Project

General

Profile

Actions

Feature #330

closed

Rule efficiency: always attempt PCRE_NO_AUTO_CAPTURE

Added by Mike Pomraning about 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

This change attempts PCRE_NO_AUTO_CAPTURE on all unnamed capture groups, as if ?: had been specified for all groups, reverting to ordinary capturing behavior if needed (if, for example, \1 is referenced).

The result is more efficient, unchanged PCRE signatures in the common case.

Rationale
---------
Remembering capture groups takes memory and time. Most signature writers don't think of using ?: when writing signatures to request more efficient behavior.

Many, many pcre: instructions in common signatures specify /(what|ever)+/ when the more efficient /(?:what|ever)+/ is all that is needed. Of the approximately 6100 ET sigs with parentheses in pcre: specifiers, only 150 reference unnamed captures and zero use ?: to disable saving captures.

In my admittedly limited testing, the 15-digit CC signatures profiled about 6% faster when compiled with PCRE_NO_AUTO_CAPTURE or when rewritten to make use of ?:.

Notes
-----
This change has no effect on named capture groups nor, as mentioned, signatures with reference earlier captures via \1, \2, etc.


Files

Actions #1

Updated by Victor Julien about 10 years ago

  • Status changed from New to Closed
  • Assignee set to Mike Pomraning
  • Target version set to 1.1beta3
  • % Done changed from 0 to 100

Good idea. Applied it, thanks Mike.

Actions

Also available in: Atom PDF