Zeek.YAML-tmLanguage

# [PackageDev] target_format: plist, ext: tmLanguage
---
name: Zeek
scopeName: source.zeek
fileTypes: [bro, zeek]
uuid: d27211b1-e07c-4c8d-9d7e-13daa805693c

patterns:

- begin: (##!|##<|##|#)
  name: comment.line.zeek
  beginCaptures:
    '1': {name: punctuation.definition.comment.zeek}
  end: $

- begin: (\")
  name: string.quoted.double.zeek
  beginCaptures:
    '1': {name: punctuation.definition.string.begin.zeek}
  end: (\")
  endCaptures:
    '1': {name: punctuation.definition.string.end.zeek}
  patterns:
    - name: constant.character.escape.zeek
      match: \\.
    - name: constant.other.placeholder.zeek
      match: '%-?[0-9]*(\.[0-9]+)?[DTdxsefg]'

# This is not the greatest match for patterns.  A more thorough replication of
# the parsing logic would be needed to understand the difference between '/'
# used as a pattern delimiter versus division operator (currently, if there's
# use of two '/' division operators on a given line, that's miss-detected as a
# pattern).
- begin: (/)(?=.*/)
  name: string.regexp.zeek
  beginCaptures:
    '1': {name: punctuation.definition.string.begin.zeek}
  end: (/)
  endCaptures:
    '1': {name: punctuation.definition.string.end.zeek}
  patterns:
    - name: constant.character.escape.zeek
      match: \\.

- match: '(@(load-plugin|load-sigs|load|unload)).*$'
  name: meta.preprocessor.zeek
  captures:
    '1': {name: keyword.other.zeek}

- match: '(@(DEBUG|DIR|FILENAME|deprecated|if|ifdef|ifndef|else|endif))'
  name: meta.preprocessor.zeek
  captures:
    '1': {name: keyword.other.zeek}

- match: '(@prefixes)\s*(\+?=).*$'
  name: meta.preprocessor.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: keyword.operator.zeek}

- match: \&\b(redef|priority|log|optional|default|add_func|delete_func|expire_func|read_expire|write_expire|create_expire|synchronized|persistent|rotate_interval|rotate_size|encrypt|raw_output|mergeable|error_handler|type_column|deprecated|on_change|backend|broker_store|broker_allow_complex_type|is_assigned|is_used)\b
  name: storage.modifier.attribute.zeek

- match: \b(T|F)\b
  name: constant.language.zeek

- match: \b\d{1,5}/(udp|tcp|icmp|unknown)\b
  name: constant.numeric.port.zeek

- match: \b(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\b
  name: constant.numeric.addr.zeek
  comment: IPv4 address

# IPv6 regex not 100% correct: that would take effort.
- match: '\[([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?((25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2})\.(25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2}))?\]'
  name: constant.numeric.addr.zeek
  comment: IPv6 address

- match: '(((?:(\d*\.\d*)([eE][+-]?\d+)?)|(?:(\d*)([eE][+-]?\d+))|(?:(\d*\.\d*)))|\d+)\s*(day|hr|min|msec|usec|sec)s?'
  name: constant.numeric.float.decimal.interval.zeek

- match: '((?:(\d*\.\d*)([eE][+-]?\d+)?)|(?:(\d*)([eE][+-]?\d+))|(?:(\d*\.\d*)))'
  name: constant.numeric.float.decimal.zeek

- match: \b(([A-Za-z0-9][A-Za-z0-9\-]*)(?:\.([A-Za-z0-9][A-Za-z0-9\-]*))+)\b
  name: constant.numeric.hostname.zeek

- match: \b(0x[0-9a-fA-F]+)\b
  name: constant.numeric.integer.hexadecimal.zeek

- match: \b(\d+)\b
  name: constant.numeric.integer.decimal.zeek

- match: '(==)|(!=)|(<=)|(<)|(>=)|(>)'
  name: keyword.operator.zeek

- match: '(&&)|(||)|(!)'
  name: keyword.operator.zeek

- match: '(=)|(\+=)|(-=)'
  name: keyword.operator.zeek

- match: '(\+\+)|(\+)|(--)|(-)|(\*)|(/)|(%)'
  name: keyword.operator.zeek

- match: '(&)|(\|)|(\^)|(~)'
  name: keyword.operator.zeek

- match: \b(in|as|is)\b
  name: keyword.operator.zeek

- match: ';'
  name: punctuation.terminator.zeek

- match: '\??\$'
  name: punctuation.accessor.zeek

- match: '::'
  name: punctuation.accessor.zeek

- match: '(\?)'
  name: keyword.operator.zeek

- match: '(?<=\S)(:)'
  name: punctuation.separator.zeek

- match: '(,)'
  name: punctuation.separator.zeek

- match: '(:)'
  name: keyword.operator.zeek

- match: (module)\s+(([A-Za-z_][A-Za-z_0-9]*)(?:::([A-Za-z_][A-Za-z_0-9]*))*)
  name: meta.namespace.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: entity.name.namespace.zeek}

- match: \b(export)\b
  name: keyword.other.zeek

- match: \b(if|else)\b
  name: keyword.control.conditional.zeek

- match: \b(for|while)\b
  name: keyword.control.zeek

- match: \b(return|break|next|continue|fallthrough)\b
  name: keyword.control.zeek

- match: \b(switch|default|case)\b
  name: keyword.control.zeek

- match: \b(add|delete|copy)\b
  name: keyword.other.zeek

- match: \b(print)\b
  name: keyword.other.zeek

- match: \b(when|timeout|schedule)\b
  name: keyword.control.zeek

- match: '\b(type)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\s*(:)\s*\b(record)\b'
  name: meta.struct.record.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: entity.name.struct.record.zeek}
    '3': {name: punctuation.separator.zeek}
    '4': {name: storage.type.struct.record.zeek keyword.declaration.struct.record.zeek}

- match: '\b(type)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\s*(:)\s*\b(enum)\b'
  name: meta.enum.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: entity.name.enum.zeek}
    '3': {name: punctuation.separator.zeek}
    '4': {name: storage.type.enum.zeek keyword.declaration.enum.zeek}

- match: '\b(type)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\s*(:)'
  name: meta.type.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: entity.name.type.zeek}
    '3': {name: punctuation.separator.zeek}

- match: \b(redef)\s+(record)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\b
  name: meta.struct.record.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: storage.type.struct.record.zeek keyword.declaration.struct.record.zeek}
    '3': {name: entity.name.struct.record.zeek}

- match: \b(redef)\s+(enum)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\b
  name: meta.enum.zeek
  captures:
    '1': {name: keyword.other.zeek}
    '2': {name: storage.type.enum.zeek keyword.declaration.enum.zeek}
    '3': {name: entity.name.enum.zeek}

- match: \b(event)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)(?=\s*\()
  captures:
    '1': {name: storage.type.zeek}
    '2': {name: entity.name.function.event.zeek}

- match: \b(hook)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)(?=\s*\()
  captures:
    '1': {name: storage.type.zeek}
    '2': {name: entity.name.function.hook.zeek}

- match: \b(function)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)(?=\s*\()
  captures:
    '1': {name: storage.type.zeek}
    '2': {name: entity.name.function.zeek}

- match: \b(redef)\b
  name: keyword.other.zeek

- match: \b(any)\b
  name: storage.type.zeek

- match: \b(enum|record|set|table|vector)\b
  name: storage.type.zeek

- match: \b(opaque)\s+(of)\s+((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)\b
  captures:
    '1': {name: storage.type.zeek}
    '2': {name: keyword.operator.zeek}
    '3': {name: storage.type.zeek}

- match: \b(of)\b
  name: keyword.operator.zeek

- match: \b(addr|bool|count|double|file|int|interval|pattern|port|string|subnet|time)\b
  name: storage.type.zeek

- match: \b(function|hook|event)\b
  name: storage.type.zeek

- match: \b(global|local|const|option)\b
  name: storage.modifier.zeek

- match: \b((?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*)(?=\s*\()
  name: entity.name.function.call.zeek

- match: \{
  name: punctuation.section.block.begin.zeek
- match: \}
  name: punctuation.section.block.end.zeek

- match: \[
  name: punctuation.section.brackets.begin.zeek
- match: \]
  name: punctuation.section.brackets.end.zeek

- match: \(
  name: punctuation.section.parens.begin.zeek
- match: \)
  name: punctuation.section.parens.end.zeek

# IDPART:      [A-Za-z_][A-Za-z_0-9]*
# ID:          {{IDPART}}(?:::{{IDPART}})*
# ID:          (?:[A-Za-z_][A-Za-z_0-9]*)(?:::(?:[A-Za-z_][A-Za-z_0-9]*))*
# FUNC_LAHEAD: (?=\s*\()
# FLOAT:       (?:(\d*\.\d*)([eE][+-]?\d+)?)|(?:(\d*)([eE][+-]?\d+))|(?:(\d*\.\d*))
# HOSTPART:    [A-Za-z0-9][A-Za-z0-9\-]*
# HOSTNAME:    {{HOSTPART}}(?:\.{{HOSTPART}})+
# IPV4_NUM:    25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[0-9]{1,2}
# IPV4_ADDR:   (?:{{IPV4_NUM}})\.(?:{{IPV4_NUM}})\.(?:{{IPV4_NUM}})\.(?:{{IPV4_NUM}})
# HEXCHAR:     [0-9a-fA-F]
# HEXTET:      {{HEXCHAR}}{1,4}

# IPV6_8HEXTETS: '\[{{HEXTET}}(?::{{HEXTET}}){7}\]'

# IPV6_6HEXTETS_4DEC: '\[(?:{{HEXTET}}:){6}{{IPV4_ADDR}}\]'

# IPV6_COMPRESSED_LEAD_HEXTETS0: '\[::(?:{{HEXTET}}(?::{{HEXTET}}){0,6})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS1: '\[{{HEXTET}}(?::{{HEXTET}}){0}::(?:{{HEXTET}}(?::{{HEXTET}}){0,5})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS2: '\[{{HEXTET}}(?::{{HEXTET}}){1}::(?:{{HEXTET}}(?::{{HEXTET}}){0,4})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS3: '\[{{HEXTET}}(?::{{HEXTET}}){2}::(?:{{HEXTET}}(?::{{HEXTET}}){0,3})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS4: '\[{{HEXTET}}(?::{{HEXTET}}){3}::(?:{{HEXTET}}(?::{{HEXTET}}){0,2})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS5: '\[{{HEXTET}}(?::{{HEXTET}}){4}::(?:{{HEXTET}}(?::{{HEXTET}}){0,1})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS6: '\[{{HEXTET}}(?::{{HEXTET}}){5}::(?:{{HEXTET}}(?::{{HEXTET}}){0,0})?\]'
# IPV6_COMPRESSED_LEAD_HEXTETS7: '\[{{HEXTET}}(?::{{HEXTET}}){6}::\]'

# IPV6_COMPRESSED: '{{IPV6_COMPRESSED_LEAD_HEXTETS0}}|{{IPV6_COMPRESSED_LEAD_HEXTETS1}}|{{IPV6_COMPRESSED_LEAD_HEXTETS2}}|{{IPV6_COMPRESSED_LEAD_HEXTETS3}}|{{IPV6_COMPRESSED_LEAD_HEXTETS4}}|{{IPV6_COMPRESSED_LEAD_HEXTETS5}}|{{IPV6_COMPRESSED_LEAD_HEXTETS6}}|{{IPV6_COMPRESSED_LEAD_HEXTETS7}}'

# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS0: '\[::(?:{{HEXTET}}(?::{{HEXTET}}){0,4})?{{IPV4_ADDR}}\]'
# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS1: '\[{{HEXTET}}(?::{{HEXTET}}){0}::(?:{{HEXTET}}(?::{{HEXTET}}){0,3})?{{IPV4_ADDR}}\]'
# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS2: '\[{{HEXTET}}(?::{{HEXTET}}){1}::(?:{{HEXTET}}(?::{{HEXTET}}){0,2})?{{IPV4_ADDR}}\]'
# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS3: '\[{{HEXTET}}(?::{{HEXTET}}){2}::(?:{{HEXTET}}(?::{{HEXTET}}){0,1})?{{IPV4_ADDR}}\]'
# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS4: '\[{{HEXTET}}(?::{{HEXTET}}){3}::(?:{{HEXTET}}(?::{{HEXTET}}){0,0})?{{IPV4_ADDR}}\]'
# IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS5: '\[{{HEXTET}}(?::{{HEXTET}}){4}::{{IPV4_ADDR}}\]'

# IPV6_COMPRESSED_HEX4DEC: '{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS0}}|{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS1}}|{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS2}}|{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS3}}|{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS4}}|{{IPV6_COMPRESSED_HEXT4DEC_LEAD_HEXTETS5}}'

# IPV6_ADDR: '{{IPV6_8HEXTETS}}|{{IPV6_6HEXTETS_4DEC}}|{{IPV6_COMPRESSED}}|{{IPV6_COMPRESSED_HEX4DEC}}'

# IP_ADDR: '{{IPV6_ADDR}}|{{IPV4_ADDR}}'