Hi List,
I have some doubts/questions on how the dfilter processing works (maybe I
don't get all the items right). I added debug logging in
epan/dfilter/semcheck.c and I realized that dfw_semcheck() is called for
every header field when a dfilter is evaluated.
Now, I intend to compile and analyze the PCRE regular expression only once
for every matches operator in a dfilter expression, by adding the following
code to the check_relation_LHS_FIELD() function:
else if (type2 == STTYPE_STRING) {
s = stnode_data(st_arg2);
if (strcmp(relation_string, "matches") == 0) {
/* Convert 2nd argument to a FT_PCRE */
fvalue = fvalue_from_string(FT_PCRE, s,
dfilter_fail);
} else {
fvalue = fvalue_from_string(ftype1, s,
dfilter_fail);
if (!fvalue) {
/* check value_string */
fvalue = mk_fvalue_from_val_string(hfinfo1,
s);
}
}
if (!fvalue) {
THROW(TypeError);
}
new_st = stnode_new(STTYPE_FVALUE, fvalue);
sttype_test_set2_args(st_node, st_arg1, new_st);
stnode_free(st_arg2);
}
I defined a new ftype_t called FT_PCRE for this purpose.
BUT... I fear that the conversion from a string to a FT_PCRE happens more
than once. Is my assumption correct, or (hopefully) not?
Regards,
Olivier
_______________________________________________
Ethereal-dev mailing list
[EMAIL PROTECTED]
http://www.ethereal.com/mailman/listinfo/ethereal-dev
