Bytevar
#######

The ``suricata.bytevar`` module provides access to variables defined by 
``byte_extract`` and ``byte_math`` keywords in Suricata rules. 

It is only available in Suricata Lua rules, not output scripts.

Setup
*****

::

    local bytevars = require("suricata.bytevar")

Module Functions
****************

.. function:: bytevars.map(sig, varname)

   Ensures that the ``bytevar`` exists and sets it up for further use
   in the script by mapping it into the Lua context. Must be called
   during ``init()``.

   :param sig: The signature object passed to ``init()``
   :param string varname: Name of the variable as defined in the rule

   :raises error: If the variable name is unknown
   :raises error: If too many byte variables are mapped

   Example:

   ::

       function init(sig)
           bytevars.map(sig, "var1")
           bytevars.map(sig, "var2")
           return {}
       end

.. function:: bytevars.get(name)

   Returns a byte variable object for the given name. May be called
   during ``thread_init()`` to save a handle to the bytevar.

   :param number name: Name of the variable previously setup with
                       ``map()``.

   :raises error: If variable name is not mapped with ``map()``.

   :returns: A byte variable object

   Example:

   ::

       function thread_init()
           bv_var1 = bytevars.get("var1")
           bv_var2 = bytevars.get("var2")
       end

Byte Variable Object Methods
****************************

.. method:: bytevar:value()

   Returns the current value of the byte variable.

   :returns: The value of the byte variable.

   Example:

   ::

       function match(args)
           local var1 = bv_var1:value()
           if var1 then
               -- Use the value
           end
       end