hog.vim (12112B)
1 " Vim syntax file 2 " Language: hog (Snort.conf + .rules) 3 " Maintainer: Victor Roemer, <vroemer@badsec.org>. 4 " Last Change: 2019 Sep 22 5 " 2012 Oct 24 -> Originalish release 6 " 2019 Sep 22 -> included PR 3069 7 8 " quit when a syntax file was already loaded 9 if exists("b:current_syntax") 10 finish 11 endif 12 13 setlocal iskeyword-=: 14 setlocal iskeyword+=- 15 syn case ignore 16 17 " Hog ruletype crap 18 syn keyword HogRuleType ruletype nextgroup=HogRuleTypeName skipwhite 19 syn match HogRuleTypeName "[[:alnum:]_]\+" contained nextgroup=HogRuleTypeBody skipwhite 20 syn region HogRuleTypeBody start="{" end="}" contained contains=HogRuleTypeType,HogOutput fold 21 syn keyword HogRuleTypeType type contained 22 23 " Hog Configurables 24 syn keyword HogPreproc preprocessor nextgroup=HogConfigName skipwhite 25 syn keyword HogConfig config nextgroup=HogConfigName skipwhite 26 syn keyword HogOutput output nextgroup=HogConfigName skipwhite 27 syn match HogConfigName "[[:alnum:]_-]\+" contained nextgroup=HogConfigOpts skipwhite 28 syn region HogConfigOpts start=":" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold keepend contained contains=HogSpecial,HogNumber,HogIPAddr,HogVar,HogComment 29 30 " Event filter's and threshold's 31 syn region HogEvFilter start="event_filter\|threshold" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogEvFilterKeyword,HogEvFilterOptions,HogComment 32 syn keyword HogEvFilterKeyword skipwhite event_filter threshold 33 syn keyword HogEvFilterOptions skipwhite type nextgroup=HogEvFilterTypes 34 syn keyword HogEvFilterTypes skipwhite limit threshold both contained 35 syn keyword HogEvFilterOptions skipwhite track nextgroup=HogEvFilterTrack 36 syn keyword HogEvFilterTrack skipwhite by_src by_dst contained 37 syn keyword HogEvFilterOptions skipwhite gen_id sig_id count seconds nextgroup=HogNumber 38 39 " Suppressions 40 syn region HogEvFilter start="suppress" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogSuppressKeyword,HogComment 41 syn keyword HogSuppressKeyword skipwhite suppress 42 syn keyword HogSuppressOptions skipwhite gen_id sig_id nextgroup=HogNumber 43 syn keyword HogSuppressOptions skipwhite track nextgroup=HogEvFilterTrack 44 syn keyword HogSuppressOptions skipwhite ip nextgroup=HogIPAddr 45 46 " Attribute table 47 syn keyword HogAttribute attribute_table nextgroup=HogAttributeFile 48 syn match HogAttributeFile contained ".*$" contains=HogVar,HogAttributeType,HogComment 49 syn keyword HogAttributeType filename 50 51 " Hog includes 52 syn keyword HogInclude include nextgroup=HogIncludeFile skipwhite 53 syn match HogIncludeFile ".*$" contained contains=HogVar,HogComment 54 55 " Hog dynamic libraries 56 syn keyword HogDylib dynamicpreprocessor dynamicengine dynamicdetection nextgroup=HogDylibFile skipwhite 57 syn match HogDylibFile "\s.*$" contained contains=HogVar,HogDylibType,HogComment 58 syn keyword HogDylibType directory file contained 59 60 " Variable dereferenced with '$' 61 syn match HogVar "\$[[:alnum:]_]\+" 62 63 ", Variables declared with 'var' 64 syn keyword HogVarType var nextgroup=HogVarSet skipwhite 65 syn match HogVarSet "[[:alnum:]_]\+" display contained nextgroup=HogVarValue skipwhite 66 syn match HogVarValue ".*$" contained contains=HogString,HogNumber,HogVar,HogComment 67 68 " Variables declared with 'ipvar' 69 syn keyword HogIPVarType ipvar nextgroup=HogIPVarSet skipwhite 70 syn match HogIPVarSet "[[:alnum:]_]\+" display contained nextgroup=HogIPVarList,HogSpecial skipwhite 71 syn region HogIPVarList start="\[" end="]" contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot 72 73 " Variables declared with 'portvar' 74 syn keyword HogPortVarType portvar nextgroup=HogPortVarSet skipwhite 75 syn match HogPortVarSet "[[:alnum:]_]\+" display contained nextgroup=HogPortVarList,HogPort,HogOpRange,HogOpNot,HogSpecial skipwhite 76 syn region HogPortVarList start="\[" end="]" contains=HogPortVarList,HogVar,HogOpNot,HogPort,HogOpRange,HogOpNot 77 syn match HogPort "\<\%(\d\+\|any\)\>" display contains=HogOpRange nextgroup=HogOpRange 78 79 " Generic stuff 80 syn match HogIPAddr contained "\<\%(\d\{1,3}\(\.\d\{1,3}\)\{3}\|any\)\>" nextgroup=HogIPCidr 81 syn match HogIPAddr contained "\<\d\{1,3}\(\.\d\{1,3}\)\{3}\>" nextgroup=HogIPCidr 82 syn match HogIPCidr contained "\/\([0-2][0-9]\=\|3[0-2]\=\)" 83 syn region HogHexEsc contained start='|' end='|' oneline 84 syn region HogString contained start='"' end='"' extend oneline contains=HogHexEsc 85 syn match HogNumber contained display "\<\d\+\>" 86 syn match HogNumber contained display "\<\d\+\>" 87 syn match HogNumber contained display "0x\x\+\>" 88 syn keyword HogSpecial contained true false yes no default all any 89 syn keyword HogSpecialAny contained any 90 syn match HogOpNot "!" contained 91 syn match HogOpRange ":" contained 92 93 " Rules 94 syn keyword HogRuleAction activate alert drop block dynamic log pass reject sdrop sblock skipwhite nextgroup=HogRuleProto,HogRuleBlock 95 syn keyword HogRuleProto ip tcp tcp-pkt tcp-stream udp icmp http ftp tls smb dns dcerpc ssh smtp imap msn modbus dnp3 enip nfs ikev2 ntp skipwhite contained nextgroup=HogRuleSrcIP 96 syn match HogRuleSrcIP "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleSrcPort 97 syn match HogRuleSrcPort "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleDir 98 syn match HogRuleDir "->\|<>" skipwhite contained nextgroup=HogRuleDstIP 99 syn match HogRuleDstIP "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleDstPort 100 syn match HogRuleDstPort "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleBlock 101 syn region HogRuleBlock start="(" end=")" transparent skipwhite contained contains=HogRuleOption,HogComment fold 102 ",HogString,HogComment,HogVar,HogOptNot 103 "syn region HogRuleOption start="\<gid\|sid\|rev\|depth\|offset\|distance\|within\>" end="\ze;" skipwhite contained contains=HogNumber 104 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP msg gid sid rev classtype priority metadata target content nocase rawbytes 105 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP depth startswith offset distance within http_client_body http_cookie http_raw_cookie http_header 106 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_raw_header http_request_line http_method http_uri http_raw_uri http_protocol http_response_line http_stat_code http_stat_msg 107 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_user_agent http_accept http_accept_enc http_accept_lang http_connection http_content_type http_content_len 108 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_referer http_start http_header_names http_server_body http_host http_raw_host 109 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP filename fileext filemagic filestore filemd5 filesha1 filesha256 filesize 110 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP dns_query tls_cert_subject tls_cert_issuer tls_cert_serial tls_cert_fingerprint 111 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP tls_sni tls_cert_notbefore tls_cert_notafter tls_cert_expired tls_cert_valid 112 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP tls.version tls.subject tls.issuerdn tls.fingerprint tls.store ja3_hash ja3_string 113 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP modbus dnp3_func dnp3_ind dnp3_obj dnp3_data enip_command cip_service 114 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP app-layer-protocol app-layer-event xbits iprep lua luajit 115 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP fast_pattern prefilter uricontent urilen isdataat pcre pkt_data file_data base64_decode base64_data 116 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP byte_test byte_jump byte_extract ftpdata_command ftpbounce asn1 cvs dce_iface dce_opnum dce_stub_data 117 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version 118 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP ssl_state fragoffset ttl tos id ipopts geoip fragbits dsize flags flow flowbits flowint seq ack window 119 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size 120 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP logto session resp react tag activates activated_by count replace detection_filter 121 syn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP threshold reference sd_pattern file_type file_group 122 123 syn region HogRuleSROP start=':' end=";" transparent keepend contained contains=HogRuleChars,HogString,HogNumber 124 syn match HogRuleChars "\%(\k\|\.\|?\|=\|/\|%\|&\)\+" contained 125 syn match HogURLChars "\%(\.\|?\|=\)\+" contained 126 127 " Hog File Type Rules 128 syn match HogFileType /^\s*file.*$/ transparent contains=HogFileTypeOpt,HogFileFROP 129 syn keyword HogFileTypeOpt skipwhite contained nextgroup=HogRuleFROP file type ver category id rev content offset msg group 130 syn region HogFileFROP start=':' end=";" transparent keepend contained contains=NotASemicoln 131 syn match NotASemiColn ".*$" contained 132 133 134 " Comments 135 syn keyword HogTodo XXX TODO NOTE contained 136 syn match HogTodo "Step\s\+#\=\d\+" contained 137 syn region HogComment start="#" end="$" contains=HogTodo,@Spell 138 139 syn case match 140 141 if !exists("hog_minlines") 142 let hog_minlines = 100 143 endif 144 exec "syn sync minlines=" . hog_minlines 145 146 hi link HogRuleType Statement 147 hi link HogRuleTypeName Type 148 hi link HogRuleTypeType Keyword 149 150 hi link HogPreproc Statement 151 hi link HogConfig Statement 152 hi link HogOutput Statement 153 hi link HogConfigName Type 154 155 "hi link HogEvFilter 156 hi link HogEvFilterKeyword Statement 157 hi link HogSuppressKeyword Statement 158 hi link HogEvFilterTypes Constant 159 hi link HogEvFilterTrack Constant 160 161 hi link HogAttribute Statement 162 hi link HogAttributeFile String 163 hi link HogAttributeType Statement 164 165 hi link HogInclude Statement 166 hi link HogIncludeFile String 167 168 hi link HogDylib Statement 169 hi link HogDylibType Statement 170 hi link HogDylibFile String 171 172 " Variables 173 " var 174 hi link HogVar Identifier 175 hi link HogVarType Keyword 176 hi link HogVarSet Identifier 177 hi link HogVarValue String 178 " ipvar 179 hi link HogIPVarType Keyword 180 hi link HogIPVarSet Identifier 181 " portvar 182 hi link HogPortVarType Keyword 183 hi link HogPortVarSet Identifier 184 hi link HogPort Constant 185 186 hi link HogTodo Todo 187 hi link HogComment Comment 188 hi link HogString String 189 hi link HogHexEsc PreProc 190 hi link HogNumber Number 191 hi link HogSpecial Constant 192 hi link HogSpecialAny Constant 193 hi link HogIPAddr Constant 194 hi link HogIPCidr Constant 195 hi link HogOpNot Operator 196 hi link HogOpRange Operator 197 198 hi link HogRuleAction Statement 199 hi link HogRuleProto Identifier 200 hi link HogRuleDir Operator 201 hi link HogRuleOption Keyword 202 hi link HogRuleChars String 203 204 hi link HogFileType HogRuleAction 205 hi link HogFileTypeOpt HogRuleOption 206 hi link NotASemiColn HogRuleChars 207 208 let b:current_syntax = "hog"