inliniac/suricata — pull request #803 by regit (2014-01-30 08:53:01+00:00)
Title: tls: fix negated match

A negated match is matching if the tested field is NULL. But as it
is not set, nor negated nor normal test must match.

Without this patch, both following signatures match when connecting to a SSL server using a US certificate:
```
alert tls any any -> any any (msg:"negated match"; tls.subject:!"C=US"; sid:1; rev:1;)
alert tls any any -> any any (msg:"non negated match"; tls.subject:"C=US"; sid:2; rev:1;)
```

PR builds:
- PR build: https://buildbot.suricata-ids.org/builders/regit/builds/92
- PR pcaps: https://buildbot.suricata-ids.org/builders/regit-pcap/builds/31