conntrack: introduce clear and equal functions for bitmask object

This patch adds two functions, useful for ulogd IPFIX
output module.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
conntrack: add mark event filter

This patch adds mark filter for event listener, using same struct
nfct_filter_dump_mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
conntrack: add zone event filter

This patch adds zone filter for event listener.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
conntrack: add zone dump filter

This patch adds zone filter for dump.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
xcnt: add XCOUNTERS
qa: add cmp ATTR_ZONE regression test cases

As reported by Ken-ichirou MATSUZAWA:

"conntrack -L --zone 0" doesn't list any output.

nfct_cmp(mask_obj, ct, NFCT_CMP_MASK)

considers ct to not match since the zone attribute
in ct is not set for the default (0) zone.

libnetfilter_conntrack should be more permissive and return
that these are equal iff 'mask_obj' has ATTR_ZONE with a 0 value,
and ct object has ATTR_ZONE not set.

These 3 checks currently fail, even though they really should not:

assert(test_cmp_attr32(ATTR_ZONE, true, false, 0, 0, NFCT_CMP_STRICT) == 1);
assert(test_cmp_attr32(ATTR_ZONE, false, true, 0, 0, NFCT_CMP_STRICT) == 1);
assert(test_cmp_attr32(ATTR_ZONE, true, false, 0, 0, NFCT_CMP_MASK) == 1);

Altough in all 3 cases the zone is only set in one conntrack, the value
is zero, so it should be equal to a conntrack object without the zone
bit set.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: remove duplicate code

nfct_filter_dump_set_attr() will set the bit.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
qa: update cmp ATTR_ZONE size mark and zone

Test all combinations of flags/attribute states for both
ZONE and MARK.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: compare: relax MARK/ZONE attribute comparision

Relax checking for MARK and ZONE to treat 'attribute not
set' like 'attribute is set to 0'.

This matches kernel behaviour, conntracks are always in zone 0,
except if specified differently.  Same for connmark.

The kernel will also not include the zone/mark attributes in dumps
unless they have non-zero values.

This makes qa/test_api pass again with the updated test cases.

Reported-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>