nfct: use timestamp of conntrack object.

If conntrack object sent by connection tracking system is containing
a timestamp we use it instead of a gettimeofday() based counter.

Signed-off-by: Eric Leblond <eric@regit.org>
ulogd: change verbosity of a message

The "registering plugin" message is not really useful as the message
is really explicit if a plugin is missing.
ulogd: close logfile description in the exit path of parent process

Joan Touzet reported that file descriptor 3 was not ever closed
in the exit path of the parent process:

open("ulogd.conf", O_RDONLY)            = 3

That corresponds to the the file descriptor that was used to
parse the configuration file was not closed.

This closes: http://bugzilla.netfilter.org/show_bug.cgi?id=793

Reported-by: Joan Touzet <joant@cloudant.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Revert "ulogd: close logfile description in the exit path of parent process"

This reverts commit 3179bd4de89de7c2388849f5bc48e8f5aad9e5b9.

Pointing to the wrong place. This is not the file descriptor
that ulogd is leaking.
ulogd: display stack during configuration
Fix automagic support of dbi, pcap and sqlite3

ulogd has automagic deps for several output plugins right now, namely dbi,
pcap and sqlite3. These plugins are built if the appropriate libs are present
on user's system. While this situation is fine with binary distros it is not OK
on source-based ones such as Gentoo.

The problem arises when such a program links against libs without user's
request and libs are later removed from system which leaves program in a
broken state.

This patch is modifying configure.ac which we apply in our package and which
fixes mentioned issue. It adds 3 new configure options: --
without-{dbi,pcap.sqlite}. I would like to emphasize that this patch doesn't
change default behaviour of configure script at all, so all other distros won't
suffer. We simply add options to explicitly disable any attempts to try and
detect libs for automagic deps, which is enough to avoid unnecessary linkage.
postgresql: add sanity checking

Clean postgresql handler at deinit.
mysql: add sanity checking

Nullify mysql handler at deinit.
sqlite3: add sanity checking

Nullify sqlite3 handler at deinit.
db: store data in memory during database downtime

This patch is adding a mechanism to store query in a backlog build
in memory. This allow to store events during downtime in memory and
realize the effective insertion when the database comes back.
A memory cap is used to avoid any memory flooding.
db: suppress field in db structure

The field is currently only used in a single function as a string
pointer and can thus be removed from the db instance structure.
db: use offset instead of direct pointer.

Use an offset approach to get the start of values printing area. It
is more generic and will be use soon.
db: add ring buffer for DB query

This patch adds an optional ring buffer option which modify
the way database queries are made. The main thread is only handling
kernel message reading and query formatting. The SQL request is made
in a separate dedicated thread.
The idea is to try to avoid buffer overrun by minimizing the time
requested to treat kernel message. Doing synchronous SQL request, as
it was made before was causing a delay which could cause some messages
to be lost in case of burst from kernel side.
db: disable SIGHUP if ring buffer is used.

The handling of signal when using threads can be complicated. When
ring buffer is used for query, this means ulogd will have to follow
some sort of mutex. Thus, it is easier and better performance wise
to disable the reload via SIGHUP when the ring buffer is used.
db: db ring has precedence over backlog.
Exec libmnl config check only if nfacct is enabled

In case nfacct is not enabled in ulogd2, libmnl is not used. So it shouldn't
be a hard global dependency, but instead only a dependency in case nfacct is
enabled.
ulogd: Perform nice() before giving up root

The daemon code currently tries to nice(-1) just after having given up root
privileges, which fails. This patch moves the nice(-1) call to just before
the code that gives up the required privileges.

Signed-off-by: Chris Boot <bootc@bootc.net>
ulogd: Implement PID file writing

The deamon currently does not have the ability to write a PID file to track its
process ID. This is very useful to an init script and to ensure there is only
one running instance. This patch implements this functionality.

Signed-off-by: Chris Boot <bootc@bootc.net>
Improve pid file handling.

This patch improves latest patch by splitting in two part the pid
file creation. This allows to display a message to stdout when
ulogd can not be started. Another linked improvement is that the
plugin initialization is not done if the pid file existence will
result in a ulogd exit.

Signed-off-by: Eric Leblond <eric@regit.org>
pgsql: add var to specify arbitrary conn params

This patch adds a configuration variable for PostgreSQL output.
Named connstring it stores the character string that will be
used to connect to the PostgreSQL server. This allows the user
to use all options available like TLS parameters for example.

Signed-off-by: Eric Leblond <eric@regit.org>