Fix misidentification of SOCKS traffic. Traffic that had a certain bytestring would get incorrectly identified as SOCKS. This seemed to happen a lot with DCE/RPC traffic.
Improve DNS analysis.

- Fix parsing of empty question sections (when QDCOUNT == 0).  In this
  case, the DNS parser would extract two 2-byte fields for use in either
  "dns_query_reply" or "dns_rejected" events (dependent on value of
  RCODE) as qclass and qtype parameters.  This is not correct, because
  such fields don't actually exist in the DNS message format when
  QDCOUNT is 0.  As a result, these events are no longer raised when
  there's an empty question section.  Scripts that depends on checking
  for an empty question section can do that in the "dns_message" event.

- Add a new "dns_unknown_reply" event, for when Bro does not know how
  to fully parse a particular resource record type.  This helps fix a
  problem in the default DNS scripts where the logic to complete
  request-reply pair matching doesn't work because it's waiting on more
  RR events to complete the reply.  i.e. it expects ANCOUNT number of
  dns_*_reply events and will wait until it gets that many before
  completing a request-reply pair and logging it to dns.log.  This could
  cause bogus replies to match a previous request if they happen to
  share a DNS transaction ID.
Change dns.log to include only standard DNS queries.

The scope of dns.log is now only standard queries (OPCODE == 0).  Other
kinds of queries (e.g. inverse query) were not handled correctly and
could interfere with the state tracking of the default DNS scripts.
Merge branch 'master' of ssh://git.bro.org/bro
Updates to Bro IDS documentation
Updates to Logs and Cluster documentation
Updates to httpmonitor and mimestats documentation.
Rewrite DNS state tracking which matches queries and replies.

The previous method of matching queries with replies was still
unreliable in cases where the reply contains no answers.  The new code
also takes extra measures to avoid pending state growing too large in
cases where the condition to match a query with a corresponding reply is
never met, but yet DNS messages continue to be exchanged over the same
connection 5-tuple (preventing cleanup of the pending state).
Add script to detect filtered TCP traces, addresses BIT-1119.

If reading a trace file w/ only TCP control packets, a warning is
emitted to suggest the 'detect_filtered_traces' option if the user
doesn't desire Bro to report missing TCP segments for such a trace file.
Merge remote-tracking branch 'origin/fastpath'

* origin/fastpath:
  Minor unified2 script documentation fix.
Merge remote-tracking branch 'origin/topic/jsiwek/tcp-improvements'

* origin/topic/jsiwek/tcp-improvements:
  Add script to detect filtered TCP traces, addresses BIT-1119.

BIT-1119 #merged

If we could only disable an event handler dynamically ...
Fixing memory leaks in input framework.
Updating submodule(s).

 [nomail]
Fixing bug in POP3 analyzer.

With certain input the analyzer could end up trying to write to
non-writable memory.
Updating submodule(s).

 [nomail]
Updating submodule(s).

 [nomail]
Updating submodule(s).

 [nomail]
Merge remote-tracking branch 'origin/fastpath'

* origin/fastpath:
  Fix x509-extension test sometimes failing.
Merge remote-tracking branch 'origin/topic/jdopheid/bro_documentation'

* origin/topic/jdopheid/bro_documentation:
  Updates to httpmonitor and mimestats documentation.
  Updates to Logs and Cluster documentation
  Updates to Bro IDS documentation

BIT-1127 #merged
Updating submodule(s).

 [nomail]