detect/byte_math: Document bytes variable name

Issue: 6145

Document that byte_math accepts a variable name for bytes (optional)

doc/userguide/rules/differences-from-snort.rst

@@ -295,6 +295,10 @@ See :doc:`http-keywords` for all HTTP keywords.
   to be specified for the ``nbytes`` value. The value of ``nbytes`` must adhere
   to the same constraints as though a value was directly supplied by the rule.
 
+-  Suricata allows a variable name from ``byte_extract`` to be specified for
+   the ``nbytes`` value. The value of ``nbytes`` must adhere to the same constraints
+   as if it were supplied directly in the rule.
+
 
 ``isdataat`` Keyword
 --------------------

doc/userguide/rules/payload-keywords.rst

@@ -459,13 +459,14 @@ other rule options later in the rule.
 
 Format::
 
-  byte_math:bytes <num of bytes>, offset <offset>, oper <operator>, rvalue <rvalue>, \
+  byte_math:bytes <num of bytes> | <variable-name> , offset <offset>, oper <operator>, rvalue <rvalue>, \
         result <result_var> [, relative] [, endian <endian>] [, string <number-type>] \
         [, dce] [, bitmask <value>];
 
 
 +-----------------------+-----------------------------------------------------------------------+
 | <num of bytes>        | The number of bytes selected from the packet                          |
+|                       | or the name of a byte_extract variable.                               |
 +-----------------------+-----------------------------------------------------------------------+
 | <offset>              | Number of bytes into the payload                                      |
 +-----------------------+-----------------------------------------------------------------------+