inliniac/suricata — pull request #277 by poona (2013-02-02 08:25:32+00:00)
Title: http_raw_host keyword

The above patch doesn't affect the current working of the engine -

Question I have -
1. I am extracting the host header value from tx->request_headers, but this holds the extracted header field.

I checked if any normalization is applied against the http header files. Couldn't find any(or am I wrong here), except that folded header lines are unfolded. Is this okay for someone writing a rule or would they want to match on the original folded lines?