Suricata

https://github.com/inliniac/suricata/pull/272

• The keyword inspects the normalized hostname. The hostname being normalized is lowercase, hence we invalidate all sigs that don't use "nocase" along with the http_host modified content.

Does this keyword addition affect anything in the existing functionality? If it doesn't I think it can go into 1.4.x, else 1.5

It doesn't affect the working. http_header would still inspect the host header section.