json: sync key name with CIM

This patch is synchronizing key name with Common Information Model.
It updates key name following what is proposed in:
 http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference
The interest of these modifications is that using the same key name
as other software will provide an easy to correlate and improve
data. For example, geoip setting in logstash can be applied on
all src_ip fields allowing geoip tagging of data.
json-dns: sync field names with draft rfc2629

This patch updates DNS field name to be in sync with RFC 2629:
 https://github.com/adulau/pdns-qof
This will allow to easily use Suricata with other passive DNS tools.
json dns: do not use array to output answer

Without this patch DNS answers for a single query are stored in a
single json event. The result is an array in the object like this one:
 {"type":"answer","id":45084,"rrname":"s-static.ak.facebook.com","rrtype":"CNAME","ttl":734},
 {"type":"answer","id":45084,"rrname":"s-static.ak.facebook.com.edgekey.net","rrtype":"CNAME","ttl":1710},
This type of output is not well supported in logstash. It is
displayed as it is written above and it is not possible to
query the fields.

I think the reason is that this is not logical if we consider search
query. For example if we search for "rrname" equal "s-static.ak.facebook.com"
we got one entry with two values in it. That's against the logic
of event. Furthermore, if we want to get a complete query, we can
used the id.

This patch splits the answer part in mulitple message. The result
is then accepted by logstash and fields can be queried easily.
json: add event_type key

This patch adds an event_type key to the generated events. Current
value is one of "dns", "alert, "file", "tls", "http", "drop". It is
then easy to differentiate in log analysis tools the events based on
source inside Suricata.
json file: separate http params

This patch separates http keys from file to have a different value
list:

{
 "time":"01\/31\/2014-12:04:52.837245","event_type":"file","src_ip":"5.3.1.1","src_port":80,"dest_ip":"1.8.1.9","dest_port":9539,"proto":"TCP",
 "http":{"url":"/foo/","hostname":"bar.com","http_refer":"http:\/\/bar.org","http_user_agent":"Mozilla\/5.0"},
 "file":{"filename":"bar","magic":"unknown","state":"CLOSED","stored":false,"size":21}
}

One interest of this modification is that it is possible to use the
same key as the one used in http events. Thus correlating both type
of events is trivial. On code side, this will permit to factorize
the code by simply asking the underlying protocol to output its
info in a json object.

Second interest is that adding file extraction for a new protocol
will result in only changing the protocol specific json list.
Fix util-debug scan-build warnings

util-debug.c:461:12: warning: Potential leak of memory pointed to by 'substr'
    return SC_ERR_SPRINTF;
           ^~~~~~~~~~~~~~
util-debug.c:856:31: warning: Potential leak of memory pointed to by 's'
                op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX);
                ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
util-debug.c:1349:9: warning: Potential leak of memory pointed to by 's'
    if (log_level >= 0 && log_level < SC_LOG_LEVEL_MAX)
        ^~~~~~~~~
3 warnings generated.
util-host-os-info: scan build fixes

util-host-os-info.c:200:13: warning: Potential leak of memory pointed to by 'ip_str'
            SCLogError(SC_ERR_INVALID_IPV6_ADDR, "Invalid IPV6 address inside");
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:278:35: note: expanded from macro 'SCLogError'
 #define SCLogError(err_code, ...) SCLogErr(SC_LOG_ERROR, err_code, \
                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:214:82: note: expanded from macro 'SCLogErr'
                                  char _sc_log_err_msg[SC_LOG_MAX_LOG_MSG_LEN] = ""; \
                                                                                 ^~
util-host-os-info.c:200:13: warning: Potential leak of memory pointed to by 'user_data'
            SCLogError(SC_ERR_INVALID_IPV6_ADDR, "Invalid IPV6 address inside");
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:278:35: note: expanded from macro 'SCLogError'
 #define SCLogError(err_code, ...) SCLogErr(SC_LOG_ERROR, err_code, \
                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:214:82: note: expanded from macro 'SCLogErr'
                                  char _sc_log_err_msg[SC_LOG_MAX_LOG_MSG_LEN] = ""; \
                                                                                 ^~
2 warnings generated.
util-host-os-info: scan-build fix

util-host-os-info.c:202:13: warning: Potential leak of memory pointed to by 'user_data'
            SCLogError(SC_ERR_INVALID_IPV6_ADDR, "Invalid IPV6 address inside");
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:278:35: note: expanded from macro 'SCLogError'
 #define SCLogError(err_code, ...) SCLogErr(SC_LOG_ERROR, err_code, \
                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./util-debug.h:214:82: note: expanded from macro 'SCLogErr'
                                  char _sc_log_err_msg[SC_LOG_MAX_LOG_MSG_LEN] = ""; \
                                                                                 ^~
1 warning generated.
stream: yaml addition for recent config options
json loggers: dup bstr with bstr_util_strdup_to_c

In various places SCStrndup was used to 'dup' a bstr string, however
libhtp provides bstr_util_strdup_to_c for this. As this is a cleaner
interface, it's preferred.
Introduce BytesToString utility

Introduce a utility function to convert an array of bytes into a
null-terminated string:

 char *BytesToString(const uint8_t *bytes, size_t nbytes);

All non-printables are copied over, except for '\0', which is
turned into literal '\' '0' in the string. So the resulting string
may be bigger than the input.
Replace remaining SCStrndup calls

Replace them with BytesToString().
Remove SCStrndup

Removed strndup wrapper as it's not available in all plaforms.
Replace strchrnul with strchr

And add a null check then of course. strchrnul isn't supported on
all platforms.
Updated banned function cocci check

Added: strndup and strchrnul

Both are not supported on OS X 10.6. It's rather old, but it's the
only Mac QA box I have, so for now it'll have to do.