Simplify anything-but

[timbray]

What is your idea?

The redesign of ByteMachine that came in with wildcards can efficiently represent byte-range transitions. Given that, anything-but and anything-but-prefix can be directly represented in a ByteMachine straightforwardly and efficiently, which would simplify the rule-matching code path.

Would you be willing to make the change?

Maybe

[schenksj]

@timbray Do you still see this as an opportunity? The anything-but-prefix (and my proposal for anything-but-suffix) matching seems to simply take advantage of the StateMachine transitions (

event-ruler/src/main/software/amazon/event/ruler/ByteMachine.java

Lines 459 to 503 in 84120a9

	for (ByteMatch match : nextTrans.getMatches()) {
	switch (match.getPattern().type()) {
	case EXACT:
	case EQUALS_IGNORE_CASE:
	case WILDCARD:
	if (valIndex == (val.length - 1)) {
	transitionTo.add(match.getNextNameState());
	}
	break;
	case NUMERIC_EQ:
	// only matches at last character
	if (fieldValueIsNumeric && valIndex == (val.length - 1)) {
	transitionTo.add(match.getNextNameState());
	}
	break;
	case PREFIX:
	transitionTo.add(match.getNextNameState());
	break;
	case SUFFIX:
	case EXISTS:
	// we already harvested these matches via separate functions due to special matching
	// requirements, so just ignore them here.
	break;
	case NUMERIC_RANGE:
	// as soon as you see the match, you've matched
	Range range = (Range) match.getPattern();
	if ((fieldValueIsNumeric && !range.isCIDR) || (!fieldValueIsNumeric && range.isCIDR)) {
	transitionTo.add(match.getNextNameState());
	}
	break;
	case ANYTHING_BUT:
	AnythingBut anythingBut = (AnythingBut) match.getPattern();
	// only applies if at last character
	if (valIndex == (val.length - 1) && anythingBut.isNumeric() == fieldValueIsNumeric) {
	failedAnythingButs.add(match.getNextNameState());
	}
	break;
	case ANYTHING_BUT_PREFIX:
	failedAnythingButs.add(match.getNextNameState());
	break;

), and if they match the get tagged as failed.

[timbray]

Absolutely. The way anything-but and suffix matching is done are sort of hacky (I can say that because anything-but is my own gross hack) and I suspect quite a bit of code could be discarded if someone were willing to buckle down and replace the hacks with principled automaton-building. I'm pretty sure performance would improve too.