From 47e268d6095676de84baf1b6123ae58742af4bec Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sun, 9 Jul 2023 10:42:06 -0400
Subject: [PATCH] detect/byte_math: Document bytes variable name

Issue: 6145

Document that byte_math accepts a variable name for bytes (optional)
---
 doc/userguide/rules/differences-from-snort.rst | 4 ++++
 doc/userguide/rules/payload-keywords.rst       | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/doc/userguide/rules/differences-from-snort.rst b/doc/userguide/rules/differences-from-snort.rst
index 50f34061b9..9ca145c5e2 100644
--- a/doc/userguide/rules/differences-from-snort.rst
+++ b/doc/userguide/rules/differences-from-snort.rst
@@ -295,6 +295,10 @@ See :doc:`http-keywords` for all HTTP keywords.
   to be specified for the ``nbytes`` value. The value of ``nbytes`` must adhere
   to the same constraints as though a value was directly supplied by the rule.
 
+-  Suricata allows a variable name from ``byte_extract`` to be specified for
+   the ``nbytes`` value. The value of ``nbytes`` must adhere to the same constraints
+   as if it were supplied directly in the rule.
+
 
 ``isdataat`` Keyword
 --------------------
diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index e9da599ee9..412f7b4fe0 100644
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -459,13 +459,14 @@ other rule options later in the rule.
 
 Format::
 
-  byte_math:bytes <num of bytes>, offset <offset>, oper <operator>, rvalue <rvalue>, \
+  byte_math:bytes <num of bytes> | <variable-name> , offset <offset>, oper <operator>, rvalue <rvalue>, \
         result <result_var> [, relative] [, endian <endian>] [, string <number-type>] \
         [, dce] [, bitmask <value>];
 
 
 +-----------------------+-----------------------------------------------------------------------+
 | <num of bytes>        | The number of bytes selected from the packet                          |
+|                       | or the name of a byte_extract variable.                               |
 +-----------------------+-----------------------------------------------------------------------+
 | <offset>              | Number of bytes into the payload                                      |
 +-----------------------+-----------------------------------------------------------------------+