Use the rules engine to create and deploy rules - Edge Security Acceleration

The rules engine allows you to follow the same syntax and logic to create and deploy various rules, such as cache rules, redirect rules, compression rules, origin rules, and Web Application Firewall (WAF) protection rules.

Overview

With the rules engine in Edge Security Acceleration (ESA), you can create rules in a GUI. ESA checks whether to apply a specific configuration to incoming requests based on request parameters defined in the rules. This allows for more flexible and precise content distribution control.

Rule priorities

Rules on a specific aspect (such as browser cache TTL) take precedence over the global configuration for the aspect.
If a specific aspect (such as caching) has a list of rules, the rules apply from top to bottom in sequence. To change the priority of a specific rule in the rule list, change its order in the rule list.

Usage notes

A single rule condition cannot exceed 4 KB in size. The total size of all configuration information of a website, except security configuration, cannot exceed 512 KB in size.
A rule condition supports a nested structure with a maximum depth of two levels. Each level supports separate logical operation settings.
A single rule condition can contain up to 20 match fields.

Filtering rules for traffic

The incoming requests can be filtered by using the following options:

All Requests: This rule applies only to all traffic. All matching results for incoming requests are true.
Filtered Requests: This rule applies only to traffic matching the custom expression.

Rule syntax

A rule condition consists of logical operators and expressions.

Logical operators: connecting expressions in a rule condition to perform a logical operation.
Expressions: filtering out reuquests that meets the designated criteria. You can group multiple expressions to filter requests.

Logical operators

A logical operator connects expressions in a rule condition to perform a logical operation. The following logical operators are supported:

and: the logical conjunction operator. A rule condition is matched only if all expressions in the rule condition are true.
or: the logical disjunction operator. A rule condition is matched if one of the expressions in the rule condition is true.

Expressions

The simplest expression includes components described in the following table.

Component	Corresponding syntax parameter	Description	Required
Match field	Field	The match field.	Yes
Value	Value	The match value.	Yes
Comparison operator	Comparison_operator	The comparison operator.	Yes

Expression syntax

Simple expressions
- Syntax: <field><comparison_operator><value>
- Example: http.request.uri.path matches"/image\.(jpg|png)$"
Compound expressions
- Definition: multiple expressions connected by logical operators
- Syntax: <expreesion><logical_operator><expression>
- Example: http.host eq "www.example.com" and http.request.uri.path eq "/content"

Match fields

Note

The hostname (http.host) match field applies to SSL/TLS encryption rules and supports only eq (equals) and ne (not equals) operators.

Match type	Description	Match type variable	Match operator	Match value
Request Method	The method used by the request.	http.request.method	equals does not equal is in is not in	Valid values: GET POST PURGE PUT HEAD OPTIONS DELETE PATCH
HTTP Version	The HTTP version used by the request.	http.request.version		Valid values: HTTP/1.0 HTTP/1.1 HTTP/2.0 HTTP/3.0
Country/Region	The country or region to which the client IP address belongs.	ip.geoip.country		You can select a value from the drop-down list. Case-insensitive Empty string not allowed in the match value
File Name	The name of the file requested by the client.	http.request.uri.path.file_name		The value cannot contain the suffix of the actual file name. Examples: /a/b: Specify b as the value. /a/b/: Specify an empty string as the value. /foo.tar.bz2: Specify foo.tar as the value. 128_128.jpg: Specify 128_128 as the value. Case-sensitive Empty string not allowed in the match value
File Extension	The suffix of the name of the file requested by the client.	http.request.uri.path.extension		The value is the string that starts from the last period (.) in the file name. When you specify the value, do not contain the period (.) in the value. For example, specify bz2 as the value if the file name is foo.tar.bz2. Case-sensitive Empty string not allowed in the match value
IP Source Address	The IP address of the client.	ip.src		IPv4 addresses are supported. Example: `192.168.X.X`. IPv6 addresses are supported. Example: `240e:95c:3004:2:3:0:0:XXX`. CIDR blocks are supported. Example: 192.168.XXX.XXX/31. Case-insensitive Empty string not allowed in the match value
SSL/HTTPS	The type of the protocol used by the request.	http.request.scheme	equals does not equal	Valid values: http https
Hostname	The hostname contained in the request. Matching order: If hostnames are included in both the URL and the HOST header, the hostname in the request URL is used.	http.host	equals does not equal contains does not contain starts with ends with does not start with does not end with matches regex does not match regex is in Is not in	Example: ["www1.alibaba.com","www2.alibaba.com"]. Case-sensitive Empty string not allowed in the match value
URI	The path in the URL of the request. The value includes the request parameters.	http.request.uri		Example: /articles/index?section=330688&expand=comments. Case-sensitive Empty string not allowed in the match value
URI Full	The full Uniform Resource Identifier (URI) of the request.	http.request.full_uri		Example: https://www.example.org/articles/index?section=330688&expand=comments. Case-sensitive Empty string not allowed in the match value
URI Path	The path in the URL of the request. The value excludes the request parameters.	http.request.uri.path		Example: /articles/index. Case-sensitive Empty string not allowed in the match value
URI Query String	All request parameters in the URL of the request.	http.request.uri.query		Example: section=330688&expand=comments. Case-sensitive Empty string not allowed in the match value
URI Query String Parameter	The specified query parameters in the URL of the request.	http.request.uri.args["session"]		You can specify a parameter name and a parameter value to match requests. For example, you can enter a parameter name session and a parameter value 330688. Case-sensitive Empty string allowed in the match value only when the match operator is equals, does not equal, contains, and matches regex.
Cookie	The cookie contained in the request.	http.cookie	equals does not equal contains does not contain matches regex does not match regex	Example: session=330688;background=light. Case-sensitive Empty string allowed in the match value
User Agent	The client information contained in the request.	http.user_agent		Example: curl/7.29.0. Case-sensitive Empty string allowed in the match value
Referer	The URL of the original web page from which the resource is requested.	http.referer		Example: http://refer.com.cn. Case-insensitive Empty string allowed in the match value
X-Forwarded-For	The value of the X-Forwarded-For header in the request.	http.x_forwarded_for		Examples: `192.168.1.X` and 192.168.2.X. Case-sensitive Empty string allowed in the match value
Header	The specified header in the request.	http.request.headers["session"]		You can specify a header name and a header value to match requests. For example, you can enter a header name session and a header value 330688. Case-sensitive Empty string allowed in the match value
Cookie Value Of	The specified cookie parameter in the request.	http.request.cookies["session"]		You can specify a cookie parameter and a cookie value to match requests. For example, you can enter a cookie parameter name session and a parameter value 330688. Case-sensitive Empty string allowed in the match value

Comparison operators

Operator name	Operator	Negatable	Value type	Remarks
Equals	eq	No	string	/
Not equals	ne	No	string	/
Contains	contains	Yes	string	The operator checks whether the specified string is contained.
Matches regex	matches	Yes	string	The operator checks for matches by regex. The operator is supported only in the Business and Enterprise plans.
Includes any	in	Yes	array	The expression is true if any of the specified elements is matched. The operator does not support wildcard characters in the value. The operator supports up to 32 elements in the value array.
Starts with	starts_with	Yes	string	/
Ends with	ends_with	Yes	string	/
Length less than	len-lt	No	integer	A match is found if the string length is less than the specified length condition.
Length equal to	len-eq	No	integer	A match is found if the string length is equal to the specified length condition.
Length greater than	len-gt	No	integer	A match is found if the string length is greater than the specified length condition.
In list	in_list	Yes	integer	This operator is used on global lists that you create at the account level.
Exists	exists	Yes	bool	The operator checks if the specified key exists in key-pair values. For example, you can use this operator in rules based on headers, cookies, and query strings.
Greater than	gt	No	integer	The operator applies to rules where the values are integers.
Smaller than	lt	No	integer	The operator applies to rules where the values are integers.
Greater than or equal to	ge	No	integer	The operator applies to rules where the values are integers.
Smaller than or equal to	le	No	integer	The operator applies to rules where the values are integers.

Wildcard characters

Wildcard character	Description
`?`	Matches one single character.
`*`	Matches any number of characters.

Create expressions

Note

By default, the expression builder is displayed for you to create expressions.

Use the expression builder

The expression builder allows you to quickly create expressions in an interactive way. However, you may need to switch to the expression editor when you create complicated expressions.

For example, if you want to create an expression based on the request method, select the expression components from the drop-down lists to have the expression builder to automatically create the expression.

Use the expression editor

The expression editor allows you to create more complicated expressions in a more flexible way.

Click Edit Expression.
In the editor, start writing your expressions.