<!--
	Nonfunctional domains:


		- berkeley.edu subdomains:

			- (www.)		(prints "No access to SSL site.")
			- alumni-friends	(prints domain name; CN: asterix.berkeley.edu)
			- gfael.are ¹
			- areweb ²
			- atcal-career ³
			- awards ³
			- builders ³
			- cads2 ³
			- cal-demo		(prints "a" over https; acts as atcal over http)
			- calparents ⁴
			- calvm	⁴
			- campaign ³
			- campuslife ⁵
			- cdms			(shows cosmology; mismatched, CN: cosmology.berkeley.edu)
			- cfr ³
			- charterday ³
			- compute.cnr ²
			- naturebeta.cnr ²
			- staff.cnr ²
			- cwh ²
			- diller ³		(403s over http)
			- discovercal ³
			- idsg.eecs		(data differs)
			- environmentalsciences ²
			- forestry ²
			- fundraising ³
			- hewlett ³
			- hewlettchallenge ³	(CN: devcomm.urel)
			- homecoming		(prints domain name)
			- hrweb ⁵
			- mailman.icsi		(refused)
			- identity ³
			- ieas
			- ims			(400; times out over https, so status unknown)
			- inauguration ³
			- lawcat		(502)
			- ls
			- blogs.lib		(shows www.lib)
			- mdp ²
			- www.mip		(403)
			- newalumnichallenge ³
			- newscenter ⁵
			- nst ²
			- nutrition ²
			- ourenvironment ²
			- socalevents ⁵
			- stadium ³
			- systemstatus
			- tiencenter		(valid cert; "Site Temporarily Unavailable" over http, so status unknown)
			- urel ³		(CN: devcomm.urel)
			- devcomm.urel		(403s over http; redirects to givetocal over https)

		- (www.)ucbsystems.org

	¹ Times out
	² Shows nature
	³ Shows givetocal
	⁴ Prints "No access to the $foo SSL site available."
	⁵ http reply


	Problematic subdomains:

		- are *
		- callcenter **
		- cosmology	(works, self-signed)
		- cs *
		- eecs *
		- graduation	(prints domain name; mismatched, CN: asterix.berkeley.edu)
		- notary.icsi	(works; mismatched, CN: *.bro.org)
		- law *
		- oskicat	(some [most?] pages redirect to http, scripts/ redirects to screens/ssoauth.html)
		- ourpromise **

	* Mismatch
	** Shows givetocal


	Partially covered subdomains:

		- alumni *
		- blogs *
		- callcenter	(→ givetocal)
		- graduation	(→ commencement)
		- ourpromise	(→ givetocal)

	* At least some pages redirect to http


	Fully covered subdomains:

		- (www.)are
		- auth
		- beartracks
		- beartracks-new
		- callink
		- calnet.calnet
		- cas-p[1-4].calnet
		- net-auth.calnet
		- (www.)cnr
		- nature.cnr
		- code
		- developer
		- events
		- as-code-prod.ist
		- as-ezsvn-prod.ist
		- (www.)law
		- (www.)lib
		- nature
		- oskicat	(→ oskicatp)
		- oskicatp
		- security
		- fortuna.security
		- students
		- sunsite
		- wikihub
		- wikihub-new


	Covered wildcard cookies:

		- .events
		- .fortuna.security
		- .security


	Other wildcard cookie domains observed:

		- .
		- .blogs.lib
		- .campuslife

-->
<ruleset name="University of California, Berkeley (partial)">

	<target host="*.berkeley.edu" />
		<!--
			These paths 302s to http:

				- $
				- community$
				- donate$
				- donate/new-alumni-challenge$
				- events$
				- join$
						-->
		<exclusion pattern="^http://alumni\.berkeley\.edu/(?!sites/)" />
		<exclusion pattern="^http://blogs\.berkeley\.edu/(?:.+/)?(?:$|\?)" />


	<securecookie host="^(?:\w.*|\.events|(?:\.fortuna)?\.security)\.berkeley\.edu$" name=".+" />


	<rule from="^http://(airbears|alumni|asterix|atcal|atcal-dev|auth|auth-key|beartracks(?:-new)?|blogs|blu|bspace|cal|calagenda|cal-dev|calfutures|callink|calmail|(?:[\w-]+\.)?calnet|career|ccc|ccc-dev|cnr|(nature|www)\.cnr|commencement|convio|code|auto(?:config|discover)\.(?:ee)?cs|developer|(?:auth|buffy)\.eecs|egiving|eureka|events|fellowship|foundation(?:-dev)?|givetocal|haasawards|services\.housing|ihouseonline|inews|international|blu\.is|as-(?:code|ezsvn)-prod\.ist|ist|journalism|kb|lib|www\.lib|nature|or|oskicatp|scholarship|(?:fortuna\.)?security|seniors|(?:new)?students|sunsite|(?:urshare-prod1|wiki)\.urel|wikihub(?:-new)?)\.berkeley\.edu/"
		to="https://$1.berkeley.edu/" />

	<rule from="^http://(?:www\.)?(are|boinc)\.berkeley\.edu/"
		to="https://$1.berkeley.edu/" />

	<rule from="^http://callcenter\.berkeley\.edu/$"
		to="https://givetocal.berkeley.edu/browse/?u=191" />

	<rule from="^http://(?:www\.)?(cs|eecs|law)\.berkeley\.edu/"
		to="https://www.$1.berkeley.edu/" />

	<rule from="^http://graduation\.berkeley\.edu/$"
		to="https://commencement.berkeley.edu/" />

	<rule from="^http://ourpromise\.berkeley\.edu/$"
		to="https://givetocal.berkeley.edu/browse/?u=174" />

</ruleset>
