gitignore: ignore generated documentation

Signed-off-by: Vincent Bernat <Vincent.Bernat@exoscale.ch>
gitignore: add manpage

Signed-off-by: Eric Leblond <eric@regit.org>
Fix JSON output on big endian systems

Signed-off-by: Jimmy Jones <jimmyjones2@gmx.co.uk>
include: keep a copy of linux/netfilter_ipv4/ipt_ULOG.h

This fixes compilation if you use a Linux kernel >= 3.17. This problem
occurs since ULOG was removed from mainstream:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7200135bc1e61f1437dc326ae2ef2f310c50b4eb

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=986
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ipfix: use nfct_bitmask

from libnetfilter_conntrack instead of original

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: fix enterprise bit handling

If this bit is zero, the Information Element identifier identifies an
Information Element in IANA-IPFIX, and the four-octet Enterprise Number field
MUST NOT be present.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: some cleanups

remove unused variables.
use unsigned int to supress gcc warning.
change struct field name from total_length to data_length.
compare bitmask by nfct_bitmask_test_bit().
change tmpl_cur to void * to calc size.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add functions for ipfix dataset creation

ulogd_key_putn() put key's value in network byteorder.
put_data_records() creates ipfix data records buffer.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add function for ipfix message creation

This function creates ipfix message, template and data part but not scope.
Header sequence is kept by struct ipfix_instance, domain id is specified
by config file. The returned value has no export time so caller set this
and free the value after using it.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: decide whether prepending template by send times

specified in config file and kept it until_template in struct ulogd_ipfix_template

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: print ipfix message

by messy ipfix_fprintf_ functions.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: build headers with template

Based on assumption that we send only two types packet, one has template
set and data set, another has data set only. Theses templates including
message header, set header and template records are put in struct
ulogd_ipfix_template as struct ipfix_msg_hdr.

Another assumption is that we can send only one dataset, cannot send
muliple datasets at onece. It's better to not include dataset buffer,
alloc it each time and use gather sendmsg to send multiple set with pre-
allocated headers.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix ipfix field_id of flow.end.usec

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: fix icmp type and code output key size

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct/ipfix: introduce new vendor id

IPFIX_VENDOR_REVERSE, defined in RFC 5103 6.1 Reverse Information Element
Private Enterprise Number. And use it at counter in nfct.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see the file by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd. This implicitly requres "oob.family" input key.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>