in (set [ (value "miss") , (value "skipped") ]))))) ))))) (block { (blockItem (statement outbound.resp.X-Cache = (value "{cache()}") ;)) (blockItem (commentLine # echo the value)) })))) (sectionBody (commentLine # Status transforms + reason)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor ( (expression (term (term (factor (comparison (comparable inbound.status) > (value 399)))) && (factor (comparison (comparable inbound.status) < (value 500))))) ))))) (block { (blockItem (statement http.status = (value 404) ;)) (blockItem (statement http.status.reason = (value "Not Here But Somewhere") ;)) })))) (sectionBody (commentLine # Example body overrides (allowed at READ_RESPONSE only))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable outbound.status) > (value 499)))))) (block { (blockItem (statement (functionCall set-body-from ( (argumentList (value "http://errors.example.com/500?rid={id.REQUEST}")) )) ;)) })) (elifClause elif (condition (expression (term (factor ( (expression (term (factor (comparison (comparable inbound.status) == (value 418))))) ))))) (block { (blockItem (statement outbound.resp.Content-Type = (value "text/plain") ;)) (blockItem (statement outbound.resp.Server = (value "ATS-HRW4U") ;)) (blockItem (statement inbound.resp.body = (value "I am a teapot, rewritten") ;)) })))) })) (programItem (section SEND_RESPONSE { (sectionBody (statement outbound.resp.Cache-Control = (value "public, max-age=60") ;)) (sectionBody (statement outbound.resp.X-Now = (value "{now.YEAR}-{now.MONTH}-{now.DAY}T{now.HOUR}:{now.MINUTE}") ;)) (sectionBody (statement outbound.resp.X-Ports = (value "in={inbound.url.port};out={outbound.url.port}") ;)) (sectionBody (statement outbound.resp.X-IPs = (value "client={inbound.ip};server={outbound.ip}") ;)) (sectionBody (statement outbound.resp.X-ID = (value "{id.UNIQUE}") ;)) (sectionBody (statement outbound.resp.ATS-Geo-Country = (value "{geo.country}") ;)) (sectionBody (statement outbound.resp.ATS-Geo-ASN = (value "{geo.asn}") ;)) (sectionBody (statement outbound.resp.ATS-Geo-ASN-NAME = (value "{geo.ASN-NAME}") ;)) (sectionBody (statement outbound.cookie.debug = (value "on") ;)) (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.req.X-Redirect) == (value "1")))))) (block { (blockItem (statement (functionCall set-redirect ( (argumentList (value 302) , (value "https://redirect.example/x?{inbound.url.query}")) )) ;)) })))) (sectionBody (statement (functionCall counter ( (argumentList (value "send_response_count")) )) ;)) })) (programItem (section TXN_CLOSE { (sectionBody (statement (functionCall counter ( (argumentList (value "txn_close_count")) )) ;)) (sectionBody (statement (functionCall no-op ( )) ;)) })) (programItem (section SEND_RESPONSE { (sectionBody (conditional (ifStatement if (condition (expression (term (factor inbound.conn.TLS)))) (block { (blockItem (statement inbound.resp.X-Client-Cert = (value "{inbound.conn.client-cert.PEM}") ;)) (blockItem (statement inbound.resp.X-Client-Cert-Subject = (value "{inbound.conn.client-cert.SUBJECT}") ;)) (blockItem (statement inbound.resp.X-Client-Cert-Issuer = (value "{inbound.conn.client-cert.ISSUER}") ;)) (blockItem (statement inbound.resp.X-Server-Cert-Subject = (value "{inbound.conn.server-cert.SUBJECT}") ;)) (blockItem (statement inbound.resp.X-Server-Cert-Serial = (value "{inbound.conn.server-cert.SERIAL}") ;)) (blockItem (statement inbound.resp.X-Client-SAN-DNS = (value "{inbound.conn.client-cert.SAN.DNS}") ;)) (blockItem (statement inbound.resp.X-Client-SAN-IP = (value "{inbound.conn.client-cert.SAN.IP}") ;)) (blockItem (statement inbound.resp.X-Server-SAN-Email = (value "{inbound.conn.server-cert.SAN.EMAIL}") ;)) (blockItem (statement inbound.resp.X-Server-SAN-URI = (value "{inbound.conn.server-cert.SAN.URI}") ;)) })))) })) (programItem (section SEND_REQUEST { (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.conn.client-cert.SAN.DNS) ~ (regex /example\.com/)))))) (block { (blockItem (statement outbound.req.X-Matched-Domain = (value "true") ;)) })))) (sectionBody (conditional (ifStatement if (condition (expression (term (factor (comparison (comparable inbound.conn.client-cert.SUBJECT) ~ (regex /CN=testcert/)))))) (block { (blockItem (statement outbound.req.X-Test-Client = (value "verified") ;)) })))) })) (programItem (section READ_RESPONSE { (sectionBody (statement outbound.resp.X-Outbound-Client-Cert = (value "{outbound.conn.client-cert.PEM}") ;)) (sectionBody (statement outbound.resp.X-Outbound-Server-Subject = (value "{outbound.conn.server-cert.SUBJECT}") ;)) })) <EOF>)
