inliniac/suricata — pull request #808 by regit (2014-01-30 17:04:58+00:00)
Title: tls: fix negated match

A negated match is matching if the tested field is NULL. But as it
is not set, nor negated nor normal test must match.

Without this patch, a rule like:
alert tls any any -> any any (msg:"negated match"; tls.subject:!"CN=home.regit.org"; sid:1; rev:1;)
is alerting for all connections. Event if they are done on a certificate
with matching subject. This was due to the fact that tls protocol
is discovered before the handshake is complete. Thus the condition
on tls is true with a NULL tls.subject. And code was returning a
positive match in the case of a NULL subject and a signature with
a negated match.

PR builds:
- PR build: https://buildbot.suricata-ids.org/builders/regit/builds/94
- PR pcaps: https://buildbot.suricata-ids.org/builders/regit-pcap/builds/33