nfct: use start timestamp if provided

in event_handler_hashtable() too.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct/ipfix: introduce new vendor id

IPFIX_VENDOR_REVERSE, defined in RFC 5103 6.1 Reverse Information Element
Private Enterprise Number. And use it at counter in nfct.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add debug symbol for yafscii

http://tools.netsa.cert.org/yaf/yafscii.html
To see the file by yafscii
yafscii --in /tmp/ulogd.yaf and see /tmp/ulogd.yaf.txt

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
sprint: introduce new output plugin

This patch introduces a new string output plugin. The output string can be
specified by "form" in config file. Format is consists of:

    key: struct ulogd_key name enclosed by <>, e.g. <orig.ip.saddr.str>
    group: enclosed by () and separated by |, pick first one if exists.
        (<orig.l4.dport>|<icmp.type>|unknown) means
        pick orig.l4.dport value if exist, or icmp.type value. if both
        of them do not exist, select "unknown" string.
    +: add two key value if it can be
    anything else: as is

meta character <>()|+\ needs to be escaped by \. Sink can be specified by "dest"
like URI syntax, proto://host:port, proto can be either file, tcp and udp,
e.g. dest="tcp://192.168.1.1:8125" for statsite. host is filename in case of
proto is file or stdout if dest is "file://"

'.' and ':' in ip address format can be changed by specifying "addrsep" for use
of graphite and statsd. This implicitly requres "oob.family" input key.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter

This patch adds a new configuration variable which is used to limit
conntrack event to connection of the mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: add mark filter for dump

This patch enables to filter dump by mark.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: use cth for polling

This patch uses cth for polling instead of pgh. pgh is now for purging
private.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: initialize at constructor_nfct as possible

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: construct by passing handler

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct: introduce count mode

This patch introduces count mode which aims to nfct-daemon.c in libmnl
examples. This mode is enabled by setting pollinterval and event_mask to 4
(NF_NETLINK_CONNTRACK_DESTROY). Timestamps will be reset every polling.
This will reset counters every polling and propagate only if packet counts are
more than 0 with zerocounter=1 in config.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nfct stats: introduce new input plugin

This patch introduce input plugin which propagates couters
acquired by IPCTNL_MSG_CT_GET_STATS_CPU.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
nflow9: introduce new NetFlow v9 output plugin

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
filter: add new filter for Netflow ICMP_TYPE

This filter creates ICMP_TYPE Netflow v9 from IPFIX icmpTypeIPv4
and icmpCodeIPv4.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
filter: add new filter for IPFIX time

This filter creates IPFIX_flow(Start|End)MicroSeconds and
IPFIX_flow(Start|End)SysUpTime from "flow.(start|end).sec" and
"flow.(start|end).usec".

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
ipfix: add flowDirection IE

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
filter: add new filter creates ifindex from CTMARK

This filter assigns IPFIX_(ingress|egress)Interface from CTMARK
specified by mark_mask_(in|out) in config.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>