dfilter: Refactor macro tree references

This replaces the current macro reference system with
a completely different implementation. Instead of a macro a reference
is a syntax element. A reference is a constant that can be filled
in the dfilter code after compilation from an existing protocol tree.
It is best understood as a field value that can be read from a fixed
tree that is not the frame being filtered. Usually this fixed tree
is the currently selected frame when the filter is applied. This
allows comparing fields in the filtered frame with fields in the
selected frame.

Because the field reference syntax uses the same sigil notation
as a macro we have to use a heuristic to distinguish them:
if the name has a dot it is a field reference, otherwise
it is a macro name.

The reference is synctatically validated at compile time.

There are two main advantages to this implementation (and a couple of
minor ones):

The protocol tree for each selected frame is only walked if we have a
display filter and if the display filter uses references. Also only the
actual reference values are copied, intead of loading the entire tree
into a hash table (in textual form even).

The other advantage is that the reference is tested like a protocol
field against all the values in the selected frame (if there is more
than one).

Currently the reference fields are not "primed" during dissection, so
the entire tree is walked to find a particular reference (this is
similar to the previous implementation).

If the display filter contains a valid reference and the reference is
not loaded at the time the filter is run the result is the same as a
non existing field for a regular READ_TREE instruction.

Fixes #17599.

1 files changed, 0 insertions, 26 deletions

diff --git a/epan/proto.c b/epan/proto.c
index ea6a397f86..6b6f626656 100644
--- a/epan/proto.c
+++ b/epan/proto.c
@@ -741,32 +741,6 @@ proto_tree_traverse_pre_order(proto_tree *tree, proto_tree_traverse_func func,
 	return FALSE;
 }
 
-gboolean
-proto_tree_traverse_post_order(proto_tree *tree, proto_tree_traverse_func func,
-			       gpointer data)
-{
-	proto_node *pnode = tree;
-	proto_node *child;
-	proto_node *current;
-
-	child = pnode->first_child;
-	while (child != NULL) {
-		/*
-		 * The routine we call might modify the child, e.g. by
-		 * freeing it, so we get the child's successor before
-		 * calling that routine.
-		 */
-		current = child;
-		child   = current->next;
-		if (proto_tree_traverse_post_order((proto_tree *)current, func, data))
-			return TRUE;
-	}
-	if (func(pnode, data))
-		return TRUE;
-
-	return FALSE;
-}
-
 void
 proto_tree_children_foreach(proto_tree *tree, proto_tree_foreach_func func,
 			    gpointer data)