yaml: add eve flow and netflow entries

Added, commented out by default.

Bug #1257.
output-lua: add script-dir config param

Add 'scripts-dir' config directive that is prepended to the script
names to form a path. If ommited or empty, script are opened from
the CWD.
output-lua: add config to yaml

Disabled by default.
output-lua: set proper callbacks for HTTP

Enable the relevant HTTP callbacks.

Bug #1287
flow: fix flow logging at shutdown

Move all flows from the hash to the recycler at shutdown.

Bug #1260
flow json log: add 'shutdown' as flow end reason

When engine shuts down all flows in the hash are logged out. They
may not have timed out yet. So they are forced. Log the reason to
be 'shutdown'.
filestore: fix parsing bug

Filestore keyword can have options or no options, and the parser
was enforcing the NOOPT flag too strictly.

Bug #1288
Don't require an action-order configuration section. If not present,
use the defaults.
Comment out in the action-order section, as its not needed if
the default configuration is used.
lua detect: expose stream payload

Allow a script to set the 'stream' buffer type. This will add the
script to the PMATCH list.

Example script:
alert tcp any any -> any any (content:"html"; lua:stream.lua; sid:1;)

    function init (args)
        local needs = {}
        needs["stream"] = tostring(true)
        return needs
    end

    -- return match via table
    function match(args)
        local result = {}

        b = tostring(args["stream"])
        o = tostring(args["offset"])

        bo = string.sub(b, o);
        print (bo)

        return result
    end

    return 0
runmode-pfring: Suppress errors when using DNA/ZC

PF_RING DNA/ZC don't use cluster-id and cluster-type. Therefore,
skip setting these values if DNA/ZC is being used.

Bug #1048
runmode-pfring: Fixed typo s/fron/from/
configure.ac: Moved libpcap before libpfring

Moved the libpcap section in configure.ac before libpfring to
enable libpfring to use the specified libpcap includes and
libraries when testing for libpfring support.

Bug #1294
App-layer: Add Modbus protocol parser

Decode Modbus request and response messages, and extracts
MODBUS Application Protocol header and the code function.

In case of read/write function, extracts message contents
(read/write address, quantity, count, data to write).

Links request and response messages in a transaction according to
Transaction Identifier (transaction management based on DNS source code).

MODBUS Messaging on TCP/IP Implementation Guide V1.0b
(http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf)
MODBUS Application Protocol Specification V1.1b3
(http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf)

Based on DNS source code.

Signed-off-by: David DIALLO <diallo@et.esia.fr>
Detect: Add Modbus keyword management

Add the modbus.function and subfunction) keywords for public function match in rules (Modbus layer).
Matching based on code function, and if necessary, sub-function code
or based on category (assigned, unassigned, public, user or reserved)
and negation is permitted.

Add the modbus.access keyword for read/write Modbus function match in rules (Modbus layer).
Matching based on access type (read or write),
and/or function type (discretes, coils, input or holding)
and, if necessary, read or write address access,
and, if necessary, value to write.
For address and value matching, "<", ">" and "<>" is permitted.

Based on TLS source code and file size source code (address and value matching).

Signed-off-by: David DIALLO <diallo@et.esia.fr>
Detect-engine: Add Modbus detection engine

Management of Modbus Tx

Based on DNS source code.

Signed-off-by: David DIALLO <diallo@et.esia.fr>