Ethereal-dev: Re: [Ethereal-dev] Modify field types

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Fri, 05 Dec 2003 20:42:11 -0000
On Fri, 2003-12-05 at 11:54, Biot Olivier wrote:
> Hi List,
> 
> If I want to optimize the "matches" operation, then I want to compile (and
> study) the RE only once, before applying the filter. In order to do so, I
> envisage to generate a new internal FT_PCRE field type, which would contain
> a pointer to a pcre_tuple structure, itself containing a pointer to the
> textual RE string, a pcre pointer, a pcre_extra pointer and a constant error
> string pointer. At filter parsing, I'd like to transform the 2nd operand of
> "matches" from any FT_STRING type to this FT_PCRE.
> 
> Is this possible, and how do I do this?
> 
> Regards,
> 
> Olivier
> 

This would be done in dfilter/semcheck.c, in much the same way that an
FT_STRING is changed to an FT_UINT32 in the case of value_string
strings.

--gilbert