util: add new functions for ipfix

open_connect_descriptor() opens socket or file specified by
URL like destination. ulogd_key_putn() stores key's value
to buf in network byte order.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: using functions in util/

Since open_connect_descriptor() in util/ipfix.c handle file output
we can handle the file by yafscii, like:

    yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add flowDirection IE

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: put next template ID into priv data

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: implement corking send

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: fix sequence number

Sequence Number:
Incremental sequence counter modulo 2^32 of all IPFIX Data Records
sent in the current stream from the current Observation Domain by
the Exporting Process.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix ipfix field_id of flow.end.usec

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix icmp type and code output key size

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use start timestamp if provided

As with in event_handler_hashtable().

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct/ipfix: introduce new vendor id

IPFIX_VENDOR_REVERSE, defined in RFC 5103 6.1 Reverse Information Element
Private Enterprise Number. And use it at counter in nfct.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
filter: add new filter for IPFIX time

This filter creates IPFIX_flow(Start|End)MicroSeconds and
IPFIX_flow(Start|End)SysUpTime from "flow.(start|end).sec" and
"flow.(start|end).usec".

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd. This implicitly requres "oob.family" input key.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce new config param reset_count

nfct_query will be called with NFCT_Q_FILTER_RESET and report
counters as delta if this reset_count param is not equal to 0.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce new config param omit_zerocount

Only emit nfct which counter is not zero if omit_zerocount is not
equal to zero. This may be useful specifying reset_count to non-zero
in polling mode.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce new delta-count mode

To emulate active timeout. This changes default configuration
behavior, needs specifying eventmask to 0 explicitly to work
in polling mode. We have now four mode: event, event nohash,
polling, delta.

* event mode
  propagate nfct at DESTROY event only.
  params required:
    pollinterval:       0 (default)
    hash_enable:        1 (default)
    event_mask:         optional

* event nohash
  propagate nfct at NEW and DESTROY event.
  params required:
    pollinterval:       0 (default)
    hash_enable:        0
    event_mask:         optional

* polling mode
  propagate nfct which is vanished since previous as DESTROY.
  params required:
    pollinterval:       != 0
    hash_enable:        1
    event_mask:         0

* delta mode
  propagate nfct at DESTROY event, and on a regular basis.
  Time when executed on a regular basis may be used as start
  and end timestamp instead of timestamps in nfct.
  params required:
    pollinterval:       != 0
    hash_enable:        1
    event_mask:         != 0 (default, optional)

if reset_count is set to non-zero:
  event:        reset counter befor starting only.
  event nohash: same as event
  polling:      reset counter every polling.
  delta:        same as pollig

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct stats: introduce new input plugin

This patch introduce input plugin which propagates couters
acquired by IPCTNL_MSG_CT_GET_STATS_CPU.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: introduce new NetFlow v9 output plugin

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>