json: somewhere along the way  IP/port pairs had gotten swapped in
http and ssh eve logs
Force pidfile creation of --pidfile.

A pidfile can be useful when not in daemon mode, for example
when running under a process supervisor.
app-layer: cleanups

Clean up AppLayerParserThreadCtxAlloc and AppLayerParserThreadCtxFree.
Both used confusing variables in loops, with the wrong types.
decode: introduce DecodeThreadVarsFree

As a mirror of DecodeThreadVarsAlloc, DecodeThreadVarsFree is used
to free the memory that DecodeThreadVarsAlloc alloc'd, including
AppLayer storage.
pcap-file: clean up decode thread local storage

Clean up the thread local data the decode portion of pcap-file use.

Bug #978.
drmemory: remove bug 978 suppression

Bug is fixed, so suppression is no longer needed.

Bug #978.
af-packet: clean up decode thread local storage

Clean up the thread local data of the decode part of afpacket.

Bug #978
nfq: clean up decode thread local storage

Clean up the thread local data the decode portion of nfq uses.

Bug #978
pfring: clean up decode thread local storage

Clean up the thread local data the decode portion of pfring uses.

Bug #978
pcap: clean up decode thread local storage

Clean up the thread local data the decode portion of pcap uses.

Bug #978
napatech: clean up decode thread local storage

Clean up the thread local data the decode portion of napatech uses.

Bug #978
ipfw: clean up decode thread local storage

Clean up the thread local data the decode portion of ipfw uses.

Bug #978
mpipe: clean up decode thread local storage

Clean up the thread local data the decode portion of mpipe uses.

Bug #978
endace-dag: clean up decode thread local storage

Clean up the thread local data the decode portion of DAG uses.

Bug #978
erf-file: clean up decode thread local storage

Clean up the thread local data the decode portion of ERF users.

Bug #978
TLS: add detection for malicious heartbeats (AKA heartbleed)

The OpenSSL implementation of RFC 6520 (Heartbeat extension) does not
check the payload length correctly, resulting in a copy of at most 64k
of memory from the server (ref: CVE-2014-0160).
This patch adds support for decoding heartbeat messages (if not
encrypted), and checking several parts (type, length and padding).
When an anomaly is detected, a TLS event is raised.
output: clean file desc at exit.

This is a beginning of implementation for bug #1660:
 https://redmine.openinfosecfoundation.org/issues/1160

This patch adds a cleaning function for each logger of new type
(packet, tx and file). These functions are called in RunModeShutDown().

The state of this patch is that it is crashing suricata when sending
pcap to analyse:
 - At first pcap if tx and file cleaning function are called
 - At second pcap if only packet cleaning function is called

The cause in first case is unknown. In second case this is due to
the necessity of cleaning the list of logger registered to a logging
type.
unified2: fix memory leak at shutdown

Module didn't properly free output context at shutdown. Led to a leak
in Unix Socket mode.
output: add Disable funcs to mirror Enable

For the loggers that we allow only one instance for: tls, ssh, drop, we
track active loggers through Output*Enable functions. Add Disable
functions to mirror this. They are to be called from the shutdown funcs
those loggers use.
drop loggers: call disable func

Call OutputDropLoggerDisable() on cleanup.