#1 Dictionary instantiation in SourceFilter

[Isaac]

In sourcefilter.py, the source_filter dictionary is shared by all instances of SourceFilter. This is a result of setting "source_filter = {}" inside the class declaration, rather than inside the __init__ function. This means that only one unique SourceFilter object can be created over the lifetime of the Python process, as they will all share the same internal source_filter. The effect of this is described in: https://docs.python.org/2/tutorial/classes.html#class-and-instance-variables

diff -r f8f315668fc3 sourcefilter.py
--- a/sourcefilter.py   Wed Jul 08 17:26:51 2015 +1000
+++ b/sourcefilter.py   Thu Jul 09 14:55:27 2015 +1000
@@ -35,15 +35,15 @@

 class SourceFilter:


-    ## dictionary of (S|D)_<ip> that points to list of ports 
-    source_filter = {}

     ## Build flow filter
     #  @param filter_str String of multiple flows,
     #                    format (S|D)_srcip_srcport[;(S|D)_srcip_srcport]*
     #                    srcport Port number, can be wildcard character '*'
     def __init__(self, filter_str):
-

+        ## dictionary of (S|D)_<ip> that points to list of ports 
+        self.source_filter = {}
+        
        if filter_str != '' and len(self.source_filter) == 0:
                for fil in filter_str.split(';'):

[S. Zander]

Yes, having only one dictionary was a deliberate choice (see also the first "if" in constructor). It means the dictionary needs to be created only once when running multiple extract tasks after each other, for example when running extract_all or analyse_all. There was no need for multiple source filters.

Unless multiple source filters are needed, I won't change this code for now (maybe later as part of a more general code overhaul). Also the above patch is incomplete. If we have a dictionary per object, then the second part of the first "if" in the constructor should be removed and also then there should be some changes to simplify source filter related code in analysecmpexp.py.