min_shark: add first-class eth.type ethertype clause AX-98261

[talvaknin1]

Adds eth.type == 0x88a4 / in {...} filtering (hex or decimal), mirroring vlan.id. Needed to filter OT protocols like EtherCAT that are identified by ethertype rather than an IP/port. AX-98261.

[dovreshef]

Hi!

Please fix the clippy / fmt issues.

In addition some comments:

Values larger than an EtherType are accepted

src/parser.rs:538-541 uses parse_u32_hex_or_dec, which accepts values through u32::MAX. But Matcher::eth_type only accepts u16 at src/expression.rs:710-713.

Consequences:

  eth.type == 0x10000   # parses, can never match
  eth.type < 0x10000    # parses, matches every possible supplied EtherType

I confirmed both 65536 and 0x10000 parse successfully.

The smallest fix is an EtherType parser that accepts decimal/hex but rejects values above u16::MAX, widening valid results into the existing ValOp representation.

Tests should cover:

• 0
• 0xffff succeeds
• 65536 and 0x10000 fail
• an out-of-range value inside a list fails

No public-path integration test

Current tests separately verify:

• lexing: src/lexer.rs
• AST construction: src/parser.rs:859-911
• manually constructed matching: src/expression.rs:1049-1082

But none exercises the actual user flow:

  parse("eth.type in {0x0800, 0x86dd}")
      .unwrap()
      .matcher()
      .eth_type(0x0800)
      .is_match()

A single test in src/driver.rs, alongside the existing integration-style tests, should cover positive and negative matching.

New parser duplicates existing code

parse_u32_hex_or_dec at src/value_parsers.rs:38-53 duplicates nearly all of parse_u64 immediately above it: UTF-8 conversion, underscore allocation, prefix handling, radix parsing.

Reuse parse_u64, then checked-convert to the EtherType range. That fixes both duplication and the P1 bug with fewer LOC.

Underscore handling is overly permissive

The parser removes every underscore, accepting malformed literals such as:

  0x1_
  _1
  0x1__2

Additional edge cases

Worth covering or defining:

• EtherType maximum: 0xffff.
• Out-of-range values in every operation form, especially lists and inequalities.
• Whether malformed underscore placement is legal.
• Missing metadata: an eth.type clause returns false if the caller never calls .eth_type(...); negating that clause then returns true, consistent with existing fields but worth understanding.
• VLAN/QinQ: clarify whether .eth_type(...) means the outer Ethernet TPID or encapsulated protocol. A single u16 cannot represent multiple nested protocol identifiers.
• IEEE 802.3 length-field frames: clarify whether callers should omit eth_type when the field is a length rather than an EtherType.