From: Shivani Bhardwaj Date: Mon, 10 Oct 2022 11:11:09 +0000 (+0530) Subject: doc: update base64_decode notes X-Git-Tag: suricata-6.0.9~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6bdcba25889ca9374091e95b9cc8c438a77b17e7;p=thirdparty%2Fsuricata.git doc: update base64_decode notes (cherry picked from commit 2a0cb1f3daa2c58021b10ff88f2e6519a2c91d8a) --- diff --git a/doc/userguide/rules/base64-keywords.rst b/doc/userguide/rules/base64-keywords.rst index 4d704292bc..7daf0c2603 100644 --- a/doc/userguide/rules/base64-keywords.rst +++ b/doc/userguide/rules/base64-keywords.rst @@ -27,6 +27,10 @@ This option makes ``offset`` skip bytes relative to the previous match. The content match that you want to decode relative to must be the first match in the stream. +.. note:: ``base64_decode`` follows RFC 4648 by default i.e. encounter with any character that is not found in the base64 alphabet leads to rejection of that character and the rest of the string. + + See Redmine Bug 5223: https://redmine.openinfosecfoundation.org/issues/5223 and RFC 4648: https://www.rfc-editor.org/rfc/rfc4648#section-3.3 + base64_data -----------