src: fix documentation regarding nfct_catch() and nfexp_catch()

Stefan reported that the *_catch() functions documentation was imprecise
on some aspects.

Reported-by: Stefan Nicolae Stancu <Stefan.Stancu@cern.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrack: labels: remove dead code

unsigned, < 0 is always false.

Signed-off-by: Florian Westphal <fw@strlen.de>
qa: add cmp ATTR_ZONE regression test cases

As reported by Ken-ichirou MATSUZAWA:

"conntrack -L --zone 0" doesn't list any output.

nfct_cmp(mask_obj, ct, NFCT_CMP_MASK)

considers ct to not match since the zone attribute
in ct is not set for the default (0) zone.

libnetfilter_conntrack should be more permissive and return
that these are equal iff 'mask_obj' has ATTR_ZONE with a 0 value,
and ct object has ATTR_ZONE not set.

These 3 checks currently fail, even though they really should not:

assert(test_cmp_attr32(ATTR_ZONE, true, false, 0, 0, NFCT_CMP_STRICT) == 1);
assert(test_cmp_attr32(ATTR_ZONE, false, true, 0, 0, NFCT_CMP_STRICT) == 1);
assert(test_cmp_attr32(ATTR_ZONE, true, false, 0, 0, NFCT_CMP_MASK) == 1);

Altough in all 3 cases the zone is only set in one conntrack, the value
is zero, so it should be equal to a conntrack object without the zone
bit set.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: remove duplicate code

nfct_filter_dump_set_attr() will set the bit.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
qa: update cmp ATTR_ZONE size mark and zone

Test all combinations of flags/attribute states for both
ZONE and MARK.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: compare: relax MARK/ZONE attribute comparision

Relax checking for MARK and ZONE to treat 'attribute not
set' like 'attribute is set to 0'.

This matches kernel behaviour, conntracks are always in zone 0,
except if specified differently.  Same for connmark.

The kernel will also not include the zone/mark attributes in dumps
unless they have non-zero values.

This makes qa/test_api pass again with the updated test cases.

Reported-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: api: add two new bitmask functions

This patch adds two functions, useful for ulogd IPFIX
output module.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
qa: add tests for new bitmask functions

for nfct_bitmask_clear() and nfct_bitmask_equal()

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
doc: fix symbol name typo in comment

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
qa: build unshared nfct environment

nssocket forks and change netns pre-establishd by ip(8), serves its
socket descriptor to parent via nssocket().  Since this socket is
isolated, it can be used to create regression tests for conntrack.

This also adds a conntrack event testcase as a first user.
A ct_echo_event.sh script is provided to build and run this test
automatically:

  # ./qa/ct_echo_event.sh
  make: Entering directory...
  ...debug output like:
      [NEW] tcp      6 2 SYN_SENT src=10.255.255.249 dst=10.255.255.250 sport...
   [UPDATE] tcp      6 2 SYN_RECV src=10.255.255.249 dst=10.255.255.250 sport...
  ...
  [DESTROY] icmp     1 src=10.255.255.249 dst=10.255.255.250 type=8 code=0...
  # echo $?
  0

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: add mark event filter

This patch adds mark filter for event listener, using same struct
nfct_filter_dump_mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
qa: add test for mark event filter

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>