Update Changelog for 2.1beta2 release
App-layer: Add Modbus protocol parser

Decode Modbus request and response messages, and extracts
MODBUS Application Protocol header and the code function.

In case of read/write function, extracts message contents
(read/write address, quantity, count, data to write).

Links request and response messages in a transaction according to
Transaction Identifier (transaction management based on DNS source code).

MODBUS Messaging on TCP/IP Implementation Guide V1.0b
(http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf)
MODBUS Application Protocol Specification V1.1b3
(http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf)

Based on DNS source code.

Signed-off-by: David DIALLO <diallo@et.esia.fr>
Detect: Add Modbus keyword management

Add the modbus.function and subfunction) keywords for public function match in rules (Modbus layer).
Matching based on code function, and if necessary, sub-function code
or based on category (assigned, unassigned, public, user or reserved)
and negation is permitted.

Add the modbus.access keyword for read/write Modbus function match in rules (Modbus layer).
Matching based on access type (read or write),
and/or function type (discretes, coils, input or holding)
and, if necessary, read or write address access,
and, if necessary, value to write.
For address and value matching, "<", ">" and "<>" is permitted.

Based on TLS source code and file size source code (address and value matching).

Signed-off-by: David DIALLO <diallo@et.esia.fr>
Detect-engine: Add Modbus detection engine

Management of Modbus Tx

Based on DNS source code.

Signed-off-by: David DIALLO <diallo@et.esia.fr>
Create a wrapper around DetectFlowvarProcessList() to check for empty list

Creates an inline wrapper to check for flowvarlist == NULL before calling
DetectFlowvarProcessList() to remove the overhead of checking since the
list is usually empty.
Enforce Signature Header structure matches Signature

Use a macro when defining the Signature Header and Signature structures
since the fields are required to match for correctness.
MPM: build sid list from MPM matches

Pmq add rule list: Array of uint32_t's to store (internal) sids from the MPM.

AC: store sids in the pattern list, append to Pmq::rule_id_array on match.

Detect: qsort rule_id_array after it was set up by the MPM. Rule id's
(Signature::num) are ordered, and the rule's with the lowest id are to
be inspected first. As the MPM doesn't fill the array in order, but instead
'randomly' we need this sort step to assure proper inspection order.

**TODO**:

Currently we use a new array 'rule_id_array'. However, in a few places,
the 'pattern_id_array' is used in a similar way (proto detect and perhaps
smtp?). So we could convert those to use the rule_id_array and remove the
pattern_id_array completely.
Detect: create per sgh non-MPM rule array

Array of rule id's that are not using MPM prefiltering. These will be
merged with the MPM results array. Together these should lead to a
list of all the rules that can possibly match.
Add negated MPM to non-MPM array (HACK)

Treat negated MPM sigs as if non-MPM, so we consider them always.

As MPM results and non-MPM rules lists are now merged and considered
for further inspection, rules that need to be considerd when a pattern
is absent are caught in the middle.

As a HACK/workaround this patch adds them to the non-MPM list. This
causes them to be inspected each time.

**TODO**
This will likely perform bad if there are a lot of rules using negated
MPM's. In the ET/ETpro rulesets those rules are quite rare though.
Replace build match array with new filter logic

Use MPM and non-MPM lists to build our match array. Both lists are
sorted, and are merged and sorted into the match array.

This disables the old match array building code and thus also bypasses
the mask checking.

**TODO**
See if we should reintroduce parts of the mask and other prefilter
logic.

**TODO**
Having a zero sized list is quite common for both lists, so we can
probably add some optimization for this.
detect: move checks from prefilter to rule detect

Move the prefilter checks to the main detect loop.

**TODO**
Review/test to what extend this is necessary.
AC: use local bit array (HACK)

Use a local pattern bit array to making sure we don't match more than
once, in addition to the pmq bitarray that is still used for results
validation higher up in the rule matching process.

Why: pmq->pattern_id_bitarray is currently sometimes used in a
'stateful' way, meaning that for a single packet we run multiple
MPM's on the same pmq w/o resetting it.

The new bitarray is used to determine wherther we need to append the
patterns associated 'sids' list to the pmq rule_id_array.

It has been observed that MPM1 matches for PAT1, and MPM2 matches for
PAT1 as well. However, in MPM1 PAT1 doesn't have the same sids list.
In this case MPM2 would not add it's sids to the list, leading to missed
detection.

**TODO**

Consider alternative solutions: e.g. make sure that each MPM runs
with it's own pmq. Then merge the pmq's using PmqMerge. Might perform
better than the stack alloc'd + memset'd bitarray in use now.
Fix AC-tile for new pattern ID array.
Implement MPM opt for b2g, b3g, wumanber

Found problems in b2gm and b2gc, so those are removed.
Optimize DetectPrefilterMergeSort

Fixup rebase changes to remove debug code

Conflicts:
	src/detect.c
Fix clang warning

Clang doesn't seem to like defining a function within a function.
Implement MPM opt for ac-bs and ac-gfbs

Copies sids changes from ac.
Dynamically resize pmq->rule_id_array

Rather than statically allocate 64K entries in every rule_id_array,
increase the size only when needed. Created a new function MpmAddSids()
to check the size before adding the new sids. If the array is not large
enough, it calls MpmAddSidsResize() that calls realloc and does error
checking. If the realloc fails, it prints an error and drops the new sids
on the floor, which seems better than exiting Suricata.

The size is increased to (current_size + new_count) * 2. This handles the
case where new_count > current_size, which would not be handled by simply
using current_size * 2. It should also be faster than simply reallocing to
current_size + new_count, which would then require another realloc for each
new addition.
Move type first in SigMatch array since it is used more often.
Prefetch the next signature pointer

Read one signature pointer ahead to prefetch the value.
Use a variable, sflags, for s->flags, since it is used many times and the
compiles doesn't know that the signatures structure doesn't change, so it
will reload s->flags.