inliniac/suricata — pull request #1147 by jasonish (2014-10-02 15:58:53+00:00)
Title: Redmine bug 1231: SSL state negation - v2.

Obsoletes #1146.

Changes:
- Use a new variable to store new flags then reset after any error returns.
- Rename current_flags to current_state.

Support negation of ssl_state arguments.

First this required the current state being passed to the ssl_state match function instead of the cumulative state, otherwise ssl_state:client_hello would also match after while in the state server_hello. Note that this patch is a bit naive as I don't know the SSL protocol that well, so its more of a preview or RFC.

This patch also changes the state separator from "|" to "," to be compatible with Snort.

And finally, handle negation of SSL states.

- PR build: https://buildbot.openinfosecfoundation.org/builders/jasonish/builds/12
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/jasonish-pcap/builds/12