Hi!
I have a few question about this patch.
On Tue, 2007-11-06 at 13:46 -0500, Micah Anderson wrote:
> diff -Naur syslog-ng-2.0.5.orig/src/filter.c syslog-ng-2.0.5/src/filter.c
> --- syslog-ng-2.0.5.orig/src/filter.c 2007-05-21 19:21:07.000000000 +0200
> +++ syslog-ng-2.0.5/src/filter.c 2007-11-03 00:30:22.000000000 +0100
> @@ -226,6 +226,7 @@
> typedef struct _FilterRE
> {
> FilterExprNode super;
> + GString *replace;
> regex_t regex;
> } FilterRE;
>
> @@ -310,6 +311,9 @@
> filter_re_free(FilterExprNode *s)
> {
> FilterRE *self = (FilterRE *) s;
> +
> + if (self->replace != NULL)
> + g_string_free(self->replace, TRUE);
>
> regfree(&self->regex);
> g_free(s);
> @@ -494,3 +498,89 @@
> self->super.eval = filter_netmask_eval;
> return &self->super;
> }
> +
> +FilterExprNode *
> +filter_strip_new(const gchar *re)
> +{
> + if (g_ascii_strcasecmp(re, "ips") == 0)
> + return filter_replace_new(re, "0.0.0.0");
> + return filter_replace_new(re, "----");
> +}
> +
> +#define FMIN(a, b) (a) < (b) ? (a) : (b)
Is there any difference between this macro and the MIN macro define in
glib?
(http://library.gnome.org/devel/glib/unstable/glib-Standard-Macros.html#MIN:CAPS)
> +#define NEW_MSG_SIZE 2048
Is there a reason to limit new message size to 2048 bytes?
> +
> +static gboolean
> +filter_replace_eval(FilterExprNode *s, LogMessage *log)
> +{
> + FilterRE *self = (FilterRE *) s;
> + gchar *buffer = log->msg.str;
> + gint snippet_size;
> + regmatch_t pmatch;
> + gchar new_msg[NEW_MSG_SIZE];
> + gchar *new_msg_max = new_msg + NEW_MSG_SIZE;
> + gchar *new_msg_ptr = new_msg;
> + gint replace_length = self->replace->len;
> + gint error;
> +
> + error = regexec(&self->regex, buffer, 1, &pmatch, 0);
> + if (error)
> + return TRUE;
> + while (!error)
> + {
> + /* copy string snippet which preceeds matched text */
> + snippet_size = FMIN(pmatch.rm_so, new_msg_max - new_msg_ptr);
> + memcpy(new_msg_ptr, buffer, snippet_size);
> + new_msg_ptr += snippet_size;
> +
> + /* copy replacement */
> + snippet_size = FMIN(replace_length, new_msg_max - new_msg_ptr);
> + memcpy(new_msg_ptr, self->replace->str, snippet_size);
> + new_msg_ptr += snippet_size;
> +
> + /* search for next match */
> + buffer += pmatch.rm_eo;
> + error = regexec(&self->regex, buffer, 1, &pmatch, REG_NOTBOL);
> + }
Why do You not use GString and g_string_append_len?
> +
> + /* copy the rest of the old message */
> + snippet_size = log->msg.len - (buffer - log->msg.str) + 1;
> + snippet_size = FMIN(snippet_size, new_msg_max - new_msg_ptr);
> + memcpy(new_msg_ptr, buffer, snippet_size);
> + new_msg[NEW_MSG_SIZE-1] = '\0';
> +
> + g_string_erase(&(log->msg), 0, -1);
I think g_string_truncate is faster and explain more the intended
feature (to me).
> + g_string_append(&(log->msg), new_msg);
> +
> + return TRUE;
> +}
> +
> +FilterExprNode *
> +filter_replace_new(const gchar *re, const gchar *replacement)
> +{
> + FilterRE *self = g_new0(FilterRE, 1);
> + gint regerr;
> +
> + if (!g_ascii_strcasecmp(re, "ips"))
> + re =
> "(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])([\\.\\-](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])){3}";
> +
> + regerr = regcomp(&self->regex, re, REG_ICASE | REG_EXTENDED);
> + if (regerr)
> + {
> + gchar errorbuf[256];
> + regerror(regerr, &self->regex, errorbuf, sizeof(errorbuf));
> + msg_error("Error compiling regular expression:",
> + evt_tag_str("re", re),
> + evt_tag_str("error", errorbuf),
> + NULL);
> + g_free(self);
> + return NULL;
> + }
> +
> + self->replace = g_string_new(replacement);
> + self->super.eval = filter_replace_eval;
> + self->super.free_fn = filter_re_free;
> +
> + return &self->super;
> +}
> +
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
