Misc improvements and bugfixes

index 52b639c..958a5de 100644
@@ -4,7 +4,8 @@ INCLUDES = $(all_includes) -I$(top_srcdir)/include
 
 pkglib_LTLIBRARIES = ulogd_filter_IFINDEX.la ulogd_filter_PWSNIFF.la \
 		     ulogd_filter_PRINTPKT.la ulogd_filter_PRINTFLOW.la \
-		     ulogd_filter_IP2STR.la ulogd_filter_IP2BIN.la
+		     ulogd_filter_IP2STR.la ulogd_filter_IP2BIN.la \
+		     ulogd_filter_MAC2STR.la
 
 ulogd_filter_IFINDEX_la_SOURCES = ulogd_filter_IFINDEX.c
 ulogd_filter_IFINDEX_la_LDFLAGS = -module -lnfnetlink

@@ -18,6 +19,9 @@ ulogd_filter_IP2STR_la_LDFLAGS = -module
 ulogd_filter_IP2BIN_la_SOURCES = ulogd_filter_IP2BIN.c
 ulogd_filter_IP2BIN_la_LDFLAGS = -module
 
+ulogd_filter_MAC2STR_la_SOURCES = ulogd_filter_MAC2STR.c
+ulogd_filter_MAC2STR_la_LDFLAGS = -module
+
 ulogd_filter_PRINTPKT_la_SOURCES = ulogd_filter_PRINTPKT.c ../util/printpkt.c
 ulogd_filter_PRINTPKT_la_LDFLAGS = -module
 

index 1265eba..bb31339 100644
@@ -72,14 +72,12 @@ ALTER TABLE ulog2 ADD KEY `timestamp` (`timestamp`);
 
 CREATE TABLE `mac` (
   `_mac_id` bigint unsigned NOT NULL,
-  `mac_saddr` binary(12) default NULL,
-  `mac_daddr` binary(12) default NULL,
+  `mac_saddr` varchar(32) default NULL,
   `mac_protocol` smallint(5) default NULL
 ) ENGINE=INNODB;
 
 ALTER TABLE mac ADD UNIQUE KEY `_mac_id` (`_mac_id`);
 ALTER TABLE mac ADD KEY `mac_saddr` (`mac_saddr`);
-ALTER TABLE mac ADD KEY `mac_daddr` (`mac_daddr`);
 ALTER TABLE mac ADD KEY `index_mac_id` (`_mac_id`);
 
 CREATE TABLE `tcp` (

@@ -213,10 +211,9 @@ CREATE SQL SECURITY INVOKER VIEW `ulog` AS
 	icmpv6_code,
 	icmpv6_echoid,
 	icmpv6_echoseq,
-	icmpv6_csum
---	mac_saddr,
---	mac_daddr,
---	mac_protocol,
+	icmpv6_csum,
+	mac_saddr as mac_saddr_str,
+	mac_protocol as oob_protocol
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
                 LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;

@@ -571,13 +568,12 @@ delimiter $$
 DROP PROCEDURE IF EXISTS PACKET_ADD_MAC;
 CREATE PROCEDURE PACKET_ADD_MAC(
 		IN `id` int(10) unsigned,
-		IN `_saddr` binary(12),
-		IN `_daddr` binary(12),
+		IN `_saddr` varchar(32),
 		IN `_protocol` smallint(5)
 		)
 BEGIN
-	INSERT INTO mac (_mac_id, mac_saddr, mac_daddr, mac_protocol) VALUES
-	(id, _saddr, _daddr, _protocol);
+	INSERT INTO mac (_mac_id, mac_saddr, mac_protocol) VALUES
+	(id, _saddr, _protocol);
 END
 $$
 

@@ -627,10 +623,9 @@ CREATE FUNCTION INSERT_PACKET_FULL(
 		icmpv6_code tinyint(3) unsigned,
 		icmpv6_echoid smallint(5) unsigned,
 		icmpv6_echoseq smallint(5) unsigned,
-		icmpv6_csum int(10) unsigned
---		mac_saddr binary(12),
---		mac_daddr binary(12),
---		mac_protocol smallint(5)
+		icmpv6_csum int(10) unsigned,
+		mac_saddr varchar(32),
+		mac_protocol smallint(5)
 		) RETURNS bigint unsigned
 READS SQL DATA
 BEGIN

@@ -652,9 +647,9 @@ BEGIN
 		CALL PACKET_ADD_ICMPV6(@lastid, icmpv6_type, icmpv6_code, icmpv6_echoid,
 				       icmpv6_echoseq, icmpv6_csum);
 	END IF;
---	IF mac_protocol IS NOT NULL THEN
---		CALL PACKET_ADD_MAC(@lastid, mac_saddr, mac_daddr, mac_protocol);
---	END IF;
+	IF mac_protocol IS NOT NULL THEN
+		CALL PACKET_ADD_MAC(@lastid, mac_saddr, mac_protocol);
+	END IF;
 	RETURN @lastid;
 END
 $$

index f4359ed..fc4aa1b 100644
@@ -68,12 +68,10 @@ CREATE INDEX ulog2_timestamp ON ulog2(timestamp);
 CREATE TABLE mac (
   _mac_id bigint PRIMARY KEY UNIQUE NOT NULL,
   mac_saddr macaddr default NULL,
-  mac_daddr macaddr default NULL,
   mac_protocol smallint default NULL
 ) WITH (OIDS=FALSE);
 
 CREATE INDEX mac_saddr ON mac(mac_saddr);
-CREATE INDEX mac_daddr ON mac(mac_daddr);
 
 CREATE TABLE tcp (
   _tcp_id bigint PRIMARY KEY UNIQUE NOT NULL,

@@ -191,7 +189,9 @@ CREATE OR REPLACE VIEW ulog AS
         icmpv6_code,
         icmpv6_echoid,
         icmpv6_echoseq,
-        icmpv6_csum
+        icmpv6_csum,
+        mac_saddr AS mac_saddr_str,
+        mac_protocol AS oob_protocol
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
                 LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;

@@ -433,6 +433,16 @@ RETURNS bigint AS $$
         SELECT currval('ulog2__id_seq');
 $$ LANGUAGE SQL SECURITY INVOKER;
 
+CREATE OR REPLACE FUNCTION INSERT_MAC(
+                IN mac_id bigint,
+                IN mac_saddr macaddr,
+                IN mac_protocol integer
+        )
+RETURNS bigint AS $$
+        INSERT INTO mac (_mac_id,mac_saddr,mac_protocol)
+                VALUES ($1,$2,$3);
+        SELECT currval('ulog2__id_seq');
+$$ LANGUAGE SQL SECURITY INVOKER;
 
 -- this function requires plpgsql
 -- su -c "createlang plpgsql ulog2" postgres

@@ -480,7 +490,9 @@ CREATE OR REPLACE FUNCTION INSERT_PACKET_FULL(
                 IN icmpv6_code integer,
                 IN icmpv6_echoid integer,
                 IN icmpv6_echoseq integer,
-                IN icmpv6_csum integer
+                IN icmpv6_csum integer,
+                IN mac_saddr varchar(32),
+                IN mac_protocol integer
         )
 RETURNS bigint AS $$
 DECLARE

@@ -496,6 +508,9 @@ BEGIN
         ELSIF (ip_protocol = 58) THEN
                 PERFORM INSERT_ICMPV6(_id,$40,$41,$42,$43,$44);
         END IF;
+        IF (mac_saddr IS NOT NULL) THEN
+                PERFORM INSERT_MAC(_id,$45::macaddr,$46);
+        END IF;
         RETURN _id;
 END
 $$ LANGUAGE plpgsql SECURITY INVOKER;

index 3def8d1..7f78242 100644
@@ -97,6 +97,7 @@ group=0
 [log2]
 group=1 # Group has to be different from the one use in log1
 addressfamily=10 # 10 is value of AF_INET6
+numeric_label=1 # label can be used to define the decision applied to packet
 
 # ebtables logging through NFLOG
 [log3]

@@ -106,6 +107,7 @@ addressfamily=7 # 7 is value of AF_BRIDGE
 [ulog1]
 # netlink multicast group (the same as the iptables --ulog-nlgroup param)
 nlgroup=1
+#numeric_label=0 # optionnal argument
 
 [emu1]
 file="/var/log/ulogd_syslogemu.log"

index ed8d982..72575b3 100644
@@ -139,6 +139,19 @@ CREATE TABLE `icmpv6` (
 ALTER TABLE icmpv6 ADD UNIQUE KEY `key_icmpv6_id` (`_icmpv6_id`);
 ALTER TABLE icmpv6 ADD KEY `index_icmpv6_id` (`_icmpv6_id`);
 
+-- State
+CREATE TABLE `label_t` (
+  `_label_id` bigint unsigned NOT NULL,
+  label tinyint(3) unsigned
+) ENGINE=INNODB;
+
+ALTER TABLE label_t ADD UNIQUE KEY `_label_id` (`_label_id`);
+ALTER TABLE label_t ADD KEY `index_label_id` (`_label_id`);
+ALTER TABLE label_t ADD KEY `label` (`label`);
+ALTER TABLE label_t ADD FOREIGN KEY (_label_id) REFERENCES ulog2 (_id);
+
+INSERT INTO _extensions (ext_name,table_name,join_name) VALUES
+        ('label','label_t','_label_id');
 
 -- views
 

@@ -213,10 +226,11 @@ CREATE SQL SECURITY INVOKER VIEW `ulog` AS
 	icmpv6_echoseq,
 	icmpv6_csum,
 	mac_saddr as mac_saddr_str,
-	mac_protocol as oob_protocol
+	mac_protocol as oob_protocol,
+	label as raw_label
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
-                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
+                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id LEFT JOIN label_t ON ulog2._id = label_t._label_id;
 
 
 -- shortcuts

@@ -578,6 +592,18 @@ END
 $$
 
 delimiter $$
+DROP PROCEDURE IF EXISTS PACKET_ADD_LABEL;
+CREATE PROCEDURE PACKET_ADD_LABEL(
+		IN `id` int(10) unsigned,
+		IN `_label` tinyint(4)
+		)
+BEGIN
+	INSERT INTO label_t (_label_id, label) VALUES (id, _label);
+END
+$$
+
+
+delimiter $$
 DROP FUNCTION IF EXISTS INSERT_PACKET_FULL;
 CREATE FUNCTION INSERT_PACKET_FULL(
 		_oob_time_sec int(10) unsigned,

@@ -625,7 +651,8 @@ CREATE FUNCTION INSERT_PACKET_FULL(
 		icmpv6_echoseq smallint(5) unsigned,
 		icmpv6_csum int(10) unsigned,
 		mac_saddr varchar(32),
-		mac_protocol smallint(5)
+		mac_protocol smallint(5),
+		label tinyint(4)
 		) RETURNS bigint unsigned
 READS SQL DATA
 BEGIN

@@ -650,6 +677,10 @@ BEGIN
 	IF mac_protocol IS NOT NULL THEN
 		CALL PACKET_ADD_MAC(@lastid, mac_saddr, mac_protocol);
 	END IF;
+	IF label IS NOT NULL THEN
+		CALL PACKET_ADD_LABEL(@lastid, label);
+	END IF;
+
 	RETURN @lastid;
 END
 $$

index cfef267..c974744 100644
@@ -25,6 +25,7 @@ CREATE TABLE _extensions (
   join_name varchar(64) NOT NULL
 ) WITH (OIDS=FALSE);
 
+DROP TABLE IF EXISTS label_t CASCADE;
 DROP TABLE IF EXISTS mac CASCADE;
 DROP TABLE IF EXISTS tcp CASCADE;
 DROP TABLE IF EXISTS udp CASCADE;

@@ -65,6 +66,13 @@ CREATE INDEX ulog2_ip_saddr ON ulog2(ip_saddr_str);
 CREATE INDEX ulog2_ip_daddr ON ulog2(ip_daddr_str);
 CREATE INDEX ulog2_timestamp ON ulog2(timestamp);
 
+CREATE TABLE label_t (
+  _label_id bigint PRIMARY KEY UNIQUE NOT NULL,
+  label smallint default NULL
+) WITH (OIDS=FALSE);
+
+CREATE INDEX label ON label_t(label);
+
 CREATE TABLE mac (
   _mac_id bigint PRIMARY KEY UNIQUE NOT NULL,
   mac_saddr macaddr default NULL,

@@ -191,10 +199,12 @@ CREATE OR REPLACE VIEW ulog AS
         icmpv6_echoseq,
         icmpv6_csum,
         mac_saddr AS mac_saddr_str,
-        mac_protocol AS oob_protocol
+        mac_protocol AS oob_protocol,
+        label AS raw_label
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
-                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
+                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id
+                LEFT JOIN label_t ON ulog2._id = label_t._label_id;
 
 -- shortcuts
 CREATE OR REPLACE VIEW view_tcp_quad AS

@@ -306,6 +316,8 @@ INSERT INTO _extensions (ext_name,table_name,join_name) VALUES
 
 CREATE OR REPLACE FUNCTION ULOG2_DROP_FOREIGN_KEYS()
 RETURNS void AS $$
+  ALTER TABLE label_t DROP CONSTRAINT label_id_fk;
+  ALTER TABLE mac DROP CONSTRAINT mac_id_fk;
   ALTER TABLE icmpv6 DROP CONSTRAINT icmpv6_id_fk;
   ALTER TABLE icmp DROP CONSTRAINT icmp_id_fk;
   ALTER TABLE udp  DROP CONSTRAINT udp_id_fk;

@@ -319,6 +331,8 @@ RETURNS void AS $$
   ALTER TABLE udp  ADD CONSTRAINT udp_id_fk  FOREIGN KEY (_udp_id)  REFERENCES ulog2(_id);
   ALTER TABLE icmp ADD CONSTRAINT icmp_id_fk FOREIGN KEY (_icmp_id) REFERENCES ulog2(_id);
   ALTER TABLE icmpv6 ADD CONSTRAINT icmpv6_id_fk FOREIGN KEY (_icmpv6_id) REFERENCES ulog2(_id);
+  ALTER TABLE mac ADD CONSTRAINT mac_id_fk FOREIGN KEY (_mac_id) REFERENCES ulog2(_id);
+  ALTER TABLE label_t ADD CONSTRAINT label_id_fk FOREIGN KEY (_label_id) REFERENCES ulog2(_id);
 $$ LANGUAGE SQL SECURITY INVOKER;
 
 

@@ -433,6 +447,16 @@ RETURNS bigint AS $$
         SELECT currval('ulog2__id_seq');
 $$ LANGUAGE SQL SECURITY INVOKER;
 
+CREATE OR REPLACE FUNCTION INSERT_STATE(
+                IN label_id bigint,
+                IN label integer
+        )
+RETURNS bigint AS $$
+        INSERT INTO label_t (_label_id,label)
+                VALUES ($1,$2);
+        SELECT currval('ulog2__id_seq');
+$$ LANGUAGE SQL SECURITY INVOKER;
+
 CREATE OR REPLACE FUNCTION INSERT_MAC(
                 IN mac_id bigint,
                 IN mac_saddr macaddr,

@@ -492,7 +516,8 @@ CREATE OR REPLACE FUNCTION INSERT_PACKET_FULL(
                 IN icmpv6_echoseq integer,
                 IN icmpv6_csum integer,
                 IN mac_saddr varchar(32),
-                IN mac_protocol integer
+                IN mac_protocol integer,
+                IN label integer
         )
 RETURNS bigint AS $$
 DECLARE

@@ -511,13 +536,13 @@ BEGIN
         IF (mac_saddr IS NOT NULL) THEN
                 PERFORM INSERT_MAC(_id,$45::macaddr,$46);
         END IF;
+        IF (label IS NOT NULL) THEN
+                PERFORM INSERT_STATE(_id,$47);
+        END IF;
         RETURN _id;
 END
 $$ LANGUAGE plpgsql SECURITY INVOKER;
 
-
-
-
 CREATE OR REPLACE FUNCTION DELETE_PACKET(
                 IN _packet_id bigint
         )

@@ -526,6 +551,8 @@ RETURNS void AS $$
   DELETE FROM icmp  WHERE icmp._icmp_id = $1;
   DELETE FROM tcp   WHERE tcp._tcp_id   = $1;
   DELETE FROM udp   WHERE udp._udp_id   = $1;
+  DELETE FROM mac   WHERE mac._mac_id   = $1;
+  DELETE FROM label_t   WHERE label_t._label_id   = $1;
   DELETE FROM ulog2 WHERE ulog2._id     = $1;
 $$ LANGUAGE SQL SECURITY INVOKER;
 

@@ -564,6 +591,7 @@ RETURNS void AS $$
   DELETE FROM tcp WHERE _tcp_id NOT IN (SELECT _id FROM ulog2);
   -- XXX note: could be rewritten (need to see what is more efficient) as:
   -- DELETE FROM tcp WHERE _tcp_id IN (SELECT tcp._tcp_id FROM tcp LEFT OUTER JOIN ulog2  ON (tcp._tcp_id = ulog2._id) WHERE ulog2._id IS NULL);
+  DELETE FROM label_t WHERE _label_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM mac WHERE _mac_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM udp WHERE _udp_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM icmp WHERE _icmp_id NOT IN (SELECT _id FROM ulog2);

index 3def8d1..578d56b 100644
@@ -97,6 +97,7 @@ group=0
 [log2]
 group=1 # Group has to be different from the one use in log1
 addressfamily=10 # 10 is value of AF_INET6
+label=1 # State can be used to define the decision applied to packet
 
 # ebtables logging through NFLOG
 [log3]

@@ -106,6 +107,7 @@ addressfamily=7 # 7 is value of AF_BRIDGE
 [ulog1]
 # netlink multicast group (the same as the iptables --ulog-nlgroup param)
 nlgroup=1
+#label=0 # optionnal argument
 
 [emu1]
 file="/var/log/ulogd_syslogemu.log"

index 72575b3..b40c961 100644
@@ -703,46 +703,48 @@ END
 $$
 
 delimiter $$
-DROP PROCEDURE IF EXISTS INSERT_CT;
-CREATE PROCEDURE INSERT_CT(
-		IN `_orig_ip_saddr` binary(16),
-		IN `_orig_ip_daddr` binary(16),
-		IN `_orig_ip_protocol` tinyint(3) unsigned,
-		IN `_orig_l4_sport` int(5),
-		IN `_orig_l4_dport` int(5),
-		IN `_orig_bytes` bigint,
-		IN `_orig_packets` bigint,
-		IN `_reply_ip_saddr` binary(16),
-		IN `_reply_ip_daddr` binary(16),
-		IN `_reply_ip_protocol` tinyint(3) unsigned,
-		IN `_reply_l4_sport` int(5),
-		IN `_reply_l4_dport` int(5),
-		IN `_reply_bytes` bigint,
-		IN `_reply_packets` bigint,
-		IN `_icmp_code` tinyint(3),
-		IN `_icmp_type` tinyint(3),
-		IN `_ct_mark` bigint,
-		IN `_flow_start_sec` int(10),
-		IN `_flow_start_usec` int(10),
-		IN `_flow_end_sec` int(10),
-		IN `_flow_end_usec` int(10)
-		)
+DROP FUNCTION IF EXISTS INSERT_CT;
+CREATE FUNCTION INSERT_CT(
+		`_oob_family` bigint,
+		`_orig_ip_saddr` binary(16),
+		`_orig_ip_daddr` binary(16),
+		`_orig_ip_protocol` tinyint(3) unsigned,
+		`_orig_l4_sport` int(5),
+		`_orig_l4_dport` int(5),
+		`_orig_bytes` bigint,
+		`_orig_packets` bigint,
+		`_reply_ip_saddr` binary(16),
+		`_reply_ip_daddr` binary(16),
+		`_reply_ip_protocol` tinyint(3) unsigned,
+		`_reply_l4_sport` int(5),
+		`_reply_l4_dport` int(5),
+		`_reply_bytes` bigint,
+		`_reply_packets` bigint,
+		`_icmp_code` tinyint(3),
+		`_icmp_type` tinyint(3),
+		`_ct_mark` bigint,
+		`_flow_start_sec` int(10),
+		`_flow_start_usec` int(10),
+		`_flow_end_sec` int(10),
+		`_flow_end_usec` int(10)
+		) RETURNS bigint unsigned
+READS SQL DATA
 BEGIN
-	INSERT INTO ulog2_ct (orig_ip_saddr, orig_ip_daddr, orig_ip_protocol,
+	INSERT INTO ulog2_ct (oob_family, orig_ip_saddr, orig_ip_daddr, orig_ip_protocol,
 		orig_l4_sport, orig_l4_dport, orig_bytes, orig_packets,
 		reply_ip_saddr, reply_ip_daddr, reply_ip_protocol,
 		reply_l4_sport, reply_l4_dport, reply_bytes, reply_packets,
 		icmp_code, icmp_type, ct_mark, 
 		flow_start_sec, flow_start_usec,
 		flow_end_sec, flow_end_usec)
- 	VALUES (_orig_ip_saddr, _orig_ip_daddr, _orig_ip_protocol,
+ 	VALUES (_oob_family, _orig_ip_saddr, _orig_ip_daddr, _orig_ip_protocol,
 		_orig_l4_sport, _orig_l4_dport, _orig_bytes, _orig_packets,
 		_reply_ip_saddr, _reply_ip_daddr, _reply_ip_protocol,
 		_reply_l4_sport, _reply_l4_dport, _reply_bytes, _reply_packets,
 		_icmp_code, _icmp_type, _ct_mark,
 		_flow_start_sec, _flow_start_usec,
 		_flow_end_sec, _flow_end_usec);
-
+	RETURN LAST_INSERT_ID();
 END
 $$
 

index bb31339..304173b 100644
@@ -139,6 +139,19 @@ CREATE TABLE `icmpv6` (
 ALTER TABLE icmpv6 ADD UNIQUE KEY `key_icmpv6_id` (`_icmpv6_id`);
 ALTER TABLE icmpv6 ADD KEY `index_icmpv6_id` (`_icmpv6_id`);
 
+-- State
+CREATE TABLE `state_t` (
+  `_state_id` bigint unsigned NOT NULL,
+  state tinyint(3) unsigned
+) ENGINE=INNODB;
+
+ALTER TABLE state_t ADD UNIQUE KEY `_state_id` (`_state_id`);
+ALTER TABLE state_t ADD KEY `index_state_id` (`_state_id`);
+ALTER TABLE state_t ADD KEY `state` (`state`);
+ALTER TABLE state_t ADD FOREIGN KEY (_state_id) REFERENCES ulog2 (_id);
+
+INSERT INTO _extensions (ext_name,table_name,join_name) VALUES
+        ('state','state_t','_state_id');
 
 -- views
 

@@ -213,10 +226,11 @@ CREATE SQL SECURITY INVOKER VIEW `ulog` AS
 	icmpv6_echoseq,
 	icmpv6_csum,
 	mac_saddr as mac_saddr_str,
-	mac_protocol as oob_protocol
+	mac_protocol as oob_protocol,
+	state as raw_state
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
-                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
+                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id LEFT JOIN state_t ON ulog2._id = state_t._state_id;
 
 
 -- shortcuts

@@ -329,20 +343,6 @@ INSERT INTO ip_proto (_proto_id,proto_name,proto_desc) VALUES
         (41,'ipv6','Internet Protocol, version 6'),
         (58,'ipv6-icmp','ICMP for IPv6');
 
--- State
-CREATE TABLE `state_t` (
-  `_state_id` bigint unsigned NOT NULL,
-  state tinyint(3) unsigned
-) ENGINE=INNODB;
-
-ALTER TABLE state_t ADD UNIQUE KEY `_state_id` (`_state_id`);
-ALTER TABLE state_t ADD KEY `index_state_id` (`_state_id`);
-ALTER TABLE state_t ADD KEY `state` (`state`);
-ALTER TABLE state_t ADD FOREIGN KEY (_state_id) REFERENCES ulog2 (_id);
-
-INSERT INTO _extensions (ext_name,table_name,join_name) VALUES
-        ('state','state_t','_state_id');
-
 -- NuFW specific
 
 CREATE TABLE `nufw` (

@@ -578,6 +578,18 @@ END
 $$
 
 delimiter $$
+DROP PROCEDURE IF EXISTS PACKET_ADD_STATE;
+CREATE PROCEDURE PACKET_ADD_STATE(
+		IN `id` int(10) unsigned,
+		IN `_state` tinyint(4)
+		)
+BEGIN
+	INSERT INTO state_t (_state_id, state) VALUES (id, _state);
+END
+$$
+
+
+delimiter $$
 DROP FUNCTION IF EXISTS INSERT_PACKET_FULL;
 CREATE FUNCTION INSERT_PACKET_FULL(
 		_oob_time_sec int(10) unsigned,

@@ -625,7 +637,8 @@ CREATE FUNCTION INSERT_PACKET_FULL(
 		icmpv6_echoseq smallint(5) unsigned,
 		icmpv6_csum int(10) unsigned,
 		mac_saddr varchar(32),
-		mac_protocol smallint(5)
+		mac_protocol smallint(5),
+		state tinyint(4)
 		) RETURNS bigint unsigned
 READS SQL DATA
 BEGIN

@@ -650,6 +663,10 @@ BEGIN
 	IF mac_protocol IS NOT NULL THEN
 		CALL PACKET_ADD_MAC(@lastid, mac_saddr, mac_protocol);
 	END IF;
+	IF state IS NOT NULL THEN
+		CALL PACKET_ADD_STATE(@lastid, state);
+	END IF;
+
 	RETURN @lastid;
 END
 $$

index fc4aa1b..b18f4a8 100644
@@ -25,6 +25,7 @@ CREATE TABLE _extensions (
   join_name varchar(64) NOT NULL
 ) WITH (OIDS=FALSE);
 
+DROP TABLE IF EXISTS state_t CASCADE;
 DROP TABLE IF EXISTS mac CASCADE;
 DROP TABLE IF EXISTS tcp CASCADE;
 DROP TABLE IF EXISTS udp CASCADE;

@@ -65,6 +66,13 @@ CREATE INDEX ulog2_ip_saddr ON ulog2(ip_saddr_str);
 CREATE INDEX ulog2_ip_daddr ON ulog2(ip_daddr_str);
 CREATE INDEX ulog2_timestamp ON ulog2(timestamp);
 
+CREATE TABLE state_t (
+  _state_id bigint PRIMARY KEY UNIQUE NOT NULL,
+  state smallint default NULL
+) WITH (OIDS=FALSE);
+
+CREATE INDEX state ON state_t(state);
+
 CREATE TABLE mac (
   _mac_id bigint PRIMARY KEY UNIQUE NOT NULL,
   mac_saddr macaddr default NULL,

@@ -191,10 +199,12 @@ CREATE OR REPLACE VIEW ulog AS
         icmpv6_echoseq,
         icmpv6_csum,
         mac_saddr AS mac_saddr_str,
-        mac_protocol AS oob_protocol
+        mac_protocol AS oob_protocol,
+        state AS raw_state
         FROM ulog2 LEFT JOIN tcp ON ulog2._id = tcp._tcp_id LEFT JOIN udp ON ulog2._id = udp._udp_id
                 LEFT JOIN icmp ON ulog2._id = icmp._icmp_id LEFT JOIN mac ON ulog2._id = mac._mac_id
-                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id;
+                LEFT JOIN icmpv6 ON ulog2._id = icmpv6._icmpv6_id
+                LEFT JOIN state_t ON ulog2._id = state_t._state_id;
 
 -- shortcuts
 CREATE OR REPLACE VIEW view_tcp_quad AS

@@ -306,6 +316,8 @@ INSERT INTO _extensions (ext_name,table_name,join_name) VALUES
 
 CREATE OR REPLACE FUNCTION ULOG2_DROP_FOREIGN_KEYS()
 RETURNS void AS $$
+  ALTER TABLE state_t DROP CONSTRAINT state_id_fk;
+  ALTER TABLE mac DROP CONSTRAINT mac_id_fk;
   ALTER TABLE icmpv6 DROP CONSTRAINT icmpv6_id_fk;
   ALTER TABLE icmp DROP CONSTRAINT icmp_id_fk;
   ALTER TABLE udp  DROP CONSTRAINT udp_id_fk;

@@ -319,6 +331,8 @@ RETURNS void AS $$
   ALTER TABLE udp  ADD CONSTRAINT udp_id_fk  FOREIGN KEY (_udp_id)  REFERENCES ulog2(_id);
   ALTER TABLE icmp ADD CONSTRAINT icmp_id_fk FOREIGN KEY (_icmp_id) REFERENCES ulog2(_id);
   ALTER TABLE icmpv6 ADD CONSTRAINT icmpv6_id_fk FOREIGN KEY (_icmpv6_id) REFERENCES ulog2(_id);
+  ALTER TABLE mac ADD CONSTRAINT mac_id_fk FOREIGN KEY (_mac_id) REFERENCES ulog2(_id);
+  ALTER TABLE state_t ADD CONSTRAINT state_id_fk FOREIGN KEY (_state_id) REFERENCES ulog2(_id);
 $$ LANGUAGE SQL SECURITY INVOKER;
 
 

@@ -433,6 +447,16 @@ RETURNS bigint AS $$
         SELECT currval('ulog2__id_seq');
 $$ LANGUAGE SQL SECURITY INVOKER;
 
+CREATE OR REPLACE FUNCTION INSERT_STATE(
+                IN state_id bigint,
+                IN state integer
+        )
+RETURNS bigint AS $$
+        INSERT INTO state_t (_state_id,state)
+                VALUES ($1,$2);
+        SELECT currval('ulog2__id_seq');
+$$ LANGUAGE SQL SECURITY INVOKER;
+
 CREATE OR REPLACE FUNCTION INSERT_MAC(
                 IN mac_id bigint,
                 IN mac_saddr macaddr,

@@ -492,7 +516,8 @@ CREATE OR REPLACE FUNCTION INSERT_PACKET_FULL(
                 IN icmpv6_echoseq integer,
                 IN icmpv6_csum integer,
                 IN mac_saddr varchar(32),
-                IN mac_protocol integer
+                IN mac_protocol integer,
+                IN state integer
         )
 RETURNS bigint AS $$
 DECLARE

@@ -511,13 +536,13 @@ BEGIN
         IF (mac_saddr IS NOT NULL) THEN
                 PERFORM INSERT_MAC(_id,$45::macaddr,$46);
         END IF;
+        IF (state IS NOT NULL) THEN
+                PERFORM INSERT_STATE(_id,$47);
+        END IF;
         RETURN _id;
 END
 $$ LANGUAGE plpgsql SECURITY INVOKER;
 
-
-
-
 CREATE OR REPLACE FUNCTION DELETE_PACKET(
                 IN _packet_id bigint
         )

@@ -526,6 +551,8 @@ RETURNS void AS $$
   DELETE FROM icmp  WHERE icmp._icmp_id = $1;
   DELETE FROM tcp   WHERE tcp._tcp_id   = $1;
   DELETE FROM udp   WHERE udp._udp_id   = $1;
+  DELETE FROM mac   WHERE mac._mac_id   = $1;
+  DELETE FROM state_t   WHERE state_t._state_id   = $1;
   DELETE FROM ulog2 WHERE ulog2._id     = $1;
 $$ LANGUAGE SQL SECURITY INVOKER;
 

@@ -564,6 +591,7 @@ RETURNS void AS $$
   DELETE FROM tcp WHERE _tcp_id NOT IN (SELECT _id FROM ulog2);
   -- XXX note: could be rewritten (need to see what is more efficient) as:
   -- DELETE FROM tcp WHERE _tcp_id IN (SELECT tcp._tcp_id FROM tcp LEFT OUTER JOIN ulog2  ON (tcp._tcp_id = ulog2._id) WHERE ulog2._id IS NULL);
+  DELETE FROM state_t WHERE _state_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM mac WHERE _mac_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM udp WHERE _udp_id NOT IN (SELECT _id FROM ulog2);
   DELETE FROM icmp WHERE _icmp_id NOT IN (SELECT _id FROM ulog2);

index ff46146..d18ed5d 100644
@@ -38,6 +38,7 @@ plugin="@libdir@/ulogd/ulogd_inpflow_NFCT.so"
 plugin="@libdir@/ulogd/ulogd_filter_IFINDEX.so"
 plugin="@libdir@/ulogd/ulogd_filter_IP2STR.so"
 plugin="@libdir@/ulogd/ulogd_filter_IP2BIN.so"
+plugin="@libdir@/ulogd/ulogd_filter_MAC2STR.so"
 plugin="@libdir@/ulogd/ulogd_filter_PRINTPKT.so"
 plugin="@libdir@/ulogd/ulogd_filter_PRINTFLOW.so"
 plugin="@libdir@/ulogd/ulogd_output_LOGEMU.so"

@@ -70,10 +71,13 @@ plugin="@libdir@/ulogd/ulogd_raw2packet_BASE.so"
 #stack=log1:NFLOG,base1:BASE,pcap1:PCAP
 
 # this is a stack for logging packet to MySQL
-#stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2bin1:IP2BIN,mysql1:MYSQL
+#stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2bin1:IP2BIN,mac2str1:MAC2STR,mysql1:MYSQL
+
+# this is a stack for logging packet to PGsql via ULOG
+#stack=ulog1:ULOG,base1:BASE,ip2str1:IP2STR,mac2str1:MAC2STR,pgsql1:PGSQL
 
 # this is a stack for logging IPv6 packet to PGsql after a collect via NFLOG
-#stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,pgsql1:PGSQL
+#stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:MAC2STR,pgsql1:PGSQL
 
 # this is a stack for logging ebtables packets to syslog after a collect via NFLOG
 #stack=log3:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,sys1:SYSLOG

@@ -92,6 +96,7 @@ group=0
 [log2]
 group=1 # Group has to be different from the one use in log1
 addressfamily=10 # 10 is value of AF_INET6
+state=1 # State can be used to define the decision applied to packet
 
 # ebtables logging through NFLOG
 [log3]

@@ -101,6 +106,7 @@ addressfamily=7 # 7 is value of AF_BRIDGE
 [ulog1]
 # netlink multicast group (the same as the iptables --ulog-nlgroup param)
 nlgroup=1
+#state=0 # optionnal argument
 
 [emu1]
 file="/var/log/ulogd_syslogemu.log"