ipfix: some cleanups

remove unused variables.
use unsigned int to supress gcc warning.
change struct field name from total_length to data_length.
compare bitmask by nfct_bitmask_test_bit().
change tmpl_cur to void * to calc size.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add functions for ipfix dataset creation

ulogd_key_putn() put key's value in network byteorder.
put_data_records() creates ipfix data records buffer.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add function for ipfix message creation

This function creates ipfix message, template and data part but not scope.
Header sequence is kept by struct ipfix_instance, domain id is specified
by config file. The returned value has no export time so caller set this
and free the value after using it.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: decide whether prepending template by send times

specified in config file and kept it until_template in struct ulogd_ipfix_template

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: print ipfix message

by messy ipfix_fprintf_ functions.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: build headers with template

Based on assumption that we send only two types packet, one has template
set and data set, another has data set only. Theses templates including
message header, set header and template records are put in struct
ulogd_ipfix_template as struct ipfix_msg_hdr.

Another assumption is that we can send only one dataset, cannot send
muliple datasets at onece. It's better to not include dataset buffer,
alloc it each time and use gather sendmsg to send multiple set with pre-
allocated headers.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix ipfix field_id of flow.end.usec

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix icmp type and code output key size
nfct/ipfix: introduce new vendor id

IPFIX_VENDOR_REVERSE, defined in RFC 5103 6.1 Reverse Information Element
Private Enterprise Number. And use it at counter in nfct.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see flow created by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: initialize at constructor_nfct as possible

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce count mode

as with nfacct using ``zerocounter''
nfct stats: introduce new input plugin

This patch introduce input plugin which emit couters got by
IPCTNL_MSG_CT_GET_STATS_CPU.
nflow9: tentative commit
icmp pack filter: add new filter

This filter creates ICMP_TYPE Netfilter v9 from IPFIX icmpTypeIPv4
and icmpCodeIPv4.