ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see flow created by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: initialize at constructor_nfct as possible

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce counter mode

This patch introduce counter mode, which aim for nfct-daemon.c in
libmnl working in ulogd. This mode emit nfct only if counter,
actually packet count of either orig or repl has changed.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce gauge counter

by reseting counter every dump.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: reset timestamp on counter mode

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>