Function pfwl_field_tags_load_L7

Function Documentation

int pfwl_field_tags_load_L7(pfwl_state_t *state, pfwl_field_id_t field, const char *tags_file)

pfwl_field_tags_load Loads the associations between fields values and user-defined tags.

Loads the associations between fields values and user-defined tags.

{ “rules”: [ {“value”: “google.com”, “matchingType”: “SUFFIX”, “tag”: “GOOGLE”}, {“value”: “amazon.com”, “matchingType”: “SUFFIX”, “tag”: “AMAZON”}, … ], }

Parameters

  • state: A pointer to the state of the library.

  • field: The field identifier.

  • tags_file: The name of the JSON file containing associations between fields values and tags. The structure of the JSON file depends from the type of ‘field’. If ‘field’ is a string:

value: Is the string to be matched against the field. The comparison will always be case insensitive. I.e. if searching for ‘BarFoo’, ‘barfoo’ and ‘BaRfOo’ will match as well. matchingType: Can be ‘PREFIX’, ‘EXACT’ or ‘SUFFIX’. tag: The tag to assign to the packet when the field matches with stringToMatch. If ‘field’ is a multi map:

{ “rules”: [ {“key”: “Host”, “value”: “google.com”, “matchingType”: “SUFFIX”, “tag”: “GOOGLE”}, {“key”: “Content-Type”, “value”: “amazon.com”, “matchingType”: “SUFFIX”, “tag”: “AMAZON”}, … ], }

key: The key to match in the multi map. ‘value’, ‘matchingType’ and ‘tag’ are the same as in the string case.

The ‘tags_file’ argument can be NULL and the matching rules can be added later with the pfwl_*_tags_add calls.

Return

0 if the loading was successful, 1 otherwise (e.g. error while parsing the json file, non existing file, etc…)