Rewrite input layer to stream the input one packet at a time, skipping
not needed packet types.

Rewrite query execution to take advantage of streaming input. Rewrite
group by and aggregation to use a hash table rather than sorting the
input.

Add support for hidden columns (in the result set but not in the
output) and straighten out some of the oddities in the evaluation
handling - row indices are now used rather than storing a pointer to
the input row on the output row, and aggregate functions store their
intermediate results on the row rather than in the evaluation tree,
and have a special path for evaluation.

On a 27 MB input file with a group by clause, the above saves around
90% memory and executes faster (spends <85% of the time).

Pull json.cpp and json.h out of the compilation. Reading JSON tables
appears to have been defunct for some time. Reviving this would entail
rewriting it to support the streaming interface.

Compatibility changes:

- Queries relying on access to columns that are not in the output in
"having" and "order by" clauses will now return an error. This may
have been useful for order by and could possibly be amended in the
future by copying the input column as a hidden column.

- Aggregation on an empty input now returns an empty output instead of
an error.
Use a fixed lookup table for converting unprintable characters,
isgraph was showing up as using 4% of the total time in a simple group
by query
Commit regenerated autoconf/automake stuff
Add ignore file
Only allocate a new destination row for an aggregations when the old
row has actually been used, this seems to save around 5-10% time on a
simple group by query
Add a destructor to Variant so it properly cleans up after itself
instead of leaking memory in case it contains a pointed to string
Fix leak introduced in reusing rows - remember to destroy text columns
before zeroing them out
Only add "from" table if it actually exists, fixes a crash bug if from
isn't specified in the SQL
Fix copy-paste bug in sum on floats
Add simple regression testing tool that executes a large query
intended to exercise all branches of the SQL evaluator - the interface
is still a bit simple-minded, but it's a start
Make "select *" work again
Add patch from Henrik Levkowetz to fix problem with returning multiple results
Make stdev return 0 instead of NaN when there are no rows
Add support for ordering on columns that aren't in the output (they
are included as hidden columns), move order by compilation to before
evaluation, this also makes the code easier to follow, fix some
potential problems with the tables array
Add -Wall, but disable a couple of specific warnings, fix the code
compile cleanly without warnings (mostly harmless stuff)
Rewrite packet handler interface so that packet handlers keep a list
of columns they can provide and take a list of columns to fill in when
parsing. Use this to only add used columns to the source rows.

Also remove some the unnecessary layering in packetq.h and remove the
broken first pass parse.

The DNS parser still extracts a lot of possibly unused information,
but just avoiding the creation and copy saves around 30% of the
running time on a simple 'select s, count(*) from dns group by s;'
query.
Use a std::vector instead of a string as key for the hash tables, this
means a dramatic improvement for numeric keys, and a slight
improvement for string keys
Inline default constructor in Variant so as not to require constructor
delegation (first available in GCC 4.7)
Rewrite string handling to use reference-counted strings to save copy
operations, remove column structs and use plain typedefs instead,
rewrite Variant so as not to mutate itself on access, rewrite accessor
so as to not go through pointer indirection, rewrite row allocation
computation (saving memory and a few percent speedup) and row
clearing, fix problem with resetting row values in the DNS parser.

The net result is about 40% less time spent in a "select src_addr,
count(*) from dns group by src_addr" query, there's at least one layer
of indirection gone, and the rules for who is responsible for string
deallocation are hopefully much clearer.
Merge pull request #9 from OleLaursen/master

Rework input layer to stream packets