ipv6: RH extension header parsing issue

A logic error in the IPv6 Routing header parsing caused accidental
updating of the original packet buffer. The calculated extension
header lenght was set to the length field of the routing header,
causing it to be wrong.

This has 2 consequences:

1. defrag failure. As the now modified payload was used in defrag,
the decoding of the reassembled packet now contained a broken length
field for the routing header. This would lead to decoding failure.

The potential here is evasion, although it would trigger:
[1:2200014:1] SURICATA IPv6 truncated extension header

2. in IPS mode, especially the AF_PACKET mode, the modified and now
broken packet would be transmitted on the wire. It's likely that
end hosts and/or routers would reject this packet.

NFQ based IPS mode would be less affected, as it 'verdicts' based on
the packet handle. In case of replacing the packet (replace keyword
or stream normalization) it could broadcast the bad packet.

Additionally, the RH Type 0 address parsing was also broken. It too
would modify the original packet. As the result of this code was not
used anywhere else in the engine, this code is now disabled.

Reported-By: Rafael Schaefer <rschaefer@ernw.de>
ipv6: convert ext header pointers to const

To prevent accidental writes into the orignal packet buffer, use
const pointers for the extension header pointers used by IPv6. This
will cause compiler warnings in case of writes.
app-layer-ssh: fix banner parser

Carefully crafted SSH banner could result in parser error.

Signed-off-by: Eric Leblond <eric@regit.org>
ssh: convert error message to debug statement

Don't print errors based on traffic issues.
yaml: add eve flow and netflow entries

Added, commented out by default.

Bug #1257.
output-lua: add script-dir config param

Add 'scripts-dir' config directive that is prepended to the script
names to form a path. If ommited or empty, script are opened from
the CWD.
output-lua: add config to yaml

Disabled by default.
output-lua: set proper callbacks for HTTP

Enable the relevant HTTP callbacks.

Bug #1287
flow: fix flow logging at shutdown

Move all flows from the hash to the recycler at shutdown.

Bug #1260
flow json log: add 'shutdown' as flow end reason

When engine shuts down all flows in the hash are logged out. They
may not have timed out yet. So they are forced. Log the reason to
be 'shutdown'.
filestore: fix parsing bug

Filestore keyword can have options or no options, and the parser
was enforcing the NOOPT flag too strictly.

Bug #1288
Don't require an action-order configuration section. If not present,
use the defaults.
Comment out in the action-order section, as its not needed if
the default configuration is used.
lua detect: expose stream payload

Allow a script to set the 'stream' buffer type. This will add the
script to the PMATCH list.

Example script:
alert tcp any any -> any any (content:"html"; lua:stream.lua; sid:1;)

    function init (args)
        local needs = {}
        needs["stream"] = tostring(true)
        return needs
    end

    -- return match via table
    function match(args)
        local result = {}

        b = tostring(args["stream"])
        o = tostring(args["offset"])

        bo = string.sub(b, o);
        print (bo)

        return result
    end

    return 0
runmode-pfring: Suppress errors when using DNA/ZC

PF_RING DNA/ZC don't use cluster-id and cluster-type. Therefore,
skip setting these values if DNA/ZC is being used.

Bug #1048
runmode-pfring: Fixed typo s/fron/from/
configure.ac: Moved libpcap before libpfring

Moved the libpcap section in configure.ac before libpfring to
enable libpfring to use the specified libpcap includes and
libraries when testing for libpfring support.

Bug #1294
detect state: always lock de_state_m

Always lock the de_state_m on access, also at flow recycle or
cleanup.
tcp session reuse: reset detect state

Reset the detect state on TCP session reuse. We reset the app layer,
so we need to reset the stateful detection as well.
Speed up SigMatchGetLastSMFromLists()

SigMatchGetLastSMFromLists() is finding the sm with the largest
index among all of the values returned from SigMatchGetLastSM() on
the set of (list and type) tuples passed as arguments.

The function was creating an array of the types, then creating an array
of the results of SigMatchGetLastSM(), sorting that list completely, then
only returning the first values from the list.

The new code, gets one set of arguments from the variable arguments, calls
SigMatchGetLastSM() and if the returned sm has a larger index, keeps that
as the last sm.