Language

Wirefilter

The wirefilter language is used in Peakhour.IO to define filters that identify matching requests and responses. This language is used throughout the request lifetime in Peakhour.IO's rules system, and it defines the available fields that can be used during each phase. The available fields are dependent on the stage of the request, and operators and functions can be used to define complex criteria.

Comparison operators

When comparing fields in the wirefilter language, you can use the following comparison operators:

operator	comparison
eq, ==	Equal
ne, !=	Not Equal
gt, >	Greater Than
lt, <	Less Than
ge, >=	Greater than or Equal to
le, <=	Less than or Equal to

For example, to filter requests from a specific IP address, you could use the following filter:

ip.src eq 1.1.1.1

Search and match operators

contains

The "contains" operator allows you to search for a sequence of characters within a string. For example, you can use the following filter to search for a specific HTTP URL:

http.request.uri contains ".html"

This filter would match requests that contain ".html" in the URI.

Functions

Functions provide additional capabilities for comparison and manipulation of values within the filter. You can find a comprehensive list of available functions in the Functions section of the documentation.

Logical expressions

Tests can be combined using logical expressions, such as "and" and "or". The following table lists the available logical operators:

operator	operator
and, &&	Logical AND
or,	Logical OR
not, !	Logical NOT

You can also use parentheses to group expressions:

(ip.src eq 1.1.1.1 or ip.src eq 1.1.1.1) and http.request.uri eq "/"

Membership operator

The membership operator allows you to check if a field matches a set of values. For example, to check against several IP addresses, you can use the following filter:

ip.src in {1.1.1.1,2.2.2.2}

This filter is equivalent to:

ip.src eq 1.1.1.1 or ip.src eq 2.2.2.2

Block Requests from a Specific IP Address

ip.src eq 1.1.1.1

Use cases

In this section, we will explore some sample use cases for the wirefilter language to give a better understanding of its capabilities and versatility.

This rule matches any requests from the IP address 1.1.1.1 and can be used to block such requests.

1. Match Requests for a Specific URL

http.request.uri eq "/index.html"

This rule matches only requests for the specific URL "/index.html" and can be used to allow only these requests.

1. Match Requests with Query Strings

http.request.uri contains "?"

This rule matches any requests that contain query strings and can be used to block such requests.

1. Block Requests with Specific User-Agent

any(http.request.headers["User-Agent"][*] == "BadBot")

This rule matches any requests with the specific User-Agent "BadBot" and can be used to block such requests.

1. Match Requests with Specific Referer

any(http.request.headers["Referer"][*] == "https://www.example.com")

This rule matches any requests with the specific Referer "https://www.example.com" and can be used to allow only these requests.

These sample use cases serve to highlight the range of functionality that can be achieved with the wirefilter language in the Peakhour.IO service. With its support for comparison operators, functions, and logical expressions, along with the ability to check for membership and search for a sequence of characters, wirefilter offers a powerful tool to define rules and control the behavior of the service. By leveraging this language, users can further tailor the Peakhour.IO service to meet their specific needs.