From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 30 Jan 2024 14:45:17 +0000 (+0100)
Subject: doc: there is no right shift for integer bitmasks
X-Git-Tag: suricata-8.0.0-beta1~1714
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e22217bda85573e9791698e4dd6e341d8cd939d7;p=thirdparty%2Fsuricata.git

doc: there is no right shift for integer bitmasks

Ticket: 6628
---

diff --git a/doc/userguide/rules/integer-keywords.rst b/doc/userguide/rules/integer-keywords.rst
index c70b8b5f18..db539bec5c 100644
--- a/doc/userguide/rules/integer-keywords.rst
+++ b/doc/userguide/rules/integer-keywords.rst
@@ -71,6 +71,10 @@ Some of these bits have a string/meaning associated to it.
 Rules can be written using a list (comma-separated) of these strings,
 where each item can be negated.
 
+There is no right shift for trailing zeros applied here (even if there is one
+for ``byte_test`` and ``byte_math``). That means a rule with
+``websocket.flags:&0xc0=2`` will be rejected as invalid as it can never match.
+
 Examples::
 
     websocket.flags:fin,!comp;