Converts the buffer to uppercase and passes the value on.
-This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO LOWERCASE``
+This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO UPPERCASE``
Example::
- ``offset`` defaults to ``0`` and must be less than ``65536``
- ``mode`` defaults to ``rfc4648``
-Note that both ``bytes`` and ``offset`` may be variables from `byte_extract` and/or `byte_math`.
+Note that both ``bytes`` and ``offset`` may be variables from `byte_extract` and/or `byte_math` in
+later versions of Suricata. They are not supported yet.
Mode ``rfc4648`` applies RFC 4648 decoding logic which is suitable for encoding binary
data that can be safely sent by email, used in a URL, or included with HTTP POST requests.
-Mode ``rfc2045`` applies RFC 2045 decoding logic which supports strings, including those with embedded spaces.
+Mode ``rfc2045`` applies RFC 2045 decoding logic which supports strings, including those with embedded spaces,
+line breaks, and any non base64 alphabet.
Mode ``strict`` will fail if an invalid character is found in the encoded bytes.