Suricata

This doesn't work:

content:"abc"; http_client_body; byte_extract:2,0,somevar,relative; content:"def"; within:somevar; http_client_body;

This is a parsing issue. If the http_client_body is put before the within, then it works.