inliniac/suricata — pull request #1146 by jasonish (2014-10-02 06:09:47+00:00)
Title: Redmine bug 1231: SSL state negation - v1.

Support negation of ssl_state arguments.

First this required the current state being passed to the ssl_state match function instead of the cumulative state, otherwise ssl_state:client_hello would also match after while in the state server_hello. Note that this patch is a bit naive as I don't know the SSL protocol that well, so its more of a preview or RFC.

This patch also changes the state separator from "|" to "," to be compatible with Snort.

And finally, handle negation of SSL states.