Wireshark · Ethereal-dev: [Ethereal-dev] Questions on dfilter processing

[Biot Olivier <Olivier.Biot@xxxxxxxxxxx>]

Hi List,

I have some doubts/questions on how the dfilter processing works (maybe I
don't get all the items right). I added debug logging in
epan/dfilter/semcheck.c and I realized that dfw_semcheck() is called for
every header field when a dfilter is evaluated.

Now, I intend to compile and analyze the PCRE regular expression only once
for every matches operator in a dfilter expression, by adding the following
code to the check_relation_LHS_FIELD() function:

	else if (type2 == STTYPE_STRING) {
		s = stnode_data(st_arg2);
		if (strcmp(relation_string, "matches") == 0) {
			/* Convert 2nd argument to a FT_PCRE */
			fvalue = fvalue_from_string(FT_PCRE, s,
dfilter_fail);
		} else {
			fvalue = fvalue_from_string(ftype1, s,
dfilter_fail);
			if (!fvalue) {
				/* check value_string */
				fvalue = mk_fvalue_from_val_string(hfinfo1,
s);
			}
		}
		if (!fvalue) {
			THROW(TypeError);
		}

		new_st = stnode_new(STTYPE_FVALUE, fvalue);
		sttype_test_set2_args(st_node, st_arg1, new_st);
		stnode_free(st_arg2);
	}

I defined a new ftype_t called FT_PCRE for this purpose.

BUT... I fear that the conversion from a string to a FT_PCRE happens more
than once. Is my assumption correct, or (hopefully) not?

Regards,

Olivier