Actions
Documentation #6694
openplacement of bitmask note about right shift behavior
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy
Description
byte_test has a snippet bout the right shift in the main keyword doc
https://docs.suricata.io/en/latest/rules/payload-keywords.html#byte-test
The <bitmask value> is applied to the extracted bytes (before the operator is applied), and the final result will be right shifted one bit for each trailing 0 in the <bitmask value>.
but byte_math and byte_jump has it in the table with a description of each keyword option.
i think byte_test should be updated to include the note in the table to match byte_math and byte_jump.
Files
Actions
#2
Updated by Juliana Fajardini Reichow 3 months ago
- File clipboard-202409241726-j3eyi.png clipboard-202409241726-j3eyi.png added
- File clipboard-202409241728-jhzx1.png clipboard-202409241728-jhzx1.png added
- Assignee changed from OISF Dev to Community Ticket
- Label Beginner, Good First Issue, Outreachy added
Adding to the description:
Currently, the bitmask row for the byte_test keyword looks like:
For this task to be considered completed, the byte_test's table bitmask row should look a bit more like:
(but with the correct info that is mentioned in the ticket description).
Actions