2 " Language: Snort Configuration File (see: http://www.snort.org)
3 " Maintainer: Phil Wood, cornett@arpa.net
4 " Last Change: $Date: 2001/06/07 21:35:11 $
5 " Filenames: *.hog *.rules snort.conf vision.conf
6 " URL: http://home.lanl.gov/cpw/vim/syntax/hog.vim
7 " Snort Version: 1.8 By Martin Roesch (roesch@clark.net, www.snort.org)
8 " TODO include all 1.8 syntax
10 " For version 5.x: Clear all syntax items
13 elseif exists("b:current_syntax")
14 " For version 6.x: Quit when a syntax file was already loaded
18 syn match hogComment +\s\#[^\-:.%#=*].*$+lc=1 contains=hogTodo,hogCommentString
19 syn region hogCommentString contained oneline start='\S\s\+\#+'ms=s+1 end='\#'
21 syn match hogJunk "\<\a\+|\s\+$"
22 syn match hogNumber contained "\<\d\+\>"
23 syn region hogText contained oneline start='\S' end=',' skipwhite
24 syn region hogTexts contained oneline start='\S' end=';' skipwhite
26 " Environment Variables
27 " =====================
28 "syn match hogEnvvar contained "[\!]\=\$\I\i*"
29 "syn match hogEnvvar contained "[\!]\=\${\I\i*}"
30 syn match hogEnvvar contained "\$\I\i*"
31 syn match hogEnvvar contained "[\!]\=\${\I\i*}"
34 " String handling lifted from vim.vim written by Dr. Charles E. Campbell, Jr.
35 " <Charles.E.Campbell.1@gsfc.nasa.gov>
36 " Try to catch strings, if nothing else matches (therefore it must precede the others!)
37 " vmEscapeBrace handles ["] []"] (ie. stays as string)
38 syn region hogEscapeBrace oneline contained transparent start="[^\\]\(\\\\\)*\[\^\=\]\=" skip="\\\\\|\\\]" end="\]"me=e-1
39 syn match hogPatSep contained "\\[|()]"
40 syn match hogNotPatSep contained "\\\\"
41 syn region hogString oneline start=+[^:a-zA-Z\->!\\]"+hs=e+1 skip=+\\\\\|\\"+ end=+"\s*;+he=s-1 contains=hogEscapeBrace,hogPatSep,hogNotPatSep oneline
42 ""syn region hogString oneline start=+[^:a-zA-Z>!\\]'+lc=1 skip=+\\\\\|\\'+ end=+'+ contains=hogEscapeBrace,vimPatSep,hogNotPatSep
43 "syn region hogString oneline start=+=!+lc=1 skip=+\\\\\|\\!+ end=+!+ contains=hogEscapeBrace,hogPatSep,hogNotPatSep
44 "syn region hogString oneline start="=+"lc=1 skip="\\\\\|\\+" end="+" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
45 "syn region hogString oneline start="[^\\]+\s*[^a-zA-Z0-9.]"lc=1 skip="\\\\\|\\+" end="+" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
46 "syn region hogString oneline start="\s/\s*\A"lc=1 skip="\\\\\|\\+" end="/" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
47 "syn match hogString contained +"[^"]*\\$+ skipnl nextgroup=hogStringCont
48 "syn match hogStringCont contained +\(\\\\\|.\)\{-}[^\\]"+
51 " Beginners - Patterns that involve ^
53 syn match hogLineComment +^[ \t]*#.*$+ contains=hogTodo,hogCommentString,hogCommentTitle
54 syn match hogCommentTitle '#\s*\u\a*\(\s\+\u\a*\)*:'ms=s+1 contained
55 syn keyword hogTodo contained TODO
58 syn match hogARPCOpt contained "\d\+,\*,\*"
59 syn match hogARPCOpt contained "\d\+,\d\+,\*"
60 syn match hogARPCOpt contained "\d\+,\*,\d\+"
61 syn match hogARPCOpt contained "\d\+,\d\+,\d"
62 syn match hogATAGOpt contained "session"
63 syn match hogATAGOpt contained "host"
64 syn match hogATAGOpt contained "dst"
65 syn match hogATAGOpt contained "src"
66 syn match hogATAGOpt contained "seconds"
67 syn match hogATAGOpt contained "packets"
68 syn match hogATAGOpt contained "bytes"
69 syn keyword hogARespOpt contained rst_snd rst_rcv rst_all skipwhite
70 syn keyword hogARespOpt contained icmp_net icmp_host icmp_port icmp_all skipwhite
71 syn keyword hogAReactOpt contained block warn msg skipwhite
72 syn match hogAReactOpt contained "proxy\d\+" skipwhite
73 syn keyword hogAFOpt contained logto content_list skipwhite
74 syn keyword hogAIPOptVal contained eol nop ts sec lsrr lsrre satid ssrr rr skipwhite
75 syn keyword hogARefGrps contained arachnids skipwhite
76 syn keyword hogARefGrps contained bugtraq skipwhite
77 syn keyword hogARefGrps contained cve skipwhite
78 syn keyword hogSessionVal contained printable all skipwhite
79 syn match hogAFlagOpt contained "[0FSRPAUfsrpau21]\+" skipwhite
80 syn match hogAFragOpt contained "[DRMdrm]\+" skipwhite
82 " Output syslog options
84 syn keyword hogSysFac contained LOG_AUTH LOG_AUTHPRIV LOG_DAEMON LOG_LOCAL0
85 syn keyword hogSysFac contained LOG_LOCAL1 LOG_LOCAL2 LOG_LOCAL3 LOG_LOCAL4
86 syn keyword hogSysFac contained LOG_LOCAL5 LOG_LOCAL6 LOG_LOCAL7 LOG_USER
88 syn keyword hogSysPri contained LOG_EMERG ALERT LOG_CRIT LOG_ERR
89 syn keyword hogSysPri contained LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBUG
91 syn keyword hogSysOpt contained LOG_CONS LOG_NDELAY LOG_PERROR
92 syn keyword hogSysOpt contained LOG_PID
94 syn keyword hogRuleType contained log pass alert activate dynamic
96 " Output log_database arguments and parameters
97 " Type of database followed by ,
98 " syn keyword hogDBSQL contained mysql postgresql unixodbc
99 " Parameters param=constant
100 " are just various constants assigned to parameter names
102 " Output log_database arguments and parameters
103 " Type of database followed by ,
104 syn keyword hogDBType contained alert log
105 syn keyword hogDBSRV contained mysql postgresql unixodbc
106 " Parameters param=constant
107 " are just various constants assigned to parameter names
108 syn keyword hogDBParam contained dbname host port user password sensor_name
110 " Output xml arguments and parameters
112 syn keyword hogXMLArg contained log alert
113 syn keyword hogXMLParam contained file protocol host port cert key ca server sanitize encoding detail
115 " hog rule handler '(.*)'
116 syn region hogAOpt contained oneline start="rpc" end=":"me=e-1 nextgroup=hogARPCOptGrp skipwhite
117 syn region hogARPCOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogARPCOpt skipwhite
119 syn region hogAOpt contained oneline start="tag" end=":"me=e-1 nextgroup=hogATAGOptGrp skipwhite
120 syn region hogATAGOptGrp contained oneline start="."hs=s+1 skip="," end=";"me=e-1 contains=hogATAGOpt,hogNumber skipwhite
122 syn region hogAOpt contained oneline start="nocase\|sameip" end=";"me=e-1 skipwhite oneline keepend
124 syn region hogAOpt contained start="resp" end=":"me=e-1 nextgroup=hogARespOpts skipwhite
125 syn region hogARespOpts contained oneline start="." end="[,;]" contains=hogARespOpt skipwhite nextgroup=hogARespOpts
127 syn region hogAOpt contained start="react" end=":"me=e-1 nextgroup=hogAReactOpts skipwhite
128 syn region hogAReactOpts contained oneline start="." end="[,;]" contains=hogAReactOpt skipwhite nextgroup=hogAReactOpts
130 syn region hogAOpt contained oneline start="depth\|seq\|ttl\|ack\|icmp_seq\|activates\|activated_by\|dsize\|icode\|icmp_id\|count\|itype\|tos\|id\|offset" end=":"me=e-1 nextgroup=hogANOptGrp skipwhite
131 syn region hogANOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogNumber skipwhite oneline keepend
133 syn region hogAOpt contained oneline start="classtype" end=":"me=e-1 nextgroup=hogAFileGrp skipwhite
135 syn region hogAOpt contained oneline start="regex\|msg\|content" end=":"me=e-1 nextgroup=hogAStrGrp skipwhite
136 "syn region hogAStrGrp contained oneline start=+:\s*"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keepend
137 syn region hogAStrGrp contained oneline start=+:\s*"\|:"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keepend
139 syn region hogAOpt contained oneline start="logto\|content-list" end=":"me=e-1 nextgroup=hogAFileGrp skipwhite
140 syn region hogAFileGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogFileName skipwhite
142 syn region hogAOpt contained oneline start="reference" end=":"me=e-1 nextgroup=hogARefGrp skipwhite
143 syn region hogARefGrp contained oneline start="."hs=s+1 end=","me=e-1 contains=hogARefGrps nextgroup=hogARefName skipwhite
144 syn region hogARefName contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogString,hogFileName,hogNumber skipwhite
146 syn region hogAOpt contained oneline start="flags" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keepend
148 syn region hogAOpt contained oneline start="fragbits" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keepend
150 syn region hogAOpt contained oneline start="ipopts" end=":"he=s-1 nextgroup=hogAIPOptVal skipwhite oneline keepend
152 "syn region hogAOpt contained oneline start="." end=":"he=s-1 contains=hogAFOpt nextgroup=hogFileName skipwhite
154 syn region hogAOpt contained oneline start="session" end=":"he=s-1 nextgroup=hogSessionVal skipwhite
156 syn match nothing "$"
157 syn region hogRules oneline contains=nothing start='$' end="$"
158 syn region hogRules oneline contains=hogRule start='('ms=s+1 end=")\s*$" skipwhite
159 syn region hogRule contained oneline start="." skip="\\;" end=";"he=s-1 contains=hogAOpts, skipwhite keepend
160 "syn region hogAOpts contained oneline start="." end="[;]"he=s-1 contains=hogAOpt skipwhite
161 syn region hogAOpts contained oneline start="." end="[;]"me=e-1 contains=hogAOpt skipwhite
165 syn keyword hogRTypeStart skipwhite ruletype nextgroup=hogRuleName skipwhite
166 syn region hogRuleName contained start="." end="\s" contains=hogFileName nextgroup=hogRTypeRegion
167 " type ruletype sub type
168 syn region hogRtypeRegion contained start="{" end="}" nextgroup=hogRTypeStart
169 syn keyword hogRTypeStart skipwhite type nextgroup=hogRuleTypes skipwhite
170 syn region hogRuleTypes contained start="." end="\s" contains=hogRuleType nextgroup=hogOutStart
174 syn keyword hogVarStart skipwhite var nextgroup=hogVarIdent skipwhite
175 syn region hogVarIdent contained start="."hs=e+1 end="\s\+"he=s-1 contains=hogEnvvar nextgroup=hogVarRegion skipwhite
176 syn region hogVarRegion contained oneline start="." contains=hogIPaddr,hogEnvvar,hogNumber,hogString,hogFileName end="$"he=s-1 keepend skipwhite
179 syn keyword hogConfigStart config skipwhite nextgroup=hogConfigType
180 syn match hogConfigType contained "\<classification\>" nextgroup=hogConfigTypeRegion skipwhite
181 syn region hogConfigTypeRegion contained oneline start=":"ms=s+1 end="$" contains=hogNumber,hogText keepend skipwhite
185 syn keyword hogIncStart include skipwhite nextgroup=hogIncRegion
186 syn region hogIncRegion contained oneline start="\>" contains=hogFileName,hogEnvvar end="$" keepend
188 " preprocessor command
189 " http_decode, minfrag, portscan[-ignorehosts]
190 syn keyword hogPPrStart preprocessor skipwhite nextgroup=hogPPr
191 syn match hogPPr contained "\<spade\>" nextgroup=hogPPrRegion skipwhite
192 syn match hogPPr contained "\<spade-homenet\>" nextgroup=hogPPrRegion skipwhite
193 syn match hogPPr contained "\<spade-threshlearn\>" nextgroup=hogPPrRegion skipwhite
194 syn match hogPPr contained "\<spade-adapt\>" nextgroup=hogPPrRegion skipwhite
195 syn match hogPPr contained "\<spade-adapt2\>" nextgroup=hogPPrRegion skipwhite
196 syn match hogPPr contained "\<spade-adapt3\>" nextgroup=hogPPrRegion skipwhite
197 syn match hogPPr contained "\<spade-survey\>" nextgroup=hogPPrRegion skipwhite
198 syn match hogPPr contained "\<defrag\>" nextgroup=hogPPrRegion skipwhite
199 syn match hogPPr contained "\<telnet_decode\>" nextgroup=hogPPrRegion skipwhite
200 syn match hogPPr contained "\<rpc_decode\>" nextgroup=hogPPrRegion skipwhite
201 syn match hogPPr contained "\<bo\>" nextgroup=hogPPrRegion skipwhite
202 syn match hogPPr contained "\<stream\>" nextgroup=hogStreamRegion skipwhite
203 syn match hogPPr contained "\<stream2\>" nextgroup=hogStreamRegion skipwhite
204 syn match hogPPr contained "\<stream3\>" nextgroup=hogStreamRegion skipwhite
205 syn match hogPPr contained "\<http_decode\>" nextgroup=hogPPrRegion skipwhite
206 syn match hogPPr contained "\<minfrag\>" nextgroup=hogPPrRegion skipwhite
207 syn match hogPPr contained "\<portscan[-ignorehosts]*\>" nextgroup=hogPPrRegion skipwhite
208 syn region hogPPrRegion contained oneline start="$" end="$" keepend
209 syn region hogPPrRegion contained oneline start=":" end="$" contains=hogNumber,hogIPaddr,hogEnvvar,hogFileName keepend
210 syn keyword hogStreamArgs contained timeout ports maxbytes
211 syn region hogStreamRegion contained oneline start=":" end="$" contains=hogStreamArgs,hogNumber
214 syn keyword hogOutStart output nextgroup=hogOut skipwhite
217 syn match hogOut contained "\<alert_syslog\>" nextgroup=hogSyslogRegion skipwhite
218 syn region hogSyslogRegion contained start=":" end="$" contains=hogSysFac,hogSysPri,hogSysOpt,hogEnvvar oneline skipwhite keepend
220 " alert_fast (full,smb,unixsock, and tcpdump)
221 syn match hogOut contained "\<alert_fast\|alert_full\|alert_smb\|alert_unixsock\|log_tcpdump\>" nextgroup=hogLogFileRegion skipwhite
222 syn region hogLogFileRegion contained start=":" end="$" contains=hogFileName,hogEnvvar oneline skipwhite keepend
225 syn match hogOut contained "\<database\>" nextgroup=hogDBTypes skipwhite
226 syn region hogDBTypes contained start=":" end="," contains=hogDBType,hogEnvvar nextgroup=hogDBSRVs skipwhite
227 syn region hogDBSRVs contained start="\s\+" end="," contains=hogDBSRV nextgroup=hogDBParams skipwhite
228 syn region hogDBParams contained start="." end="="me=e-1 contains=hogDBParam nextgroup=hogDBValues
229 syn region hogDBValues contained start="." end="\>" contains=hogNumber,hogEnvvar,hogAscii nextgroup=hogDBParams oneline skipwhite
230 syn match hogAscii contained "\<\a\+"
233 syn match hogOut contained "\<log_tcpdump\>" nextgroup=hogLogRegion skipwhite
234 syn region hogLogRegion oneline start=":" skipwhite end="$" contains=hogEnvvar,hogFileName keepend
237 syn keyword hogXMLTrans contained http https tcp iap
238 syn match hogOut contained "\<xml\>" nextgroup=hogXMLRegion skipwhite
239 syn region hogXMLRegion contained start=":" end="," contains=hogXMLArg,hogEnvvar nextgroup=hogXMLParams skipwhite
240 "syn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLProto nextgroup=hogXMLProtos
241 "syn region hogXMLProtos contained start="." end="\>" contains=hogXMLTrans nextgroup=hogXMLParams
242 syn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLParam nextgroup=hogXMLValue
243 syn region hogXMLValue contained start="." end="\>" contains=hogNumber,hogIPaddr,hogEnvvar,hogAscii,hogFileName nextgroup=hogXMLParams oneline skipwhite keepend
246 syn match hogFileName contained "[-./[:alnum:]_~]\+"
247 syn match hogFileName contained "[-./[:alnum:]_~]\+"
249 syn match hogIPaddr "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>"
250 syn match hogIPaddr "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>"
252 syn keyword hogProto tcp TCP ICMP icmp udp UDP
254 " hog alert address port pairs
256 syn match hogIPaddrAndPort contained "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>" skipwhite nextgroup=hogPort
257 syn match hogIPaddrAndPort contained "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>" skipwhite nextgroup=hogPort
258 syn match hogIPaddrAndPort contained "\<any\>" skipwhite nextgroup=hogPort
259 syn match hogIPaddrAndPort contained "\$\I\i*" nextgroup=hogPort skipwhite
260 syn match hogIPaddrAndPort contained "\${\I\i*}" nextgroup=hogPort skipwhite
261 "syn match hogPort contained "[\!]\=[\:]\=\d\+L\=\>" skipwhite
262 syn match hogPort contained "[\:]\=\d\+\>"
263 syn match hogPort contained "[\!]\=\<any\>" skipwhite
264 syn match hogPort contained "[\!]\=\d\+L\=:\d\+L\=\>" skipwhite
267 syn keyword hog7Functions activate skipwhite nextgroup=hogActRegion
268 syn keyword hog7Functions dynamic skipwhite nextgroup=hogActRegion
269 syn keyword hogActStart alert skipwhite nextgroup=hogActRegion
270 syn keyword hogActStart log skipwhite nextgroup=hogActRegion
271 syn keyword hogActStart pass skipwhite nextgroup=hogActRegion
273 syn region hogActRegion contained oneline start="tcp\|TCP\|udp\|UDP\|icmp\|ICMP" end="\s\+"me=s-1 nextgroup=hogActSource oneline keepend skipwhite
274 syn region hogActSource contained oneline contains=hogIPaddrAndPort start="\s\+"ms=e+1 end="->\|<>"me=e-2 oneline keepend skipwhite nextgroup=hogActDest
275 syn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="$" oneline keepend
276 syn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="("me=e-1 oneline keepend skipwhite nextgroup=hogRules
279 " ====================
280 if version >= 508 || !exists("did_hog_syn_inits")
282 let did_hog_syn_inits = 1
283 command -nargs=+ HiLink hi link <args>
285 command -nargs=+ HiLink hi def link <args>
287 " The default methods for highlighting. Can be overridden later
288 HiLink hogComment Comment
289 HiLink hogLineComment Comment
290 HiLink hogAscii Constant
291 HiLink hogCommentString Constant
292 HiLink hogFileName Constant
293 HiLink hogIPaddr Constant
294 HiLink hogNotPatSep Constant
295 HiLink hogNumber Constant
296 HiLink hogText Constant
297 HiLink hogString Constant
298 HiLink hogSysFac Constant
299 HiLink hogSysOpt Constant
300 HiLink hogSysPri Constant
301 " HiLink hogAStrGrp Error
303 HiLink hogEnvvar Identifier
304 HiLink hogIPaddrAndPort Identifier
305 HiLink hogVarIdent Identifier
306 HiLink hogATAGOpt PreProc
307 HiLink hogAIPOptVal PreProc
308 HiLink hogARespOpt PreProc
309 HiLink hogAReactOpt PreProc
310 HiLink hogAFlagOpt PreProc
311 HiLink hogAFragOpt PreProc
312 HiLink hogCommentTitle PreProc
313 HiLink hogDBType PreProc
314 HiLink hogDBSRV PreProc
315 HiLink hogPort PreProc
316 HiLink hogARefGrps PreProc
317 HiLink hogSessionVal PreProc
318 HiLink hogXMLArg PreProc
319 HiLink hogARPCOpt PreProc
320 HiLink hogPatSep Special
321 HiLink hog7Functions Statement
322 HiLink hogActStart Statement
323 HiLink hogIncStart Statement
324 HiLink hogConfigStart Statement
325 HiLink hogOutStart Statement
326 HiLink hogPPrStart Statement
327 HiLink hogVarStart Statement
328 HiLink hogRTypeStart Statement
330 HiLink hogRuleType Type
332 HiLink hogANoVal Type
333 HiLink hogAStrOpt Type
336 HiLink hogDBParam Type
337 HiLink hogStreamArgs Type
340 HiLink hogConfigType Type
341 HiLink hogActRegion Type
343 HiLink hogXMLParam Type
349 let b:current_syntax = "hog"