syslog facility conditions are not parsed or honoured

[candlerb]

Describe the bug
The documentation says that "syslog_facility" is a valid condition.

The sagan-rules repo says that "facility" is a valid condition (e.g. facility: kern)

However, neither of these have any effect.

To Reproduce

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "GOTCHA"; content: "abcde"; classtype: unsuccessful-user; facility: mail; syslog_facility: mail; sid: 911; rev: 1; )

You can trigger this with:

echo "192.0.2.1|auth|info|info|sshd|2001-01-01|00:00:00|sshd|abcde" >/var/sagan/fifo/sagan.fifo

Note that the facility in the message is auth not mail:

[D] [processor.c, line 168] **[Parsed Syslog]*********************************
[D] [processor.c, line 169] Host: 192.0.2.1 | Program: sshd | Facility: auth | Priority: info | Level: info | Tag: sshd | Date: 2001-01-01 | Time: 00:00:00
[D] [processor.c, line 170] Parsed message: abcde
[D] [processors/engine.c, line 1548] **[Trigger]*********************************
[D] [processors/engine.c, line 1549] Program: sshd | Facility: auth | Priority: info | Level: info | Tag: sshd
[D] [processors/engine.c, line 1550] Threshold flag: 0 | After flag: 0 | Flexbit Flag: 0 | Flexbit status: 0
[D] [processors/engine.c, line 1551] Triggering Message: abcde

Expected behavior
Alert to trigger only on matching syslog facility

Screenshots
N/A

Desktop (please complete the following information):
N/A

Smartphone (please complete the following information):
N/A

Additional context
Adding debugging to src/processors/engine.c shows that the value has not been parsed.

                    if ( rulestruct[b].s_facility[0] != '\0' )
                        {
                            strlcpy(tmpbuf, rulestruct[b].s_facility, sizeof(tmpbuf));
                            Sagan_Log(DEBUG, "facility: %s", tmpbuf);    <<< NOT INVOKED

Because of #140, the no warning is generated saying that the facility / syslog_facility condition is not recognised.