columns: Allow any field expression syntax to be used in columns

Allow anything that can be used in a display filter to be used in
columns (with the exception that field references don't work without
a notion of a currently selected frame): display filter functions,
slices, arithmetic calculations, logical tests, raw byte addressing,
the layer modifier, display filter macros, etc., alone or in
combination.

Show the results and generate filters. Note that "resolved" values are
not yet supported. They make conceptual sense for some expressions
(e.g., if the layer modifier only is used) but not for others.
Perhaps resolution could be done as a final step in the filter before
returning values.

It would also be useful to be able to get the expected return type
of an expression, so that the functions for right justifying a column
or sorting numerically could work. Right now the results are treated
as strings even if the return field values are numeric.

Multifield columns (i.e., concatenation of field values) are currently
implemented using the OR operator.For backwards compability, continue to
support that. When a true logical OR would give a different result,
surround the expression in parentheses, which the multifield columns did
not previously support (due to the regex used instead of full filter
grammar parsing.)

Perhaps in the future we should introduce a separate operator for
concatenation, possibly only used in column definitions and nowhere
else.

Update release notes.

Fix #7752. Fix #10154. Fix #15990. Fix #18588. Fix #19076.
Related to #16181 - it's now possibly to define new display filter
functions so that is essentially solved, though I suppose there's
always room for more built-in functions.

1 files changed, 24 insertions, 6 deletions

diff --git a/ui/packet_list_utils.c b/ui/packet_list_utils.c
index ce5a6d27ce..312d156e12 100644
--- a/ui/packet_list_utils.c
+++ b/ui/packet_list_utils.c
@@ -20,7 +20,8 @@ right_justify_column (gint col, capture_file *cf)
 {
     header_field_info *hfi;
     gboolean right_justify = FALSE;
-    guint num_fields, *field_idx, ii;
+    guint num_fields, ii;
+    col_custom_t *col_custom;
     guint right_justify_count = 0;
 
     if (!cf) return FALSE;
@@ -43,10 +44,17 @@ right_justify_column (gint col, capture_file *cf)
         case COL_CUSTOM:
             num_fields = g_slist_length(cf->cinfo.columns[col].col_custom_fields_ids);
             for (ii = 0; ii < num_fields; ii++) {
-                field_idx = (guint *) g_slist_nth_data(cf->cinfo.columns[col].col_custom_fields_ids, ii);
-                hfi = proto_registrar_get_nth(*field_idx);
+                col_custom = (col_custom_t *) g_slist_nth_data(cf->cinfo.columns[col].col_custom_fields_ids, ii);
+                if (col_custom->field_id == 0) {
+                    /* XXX - If there were some way to check the compiled dfilter's
+                     * expected return type, we could use that.
+                     */
+                    return FALSE;
+                }
+                hfi = proto_registrar_get_nth(col_custom->field_id);
 
                 /* Check if this is a valid field and we have no strings lookup table */
+                /* XXX - We should check every hfi with the same abbreviation */
                 if ((hfi != NULL) && ((hfi->strings == NULL) || !get_column_resolved(col))) {
                     /* Check for bool, framenum, double, float, relative time and decimal/octal integer types */
                     if ((hfi->type == FT_BOOLEAN) || (hfi->type == FT_FRAMENUM) || (hfi->type == FT_DOUBLE) ||
@@ -77,7 +85,8 @@ resolve_column (gint col, capture_file *cf)
 {
     header_field_info *hfi;
     gboolean resolve = FALSE;
-    guint num_fields, *field_idx, ii;
+    guint num_fields, ii;
+    col_custom_t *col_custom;
 
     if (!cf) return FALSE;
 
@@ -86,8 +95,17 @@ resolve_column (gint col, capture_file *cf)
         case COL_CUSTOM:
             num_fields = g_slist_length(cf->cinfo.columns[col].col_custom_fields_ids);
             for (ii = 0; ii < num_fields; ii++) {
-                field_idx = (guint *) g_slist_nth_data(cf->cinfo.columns[col].col_custom_fields_ids, ii);
-                hfi = proto_registrar_get_nth(*field_idx);
+                col_custom = (col_custom_t *) g_slist_nth_data(cf->cinfo.columns[col].col_custom_fields_ids, ii);
+                if (col_custom->field_id == 0) {
+                    /* XXX - A "resolved" string might be conceivable for certain
+                     * expressions, but would require being able to know which
+                     * hfinfo produced each value, if there are multiple hfi with
+                     * the same abbreviation.
+                     */
+                    continue;
+                }
+                hfi = proto_registrar_get_nth(col_custom->field_id);
+                /* XXX - We should check every hfi with the same abbreviation */
 
                 /* Check if we have an OID, a (potentially) resolvable network
                  * address, a Boolean, or a strings table with integer values */