At the moment, SSL connections where the ssl_established event does not fire are not logged.

That means that, for example, connections that are terminated with an alert during the
handshake never appear in the ssl.log.

This patch changes this behavior - now all ssl connections that fire any event are logged.

The protocol confirmation of the ssl analyzer is moved to the client_hello instead to
the server hello. Furthermore, an additional field is added to ssl.log, which indicates
if a connection has been established or not (which probably indicates a handshake problem).
update test baselines
only call disable_analyzer if the connection is still open.
Fix DNS SRV responses and a small issue with NBNS queries and label length.

 - DNS SRV responses never had the code written to actually
   generate the dns_SRV_reply event.  Adding this required
   extending the event a bit to add extra information.  SRV responses
   now appear in the dns.log file correctly.

 - Fixed an issue where some Microsoft NetBIOS Name Service lookups
   would exceed the max label length for DNS and cause an incorrect
   "DNS_label_too_long" weird.
No longer accidentally attempting to parse NBSTAT RRs as SRV RRs.

The NetBios name service RFC (1002) specified NBSTAT (NetBios Status)
resource records to have identifier 0x0021.  The DNS SRV RFC specified
SRV records to have identifier 33.  Unfortunately those are the
same number. :)

We now check the resp port to handle this situation better so that
we won't be attempting to parse NBSTAT records as SRV (which
causes several weird messages).
Merge remote-tracking branch 'origin/topic/bernhard/ssl-failure'

* origin/topic/bernhard/ssl-failure:
  only call disable_analyzer if the connection is still open.
  update test baselines
  At the moment, SSL connections where the ssl_established event does not fire are not logged.
Merge remote-tracking branch 'origin/topic/seth/dns-srv-fix'

* origin/topic/seth/dns-srv-fix:
  No longer accidentally attempting to parse NBSTAT RRs as SRV RRs.
  Fix DNS SRV responses and a small issue with NBNS queries and label length.

BIT-1147 #merged
Fix non-deterministic logging of unmatched DNS msgs, addresses BIT-1153

Unmatched DNS messages may fail to be logged sometimes due to a type of
iterator invalidation.
Merge remote-tracking branch 'origin/topic/jsiwek/bit-1153'

* origin/topic/jsiwek/bit-1153:
  Fix non-deterministic logging of unmatched DNS msgs, addresses BIT-1153

BIT-1153 #merged
Merge branch 'master' into topic/jsiwek/flip-roles
Improve analysis of TCP SYN/SYN-ACK reversal situations.

- Since it's just the handshake packets out of order, they're no
  longer treated as partial connections, which some protocol analyzers
  immediately refuse to look at.

- The TCP_Reassembler "is_orig" state failed to change, which led to
  protocol analyzers sometimes using the wrong value for that.

- Add a unit test which exercises the Connection::FlipRoles() code
  path (i.e. the SYN/SYN-ACK reversal situation).

Addresses BIT-1148.