#####
#
# Copyright (C) 2003 Laurent Oudot <oudot.laurent@wanadoo.fr>
# All Rights Reserved
# This ruleset is currently unmaintained.  Contact the Prelude
# development team if you would like to maintain it.
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

# See this page for references : http://www.zyxel.com/support/supportnote/p650/app/syslog.htm

# ZyXEL router support for Prelude-LML 
# (should work with most ZynOS network devices)

# 1) CDR log : (call messages)

# Feb 14 16:57:17 192.168.1.1 ZyXEL Communications Corp.: board 0 line 0 channel 0, call 18, C01 Incoming Call OK
# Feb 14 17:07:18 192.168.1.1 ZyXEL Communications Corp.: board 0 line 0 channel 0, call 18, C02 Call Terminated

# 2) Packet triggered log : (just for info)

# Jul 19 11:28:39 192.168.102.2 ZyXEL Communications Corp.: Packet Trigger: Protocol=1, Data=4500003c100100001f010004c0a86614ca849a7b08004a5c020001006162636465666768696a6b6c6d6e6f7071727374
# Jul 19 11:28:56 192.168.102.2 ZyXEL Communications Corp.: Packet Trigger: Protocol=1, Data=4500002c1b0140001f06b50ec0a86614ca849a7b0427001700195b3e00000000600220008cd40000020405b4

# 3) Filter log :

# Jul 19 14:44:09 192.168.1.1 ZyXEL Communications Corp.: IP[Src=202.132.154.1 Dst=192.168.1.33 UDP spo=0035  dpo=05d4]}S03>R01mF

regex=ZyXEL Communications Corp.: IP\[Src=([0-9\.]+) Dst=([0-9\.]+) ([A-Z]+) spo=([0-9A-Fa-f]+)  dpo=([0-9A-Fa-f]+).*S(\d{2})>R(\d{2})(.)(.); \
 classification.text=ZyXEL ip access; \
 id=2500; \
 revision=1; \
 assessment.impact.completion = failed; \
 assessment.impact.type = other; \
 assessment.impact.severity = medium; \
 assessment.impact.description= Someone probably tried to bypass filtering : $1 ($3 $4) -> $2 ($3 $5)  ruleset $6 rule $7; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address = $1; \
 source(0).service.port = 0x$4; \
 source(0).service.protocol = $3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address = $2; \
 target(0).service.port = 0x$5; \
 target(0).service.protocol = $3; \
 last

# Jul 19 14:44:13 192.168.1.1 ZyXEL Communications Corp.: IP[Src=192.168.1.33 Dst=202.132.154.1 ICMP]}S03>R01mF

regex=ZyXEL Communications Corp.: IP\[Src=([0-9\.]+) Dst=([0-9\.]+) ([A-Z]+)\].*S(\d{2})>R(\d{2})(.)(.); \
 classification.text=ZyXEL ip access; \
 id=2501; \
 revision=1; \
 assessment.impact.completion = failed; \
 assessment.impact.type = other;\
 assessment.impact.severity = medium; \
 assessment.impact.description= Someone probably tried to bypass filtering : $1 ($3) -> $2 ($3)  ruleset $4 rule $5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address = $1; \
 source(0).service.protocol = $3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address = $2; \
 target(0).service.protocol = $3; \
 last

# 4) PPP Log :

# Jul 19 11:43:25 192.168.1.1 ZyXEL Communications Corp.: ppp:LCP Starting
# Jul 19 11:43:43 192.168.1.1 ZyXEL Communications Corp.: ppp:IPCP Opening
# Jul 19 11:43:51 192.168.1.1 ZyXEL Communications Corp.: ppp:CCP Opening
# Jul 19 11:44:14 192.168.1.1 ZyXEL Communications Corp.: ppp:BACP Closing

regex=ZyXEL Communications Corp.: ppp:(LCP|IPCP|CCP|BACP) (Starting|Opening|Closing); \
 classification.text=ZyXEL PPP $2; \
 id=2502; \
 revision=1; \
 assessment.impact.type = other;\
 assessment.impact.severity = low; \
 assessment.impact.description=$2 $1 connection; \
 last