make install-full: get correct version of ET

Version 2.0.
Disable emerging-icmp in default config

The file has no active rules by default.
configure: simplify OpenBSD handling

Treat all OpenBSD versions in the same way. No more -fgnu89-inline.
Coverity fix

Coverity 992695, fix potential array index with negative int. Very unlikely
case at rule keyword parsing stage.
Fix null dereference in eve-log

Eve-log would call GET_VLAN_ID on the packets vlan header if p->vlan_idx
was bigger than 0. GET_VLAN_ID would then unconditionally dereference
p->vlanh[0] or [1]. However, there are a number of cases in which these
pointers are not set. Defrag pseudo packets, AF_PACKET and in the future
PF_RING, do set the id's, but not the header pointers.

This patch adds 2 new macro's which are wrappers around a function:

VLAN_GET_ID1 and VLAN_GET_ID2 get the id's by calling DecodeVLANGetId.

This function will return the correct id.

Bug #1120.
json output: fix vlan byte order in output

VLAN functions/macros return vlan id in host byte order, so no need
to convert them in output functions.
Fix BytesToString indexing array using wrong index

This would lead to reading past the end of the buffer and also writing
past the end of the newly allocated buffer.

Bug #1121
Fix False Positive of rules with ports on portless protocols

In case of 'alert ip' rules that have ports, the port checks would
be bypassed for non-port protocols, such as ICMP. This would lead to
a rule matching: a false positive.

This patch adds a check. If the rule has a port setting other than
'any' and the protocol is not TCP, UDP or SCTP, then we rule won't
match.

Rules with 'alert ip' and ports are rare, so the impact should be
minimal.

Bug #611.
http: add info message about memcap

Display a message about http memcap when it is set in config file.
ipfw: fix build

Buildbot reported:
 runmode-ipfw.c: In function 'RunModeIpsIPFWAuto':
 runmode-ipfw.c:85: error: implicit declaration of function 'LiveDeviceHasNoStats'
OpenBSD: set correct magic path

For all 5.x OpenBSDs it seems the magic path is:
    /usr/local/share/misc/magic.mgc
pfring: get vlan id from header

PF_RING is delivering the packet with VLAN header stripped. This
patch updates the code to get the information from PF_RING extended
header information.

This patch uses the new function SCKernelVersionIsAtLeast to know
that we've got a old kernel that do not strip the VLAN header from
the message before sending it to userspace.
output-json: update timestamp format

This patch updates the timestamp format used in eve loggin.
It uses a ISO 8601 comptatible string. This allow tools parsing
the output to easily detect adn/or use the timestamp.

In the EVE JSON output, the value of the timestamp key has been
changed to 'timestamp' (instead of 'time'). This allows tools
like Splunk to detect the timestamp and use it without configuration.

Logstash configuration is simple:

input {
   file {
      path => [ "/usr/local/var/log/suricata/eve.json" ]
      codec =>   json
      type => "suricata-log"
   }
}

filter {
   if [type] == "suricata-log" {
      date {
        match => [ "timestamp", "ISO8601" ]
      }
   }
}

In splunk, auto detection of the fle format is failling and it seems
you need to define a type to parse JSON in
$SPLUNK_DIR/etc/system/local/props.conf:

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Then you can simply declare the log file in
$SPLUNK_DIR/etc/system/local/inputs.conf:

[monitor:///usr/local/var/log/suricata/eve.json]
sourcetype = suricata

In both cases the timestamp are correctly imported by
the tools.
Bug 611: fix for iponly

Fix Bug 611 for ip-only rules as well. If 'alert ip' rule has ports,
don't match on protocols that don't have ports. Like ICMP.

Bug #611.
eve-log: output cleanup

Suppress debug messages and print in a nicer way which modules are
being enabled.
eve-log: enable in default config

In the default config, eve-log is now enabled by default. All loggers
except 'drop' are enabled.
yaml: increase default memcaps

Increase default flow and stream reassembly memcaps.
yaml: comment out example config

Comment out htp settings that should only serve as an example.
Update ChangeLog for 2.0rc2 release
pfring: call enable_ring after set_cluster

Move pfring_enable_ring to the start of ReceivePfringLoop() so that
it's guaranteed to be called after all threads have called
pfring_set_cluster first.

This is necessary because pfring will already make packets available
to thread N, while thread N+1 is still registering itself. This leads
to cases where the first packet(s) of a flow are processed by a
different thread in Suricata than the later ones.

This is a race condition only at start up. New flows after the pfring
initialization is complete will not be influenced by this.

Bug #1129.