Do not apply color rule filter every dissection

Introduce a frame_data flag "need_colorize" to indicate that coloring
rules need to be evaluated and set it for the GUI (not tshark). This
restores the original performance characteristics.

It additionally fixes a regression where the color filter name and
filter is not shown anymore in the tree (I guess it is related to the
edt->tree being NULL when re-selected, resulting in empty color_filter).

Remaining problems:

 - Display filter cannot contain frame.coloring_rule.* fields. Code is
   present to enable this, but then a method is needed to avoid an
   expensive second calculation (which is why it is disabled).
 - The columns are still not updated after coloring rule change.
 - The two frame.coloring_rule fields in the tree are not updated when
   the coloring rule is changed (e.g. Ctrl-1).

The last two issues were supposed to be fixed by the previous patch, but
there is probably some missing code... Tested with GTK and Qt.

Bug: 11980
Change-Id: I3ef7713b28db242e178d20f6a5f333374718b52e
Reviewed-on: https://code.wireshark.org/review/13170
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/file.c b/file.c
index 44ff87b142..125976f778 100644
--- a/file.c
+++ b/file.c
@@ -1099,6 +1099,15 @@ add_packet_to_packet_list(frame_data *fdata, capture_file *cf,
   if (dfcode != NULL) {
       epan_dissect_prime_dfilter(edt, dfcode);
   }
+#if 0
+  /* Prepare coloring rules, this ensures that display filter rules containing
+   * frame.color_rule references are still processed.
+   * TODO: actually detect that situation or maybe apply other optimizations? */
+  if (edt->tree && color_filters_used()) {
+    color_filters_prime_edt(edt);
+    fdata->flags.need_colorize = 1;
+  }
+#endif
 
   /* Dissect the frame. */
   epan_dissect_run_with_taps(edt, cf->cd_t, phdr, frame_tvbuff_new(fdata, buf), fdata, cinfo);