Ethereal-dev: Re: [Ethereal-dev] Modify field types

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Fri, 05 Dec 2003 20:42:11 -0000
On Fri, 2003-12-05 at 11:54, Biot Olivier wrote:
> Hi List,
> 
> If I want to optimize the "matches" operation, then I want to compile (and
> study) the RE only once, before applying the filter. In order to do so, I
> envisage to generate a new internal FT_PCRE field type, which would contain
> a pointer to a pcre_tuple structure, itself containing a pointer to the
> textual RE string, a pcre pointer, a pcre_extra pointer and a constant error
> string pointer. At filter parsing, I'd like to transform the 2nd operand of
> "matches" from any FT_STRING type to this FT_PCRE.
> 
> Is this possible, and how do I do this?
> 
> Regards,
> 
> Olivier
> 

This would be done in dfilter/semcheck.c, in much the same way that an
FT_STRING is changed to an FT_UINT32 in the case of value_string
strings.

--gilbert