2 " Language: Snort Configuration File (see: http://www.snort.org)
3 " Maintainer: Phil Wood, cornett@arpa.net
4 " Last Change: $Date: 2004/06/13 17:41:17 $
5 " Filenames: *.hog *.rules snort.conf vision.conf
6 " URL: http://home.lanl.gov/cpw/vim/syntax/hog.vim
7 " Snort Version: 1.8 By Martin Roesch (roesch@clark.net, www.snort.org)
8 " TODO include all 1.8 syntax
10 " For version 5.x: Clear all syntax items
13 elseif exists("b:current_syntax")
14 " For version 6.x: Quit when a syntax file was already loaded
18 syn match hogComment +\s\#[^\-:.%#=*].*$+lc=1 contains=hogTodo,hogCommentString
19 syn region hogCommentString contained oneline start='\S\s\+\#+'ms=s+1 end='\#'
21 syn match hogJunk "\<\a\+|\s\+$"
22 syn match hogNumber contained "\<\d\+\>"
23 syn region hogText contained oneline start='\S' end=',' skipwhite
24 syn region hogTexts contained oneline start='\S' end=';' skipwhite
26 " Environment Variables
27 " =====================
28 "syn match hogEnvvar contained "[\!]\=\$\I\i*"
29 "syn match hogEnvvar contained "[\!]\=\${\I\i*}"
30 syn match hogEnvvar contained "\$\I\i*"
31 syn match hogEnvvar contained "[\!]\=\${\I\i*}"
34 " String handling lifted from vim.vim written by Dr. Charles E. Campbell, Jr.
35 " Try to catch strings, if nothing else matches (therefore it must precede the others!)
36 " vmEscapeBrace handles ["] []"] (ie. stays as string)
37 syn region hogEscapeBrace oneline contained transparent start="[^\\]\(\\\\\)*\[\^\=\]\=" skip="\\\\\|\\\]" end="\]"me=e-1
38 syn match hogPatSep contained "\\[|()]"
39 syn match hogNotPatSep contained "\\\\"
40 syn region hogString oneline start=+[^:a-zA-Z\->!\\]"+hs=e+1 skip=+\\\\\|\\"+ end=+"\s*;+he=s-1 contains=hogEscapeBrace,hogPatSep,hogNotPatSep oneline
41 ""syn region hogString oneline start=+[^:a-zA-Z>!\\]'+lc=1 skip=+\\\\\|\\'+ end=+'+ contains=hogEscapeBrace,vimPatSep,hogNotPatSep
42 "syn region hogString oneline start=+=!+lc=1 skip=+\\\\\|\\!+ end=+!+ contains=hogEscapeBrace,hogPatSep,hogNotPatSep
43 "syn region hogString oneline start="=+"lc=1 skip="\\\\\|\\+" end="+" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
44 "syn region hogString oneline start="[^\\]+\s*[^a-zA-Z0-9.]"lc=1 skip="\\\\\|\\+" end="+" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
45 "syn region hogString oneline start="\s/\s*\A"lc=1 skip="\\\\\|\\+" end="/" contains=hogEscapeBrace,hogPatSep,hogNotPatSep
46 "syn match hogString contained +"[^"]*\\$+ skipnl nextgroup=hogStringCont
47 "syn match hogStringCont contained +\(\\\\\|.\)\{-}[^\\]"+
50 " Beginners - Patterns that involve ^
52 syn match hogLineComment +^[ \t]*#.*$+ contains=hogTodo,hogCommentString,hogCommentTitle
53 syn match hogCommentTitle '#\s*\u\a*\(\s\+\u\a*\)*:'ms=s+1 contained
54 syn keyword hogTodo contained TODO
57 syn match hogARPCOpt contained "\d\+,\*,\*"
58 syn match hogARPCOpt contained "\d\+,\d\+,\*"
59 syn match hogARPCOpt contained "\d\+,\*,\d\+"
60 syn match hogARPCOpt contained "\d\+,\d\+,\d"
61 syn match hogATAGOpt contained "session"
62 syn match hogATAGOpt contained "host"
63 syn match hogATAGOpt contained "dst"
64 syn match hogATAGOpt contained "src"
65 syn match hogATAGOpt contained "seconds"
66 syn match hogATAGOpt contained "packets"
67 syn match hogATAGOpt contained "bytes"
68 syn keyword hogARespOpt contained rst_snd rst_rcv rst_all skipwhite
69 syn keyword hogARespOpt contained icmp_net icmp_host icmp_port icmp_all skipwhite
70 syn keyword hogAReactOpt contained block warn msg skipwhite
71 syn match hogAReactOpt contained "proxy\d\+" skipwhite
72 syn keyword hogAFOpt contained logto content_list skipwhite
73 syn keyword hogAIPOptVal contained eol nop ts sec lsrr lsrre satid ssrr rr skipwhite
74 syn keyword hogARefGrps contained arachnids skipwhite
75 syn keyword hogARefGrps contained bugtraq skipwhite
76 syn keyword hogARefGrps contained cve skipwhite
77 syn keyword hogSessionVal contained printable all skipwhite
78 syn match hogAFlagOpt contained "[0FSRPAUfsrpau21]\+" skipwhite
79 syn match hogAFragOpt contained "[DRMdrm]\+" skipwhite
81 " Output syslog options
83 syn keyword hogSysFac contained LOG_AUTH LOG_AUTHPRIV LOG_DAEMON LOG_LOCAL0
84 syn keyword hogSysFac contained LOG_LOCAL1 LOG_LOCAL2 LOG_LOCAL3 LOG_LOCAL4
85 syn keyword hogSysFac contained LOG_LOCAL5 LOG_LOCAL6 LOG_LOCAL7 LOG_USER
87 syn keyword hogSysPri contained LOG_EMERG ALERT LOG_CRIT LOG_ERR
88 syn keyword hogSysPri contained LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBUG
90 syn keyword hogSysOpt contained LOG_CONS LOG_NDELAY LOG_PERROR
91 syn keyword hogSysOpt contained LOG_PID
93 syn keyword hogRuleType contained log pass alert activate dynamic
95 " Output log_database arguments and parameters
96 " Type of database followed by ,
97 " syn keyword hogDBSQL contained mysql postgresql unixodbc
98 " Parameters param=constant
99 " are just various constants assigned to parameter names
101 " Output log_database arguments and parameters
102 " Type of database followed by ,
103 syn keyword hogDBType contained alert log
104 syn keyword hogDBSRV contained mysql postgresql unixodbc
105 " Parameters param=constant
106 " are just various constants assigned to parameter names
107 syn keyword hogDBParam contained dbname host port user password sensor_name
109 " Output xml arguments and parameters
111 syn keyword hogXMLArg contained log alert
112 syn keyword hogXMLParam contained file protocol host port cert key ca server sanitize encoding detail
114 " hog rule handler '(.*)'
115 syn region hogAOpt contained oneline start="rpc" end=":"me=e-1 nextgroup=hogARPCOptGrp skipwhite
116 syn region hogARPCOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogARPCOpt skipwhite
118 syn region hogAOpt contained oneline start="tag" end=":"me=e-1 nextgroup=hogATAGOptGrp skipwhite
119 syn region hogATAGOptGrp contained oneline start="."hs=s+1 skip="," end=";"me=e-1 contains=hogATAGOpt,hogNumber skipwhite
121 syn region hogAOpt contained oneline start="nocase\|sameip" end=";"me=e-1 skipwhite oneline keepend
123 syn region hogAOpt contained start="resp" end=":"me=e-1 nextgroup=hogARespOpts skipwhite
124 syn region hogARespOpts contained oneline start="." end="[,;]" contains=hogARespOpt skipwhite nextgroup=hogARespOpts
126 syn region hogAOpt contained start="react" end=":"me=e-1 nextgroup=hogAReactOpts skipwhite
127 syn region hogAReactOpts contained oneline start="." end="[,;]" contains=hogAReactOpt skipwhite nextgroup=hogAReactOpts
129 syn region hogAOpt contained oneline start="depth\|seq\|ttl\|ack\|icmp_seq\|activates\|activated_by\|dsize\|icode\|icmp_id\|count\|itype\|tos\|id\|offset" end=":"me=e-1 nextgroup=hogANOptGrp skipwhite
130 syn region hogANOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogNumber skipwhite oneline keepend
132 syn region hogAOpt contained oneline start="classtype" end=":"me=e-1 nextgroup=hogAFileGrp skipwhite
134 syn region hogAOpt contained oneline start="regex\|msg\|content" end=":"me=e-1 nextgroup=hogAStrGrp skipwhite
135 "syn region hogAStrGrp contained oneline start=+:\s*"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keepend
136 syn region hogAStrGrp contained oneline start=+:\s*"\|:"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keepend
138 syn region hogAOpt contained oneline start="logto\|content-list" end=":"me=e-1 nextgroup=hogAFileGrp skipwhite
139 syn region hogAFileGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogFileName skipwhite
141 syn region hogAOpt contained oneline start="reference" end=":"me=e-1 nextgroup=hogARefGrp skipwhite
142 syn region hogARefGrp contained oneline start="."hs=s+1 end=","me=e-1 contains=hogARefGrps nextgroup=hogARefName skipwhite
143 syn region hogARefName contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogString,hogFileName,hogNumber skipwhite
145 syn region hogAOpt contained oneline start="flags" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keepend
147 syn region hogAOpt contained oneline start="fragbits" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keepend
149 syn region hogAOpt contained oneline start="ipopts" end=":"he=s-1 nextgroup=hogAIPOptVal skipwhite oneline keepend
151 "syn region hogAOpt contained oneline start="." end=":"he=s-1 contains=hogAFOpt nextgroup=hogFileName skipwhite
153 syn region hogAOpt contained oneline start="session" end=":"he=s-1 nextgroup=hogSessionVal skipwhite
155 syn match nothing "$"
156 syn region hogRules oneline contains=nothing start='$' end="$"
157 syn region hogRules oneline contains=hogRule start='('ms=s+1 end=")\s*$" skipwhite
158 syn region hogRule contained oneline start="." skip="\\;" end=";"he=s-1 contains=hogAOpts, skipwhite keepend
159 "syn region hogAOpts contained oneline start="." end="[;]"he=s-1 contains=hogAOpt skipwhite
160 syn region hogAOpts contained oneline start="." end="[;]"me=e-1 contains=hogAOpt skipwhite
164 syn keyword hogRTypeStart skipwhite ruletype nextgroup=hogRuleName skipwhite
165 syn region hogRuleName contained start="." end="\s" contains=hogFileName nextgroup=hogRTypeRegion
166 " type ruletype sub type
167 syn region hogRtypeRegion contained start="{" end="}" nextgroup=hogRTypeStart
168 syn keyword hogRTypeStart skipwhite type nextgroup=hogRuleTypes skipwhite
169 syn region hogRuleTypes contained start="." end="\s" contains=hogRuleType nextgroup=hogOutStart
173 syn keyword hogVarStart skipwhite var nextgroup=hogVarIdent skipwhite
174 syn region hogVarIdent contained start="."hs=e+1 end="\s\+"he=s-1 contains=hogEnvvar nextgroup=hogVarRegion skipwhite
175 syn region hogVarRegion contained oneline start="." contains=hogIPaddr,hogEnvvar,hogNumber,hogString,hogFileName end="$"he=s-1 keepend skipwhite
178 syn keyword hogConfigStart config skipwhite nextgroup=hogConfigType
179 syn match hogConfigType contained "\<classification\>" nextgroup=hogConfigTypeRegion skipwhite
180 syn region hogConfigTypeRegion contained oneline start=":"ms=s+1 end="$" contains=hogNumber,hogText keepend skipwhite
184 syn keyword hogIncStart include skipwhite nextgroup=hogIncRegion
185 syn region hogIncRegion contained oneline start="\>" contains=hogFileName,hogEnvvar end="$" keepend
187 " preprocessor command
188 " http_decode, minfrag, portscan[-ignorehosts]
189 syn keyword hogPPrStart preprocessor skipwhite nextgroup=hogPPr
190 syn match hogPPr contained "\<spade\>" nextgroup=hogPPrRegion skipwhite
191 syn match hogPPr contained "\<spade-homenet\>" nextgroup=hogPPrRegion skipwhite
192 syn match hogPPr contained "\<spade-threshlearn\>" nextgroup=hogPPrRegion skipwhite
193 syn match hogPPr contained "\<spade-adapt\>" nextgroup=hogPPrRegion skipwhite
194 syn match hogPPr contained "\<spade-adapt2\>" nextgroup=hogPPrRegion skipwhite
195 syn match hogPPr contained "\<spade-adapt3\>" nextgroup=hogPPrRegion skipwhite
196 syn match hogPPr contained "\<spade-survey\>" nextgroup=hogPPrRegion skipwhite
197 syn match hogPPr contained "\<defrag\>" nextgroup=hogPPrRegion skipwhite
198 syn match hogPPr contained "\<telnet_decode\>" nextgroup=hogPPrRegion skipwhite
199 syn match hogPPr contained "\<rpc_decode\>" nextgroup=hogPPrRegion skipwhite
200 syn match hogPPr contained "\<bo\>" nextgroup=hogPPrRegion skipwhite
201 syn match hogPPr contained "\<stream\>" nextgroup=hogStreamRegion skipwhite
202 syn match hogPPr contained "\<stream2\>" nextgroup=hogStreamRegion skipwhite
203 syn match hogPPr contained "\<stream3\>" nextgroup=hogStreamRegion skipwhite
204 syn match hogPPr contained "\<http_decode\>" nextgroup=hogPPrRegion skipwhite
205 syn match hogPPr contained "\<minfrag\>" nextgroup=hogPPrRegion skipwhite
206 syn match hogPPr contained "\<portscan[-ignorehosts]*\>" nextgroup=hogPPrRegion skipwhite
207 syn region hogPPrRegion contained oneline start="$" end="$" keepend
208 syn region hogPPrRegion contained oneline start=":" end="$" contains=hogNumber,hogIPaddr,hogEnvvar,hogFileName keepend
209 syn keyword hogStreamArgs contained timeout ports maxbytes
210 syn region hogStreamRegion contained oneline start=":" end="$" contains=hogStreamArgs,hogNumber
213 syn keyword hogOutStart output nextgroup=hogOut skipwhite
216 syn match hogOut contained "\<alert_syslog\>" nextgroup=hogSyslogRegion skipwhite
217 syn region hogSyslogRegion contained start=":" end="$" contains=hogSysFac,hogSysPri,hogSysOpt,hogEnvvar oneline skipwhite keepend
219 " alert_fast (full,smb,unixsock, and tcpdump)
220 syn match hogOut contained "\<alert_fast\|alert_full\|alert_smb\|alert_unixsock\|log_tcpdump\>" nextgroup=hogLogFileRegion skipwhite
221 syn region hogLogFileRegion contained start=":" end="$" contains=hogFileName,hogEnvvar oneline skipwhite keepend
224 syn match hogOut contained "\<database\>" nextgroup=hogDBTypes skipwhite
225 syn region hogDBTypes contained start=":" end="," contains=hogDBType,hogEnvvar nextgroup=hogDBSRVs skipwhite
226 syn region hogDBSRVs contained start="\s\+" end="," contains=hogDBSRV nextgroup=hogDBParams skipwhite
227 syn region hogDBParams contained start="." end="="me=e-1 contains=hogDBParam nextgroup=hogDBValues
228 syn region hogDBValues contained start="." end="\>" contains=hogNumber,hogEnvvar,hogAscii nextgroup=hogDBParams oneline skipwhite
229 syn match hogAscii contained "\<\a\+"
232 syn match hogOut contained "\<log_tcpdump\>" nextgroup=hogLogRegion skipwhite
233 syn region hogLogRegion oneline start=":" skipwhite end="$" contains=hogEnvvar,hogFileName keepend
236 syn keyword hogXMLTrans contained http https tcp iap
237 syn match hogOut contained "\<xml\>" nextgroup=hogXMLRegion skipwhite
238 syn region hogXMLRegion contained start=":" end="," contains=hogXMLArg,hogEnvvar nextgroup=hogXMLParams skipwhite
239 "syn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLProto nextgroup=hogXMLProtos
240 "syn region hogXMLProtos contained start="." end="\>" contains=hogXMLTrans nextgroup=hogXMLParams
241 syn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLParam nextgroup=hogXMLValue
242 syn region hogXMLValue contained start="." end="\>" contains=hogNumber,hogIPaddr,hogEnvvar,hogAscii,hogFileName nextgroup=hogXMLParams oneline skipwhite keepend
245 syn match hogFileName contained "[-./[:alnum:]_~]\+"
246 syn match hogFileName contained "[-./[:alnum:]_~]\+"
248 syn match hogIPaddr "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>"
249 syn match hogIPaddr "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>"
251 syn keyword hogProto tcp TCP ICMP icmp udp UDP
253 " hog alert address port pairs
255 syn match hogIPaddrAndPort contained "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>" skipwhite nextgroup=hogPort
256 syn match hogIPaddrAndPort contained "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>" skipwhite nextgroup=hogPort
257 syn match hogIPaddrAndPort contained "\<any\>" skipwhite nextgroup=hogPort
258 syn match hogIPaddrAndPort contained "\$\I\i*" nextgroup=hogPort skipwhite
259 syn match hogIPaddrAndPort contained "\${\I\i*}" nextgroup=hogPort skipwhite
260 "syn match hogPort contained "[\!]\=[\:]\=\d\+L\=\>" skipwhite
261 syn match hogPort contained "[\:]\=\d\+\>"
262 syn match hogPort contained "[\!]\=\<any\>" skipwhite
263 syn match hogPort contained "[\!]\=\d\+L\=:\d\+L\=\>" skipwhite
266 syn keyword hog7Functions activate skipwhite nextgroup=hogActRegion
267 syn keyword hog7Functions dynamic skipwhite nextgroup=hogActRegion
268 syn keyword hogActStart alert skipwhite nextgroup=hogActRegion
269 syn keyword hogActStart log skipwhite nextgroup=hogActRegion
270 syn keyword hogActStart pass skipwhite nextgroup=hogActRegion
272 syn region hogActRegion contained oneline start="tcp\|TCP\|udp\|UDP\|icmp\|ICMP" end="\s\+"me=s-1 nextgroup=hogActSource oneline keepend skipwhite
273 syn region hogActSource contained oneline contains=hogIPaddrAndPort start="\s\+"ms=e+1 end="->\|<>"me=e-2 oneline keepend skipwhite nextgroup=hogActDest
274 syn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="$" oneline keepend
275 syn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="("me=e-1 oneline keepend skipwhite nextgroup=hogRules
278 " ====================
279 if version >= 508 || !exists("did_hog_syn_inits")
281 let did_hog_syn_inits = 1
282 command -nargs=+ HiLink hi link <args>
284 command -nargs=+ HiLink hi def link <args>
286 " The default methods for highlighting. Can be overridden later
287 HiLink hogComment Comment
288 HiLink hogLineComment Comment
289 HiLink hogAscii Constant
290 HiLink hogCommentString Constant
291 HiLink hogFileName Constant
292 HiLink hogIPaddr Constant
293 HiLink hogNotPatSep Constant
294 HiLink hogNumber Constant
295 HiLink hogText Constant
296 HiLink hogString Constant
297 HiLink hogSysFac Constant
298 HiLink hogSysOpt Constant
299 HiLink hogSysPri Constant
300 " HiLink hogAStrGrp Error
302 HiLink hogEnvvar Identifier
303 HiLink hogIPaddrAndPort Identifier
304 HiLink hogVarIdent Identifier
305 HiLink hogATAGOpt PreProc
306 HiLink hogAIPOptVal PreProc
307 HiLink hogARespOpt PreProc
308 HiLink hogAReactOpt PreProc
309 HiLink hogAFlagOpt PreProc
310 HiLink hogAFragOpt PreProc
311 HiLink hogCommentTitle PreProc
312 HiLink hogDBType PreProc
313 HiLink hogDBSRV PreProc
314 HiLink hogPort PreProc
315 HiLink hogARefGrps PreProc
316 HiLink hogSessionVal PreProc
317 HiLink hogXMLArg PreProc
318 HiLink hogARPCOpt PreProc
319 HiLink hogPatSep Special
320 HiLink hog7Functions Statement
321 HiLink hogActStart Statement
322 HiLink hogIncStart Statement
323 HiLink hogConfigStart Statement
324 HiLink hogOutStart Statement
325 HiLink hogPPrStart Statement
326 HiLink hogVarStart Statement
327 HiLink hogRTypeStart Statement
329 HiLink hogRuleType Type
331 HiLink hogANoVal Type
332 HiLink hogAStrOpt Type
335 HiLink hogDBParam Type
336 HiLink hogStreamArgs Type
339 HiLink hogConfigType Type
340 HiLink hogActRegion Type
342 HiLink hogXMLParam Type
348 let b:current_syntax = "hog"