Very basic file-analyzer for x509 certificates. Mostly ripped from
the ssl-analyzer and the topic/bernhard/x509 branch.

Simply prints information about the encountered certificates (I have
not yet my mind up, what I will log...).

Next step: extensions...
parse out extension. One event for general extensions (just returns the
openssl-parsed string-value), one event for basicconstraints (is a certificate
a CA or not) and one event for subject-alternative-names (only DNS parts).
rip out x509 code from ssl analyzer. Note that since at the moment
the file analyzer does not yet re-populate the info record that
means quite a lot of information is simply not available.
Fix misidentification of SOCKS traffic. Traffic that had a certain bytestring would get incorrectly identified as SOCKS. This seemed to happen a lot with DCE/RPC traffic.
Make x509 certificates an opaque type
Merge remote-tracking branch 'origin/master' into topic/bernhard/file-analysis-x509

Conflicts:
	src/analyzer/protocol/ssl/events.bif

Still broken.
add channel_id tls extension number.

This number is not IANA defined, but we see it being
actively used.
Merge remote-tracking branch 'origin/master' into topic/vladg/socks_fix
Updating submodule(s).

 [nomail]
Merge branch 'master' of git.bro.org:bro
Baseline updates for DNS change.

I assume these are expected, and in any case it's DS that's being
tested not DNS. :)
Updating submodule(s).

 [nomail]
Fix memory leak in modbus analyzer.

Would happen if there's a 'modbus_read_fifo_queue_response'
event handler.
Increase timeouts of some unit tests.
HTTP CONNECT proxy support.

 - The HTTP analyzer now supports handling HTTP CONNECT proxies
   same as the SOCKS analyzer handles proxying.
Merge remote-tracking branch 'origin/fastpath'

* origin/fastpath:
  Increase timeouts of some unit tests.
  Fix memory leak in modbus analyzer.
  add channel_id tls extension number.
Revert "Expanding the HTTP methods used in the signature to detect HTTP traffic."

This reverts commit 506b26e5ff137f61e087292c0b62453086f5fca9.

The corresponding patch adding HTTP CONNECT support doesn't work yet
so backing this out until we get that in shape.
Refactor DNS script's state management to improve performance.

The amount of timers involved in DNS::PendingMessage tables'
expiration attributes have a significant performance hit.  Instead the
script now relies solely on maximum thresholds for pending message
quantities to limit amount of accumulated state.  There's a new option,
"DNS::max_pending_query_ids", to limit the number outstanding messages
across all DNS query IDs ("DNS::max_pending_msgs" still limits number
of outstanding messages for a *given* query ID).
Merge remote-tracking branch 'origin/topic/jsiwek/dns-perf'

* origin/topic/jsiwek/dns-perf:
  Refactor DNS script's state management to improve performance.

BIT-1133
Merge remote-tracking branch 'origin/topic/vladg/socks_fix'

* origin/topic/vladg/socks_fix:
  Fix misidentification of SOCKS traffic. Traffic that had a certain bytestring would get incorrectly identified as SOCKS. This seemed to happen a lot with DCE/RPC traffic.

Tweaked the error message and added SetSkip() to the "reserved" case
as well.

BIT-1130 #merged