From e22217bda85573e9791698e4dd6e341d8cd939d7 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 30 Jan 2024 15:45:17 +0100 Subject: [PATCH] doc: there is no right shift for integer bitmasks Ticket: 6628 --- doc/userguide/rules/integer-keywords.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/userguide/rules/integer-keywords.rst b/doc/userguide/rules/integer-keywords.rst index c70b8b5f18..db539bec5c 100644 --- a/doc/userguide/rules/integer-keywords.rst +++ b/doc/userguide/rules/integer-keywords.rst @@ -71,6 +71,10 @@ Some of these bits have a string/meaning associated to it. Rules can be written using a list (comma-separated) of these strings, where each item can be negated. +There is no right shift for trailing zeros applied here (even if there is one +for ``byte_test`` and ``byte_math``). That means a rule with +``websocket.flags:&0xc0=2`` will be rejected as invalid as it can never match. + Examples:: websocket.flags:fin,!comp; -- 2.47.2