ipfix: fix enterprise bit handling

If this bit is zero, the Information Element identifier identifies an
Information Element in IANA-IPFIX, and the four-octet Enterprise Number field
MUST NOT be present.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: some cleanups

remove unused variables.
use unsigned int to supress gcc warning.
change struct field name from total_length to data_length.
compare bitmask by nfct_bitmask_test_bit().
change tmpl_cur to void * to calc size.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add functions for ipfix dataset creation

ulogd_key_putn() put key's value in network byteorder.
put_data_records() creates ipfix data records buffer.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add function for ipfix message creation

This function creates ipfix message, template and data part but not scope.
Header sequence is kept by struct ipfix_instance, domain id is specified
by config file. The returned value has no export time so caller set this
and free the value after using it.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: decide whether prepending template by send times

specified in config file and kept it until_template in struct ulogd_ipfix_template

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: print ipfix message

by messy ipfix_fprintf_ functions.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: build headers with template

Based on assumption that we send only two types packet, one has template
set and data set, another has data set only. Theses templates including
message header, set header and template records are put in struct
ulogd_ipfix_template as struct ipfix_msg_hdr.

Another assumption is that we can send only one dataset, cannot send
muliple datasets at onece. It's better to not include dataset buffer,
alloc it each time and use gather sendmsg to send multiple set with pre-
allocated headers.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix ipfix field_id of flow.end.usec

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix icmp type and code output key size

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct/ipfix: introduce new vendor id

IPFIX_VENDOR_REVERSE, defined in RFC 5103 6.1 Reverse Information Element
Private Enterprise Number. And use it at counter in nfct.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see the file by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd. This implicitly requres "oob.family" input key.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: initialize at constructor_nfct as possible

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce count mode

This patch introduces count mode which aims to nfct-daemon.c in libmnl
examples. This mode is enabled by setting pollinterval and event_mask to 4
(NF_NETLINK_CONNTRACK_DESTROY). Timestamps will be reset every polling.
This will reset counters every polling and propagate only if packet counts are
more than 0 with zerocounter=1 in config.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct stats: introduce new input plugin

This patch introduce input plugin which propagates couters
acquired by IPCTNL_MSG_CT_GET_STATS_CPU.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: introduce new NetFlow v9 output plugin

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>