" Snort syntax file" Language:	  Snort Configuration File (see: http://www.snort.org)" Maintainer:	  Phil Wood, cornett@arpa.net" Last Change:	  $Date: 2001/06/07 21:35:11 $" Filenames:	  *.hog *.rules snort.conf vision.conf" URL:		  http://home.lanl.gov/cpw/vim/syntax/hog.vim" Snort Version:  1.8 By Martin Roesch (roesch@clark.net, www.snort.org)" TODO            include all 1.8 syntax" For version 5.x: Clear all syntax itemsif version < 600   syntax clearelseif exists("b:current_syntax")" For version 6.x: Quit when a syntax file was already loaded   finishendifsyn match  hogComment	+\s\#[^\-:.%#=*].*$+lc=1	contains=hogTodo,hogCommentStringsyn region hogCommentString contained oneline start='\S\s\+\#+'ms=s+1 end='\#'syn match   hogJunk "\<\a\+|\s\+$" syn match   hogNumber contained	"\<\d\+\>"syn region  hogText contained oneline start='\S' end=',' skipwhitesyn region  hogTexts contained oneline start='\S' end=';' skipwhite" Environment Variables" ====================="syn match hogEnvvar contained	"[\!]\=\$\I\i*""syn match hogEnvvar contained	"[\!]\=\${\I\i*}"syn match hogEnvvar contained	"\$\I\i*"syn match hogEnvvar contained	"[\!]\=\${\I\i*}"" String handling lifted from vim.vim written by Dr. Charles E. Campbell, Jr." <Charles.E.Campbell.1@gsfc.nasa.gov>" Try to catch strings, if nothing else matches (therefore it must precede the others!)" vmEscapeBrace handles ["]  []"] (ie. stays as string)syn region       hogEscapeBrace   oneline contained transparent     start="[^\\]\(\\\\\)*\[\^\=\]\=" skip="\\\\\|\\\]" end="\]"me=e-1syn match        hogPatSep        contained        "\\[|()]"syn match        hogNotPatSep     contained        "\\\\"syn region       hogString        oneline          start=+[^:a-zA-Z\->!\\]"+hs=e+1 skip=+\\\\\|\\"+ end=+"\s*;+he=s-1                contains=hogEscapeBrace,hogPatSep,hogNotPatSep oneline""syn region       hogString        oneline          start=+[^:a-zA-Z>!\\]'+lc=1 skip=+\\\\\|\\'+ end=+'+                contains=hogEscapeBrace,vimPatSep,hogNotPatSep"syn region       hogString        oneline          start=+=!+lc=1   skip=+\\\\\|\\!+ end=+!+                           contains=hogEscapeBrace,hogPatSep,hogNotPatSep"syn region       hogString        oneline          start="=+"lc=1   skip="\\\\\|\\+" end="+"                           contains=hogEscapeBrace,hogPatSep,hogNotPatSep"syn region       hogString        oneline          start="[^\\]+\s*[^a-zA-Z0-9.]"lc=1 skip="\\\\\|\\+" end="+"         contains=hogEscapeBrace,hogPatSep,hogNotPatSep"syn region       hogString        oneline          start="\s/\s*\A"lc=1 skip="\\\\\|\\+" end="/"                       contains=hogEscapeBrace,hogPatSep,hogNotPatSep"syn match        hogString        contained        +"[^"]*\\$+      skipnl nextgroup=hogStringCont"syn match        hogStringCont    contained        +\(\\\\\|.\)\{-}[^\\]"+" Beginners - Patterns that involve ^"syn match  hogLineComment	+^[ \t]*#.*$+	contains=hogTodo,hogCommentString,hogCommentTitlesyn match  hogCommentTitle	'#\s*\u\a*\(\s\+\u\a*\)*:'ms=s+1 containedsyn keyword hogTodo contained	TODO" Rule keywordssyn match   hogARPCOpt contained "\d\+,\*,\*"syn match   hogARPCOpt contained "\d\+,\d\+,\*"syn match   hogARPCOpt contained "\d\+,\*,\d\+"syn match   hogARPCOpt contained "\d\+,\d\+,\d"syn match   hogATAGOpt contained "session"syn match   hogATAGOpt contained "host"syn match   hogATAGOpt contained "dst"syn match   hogATAGOpt contained "src"syn match   hogATAGOpt contained "seconds"syn match   hogATAGOpt contained "packets"syn match   hogATAGOpt contained "bytes"syn keyword hogARespOpt contained rst_snd rst_rcv rst_all skipwhitesyn keyword hogARespOpt contained icmp_net icmp_host icmp_port icmp_all skipwhitesyn keyword hogAReactOpt contained block warn msg skipwhitesyn match   hogAReactOpt contained "proxy\d\+" skipwhitesyn keyword hogAFOpt contained logto content_list skipwhitesyn keyword hogAIPOptVal contained  eol nop ts sec lsrr lsrre satid ssrr rr skipwhitesyn keyword hogARefGrps contained arachnids skipwhitesyn keyword hogARefGrps contained bugtraq skipwhitesyn keyword hogARefGrps contained cve skipwhitesyn keyword hogSessionVal contained  printable all skipwhitesyn match   hogAFlagOpt contained "[0FSRPAUfsrpau21]\+" skipwhitesyn match   hogAFragOpt contained "[DRMdrm]\+" skipwhite"" Output syslog options" Facilitiessyn keyword hogSysFac contained LOG_AUTH LOG_AUTHPRIV LOG_DAEMON LOG_LOCAL0 syn keyword hogSysFac contained LOG_LOCAL1 LOG_LOCAL2 LOG_LOCAL3 LOG_LOCAL4 syn keyword hogSysFac contained LOG_LOCAL5 LOG_LOCAL6 LOG_LOCAL7 LOG_USER " Prioritiessyn keyword hogSysPri contained LOG_EMERG ALERT LOG_CRIT LOG_ERR syn keyword hogSysPri contained LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBUG " Optionssyn keyword hogSysOpt contained LOG_CONS LOG_NDELAY LOG_PERROR syn keyword hogSysOpt contained LOG_PID " RuleTypessyn keyword hogRuleType contained log pass alert activate dynamic" Output log_database arguments and parameters" Type of database followed by ," syn keyword hogDBSQL contained mysql postgresql unixodbc" Parameters param=constant" are just various constants assigned to parameter names" Output log_database arguments and parameters" Type of database followed by ,syn keyword hogDBType contained alert logsyn keyword hogDBSRV contained mysql postgresql unixodbc" Parameters param=constant" are just various constants assigned to parameter namessyn keyword hogDBParam contained dbname host port user password sensor_name " Output xml arguments and parameters" xml argssyn keyword hogXMLArg  contained log alertsyn keyword hogXMLParam contained file protocol host port cert key ca server sanitize encoding detail"" hog rule handler '(.*)'syn region  hogAOpt contained oneline start="rpc" end=":"me=e-1 nextgroup=hogARPCOptGrp skipwhitesyn region  hogARPCOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogARPCOpt skipwhitesyn region  hogAOpt contained oneline start="tag" end=":"me=e-1 nextgroup=hogATAGOptGrp skipwhitesyn region  hogATAGOptGrp contained oneline start="."hs=s+1 skip="," end=";"me=e-1 contains=hogATAGOpt,hogNumber skipwhite"syn region  hogAOpt contained oneline start="nocase\|sameip" end=";"me=e-1 skipwhite oneline keepend"syn region  hogAOpt contained start="resp" end=":"me=e-1 nextgroup=hogARespOpts skipwhitesyn region  hogARespOpts contained oneline start="." end="[,;]" contains=hogARespOpt skipwhite nextgroup=hogARespOpts"syn region  hogAOpt contained start="react" end=":"me=e-1 nextgroup=hogAReactOpts skipwhitesyn region  hogAReactOpts contained oneline start="." end="[,;]" contains=hogAReactOpt skipwhite nextgroup=hogAReactOptssyn region  hogAOpt contained oneline start="depth\|seq\|ttl\|ack\|icmp_seq\|activates\|activated_by\|dsize\|icode\|icmp_id\|count\|itype\|tos\|id\|offset" end=":"me=e-1 nextgroup=hogANOptGrp skipwhitesyn region  hogANOptGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogNumber skipwhite oneline keependsyn region  hogAOpt contained oneline start="classtype" end=":"me=e-1 nextgroup=hogAFileGrp skipwhitesyn region  hogAOpt contained oneline start="regex\|msg\|content" end=":"me=e-1 nextgroup=hogAStrGrp skipwhite"syn region  hogAStrGrp contained oneline start=+:\s*"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keependsyn region  hogAStrGrp contained oneline start=+:\s*"\|:"+hs=s+1 skip="\\;" end=+"\s*;+he=s-1 contains=hogString skipwhite oneline keependsyn region  hogAOpt contained oneline start="logto\|content-list" end=":"me=e-1 nextgroup=hogAFileGrp skipwhitesyn region  hogAFileGrp contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogFileName skipwhitesyn region  hogAOpt contained oneline start="reference" end=":"me=e-1 nextgroup=hogARefGrp skipwhitesyn region  hogARefGrp contained oneline start="."hs=s+1 end=","me=e-1 contains=hogARefGrps nextgroup=hogARefName skipwhitesyn region  hogARefName contained oneline start="."hs=s+1 end=";"me=e-1 contains=hogString,hogFileName,hogNumber skipwhitesyn region  hogAOpt contained oneline start="flags" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keependsyn region  hogAOpt contained oneline start="fragbits" end=":"he=s-1 nextgroup=hogAFlagOpt skipwhite oneline keependsyn region  hogAOpt contained oneline start="ipopts" end=":"he=s-1 nextgroup=hogAIPOptVal skipwhite oneline keepend"syn region  hogAOpt contained oneline start="." end=":"he=s-1 contains=hogAFOpt nextgroup=hogFileName skipwhitesyn region  hogAOpt contained oneline start="session" end=":"he=s-1 nextgroup=hogSessionVal skipwhitesyn match   nothing  "$"syn region  hogRules oneline  contains=nothing start='$' end="$" syn region  hogRules oneline  contains=hogRule start='('ms=s+1 end=")\s*$" skipwhitesyn region  hogRule  contained oneline start="." skip="\\;" end=";"he=s-1 contains=hogAOpts, skipwhite keepend"syn region  hogAOpts contained oneline start="." end="[;]"he=s-1 contains=hogAOpt skipwhitesyn region  hogAOpts contained oneline start="." end="[;]"me=e-1 contains=hogAOpt skipwhite" ruletype commandsyn keyword hogRTypeStart skipwhite ruletype nextgroup=hogRuleName skipwhite syn region  hogRuleName  contained  start="." end="\s" contains=hogFileName  nextgroup=hogRTypeRegion" type ruletype sub typesyn region hogRtypeRegion contained start="{" end="}" nextgroup=hogRTypeStartsyn keyword hogRTypeStart skipwhite type nextgroup=hogRuleTypes skipwhitesyn region  hogRuleTypes  contained  start="." end="\s" contains=hogRuleType nextgroup=hogOutStart" var commandsyn keyword hogVarStart skipwhite var nextgroup=hogVarIdent skipwhite syn region  hogVarIdent contained  start="."hs=e+1 end="\s\+"he=s-1 contains=hogEnvvar nextgroup=hogVarRegion skipwhite syn region  hogVarRegion  contained  oneline  start="." contains=hogIPaddr,hogEnvvar,hogNumber,hogString,hogFileName end="$"he=s-1 keepend skipwhite