adding http_header keyword support

src/Makefile.am

@@ -104,6 +104,7 @@ detect-itype.c detect-itype.h \
 detect-icode.c detect-icode.h \
 detect-http-cookie.c detect-http-cookie.h \
 detect-http-method.c detect-http-method.h \
+detect-http-header.c detect-http-header.h \
 detect-tls-version.c detect-tls-version.h \
 detect-icmp-id.c detect-icmp-id.h \
 detect-icmp-seq.c detect-icmp-seq.h \

src/detect-http-header.h

@@ -0,0 +1,21 @@
+/**
+ * Copyright (c) 2010 Open Information Security Foundation.
+ *
+ * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
+ */
+
+#ifndef __DETECT_HTTP_HEADER_H__
+#define __DETECT_HTTP_HEADER_H__
+
+#define DETECT_AL_HTTP_HEADER_NOCASE   0x01
+#define DETECT_AL_HTTP_HEADER_NEGATED  0x02
+
+typedef struct DetectHttpHeaderData_ {
+    uint8_t *content;
+    uint8_t content_len;
+    uint8_t flags;
+} DetectHttpHeaderData;
+
+void DetectHttpHeaderRegister(void);
+
+#endif /* __DETECT_HTTP_HEADER_H__ */

src/detect.c

@@ -83,6 +83,7 @@
 #include "detect-urilen.h"
 #include "detect-detection-filter.h"
 #include "detect-http-client-body.h"
+#include "detect-http-header.h"
 
 #include "util-rule-vars.h"
 
@@ -2961,6 +2962,7 @@ void SigTableSetup(void) {
     DetectTlsVersionRegister();
     DetectUrilenRegister();
     DetectDetectionFilterRegister();
+    DetectHttpHeaderRegister();
     DetectHttpClientBodyRegister();
 
     uint8_t i = 0;

src/detect.h

@@ -640,6 +640,7 @@ enum {
     DETECT_AL_HTTP_METHOD,
     DETECT_AL_URILEN,
     DETECT_AL_HTTP_CLIENT_BODY,
+    DETECT_AL_HTTP_HEADER,
 
     DETECT_DCE_IFACE,
     DETECT_DCE_OPNUM,