<!--
	For rules causing false/broken MCB, see Apple-falsemixed.xml.

	For problematic rules, see Apple-mismatches.xml.


	Other Apple rulesets:

		- Apple_China.xml


	CDN buckets:

		- a248.e.akamai.net/7/248/51/20120908/swdlp.apple.com/
		- a772.g.akamai.net/7/772/51/ef865529940b9e/www.apple.com/
		- a771.da1.akamai.net/L/771/82810/5m/init.itunes.apple.com/ | ax.init.itunes.apple.com.edgesuite.net
		- appldnld.apple.com.akadns.net
		- devimages.apple.com.edgekey.net
		- init.ess.apple.com.edgesuite.net

		- ping.itunes.apple.com.edgesuite.net

			- a1755.b.akamai.net

		- static-uptodate.apple.com.edgekey.net
		- storeimages.apple.com.edgekey.net
		- km.support.apple.com.edgekey.net
		- images.apple.com.edgesuite.net
		- ax.init.itunes.apple.com.edgesuite.net

		- legacy-support.apple.com.edgesuite.net

			- docs.info.apple.com
			- www0.info.apple.com

		- ax.phobos.apple.com.edgesuite.net
		- a\d+.phobos.apple.com.edgesuite.net

		- a([1-5]).mzstatic.com.edgesuite.net/...

			- a$1.da1.akamai.net/...


	Nonfunctional domains:

		- apple.com subdomains:

			- deimos3	(403/404, akamai)
			- init.ess	(503, akamai)
			- userprofile.itunes *
			- rss.lists	(shows lists; mismatched, CN: lists.apple.com)
			- mynews *

		- dzc-metrics.mzstatic.com **

	* Refused
	** Data differ between http & https


	Problematic domains:

		- apple.com subdomains:

			- adcdownload *
			- appldnld *
			- devimages *
			- images *
			- manuals.info *
			- docs.info *
			- www.info *
			- www0.info *
			- dzc.itunes		(data differ)
			- ping.itunes *
			- prod.lists ³
			- www.lists		(mismatched, CN: lists.apple.com)
			- a1.phobos *
			- a1721.phobos *
			- a1980.phobos *
			- static-mynews *
			- storeimages *
			- km.support *
			- trailers *

		- store.storeimages.cdn-apple.com *
		- iwork.com				(cert only matches www)

		- mzstatic.com subdomains:

			- (www.)	(refused)
			- a\d *
			- r *
			- r[1-8] *
			- store *

	* Akamai
	³ Mismatched, CN: lists.apple.com


	Partially covered domains:

		- concierge *
		- store *

	* At least some pages redirect to http


	Fully covered domains:

		- apple.com subdomains:

			- (www.)
			- albert
			- appldnld		(→ akamai)
			- appleid
			- application
			- as-images
			- bugreport
			- buyiphone
			- buyiphone[1-4]
			- certifications
			- configuration
			- connect
			- consultants-locator
			- csat
			- daw
			- developer
			- devforums
			- devimages		(→ devimages.apple.com.edgekey.net)
			- discussions
			- discussionsjapan
			- ecommerce
			- service.ess
			- service[12].ess
			- expresslane
			- gsx
			- gsxapp
			- help
			- hrweb
			- iad
			- id
			- idmsa
			- iforgot
			- images		(→ ssl)
			- docs.info		(→ akamai)
			- manuals.info		(→ akamai)
			- www0.info		(→ akamai)

			- itunes subdomains:

				- ^
				- affiliate
				- api
				- autolinkmaker
				- banners
				- bookkeeper
				- buy
				- c
				- client-api
				- du
				- feeds
				- files
				- genius
				- genius-2
				- genius-download
				- genius-download-2
				- genius-upload
				- genius-upload-2
				- homesharing
				- init
				- itunesu
				- ld-[1-8]
				- ld-nk11
				- ld-st11
				- linkmaker
				- my
				- myapp
				- p\d+-buy
				- p100-sandbox
				- p1-u
				- p2-u
				- partiality
				- pd-nk
				- pd-st
				- play
				- rss
				- s
				- sandbox
				- sc
				- se
				- search
				- sidebar
				- sitemanager
				- sp
				- static
				- stations
				- su
				- tl
				- tl-activity
				- upp
				- userpub
				- volume
				- vpp
				- widgets

			- itunesconnect
			- jobs
			- jointventure
			- (www.)lists		(www → ^)
			- prod.lists
			- locate
			- mypage
			- nc-as-images
			- nc-buyiphone
			- nc-unbrick1
			- nwk-as-images
			- nwk-buyiphone
			- nwk-unbrick[12]
			- onetoone
			- opensource
			- www.opensource
			- phobos
			- portal
			- register
			- remoteadvisor
			- reportingitc
			- securemetrics
			- reseller
			- reserve
			- salestraining
			- selfsolve
			- ssl
			- secure.store
			- secure\d.store
			- storeimages		(→ storeimages.apple.com.edgekey.net)
			- km.support		(→ km.support.apple.com.edgekey.net)
			- supportprofile
			- swdlp
			- uptodate
			- wdg2

		- hrweb.cdn-apple.com
		- store.storeimages.cdn-apple.com	(→ storeimages.apple.com.edgekey.net)
		- ax.phobos.apple.com.edgesuite.net	(→ s.mzstatic.com)
		- (www.)iwork.com			(^ → www)
		- (www.)me.com

		- mzstatic.com subdomains:

			- (www.)	(→ ssl.apple.com)
			- a[1-5]	(→ s[1-5])
			- accertify
			- itc
			- metrics
			- r		(→ s)
			- s
			- s[1-5]


	Observed cookie domains:

		- .
		- consultants-locator
		- genius-download.itunes
		- genius-upload.itunes
		- sitemanager.itunes
		- vpp.itunes
		- store
		- .store
		- support
		- supportprofile


	Mixed content:

		- Scripts, on:

			- support from images *
			- support from km.support *

		- css, on:

			- support from images *
			- support from km.support *

		- Images, on:

			- consultants-locator from images *
			- itunes from images *
			- itunes from ax.phobos.apple.com.edgesuite.net *
			- itunes from a[1-5].mzstatic.com *
			- support from images *
			- support from km.support *

	* Secured by us


	NB: We secure all resources, and thus
	-falsemixed should be merged for Ffx 24.

-->
<ruleset name="Apple.com (parial)">

	<target host="apple.com" />
	<target host="*.apple.com" />
		<exclusion pattern="^http://concierge\.apple\.com/(?!resources/)" />
		<exclusion pattern="^http://store\.apple\.com/(?!Catalog/|[\w/]+/css/|rs/)" />
	<target host="*.cdn-apple.com" />
	<target host="ax.phobos.apple.com.edgesuite.net" />
	<target host="iwork.com" />
	<target host="www.iwork.com" />
	<target host="me.com" />
	<target host="www.me.com" />
	<target host="mzstatic.com" />
	<target host="*.mzstatic.com" />


	<!--	Tracking cookies:
					-->
	<securecookie host="^\.apple\.com$" name="^s_.+$" />
	<!--
		Can we secured any of these safely?
							-->
	<!--securecookie host="^\.apple\.com$" name="^(ccl|dslang|dssid2|dz_in_cookie|geo|itspod|mzf_in|mzf_odc|ns-mzf-inst|Pod|POD|wosid-lite)$" /-->
	<!--
		No known problems, just being cautious:
							-->
	<securecookie host="^(?!\.?(?:concierg|stor)e\.apple\.com).+\.apple\.com$" name=".+" />


	<rule from="^http://((?:albert|appleid|application|(?:nc-|nwk-)?as-images|bugreport|buyiphone\d?|certifications|concierge|configuration|connect|consultants-locator|csat|daw|developer|devforums|discussions(?:japan)?|ecommerce|service\d?\.ess|expresslane|gsx|gsxapp|help|hrweb|ia?d|idmsa|iforgot|(?:(?:affiliate|api|autolinkmaker|banners|bookkeeper|buy|c|client-api|du|feeds|files|genius(?:-download|-upload)?(?:-2)?|homesharing|init|itunesu|ld-(?:\d|nk11|st11)|linkmaker|my|myapp|p\d+-buy|p100-sandbox|p[12]-u|partiality|pd-nk|pd-st|play|rss|s|sandbox|sc|se|search|sidebar|sitemanager|sp|static|stations|su|tl|tl-activity|upp|userpub|volume|vpp|widgets)\.)?itunes|itunesconnect|jointventure|jobs|locate|mypage|n(?:c|wk)-(?:buyiphone|unbrick1)|nwk-unbrick2|onetoone|(www\.)?opensource|phobos|portal|register|remoteadvisor|reportingitc|reseller|reserve|salestraining|securemetrics|selfsolve|store|secure\d?\.store|supportprofile|swdlp|uptodate|wdg2|www)\.)?apple\.com/"
		to="https://$1apple.com/" />

	<rule from="^http://appldnld\.apple\.com/"
		to="https://a248.e.akamai.net/7/248/51/20120908/appldnld.apple.com/" />

	<rule from="^http://devimages\.apple\.com/"
		to="https://devimages.apple.com.edgekey.net/" />

	<rule from="^http://(?:images|ssl)\.apple\.com/"
		to="https://ssl.apple.com/" />

	<rule from="^http://docs\.info\.apple\.com/"
		to="https://a248.e.akamai.net/7/248/51/20120908/docs.info.apple.com/" />

	<rule from="^http://manuals\.info\.apple\.com/"
		to="https://a248.e.akamai.net/7/248/51/20120908/manuals.info.apple.com/" />

	<rule from="^http://www0\.info\.apple\.com/"
		to="https://a248.e.akamai.net/7/1300/51/20120908/www0.info.apple.com/" />

	<rule from="^http://(?:prod\.|www\.)?lists\.apple\.com/"
		to="https://lists.apple.com/" />

	<rule from="^http://store(?:images\.|\.storeimages\.cdn-)apple\.com/"
		to="https://storeimages.apple.com.edgekey.net/" />

	<rule from="^http://hrweb\.cdn-apple\.com/"
		to="https://hrweb.cdn-apple.com/" />

	<rule from="^http://ax\.phobos\.apple\.com\.edgesuite\.net/"
		to="https://s.mzstatic.com/" />

	<rule from="^http://km\.support\.apple\.com/"
		to="https://km.support.apple.com.edgekey.net/" />

	<rule from="^http://(?:www\.)?iwork\.com/"
		to="https://www.iwork.com/" />

	<rule from="^http://(www\.)?me\.com/"
		to="https://$1me.com/" />

	<!--	Redirects over http to www.apple.com
							-->
	<rule from="^http://(?:www\.)?mzstatic\.com/"
		to="https://www.apple.com/" />

	<rule from="^http://a(\d)\.mzstatic\.com/"
		to="https://s$1.mzstatic.com/" />

	<rule from="^http://(accertify|itc|metrics|s\d?)\.mzstatic\.com/"
		to="https://$1.mzstatic.com/" />

	<rule from="^http://r\.mzstatic\.com/"
		to="https://s.mzstatic.com/" />

	<rule from="^https?://trailers\.apple\.com/"
		to="http://trailers.apple.com/" downgrade="1" />
</ruleset>
