Suricata

Support the use of variables within transforms, e.g,

alert http any any -> any any (msg:"byte extract test 1";  byte_extract:2,15,two1,string,dec; http.uri; content:"dGhpc2lzYXRlc3QK"; from_base64: offset two1; sid:1; rev:1;)

With this rule (and variable support from the from_base64 transform), the transform was never invoked following the call to DetectByteExtractDoMatch during content inspection.