eth is may easily ocur when using ifname mask. This could be also fixed by interpreting 'eth' as a simple string in the parser but I think this selector also looks more similar to what we use in tcpdump. Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> --- src/parser.y | 4 ++-- src/scanner.l | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/parser.y b/src/parser.y index 26e71e3..461eb3f 100644 --- a/src/parser.y +++ b/src/parser.y @@ -193,7 +193,7 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token BRIDGE "bridge" -%token ETH "eth" +%token ETHER "ether" %token SADDR "saddr" %token DADDR "daddr" %token TYPE "type" @@ -1392,7 +1392,7 @@ payload_base_spec : LL_HDR { $$ = PAYLOAD_BASE_LL_HDR; } | TRANSPORT_HDR { $$ = PAYLOAD_BASE_TRANSPORT_HDR; } ; -eth_hdr_expr : ETH eth_hdr_field +eth_hdr_expr : ETHER eth_hdr_field { $$ = payload_expr_alloc(&@$, &payload_eth, $2); } diff --git a/src/scanner.l b/src/scanner.l index 2d7ac88..a4db017 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -278,7 +278,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "bridge" { return BRIDGE; } -"eth" { return ETH; } +"ether" { return ETHER; } "saddr" { return SADDR; } "daddr" { return DADDR; } "type" { return TYPE; } -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html