<ruleset name="Google Search" match_rule="http:.*google\.">
  <target host="*.google.com" />
  <target host="google.com" />
  <target host="www.google.com.*" />
  <target host="google.com.*" />
  <target host="www.google.co.*" />
  <target host="google.co.*" />
  <target host="www.google.*" />
  <target host="google.*" />
  <!-- beyond clients1 these do not currently exist in the ccTLDs, 
       but just in case... -->
  <target host="clients1.google.com.*" />
  <target host="clients2.google.com.*" />
  <target host="clients3.google.com.*" />
  <target host="clients4.google.com.*" />
  <target host="clients5.google.com.*" />
  <target host="clients1.google.co.*" />
  <target host="clients2.google.co.*" />
  <target host="clients3.google.co.*" />
  <target host="clients4.google.co.*" />
  <target host="clients5.google.co.*" />
  <target host="clients1.google.*" />
  <target host="clients2.google.*" />
  <target host="clients3.google.*" />
  <target host="clients4.google.*" />
  <target host="clients5.google.*" />

  <!-- Some Google pages can generate naive links back to the
       unencrypted version of encrypted.google.com, which is a
       301 but theoretically vulnerable to SSL stripping. -->

  <rule from="^http://encrypted\.google\.com/"
          to="https://encrypted.google.com/"/>

  <!-- The most basic case. -->

  <rule from="^http://(www\.)?google\.com/search" 
          to="https://encrypted.google.com/search"/>

  <!-- A very annoying exception that we seem to need for the basic case -->

  <exclusion pattern="^http://(www\.)?google\.com/search.*tbs=shop" />
  <exclusion pattern="^http://clients[0-9]\.google\.com/.*client=products.*" />
  <exclusion pattern="^http://suggestqueries\.google\.com/.*client=products.*" />

  <!-- Google's help is now available in HTTPS too. -->
  <rule from="^http://(www\.)?google\.com/support/" 
          to="https://www.google.com/support/"/>

  <!-- But not the forums, bizarrely. -->
  <exclusion pattern="^http://www\.google\.com/support/forum([\?/].*)?$"/>

  <!-- There are two distinct cases for these firefox searches -->

  <rule from="^http://(www\.)?google\.com/firefox/?$" 
          to="https://encrypted.google.com/"/>

  <rule from="^http://(www\.)?google\.com/firefox" 
          to="https://encrypted.google.com/search"/>

  <rule from="^http://(www\.)?google\.com/webhp" 
          to="https://encrypted.google.com/webhp"/>

  <rule from="^http://(www\.)?google\.com/#" 
          to="https://encrypted.google.com/#"/>

  <rule from="^http://(www\.)?google\.com/$" 
          to="https://encrypted.google.com/"/>

  <!-- most google international sites look like "google.fr" -->

  <rule 
    from="^http://(www\.)?google\.[^/@:][^/@:]/(search\?|firefox|#)" 
      to="https://encrypted.google.com/#" />

  <!-- some look like "google.co.jp" -->
  <!-- and some crazy ones like "google.com.au" -->
  <rule 
    from="^http://(www\.)?google\.com?\.[^/@:][^/@:]/(search\?|firefox|#)" 
      to="https://encrypted.google.com/#" />
  <!-- Completion urls look like this: 

http://clients2.google.co.jp/complete/search?hl=ja&client=hp&expIds=17259,24660,24729,24745&q=m&cp=1 HTTP/1.1\r\n

   -->
  <rule from="^http://clients[0-9]\.google\.com/complete/search" 
          to="https://clients1.google.com/complete/search"/>

  <rule from="^http://clients[0-9]\.google\.com?\.[^/:@][^/:@]/complete/search" 
          to="https://clients1.google.com/complete/search"/>

  <rule from="^http://clients[0-9]\.google\.[^/:@][^/:@]/complete/search" 
          to="https://clients1.google.com/complete/search"/>

  <rule from="^http://suggestqueries\.google\.com/complete/search" 
          to="https://clients1.google.com/complete/search"/>

  <!-- We are trying a large collection of mappings from google country sites
       to https://encrypted.google.com/webhp?hl=<lang> where lang is the default
       language for that country.  The concern with that was that the hl=
       parameter would override any user preference for a particular language,
       which would be Bad, especially if people got bounced from 
       http://google.com to google.cctld to https://google/webhp?hl=<constant>
       but since we actually prevent google from performing the first bounce, 
       we don't have to worry about this so much!
       -->

  <rule 
   from="^http://(www\.)?google\.(com?\.)?(au|ca|gh|ie|in|jm|ke|lk|my|na|ng|nz|pk|rw|sl|sg|ug|uk|za|zw)/?$"
     to="https://encrypted.google.com/" />

  <rule 
   from="^http://(www\.)?google\.(com?\.)?(ar|bo|cl|co|cu|cr|ec|es|gt|mx|pa|pe|py|sv|uy|ve)/?$"
    to="https://encrypted.google.com/webhp?hl=es" />

  <rule 
   from="^http://(www\.)?google\.(com\.)?(ae|bh|eg|jo|kw|lb|ly|om|qa|sa)/?$"
     to="https://encrypted.google.com/webhp?hl=ar" />

  <rule from="^http://(www\.)?google\.(at|ch|de)/?$"
          to="https://encrypted.google.com/webhp?hl=de" />

  <rule from="^http://(www\.)?google\.(fr|nl|it|pl|ru|bg|pt|ro|hr|fi)/?$"
          to="https://encrypted.google.com/webhp?hl=$2" />

  <rule from="^http://(www\.)?google\.com?\.(id|th|tr)/?$"
          to="https://encrypted.google.com/webhp?hl=$2" />

  <rule from="^http://(www\.)?google\.com\.il/?$"
          to="https://encrypted.google.com/webhp?hl=he" />

  <rule from="^http://(www\.)?google\.com\.kr/?$"
          to="https://encrypted.google.com/webhp?hl=ko" />

  <rule from="^http://(www\.)?google\.com\.jp/?$"
          to="https://encrypted.google.com/webhp?hl=ja" />

  <rule from="^http://(www\.)?google\.com\.vn/?$"
          to="https://encrypted.google.com/webhp?hl=vi" />

  <rule from="^http://(www\.)?google\.com\.br/?$"
          to="https://encrypted.google.com/webhp?hl=pt-BR" />

  <rule from="^http://(www\.)?google\.se/?$"
          to="https://encrypted.google.com/webhp?hl=sv" />

</ruleset>
