[Guy Harris <guy@xxxxxxxxxxxx>]

On Wed, Feb 11, 2004 at 10:28:09AM +0100, Biot Olivier wrote:
> It certainly is, but that'd require some work on the dfilter parser.

It might be that the number of token types should be reduced, with
STRING, FIELD, and UNPARSED merged into a single type, and with the code
for rules that involve the new token type explicitly checking whether
the right type is there, so that, for example, "ip" and "whoop" would be
the same token type, and, for example, the code for

	logical_test(T) ::= FIELD(F).
	{
		T = stnode_new(STTYPE_TEST, NULL);
		sttype_test_set1(T, TEST_OP_EXISTS, F);
	}

would become

	logical_test(T) ::= STRING(S).
	{
		if (S isn't the unquoted name of a field)
			dfilter_fail(appropriate message);
		T = stnode_new(STTYPE_TEST, NULL);
		sttype_test_set1(T, TEST_OP_EXISTS, S);
	}

The value for a STRING token would include a flag specifying whether
it's quoted or unquoted, as well as the actual string value.