dfilter: Replace unparsed lexical type and simplify grammar

Remove unparsed lexical type and replace it with identifier
and constant. This separation is still necessary to differentiate
names (fields and function) from literals that look like names
but it has some advantages to do it at the lexical level.

The main advantage is a much cleaner and simplified grammar,
because we only have a single token type for field names, without
any loss of generality (the same name is valid for fields and
function names for example).

The CONSTANT token type is necessary to be different from literal
to provide errors for function rules.

1 files changed, 6 insertions, 0 deletions

diff --git a/test/suite_dfilter/group_syntax.py b/test/suite_dfilter/group_syntax.py
index c6f1f9ede0..829f4e6d8c 100644
--- a/test/suite_dfilter/group_syntax.py
+++ b/test/suite_dfilter/group_syntax.py
@@ -132,6 +132,12 @@ class case_syntax(unittest.TestCase):
         dfilter = '\ttcp.stream \r\n== 1'
         checkDFilterSucceed(dfilter)
 
+    def test_func_name_clash1(self, checkDFilterFail):
+        # "tcp" is a (non-existent) function, not a protocol
+        error = "Function 'tcp' does not exist"
+        dfilter = 'frame == tcp()'
+        checkDFilterFail(dfilter, error)
+
 @fixtures.uses_fixtures
 class case_equality(unittest.TestCase):
     trace_file = "sip.pcapng"