1d7464be9SBram Moolenaar" Vim syntax file 2d7464be9SBram Moolenaar" Language: hog (Snort.conf + .rules) 3d7464be9SBram Moolenaar" Maintainer: Victor Roemer, <[email protected]>. 4*5be4ceecSBram Moolenaar" Last Change: 2019 Sep 22 5d7464be9SBram Moolenaar" 2012 Oct 24 -> Originalish release 6*5be4ceecSBram Moolenaar" 2019 Sep 22 -> included PR 3069 7071d4279SBram Moolenaar 889bcfda6SBram Moolenaar" quit when a syntax file was already loaded 989bcfda6SBram Moolenaarif exists("b:current_syntax") 10071d4279SBram Moolenaar finish 11071d4279SBram Moolenaarendif 12071d4279SBram Moolenaar 13d7464be9SBram Moolenaarsetlocal iskeyword-=: 14d7464be9SBram Moolenaarsetlocal iskeyword+=- 15d7464be9SBram Moolenaarsyn case ignore 16071d4279SBram Moolenaar 17d7464be9SBram Moolenaar" Hog ruletype crap 18d7464be9SBram Moolenaarsyn keyword HogRuleType ruletype nextgroup=HogRuleTypeName skipwhite 19d7464be9SBram Moolenaarsyn match HogRuleTypeName "[[:alnum:]_]\+" contained nextgroup=HogRuleTypeBody skipwhite 20d7464be9SBram Moolenaarsyn region HogRuleTypeBody start="{" end="}" contained contains=HogRuleTypeType,HogOutput fold 21d7464be9SBram Moolenaarsyn keyword HogRuleTypeType type contained 22071d4279SBram Moolenaar 23d7464be9SBram Moolenaar" Hog Configurables 24d7464be9SBram Moolenaarsyn keyword HogPreproc preprocessor nextgroup=HogConfigName skipwhite 25d7464be9SBram Moolenaarsyn keyword HogConfig config nextgroup=HogConfigName skipwhite 26d7464be9SBram Moolenaarsyn keyword HogOutput output nextgroup=HogConfigName skipwhite 27d7464be9SBram Moolenaarsyn match HogConfigName "[[:alnum:]_-]\+" contained nextgroup=HogConfigOpts skipwhite 28d7464be9SBram Moolenaarsyn region HogConfigOpts start=":" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold keepend contained contains=HogSpecial,HogNumber,HogIPAddr,HogVar,HogComment 29d7464be9SBram Moolenaar 30d7464be9SBram Moolenaar" Event filter's and threshold's 31d7464be9SBram Moolenaarsyn region HogEvFilter start="event_filter\|threshold" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogEvFilterKeyword,HogEvFilterOptions,HogComment 32d7464be9SBram Moolenaarsyn keyword HogEvFilterKeyword skipwhite event_filter threshold 33d7464be9SBram Moolenaarsyn keyword HogEvFilterOptions skipwhite type nextgroup=HogEvFilterTypes 34d7464be9SBram Moolenaarsyn keyword HogEvFilterTypes skipwhite limit threshold both contained 35d7464be9SBram Moolenaarsyn keyword HogEvFilterOptions skipwhite track nextgroup=HogEvFilterTrack 36d7464be9SBram Moolenaarsyn keyword HogEvFilterTrack skipwhite by_src by_dst contained 37d7464be9SBram Moolenaarsyn keyword HogEvFilterOptions skipwhite gen_id sig_id count seconds nextgroup=HogNumber 38d7464be9SBram Moolenaar 39d7464be9SBram Moolenaar" Suppressions 40d7464be9SBram Moolenaarsyn region HogEvFilter start="suppress" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogSuppressKeyword,HogComment 41d7464be9SBram Moolenaarsyn keyword HogSuppressKeyword skipwhite suppress 42d7464be9SBram Moolenaarsyn keyword HogSuppressOptions skipwhite gen_id sig_id nextgroup=HogNumber 43d7464be9SBram Moolenaarsyn keyword HogSuppressOptions skipwhite track nextgroup=HogEvFilterTrack 44d7464be9SBram Moolenaarsyn keyword HogSuppressOptions skipwhite ip nextgroup=HogIPAddr 45d7464be9SBram Moolenaar 46d7464be9SBram Moolenaar" Attribute table 47d7464be9SBram Moolenaarsyn keyword HogAttribute attribute_table nextgroup=HogAttributeFile 48d7464be9SBram Moolenaarsyn match HogAttributeFile contained ".*$" contains=HogVar,HogAttributeType,HogComment 49d7464be9SBram Moolenaarsyn keyword HogAttributeType filename 50d7464be9SBram Moolenaar 51d7464be9SBram Moolenaar" Hog includes 52d7464be9SBram Moolenaarsyn keyword HogInclude include nextgroup=HogIncludeFile skipwhite 53d7464be9SBram Moolenaarsyn match HogIncludeFile ".*$" contained contains=HogVar,HogComment 54d7464be9SBram Moolenaar 55d7464be9SBram Moolenaar" Hog dynamic libraries 56d7464be9SBram Moolenaarsyn keyword HogDylib dynamicpreprocessor dynamicengine dynamicdetection nextgroup=HogDylibFile skipwhite 57d7464be9SBram Moolenaarsyn match HogDylibFile "\s.*$" contained contains=HogVar,HogDylibType,HogComment 58d7464be9SBram Moolenaarsyn keyword HogDylibType directory file contained 59d7464be9SBram Moolenaar 60d7464be9SBram Moolenaar" Variable dereferenced with '$' 61d7464be9SBram Moolenaarsyn match HogVar "\$[[:alnum:]_]\+" 62d7464be9SBram Moolenaar 63d7464be9SBram Moolenaar", Variables declared with 'var' 64d7464be9SBram Moolenaarsyn keyword HogVarType var nextgroup=HogVarSet skipwhite 65d7464be9SBram Moolenaarsyn match HogVarSet "[[:alnum:]_]\+" display contained nextgroup=HogVarValue skipwhite 66d7464be9SBram Moolenaarsyn match HogVarValue ".*$" contained contains=HogString,HogNumber,HogVar,HogComment 67d7464be9SBram Moolenaar 68d7464be9SBram Moolenaar" Variables declared with 'ipvar' 69d7464be9SBram Moolenaarsyn keyword HogIPVarType ipvar nextgroup=HogIPVarSet skipwhite 70d7464be9SBram Moolenaarsyn match HogIPVarSet "[[:alnum:]_]\+" display contained nextgroup=HogIPVarList,HogSpecial skipwhite 71d7464be9SBram Moolenaarsyn region HogIPVarList start="\[" end="]" contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot 72d7464be9SBram Moolenaar 73d7464be9SBram Moolenaar" Variables declared with 'portvar' 74d7464be9SBram Moolenaarsyn keyword HogPortVarType portvar nextgroup=HogPortVarSet skipwhite 75d7464be9SBram Moolenaarsyn match HogPortVarSet "[[:alnum:]_]\+" display contained nextgroup=HogPortVarList,HogPort,HogOpRange,HogOpNot,HogSpecial skipwhite 76d7464be9SBram Moolenaarsyn region HogPortVarList start="\[" end="]" contains=HogPortVarList,HogVar,HogOpNot,HogPort,HogOpRange,HogOpNot 77d7464be9SBram Moolenaarsyn match HogPort "\<\%(\d\+\|any\)\>" display contains=HogOpRange nextgroup=HogOpRange 78d7464be9SBram Moolenaar 79d7464be9SBram Moolenaar" Generic stuff 80d7464be9SBram Moolenaarsyn match HogIPAddr contained "\<\%(\d\{1,3}\(\.\d\{1,3}\)\{3}\|any\)\>" nextgroup=HogIPCidr 81d7464be9SBram Moolenaarsyn match HogIPAddr contained "\<\d\{1,3}\(\.\d\{1,3}\)\{3}\>" nextgroup=HogIPCidr 82d7464be9SBram Moolenaarsyn match HogIPCidr contained "\/\([0-2][0-9]\=\|3[0-2]\=\)" 83d7464be9SBram Moolenaarsyn region HogHexEsc contained start='|' end='|' oneline 84d7464be9SBram Moolenaarsyn region HogString contained start='"' end='"' extend oneline contains=HogHexEsc 85d7464be9SBram Moolenaarsyn match HogNumber contained display "\<\d\+\>" 86d7464be9SBram Moolenaarsyn match HogNumber contained display "\<\d\+\>" 87d7464be9SBram Moolenaarsyn match HogNumber contained display "0x\x\+\>" 88d7464be9SBram Moolenaarsyn keyword HogSpecial contained true false yes no default all any 89d7464be9SBram Moolenaarsyn keyword HogSpecialAny contained any 90d7464be9SBram Moolenaarsyn match HogOpNot "!" contained 91d7464be9SBram Moolenaarsyn match HogOpRange ":" contained 92d7464be9SBram Moolenaar 93d7464be9SBram Moolenaar" Rules 94d7464be9SBram Moolenaarsyn keyword HogRuleAction activate alert drop block dynamic log pass reject sdrop sblock skipwhite nextgroup=HogRuleProto,HogRuleBlock 95*5be4ceecSBram Moolenaarsyn keyword HogRuleProto ip tcp tcp-pkt tcp-stream udp icmp http ftp tls smb dns dcerpc ssh smtp imap msn modbus dnp3 enip nfs ikev2 ntp skipwhite contained nextgroup=HogRuleSrcIP 96d7464be9SBram Moolenaarsyn match HogRuleSrcIP "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleSrcPort 97d7464be9SBram Moolenaarsyn match HogRuleSrcPort "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleDir 98d7464be9SBram Moolenaarsyn match HogRuleDir "->\|<>" skipwhite contained nextgroup=HogRuleDstIP 99d7464be9SBram Moolenaarsyn match HogRuleDstIP "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleDstPort 100d7464be9SBram Moolenaarsyn match HogRuleDstPort "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleBlock 101d7464be9SBram Moolenaarsyn region HogRuleBlock start="(" end=")" transparent skipwhite contained contains=HogRuleOption,HogComment fold 102d7464be9SBram Moolenaar",HogString,HogComment,HogVar,HogOptNot 103d7464be9SBram Moolenaar"syn region HogRuleOption start="\<gid\|sid\|rev\|depth\|offset\|distance\|within\>" end="\ze;" skipwhite contained contains=HogNumber 104*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP msg gid sid rev classtype priority metadata target content nocase rawbytes 105*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP depth startswith offset distance within http_client_body http_cookie http_raw_cookie http_header 106*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_raw_header http_request_line http_method http_uri http_raw_uri http_protocol http_response_line http_stat_code http_stat_msg 107*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_user_agent http_accept http_accept_enc http_accept_lang http_connection http_content_type http_content_len 108*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP http_referer http_start http_header_names http_server_body http_host http_raw_host 109*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP filename fileext filemagic filestore filemd5 filesha1 filesha256 filesize 110*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP dns_query tls_cert_subject tls_cert_issuer tls_cert_serial tls_cert_fingerprint 111*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP tls_sni tls_cert_notbefore tls_cert_notafter tls_cert_expired tls_cert_valid 112*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP tls.version tls.subject tls.issuerdn tls.fingerprint tls.store ja3_hash ja3_string 113*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP modbus dnp3_func dnp3_ind dnp3_obj dnp3_data enip_command cip_service 114*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP app-layer-protocol app-layer-event xbits iprep lua luajit 115*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP fast_pattern prefilter uricontent urilen isdataat pcre pkt_data file_data base64_decode base64_data 116*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP byte_test byte_jump byte_extract ftpdata_command ftpbounce asn1 cvs dce_iface dce_opnum dce_stub_data 117d7464be9SBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version 118*5be4ceecSBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP ssl_state fragoffset ttl tos id ipopts geoip fragbits dsize flags flow flowbits flowint seq ack window 119d7464be9SBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size 120d7464be9SBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP logto session resp react tag activates activated_by count replace detection_filter 121d7464be9SBram Moolenaarsyn keyword HogRuleOption skipwhite contained nextgroup=HogRuleSROP threshold reference sd_pattern file_type file_group 122d7464be9SBram Moolenaar 123d7464be9SBram Moolenaarsyn region HogRuleSROP start=':' end=";" transparent keepend contained contains=HogRuleChars,HogString,HogNumber 124d7464be9SBram Moolenaarsyn match HogRuleChars "\%(\k\|\.\|?\|=\|/\|%\|&\)\+" contained 125d7464be9SBram Moolenaarsyn match HogURLChars "\%(\.\|?\|=\)\+" contained 126d7464be9SBram Moolenaar 127d7464be9SBram Moolenaar" Hog File Type Rules 128d7464be9SBram Moolenaarsyn match HogFileType /^\s*file.*$/ transparent contains=HogFileTypeOpt,HogFileFROP 129d7464be9SBram Moolenaarsyn keyword HogFileTypeOpt skipwhite contained nextgroup=HogRuleFROP file type ver category id rev content offset msg group 130d7464be9SBram Moolenaarsyn region HogFileFROP start=':' end=";" transparent keepend contained contains=NotASemicoln 131d7464be9SBram Moolenaarsyn match NotASemiColn ".*$" contained 132071d4279SBram Moolenaar 133071d4279SBram Moolenaar 134d7464be9SBram Moolenaar" Comments 135d7464be9SBram Moolenaarsyn keyword HogTodo XXX TODO NOTE contained 136d7464be9SBram Moolenaarsyn match HogTodo "Step\s\+#\=\d\+" contained 137d7464be9SBram Moolenaarsyn region HogComment start="#" end="$" contains=HogTodo,@Spell 138071d4279SBram Moolenaar 139d7464be9SBram Moolenaarsyn case match 140071d4279SBram Moolenaar 141d7464be9SBram Moolenaarif !exists("hog_minlines") 142d7464be9SBram Moolenaar let hog_minlines = 100 143071d4279SBram Moolenaarendif 144d7464be9SBram Moolenaarexec "syn sync minlines=" . hog_minlines 145d7464be9SBram Moolenaar 146d7464be9SBram Moolenaarhi link HogRuleType Statement 147d7464be9SBram Moolenaarhi link HogRuleTypeName Type 148d7464be9SBram Moolenaarhi link HogRuleTypeType Keyword 149d7464be9SBram Moolenaar 150d7464be9SBram Moolenaarhi link HogPreproc Statement 151d7464be9SBram Moolenaarhi link HogConfig Statement 152d7464be9SBram Moolenaarhi link HogOutput Statement 153d7464be9SBram Moolenaarhi link HogConfigName Type 154d7464be9SBram Moolenaar 155d7464be9SBram Moolenaar"hi link HogEvFilter 156d7464be9SBram Moolenaarhi link HogEvFilterKeyword Statement 157d7464be9SBram Moolenaarhi link HogSuppressKeyword Statement 158d7464be9SBram Moolenaarhi link HogEvFilterTypes Constant 159d7464be9SBram Moolenaarhi link HogEvFilterTrack Constant 160d7464be9SBram Moolenaar 161d7464be9SBram Moolenaarhi link HogAttribute Statement 162d7464be9SBram Moolenaarhi link HogAttributeFile String 163d7464be9SBram Moolenaarhi link HogAttributeType Statement 164d7464be9SBram Moolenaar 165d7464be9SBram Moolenaarhi link HogInclude Statement 166d7464be9SBram Moolenaarhi link HogIncludeFile String 167d7464be9SBram Moolenaar 168d7464be9SBram Moolenaarhi link HogDylib Statement 169d7464be9SBram Moolenaarhi link HogDylibType Statement 170d7464be9SBram Moolenaarhi link HogDylibFile String 171d7464be9SBram Moolenaar 172d7464be9SBram Moolenaar" Variables 173d7464be9SBram Moolenaar" var 174d7464be9SBram Moolenaarhi link HogVar Identifier 175d7464be9SBram Moolenaarhi link HogVarType Keyword 176d7464be9SBram Moolenaarhi link HogVarSet Identifier 177d7464be9SBram Moolenaarhi link HogVarValue String 178d7464be9SBram Moolenaar" ipvar 179d7464be9SBram Moolenaarhi link HogIPVarType Keyword 180d7464be9SBram Moolenaarhi link HogIPVarSet Identifier 181d7464be9SBram Moolenaar" portvar 182d7464be9SBram Moolenaarhi link HogPortVarType Keyword 183d7464be9SBram Moolenaarhi link HogPortVarSet Identifier 184d7464be9SBram Moolenaarhi link HogPort Constant 185d7464be9SBram Moolenaar 186d7464be9SBram Moolenaarhi link HogTodo Todo 187d7464be9SBram Moolenaarhi link HogComment Comment 188d7464be9SBram Moolenaarhi link HogString String 189d7464be9SBram Moolenaarhi link HogHexEsc PreProc 190d7464be9SBram Moolenaarhi link HogNumber Number 191d7464be9SBram Moolenaarhi link HogSpecial Constant 192d7464be9SBram Moolenaarhi link HogSpecialAny Constant 193d7464be9SBram Moolenaarhi link HogIPAddr Constant 194d7464be9SBram Moolenaarhi link HogIPCidr Constant 195d7464be9SBram Moolenaarhi link HogOpNot Operator 196d7464be9SBram Moolenaarhi link HogOpRange Operator 197d7464be9SBram Moolenaar 198d7464be9SBram Moolenaarhi link HogRuleAction Statement 199d7464be9SBram Moolenaarhi link HogRuleProto Identifier 200d7464be9SBram Moolenaarhi link HogRuleDir Operator 201d7464be9SBram Moolenaarhi link HogRuleOption Keyword 202d7464be9SBram Moolenaarhi link HogRuleChars String 203d7464be9SBram Moolenaar 204d7464be9SBram Moolenaarhi link HogFileType HogRuleAction 205d7464be9SBram Moolenaarhi link HogFileTypeOpt HogRuleOption 206d7464be9SBram Moolenaarhi link NotASemiColn HogRuleChars 207071d4279SBram Moolenaar 208071d4279SBram Moolenaarlet b:current_syntax = "hog" 209