From 9dcad9b32272105bd249ded2fd6c78166bb72cdb Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 21:57:31 -0700
Subject: [PATCH 1/3] conf: parser: expand kmsg-netfilter-log to an
 extended-regex

No change in behavior, confirmed w/test harness.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 6a4a14a8e0d..6953a65d306 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -117,6 +117,34 @@ parsers:
   - name: kmsg-netfilter-log
     # Examples: TCP: https://rubular.com/r/Q8YY6fHqlqwGI0  UDP: https://rubular.com/r/B0ID69H9FvN0tp
     format: regex
-    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) kernel - - - \[[0-9\.]*\] (?<logprefix>[^ ]*)\s?IN=(?<in>[^ ]*) OUT=(?<out>[^ ]*) MAC=(?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<ethtype>[0-9a-f]{2}:[0-9a-f]{2}) SRC=(?<saddr>[^ ]*) DST=(?<daddr>[^ ]*) LEN=(?<len>[^ ]*) TOS=(?<tos>[^ ]*) PREC=(?<prec>[^ ]*) TTL=(?<ttl>[^ ]*) ID=(?<id>[^ ]*) (D*F*)\s*PROTO=(?<proto>[^ ]*)\s?((SPT=)?(?<sport>[0-9]*))\s?((DPT=)?(?<dport>[0-9]*))\s?((LEN=)?(?<protolen>[0-9]*))\s?((WINDOW=)?(?<window>[0-9]*))\s?((RES=)?(?<res>0?x?[0-9]*))\s?(?<flag>[^ ]*)\s?((URGP=)?(?<urgp>[0-9]*))'
+    regex: |
+      (?x)
+      ^
+        \<(?<pri>[0-9]{1,5})\>1\s
+        (?<time>[^\s]+)\s
+        (?<host>[^\s]+)\s
+        kernel\s -\s -\s -\s \[[0-9\.]*\]\s
+        (?<logprefix>[^\s]*)\s?
+        IN=(?<in>[^\s]*)\s
+        OUT=(?<out>[^\s]*)\s
+        MAC= (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<ethtype>[0-9a-f]{2}:[0-9a-f]{2})\s
+        SRC=(?<saddr>[^\s]*)\s
+        DST=(?<daddr>[^\s]*)\s
+        LEN=(?<len>[^\s]*)\s
+        TOS=(?<tos>[^\s]*)\s
+        PREC=(?<prec>[^\s]*)\s
+        TTL=(?<ttl>[^\s]*)\s
+        ID=(?<id>[^\s]*)\s
+        (D*F*)\s*
+        PROTO=(?<proto>[^\s]*)\s?
+        ( (SPT=)? (?<sport>[0-9]*) )\s?
+        ( (DPT=)? (?<dport>[0-9]*) )\s?
+        ( (LEN=)? (?<protolen>[0-9]*) )\s?
+        ( (WINDOW=)? (?<window>[0-9]*) )\s?
+        ( (RES=)? (?<res>0?x?[0-9]*) )\s?
+        (?<flag>[^\s]*)\s?
+        ( (URGP=)? (?<urgp>[0-9]*) )
     time_key: time
     time_format: '%Y-%m-%dT%H:%M:%S.%L%z'

From d51e60334182976d54227f9fc3961634d14497c1 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 21:58:33 -0700
Subject: [PATCH 2/3] conf: parser: kmsg-netfilter-log: fix kernel uptime
 matching

Linux kernel uptime timestamps use "[%5lu.%06lu]", meaning there
are leading spaces inside the [ ] until uptime reaches 10,000 secs.
The existing test-cases both have 6-digit seconds, so this wasn't
noticed.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index 6953a65d306..e52fe2421fa 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -123,7 +123,7 @@ parsers:
         \<(?<pri>[0-9]{1,5})\>1\s
         (?<time>[^\s]+)\s
         (?<host>[^\s]+)\s
-        kernel\s -\s -\s -\s \[[0-9\.]*\]\s
+        kernel\s -\s -\s -\s \[\s*[0-9\.]*\]\s
         (?<logprefix>[^\s]*)\s?
         IN=(?<in>[^\s]*)\s
         OUT=(?<out>[^\s]*)\s

From 6698fcb09000478956a08bcd8fbaefb010a18d92 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 22:05:36 -0700
Subject: [PATCH 3/3] conf: parser: kmsg-netfilter-log: fix MAC= parsing

Linux firewall logs' MAC= field is in wire order - dst MAC, then
src MAC, then ethertype.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/parsers.yaml b/conf/parsers.yaml
index e52fe2421fa..091c184c215 100644
--- a/conf/parsers.yaml
+++ b/conf/parsers.yaml
@@ -127,8 +127,8 @@ parsers:
         (?<logprefix>[^\s]*)\s?
         IN=(?<in>[^\s]*)\s
         OUT=(?<out>[^\s]*)\s
-        MAC= (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
-        :    (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        MAC= (?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
+        :    (?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2})
         :    (?<ethtype>[0-9a-f]{2}:[0-9a-f]{2})\s
         SRC=(?<saddr>[^\s]*)\s
         DST=(?<daddr>[^\s]*)\s