There are several problems with this question:
You haven't told us what programming language you are using, or at least which flavor of regular expressions. POSIX? PCRE? Something unusual?
In what context are you using this? Are you running an HTTP server, and clients are submitting requests like these? Or are you running a proxy that is accepting these requests and analyzing them? Which proxy are you using -- is it something you've written by hand (in what language?) or something you downloaded?
It's not clear from your post that you're getting two User-Agent:
headers specified in a single request. In your post, you seem to have some line break problems (which I've edited), but it appears that you are getting three separate HTTP requests, and it's perfectly okay to have different User-Agent:
in each HTTP request. If you are actually getting input from a client like the data you were seeing in your original post (with NO linebreak after the User-Agent:
and before the next CONNECT
), then someone is trying to fool your proxy on purpose by omitting the linebreak, and attempting to do HTTP pipelining through your proxy. A standards-compliant implementation will have linebreaks, even if the HTTP Request Body is empty.
Trying to parse things using regular expressions is dangerous. At the very least, you need to be prepared to handle arbitrary input. There is no universally agreed-upon standard for the formatting of the User-Agent:
string, and many public Internet hosts that connect to a public web server will attempt to "fuzz" the server by sending it malformed requests. It is perfectly possible for a client to submit headers such as the following, even all in a single request if they want:
User-Agent: Lol your regex won't match this
User-Agent: Mozzarella/0.-0 ((Let's )()confuse your reg((ex))((()) ApplePie/-NaN (FUZZ, like Police) 3.14159\EvilAttacker )
User-Agent: Mozilla/5.0 (Windows LOL 973.1; LOL64) ...
Trying to understand a client's user-agent and then glean useful information from that is stupid. Because the client can set it to whatever they like, you should not consider a given user-agent to mean anything at all. It's like if I tell you "I have a million dollars!" -- do you have any particular reason to believe me? I'm simply alleging that fact. User-Agent:
is no different. A Windows 95 box could allege to be Windows 8.1 running IE 11. A Mac OS X 10.8 box could allege to be Red Hat Enterprise Linux 5 running Firefox 2.0. Someone deliberately trying to fool with you could allege that their operating system is "AsadzOS version 0.1".
There are very few reasonable uses of the User-Agent:
header, and in each of those use cases, it is essential that you handle all possible matching failures, false positive, false negatives, etc. very carefully, and prevent any unintended behavior in your parser by giving up if you can't make sense of the input.
On top of all this, this is a question for StackOverflow, as it is completely off-topic on SuperUser to be discussing programming techniques. I just needed to post this long-form answer to explain to you why this is a bad question.