rule parser: fix crashing on malformed options

Fix crashing on malformed rule options like 'rev;1;'.

Bug 1254.
rule parser: set flag for optionless keywords

If a keyword doesn't have an argument, it should set the SIGMATCH_NOOPT
flag so the parser knows.
af-packet: force suricata in IPS mode when needed

AF_PACKET is not setting the engine mode to IPS when some
interfaces are peered and use IPS mode. This is due to the
fact, it is possible to peer 2 interfaces and run an IPS on
them and have a third one that is running in normal IDS mode.

In fact this choice is the bad one as unwanted side effect is
that there is no drop log and that stream inline is not used.

To fix that, this patch puts suricata in IPS mode as soon as
there is two interfaces in IPS mode. And it displays a error
message to warn user that the accuracy of detection on IDS only
interfaces will be low.
af-packet: check pointers before use
ipv6: RH extension header parsing issue

A logic error in the IPv6 Routing header parsing caused accidental
updating of the original packet buffer. The calculated extension
header lenght was set to the length field of the routing header,
causing it to be wrong.

This has 2 consequences:

1. defrag failure. As the now modified payload was used in defrag,
the decoding of the reassembled packet now contained a broken length
field for the routing header. This would lead to decoding failure.

The potential here is evasion, although it would trigger:
[1:2200014:1] SURICATA IPv6 truncated extension header

2. in IPS mode, especially the AF_PACKET mode, the modified and now
broken packet would be transmitted on the wire. It's likely that
end hosts and/or routers would reject this packet.

NFQ based IPS mode would be less affected, as it 'verdicts' based on
the packet handle. In case of replacing the packet (replace keyword
or stream normalization) it could broadcast the bad packet.

Additionally, the RH Type 0 address parsing was also broken. It too
would modify the original packet. As the result of this code was not
used anywhere else in the engine, this code is now disabled.

Reported-By: Rafael Schaefer <rschaefer@ernw.de>
ipv6: convert ext header pointers to const

To prevent accidental writes into the orignal packet buffer, use
const pointers for the extension header pointers used by IPv6. This
will cause compiler warnings in case of writes.
app-layer-ssh: fix banner parser

Carefully crafted SSH banner could result in parser error.

Signed-off-by: Eric Leblond <eric@regit.org>
ssh: convert error message to debug statement

Don't print errors based on traffic issues.
yaml: add eve flow and netflow entries

Added, commented out by default.

Bug #1257.
output-lua: add script-dir config param

Add 'scripts-dir' config directive that is prepended to the script
names to form a path. If ommited or empty, script are opened from
the CWD.
output-lua: add config to yaml

Disabled by default.
output-lua: set proper callbacks for HTTP

Enable the relevant HTTP callbacks.

Bug #1287
flow: fix flow logging at shutdown

Move all flows from the hash to the recycler at shutdown.

Bug #1260
flow json log: add 'shutdown' as flow end reason

When engine shuts down all flows in the hash are logged out. They
may not have timed out yet. So they are forced. Log the reason to
be 'shutdown'.
filestore: fix parsing bug

Filestore keyword can have options or no options, and the parser
was enforcing the NOOPT flag too strictly.

Bug #1288
Don't require an action-order configuration section. If not present,
use the defaults.
Comment out in the action-order section, as its not needed if
the default configuration is used.
lua detect: expose stream payload

Allow a script to set the 'stream' buffer type. This will add the
script to the PMATCH list.

Example script:
alert tcp any any -> any any (content:"html"; lua:stream.lua; sid:1;)

    function init (args)
        local needs = {}
        needs["stream"] = tostring(true)
        return needs
    end

    -- return match via table
    function match(args)
        local result = {}

        b = tostring(args["stream"])
        o = tostring(args["offset"])

        bo = string.sub(b, o);
        print (bo)

        return result
    end

    return 0
runmode-pfring: Suppress errors when using DNA/ZC

PF_RING DNA/ZC don't use cluster-id and cluster-type. Therefore,
skip setting these values if DNA/ZC is being used.

Bug #1048
runmode-pfring: Fixed typo s/fron/from/