# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
kingdon_firewall = {

  plugin_version = "1.0.2"

  # 2009-07-06 - 1.0 - GMF - Initial implementation
  # 2009-07-08 - 1.0.1 - GMF - Added support for "drop incoming packet.*udp" lines
  # 2011-03-30 - 1.0.1 - MSG - Edited info lines.

  info.1.manfacturer = "ZhongXin"
  info.1.device = "Kindon Firewall"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "Kingdon Firewall"
  log.miscellaneous.log_data_type = "firewall"
  log.miscellaneous.log_format_type = "firewall"

  info.1.manfacturer = "Kingdon, Inc."
  info.1.device = "Kingdon Firewall"
  info.1.version.1 = ""

  # The log is in this format if any of the first ten lines match this regular expression
  # Jun 17 15:20:21 rules : drop incoming packet, 12.34.56.78 : 445 - 98.76.54.32 : 2433, tcp flags -S----
  log.format.autodetect_regular_expression = "^[A-Z][a-z][a-z] [0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9] (fwctrl|rules|report) : "

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  log.format.date_format = "mmm dd"

  # Log fields
  log.fields = {

    date = ""
    time = ""
    type = ""
    action = ""
    source_ip.type = "host" 
    source_port = ""
    destination_ip = ""
    destination_port = ""
    tcp_flags = ""

    accesses = ""

  } # log.fields


  # Log Parsing Filters
  log.parsing_filters.parse = `
if (matches_regular_expression(current_log_line(), "^([A-Z][a-z][a-z] [0-9][0-9]) ([0-9][0-9]:[0-9][0-9]:[0-9][0-9]) ([^ ]+) : (.*)$")) then (

  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  set_collected_field('', 'type', $3);

  v.remainder = $4;

  # Handle drop incoming packet lines
  if (matches_regular_expression(v.remainder, "^(drop incoming packet), ([0-9.]+) : ([0-9]+) - ([0-9.]+) : ([0-9]+), (.*)$")) then (

    set_collected_field('', 'action', $1);
    set_collected_field('', 'source_ip', $2);
    set_collected_field('', 'source_port', $3);
    set_collected_field('', 'destination_ip', $4);
    set_collected_field('', 'destination_port', $5);

    v.remainder = $6;
    if (matches_regular_expression(v.remainder, "tcp flags (.*)$")) then (
      set_collected_field('', 'tcp_flags', $1);
    );

  ); # if drop incoming packet

  set_collected_field('', 'accesses', 1);
  accept_collected_entry('', false);
);
`


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    type = ""
    action = ""
    source_ip = "" 
    source_port = ""
    location = ""
    destination_ip = ""
    destination_port = ""
    tcp_flags = ""

  } # database.fields


  database.numerical_fields = {

    accesses = {
      requires_log_field = false
      default = true
      entries_field = true
    } # accesses

    unique_source_ips = {
      log_field = "source_ip"
      type = "unique"
    } # unique_source_ips

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # kingdon_firewall