Suricata

We need feedback on what usecases would need to be added/supported.

While Suricata has matured to the point where it should be defining IDS rule capabilities instead of reacting to other vendors, I think in this case it makes sense to try to make this compatible with the existing Snort 'byte_math' keyword.

Format:

byte_math:bytes <bytes_to_extract>, offset <offset_value>, oper <operator>,
rvalue <r_value>, result <result_variable> [, relative]
[, endian <endian>] [, string <number type>][, dce]
[, bitmask <bitmask_value>];


Ref: Snort 2.9.9.0 manual, section 3.5.34

This keyword is functionally different but structurally similar (not exact) to other 'byte_*' keywords such as 'byte_test', 'byte_extract' and 'byte_jump'.

Cross-variable buffer usage should be allowed, however this may be a challenge (or secondary goal) since currently cross-buffer byte extraction and usage isn't currently supported.

https://github.com/OISF/suricata/pull/4502