/*
	This file defines the default set of format-statments for use in defining
	policy-statement behaviour, and policy-statement syntax checking.

	Generaly speaking, only develolpers need concern themselves with writing
	map-statements, however administrators who wish to call policy-statements
	from within policy-statements (sub-policy calls) or implement vendor
	specific MIB items may have need to alter these format-statements or
	create their own.

	Default set of format-statements:

	PREFIX_FILTER_FORMAT:	This format-statement defines a simple interface
									for filtering IPv4 addresses and subnets from being
									used by a module.

	SNMPTRAP_FORMAT:			This format-statement defines the interface for
									evaluating SNMP traps with a policy-statement.

	ICMP_FORMAT:				This format-statement defines the interface for
									evaluating ICMP events such as packet loss,
									latency, and jitter.
*/

policy-options {
	/*
		A format-statement used for filtering IP addresses and networks.
	*/
	format-statement PREFIX_FILTER_FORMAT {
		term PREFIX_FILTER {
			from {
				variable prefix {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	equal-to;	/* The function	used to evaluate if a subnet or IP address is within a prefix defined in the policy is
													equal-to. */
				}
				variable prefix-except {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	not-equal;	/* The function	used to evaluate if a subnet or IP address is NOT within a prefix defined in the policy is not-equal. */
				}
				group TOS_BITS {
					required no;

					type		integer;
					function	equal-to;

					variable tos;
					variable dscp;
					variable precedence;
				}
			}
			then {
				action {
					default	accept;					/* If no action keyword is given in the policy-statement term, accept will be applied. */
					value		[ accept reject ];	/* The only valid actions for a policy-statement term is either accept or reject. */
				}
			}
		}
	}

	/*
		A format-statement used for syslog monitoring policies.
	*/
	format-statement SYSLOG_FORMAT {
		term SYSLOG_MESSAGE {
			from {
				variable protocol {
					required	no;

					type		string;
					function	equal-to;
					value		[ syslog ];
				}
				variable origin {
					required	no;

					type		string;
					function	equal-to;
					value		[ network ];
				}
				variable source {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	equal-to;	/* The function	used to evaluate if a subnet or IP address is within a prefix defined in the policy is equal-to. */
				}
				variable source-except {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	not-equal;	/* The function	used to evaluate if a subnet or IP address is NOT within a prefix defined in the policy is not-equal. */
				}
				variable pid {
					required	no;

					type		integer;
					function	equal-to;
				}
				variable raw {
					required	no;

					type		regex;
					function	equal-to;
				}
				group MESSAGE_PART {
					required	no;

					type		[ string regex ];
					function	equal-to;

					variable	hostname;
					variable	timestamp;
					variable	msg;
					variable tag;
					variable	content;
					variable	priority;
					variable	facility;
					variable	severity;
				}
			}
		}
	}

	/*
		A format-statement used for SNMP trap monitoring policies.
	*/
	format-statement SNMPTRAP_FORMAT {
		/*
			This term defines behavior expected of a policy-statement term dealing
			with authentication failure SNMP traps.
		*/
		term AUTHENTICATION_FAILURE {
			from {
				variable protocol {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		string;			/* This variable is a string. */
					function	equal-to;		/* This variable is compared using a simple equal operator. */
					value		[ snmptrap ];	/* The only acceptable values which can be defined in a policy-statement to match against is 'snmptrap'. */
				}
				variable origin {
					required	no;

					type		string;
					function	equal-to;
					value		[ network ];
				}
				variable trap-type {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		string;			/* This variable is a string. */
					function	equal-to;		/* This variable is compared using a simple equal operator. */
					value		[ authentication-failure ];
				}
				variable source {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	equal-to;	/* The function	used to evaluate if a subnet or IP address is within a prefix defined in the policy is equal-to. */
				}
				variable source-except {
					required no;			/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;		/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	not-equal;	/* The function	used to evaluate if a subnet or IP address is NOT within a prefix defined in the policy is not-equal. */
				}
				variable community {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		string;			/* This variable is a string. */
					function	equal-to;		/* This variable is compared using a simple equal operator. */
				}
				variable state {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		string;			/* This variable is a string. */
					function	equal-to;		/* This variable is compared using a simple equal operator. */
					value		[ normal failure warning recovery ];	/* The only valid values which can be defined in a policy-statement to match against are 'normal', 'failure', 'warning', and 'recovery'. */
				}
				/* A variable group containing MIB values that shares common attributes. */
				group OID_VALUE {
					required		 no;			/* Variables in this group is not required to be present in the 'from' clause of the policy-statement. */

					type			[ string regex ];	/* This variable may be either a string or POSIX extended regular expression. */
					function		equal-to;	/* This variable is compared using a simple equal operator, and if that does not match, it is checked to see if it matches by regular expression. */

					apply-map	SOURCE_TO_ELEMENT_DATA_MAP;

					variable 	snmp:ifName;
					variable 	snmp:ifDescr;
					variable 	snmp:ifAlias;
					variable 	snmp:sysName.0;		/* The variable sysName is a valid to match against; it inherits the group's properties. */
				}
			}
			then {
				set {
					/* The variable 'state' is valid to set in the then clause of this policy. */
					variable state {
						value		[ normal failure warning recovery ];	/* This variable can only be set to 'normal', 'failure', 'warning', or 'recovery'. */
					}
				}
				action {
					default		next-term;	/* If no action keyword is given in the policy-statement term, evaluation will continue to the next term in the policy-statement chain. */
					value			[ next-term next-policy accept reject ];	/* The only valid actions for a policy-statement term are next-term, next-policy, accept, or reject. */
				}
			}
		}

		/*
			This term defines behavior expected of a policy-statement term dealing with SNMP traps about interface state changes.
		*/
		term INTERFACE_STATE {
			from {
				variable protocol {
					required	no;

					type		string;
					function	equal-to;
					value		[ snmptrap ];
				}
				variable event {
					required	no;

					type		string;
					function	equal-to;
					value		[ ifDown ifUp ];
				}
				variable trap-type {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		string;			/* This variable is a string. */
					function	equal-to;		/* This variable is compared using a simple equal operator. */
					value		[ link-up link-down ];
				}
				variable source {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;			/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	equal-to;		/* The function	used to evaluate if a subnet or IP address is within a prefix defined in the policy is
														equal-to. */
				}
				variable source-except {
					required no;				/* This variable is not required to be present in the 'from' clause of the policy-statement. */

					type		prefix;			/* This variable must be a valid IPv4 prefix or address (ie: 10.0.0.0/8 or 10.0.0.1). */
					function	not-equal;		/* The function	used to evaluate if a subnet or IP address is within a prefix defined in the policy is
														equal-to. */
				}
				variable community {
					required	no;

					type		string;
					function	equal-to;
				}
				variable state {
					required	no;

					type		string;
					function	equal-to;
					value		[ normal failure warning recovery ];
				}
				group CONNECTION {
					required		no;

					apply-map	SOURCE_IFNAME_TO_CONNECTED_MAP;

					variable connection-id {
						type		integer;

						function	not-equal;
					}

					variable connected {
						type		string;

						function	equal-to;
						value		[ true false ];
					}
				}
				group OID_VALUE {
					required		no;

					type			[ string regex ];
					function		equal-to;

					apply-map	SOURCE_IFNAME_TO_DATA_MAP;

					variable 	snmp:ifName;
					variable 	snmp:ifDescr;
					variable 	snmp:ifAlias;
					variable 	snmp:sysName.0;
				}
			}
			then {
				set {
					variable state {
						value	[ normal failure warning recovery ];
					}
				}
			}
		}
	}

	/*
		A format-statement used for ICMP monitoring policies.
	*/
	format-statement ICMP_FORMAT {
		term ALL_EVENT {
			from {
				variable protocol {
					required	no;

					type 		string;
					function	equal-to;

					value		[ icmp ];
				}
				variable source {
					required no;

					type		prefix;
					function	equal-to;
				}
				variable source-except {
					required no;

					type		prefix;
					function	not-equal;
				}
				variable ip {
					required no;

					type		prefix;
					function	equal-to;
				}
				variable ip-except {
					required no;

					type		prefix;
					function	not-equal;
				}
				variable interval {
					required	no;

					type		integer;
					function	equal-to;

					suffix-modifier ms {
						function	multiply;
						argument	1;
					}
					suffix-modifier sec {
						function	multiply;
						argument	1000;
					}
					suffix-modifier min {
						function	multiply;
						argument	60000;
					}
				}
				variable state {
					required	no;

					type 		string;
					function	equal-to;

					value		[ normal warning failure recovery ];
				}
				group EVALUATION_FUNCTION {
					required		yes;
					type 			integer;

					variable less-than {
						function	less-than;
					}					
					variable at-least {
						function	at-least;
					}
					variable at-most {
						function	at-most;
					}
					variable more-than {
						function	more-than;
					}
					variable equal-to {
						function	equal-to;
					}
					variable not-equal {
						function	not-equal;
					}
					suffix-modifier pct {
						function	ignore;
					}
					dependency REQUIRE_EVENT {
						variable	event;
					}
				}
				group CONNECTION {
					required		no;

					apply-map	IP_TO_CONNECTED_MAP;

					variable connection-id {
						type		integer;

						function	not-equal;
					}

					variable connected {
						type		string;

						function	equal-to;
						value		[ true false ];
					}
				}
				group TOS_BITS {
					required no;

					type		integer;
					function	equal-to;

					variable tos;
					variable dscp;
					variable precedence;
				}
				group OID_VALUE {
					required		no;

					type			[ string regex ];
					function		equal-to;

					apply-map	IP_TO_DATA_MAP;

					variable		snmp:ifName;
					variable		snmp:ifDescr;
					variable		snmp:ifAlias;
					variable		snmp:sysName.0;
				}
			}
			then {
				set {
					variable state {
						required	no;
						type		string;

						value		[ normal warning failure recovery ];
					}
					variable	statistics {
						required	no;
						type		string;

						value		[ clear-history ];
					}
				}
			}
		}
		term PACKET_LOSS_EVENT {
			from {
				variable	event {
					required	no;

					type 		string;
					function	equal-to;

					value		[ packet-loss ];
				}
				variable	type {
					required	no;

					type 		string;
					function	equal-to;
				}
				variable	code {
					required	no;

					type 		string;
					function	equal-to;
				}
			}
		}
		term LATENCY_EVENT {
			from {
				variable	event {
					required	no;

					type 		string;
					function	equal-to;

					value		[ latency-minimum latency-maximum latency-average ];
				}
			}
		}
		term JITTER_EVENT {
			from {
				variable	event {
					required	no;

					type 		string;
					function	equal-to;

					value		[ jitter-minimum jitter-maximum jitter-average ];
				}
			}
		}
		term NORMALIZED_EVENT {
			from {
				variable	event {
					required	no;

					type 		string;
					function	equal-to;

					value		[ normalized-latency normalized-variation-absolute normalized-variation-increase normalized-variation-decrease normalized-percent-absolute normalized-percent-increase normalized-percent-decrease ];
				}
			}
		}
		term TOS_CHANGE_EVENT {
			from {
				variable	event {
					required	no;

					type 		string;
					function	equal-to;

					value		[ tos-change ];
				}
			}
		}
	}

	/*
		A format-statement used for email output policies.
	*/
	format-statement EMAIL_FORMAT {
		term EMAIL_ARGUMENTS {
			from {
				variable date {
					required	no;

					type		date;
					function	equal-to;
				}
				variable day-of-week {
					required	no;

					type		day;
					function	equal-to;

					value		[ Sunday Monday Tuesday Wednesday Thursday Friday Saturday ];
				}
				variable begin-time {
					required	no;

					type		time;
					function	at-least;
				}	
				variable	end-time {
					required	no;

					type		time;
					function	at-most;
				}
			}
			then {
				set {
					variable	alias {
						required	no;
						type		string;
					}
					variable	from {
						required	no;
						type		string;
					}
					variable to {
						required	no;
						type		string;
					}
					variable cc {
						required	no;
						type		string;
					}
					variable bcc {
						required	no;
						type		string;
					}
					variable	subject {
						required	no;
						type		string;
					}
					variable	body {
						required	no;
						type		string;
					}
				}
			}
		}
	}

	/*
		A format-statement used for gui output policies.
	*/
	format-statement GUI_FORMAT {
		term EVENT {
			from {
				variable	element-id {
					required	no;

					type		integer;	
					function	equal-to;
				}
				variable	interface-id {
					required	no;

					type		integer;	
					function	equal-to;
				}
				variable	address-id {
					required	no;

					type		integer;	
					function	equal-to;
				}
				variable protocol {
					required	no;
					type		string;
					function	equal-to;
					value		[ icmp snmp syslog snmptrap ];
				}
				variable state {
					required	no;
					type		string;
					function	equal-to;
					value		[ normal warning failure recovery ];
				}
				variable origin {
					required	no;
					type		string;
					function	equal-to;
					value		[ gui_event output ];
				}
				variable	channel {
					required	no;
					type		string;
					function	equal-to;
				}
				variable	age {
					required	no;

					type		integer;	
					function	at-least;

					suffix-modifier sec {
						function	ignore;
					}
					suffix-modifier min {
						function	multiply;
						argument	60;
					}
					suffix-modifier hour {
						function	multiply;
						argument	3600;
					}
					suffix-modifier day {
						function	multiply;
						argument	86400;
					}
				}
			}
		}
	}

	/*
		A format-statement used for state monitor policies.
	*/
	format-statement STATE_FORMAT {
		term MODULE_STATE {
			from {
				variable icmp-state {
					required no;
					type		string;
					function	equal-to;
				}
				variable syslog-state {
					required no;
					type		string;
					function	equal-to;
				}
				variable snmptrap-state {
					required no;
					type		string;
					function	equal-to;
				}
				variable snmp-state {
					required no;
					type		string;
					function	equal-to;
				}
			}
		}
		term EXPIRED_STATE {
			from {
				variable protocol {
					required	no;
					type		string;
					function	equal-to;
					value		[ icmp snmp syslog snmptrap ];
				}
				variable state {
					required	no;
					type		string;
					function	equal-to;
					value		[ state ];
				}
				variable origin {
					required	no;
					type		string;
					function	equal-to;
					value		[ state ];
				}
				variable	channel {
					required	no;
					type		string;
					function	equal-to;
				}
				variable	age {
					required	no;

					type		integer;	
					function	at-least;

					suffix-modifier sec {
						function	ignore;
					}
					suffix-modifier min {
						function	multiply;
						argument	60;
					}
					suffix-modifier hour {
						function	multiply;
						argument	3600;
					}
					suffix-modifier day {
						function	multiply;
						argument	86400;
					}
				}
			}
			then {
				set {
					variable state {
						value	[ clear ];
					}
				}
				action {
					default	accept;
					value		[ accept reject ];
				}
			}
		}
	}
}

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim600: fdm=marker
** vim: noet ts=3 sw=3
** vim: syntax=sella_nms
*/
