ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see the file by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd. This implicitly requres "oob.family" key input to print
IP addresses even IP address will not in form.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: initialize at constructor_nfct as possible

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce count mode

This patch introduces count mode which aims to nfct-daemon.c in libmnl
examples. This mode is enabled by setting pollinterval and event_mask to 4
(NF_NETLINK_CONNTRACK_DESTROY). Timestamps will be reset every polling.
This will reset counters every polling and propagate only if packet counts are
more than 0 with zerocounter=1 in config.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct stats: introduce new input plugin

This patch introduce input plugin which propagates couters
acquired by IPCTNL_MSG_CT_GET_STATS_CPU.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: introduce new NetFlow v9 output plugin

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
icmp pack filter: add new filter

This filter creates ICMP_TYPE Netfilter v9 from IPFIX icmpTypeIPv4
and icmpCodeIPv4.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
time conversion filter: add new filter

This filter creates IPFIX_flow(Start|End)MicroSeconds and
IPFIX_flow(Start|End)SysUpTime from "flow.(start|end).sec" and
"flow.(start|end).usec".

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
markif filter: add new filter

This filter assigns IPFIX_(ingress|egress)Interface from CTMARK
specified by mark_mask_(in|out) in config.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add flowDirection IE

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: reverse fields on reply

set INPUT_SNMP, OUTPUT_SNMP and DIRECTION appropriately.
by overwriting input_keys.

Signed-off-by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: add filter and config for prime service