From bf17668d568eb8bb2dd2f80a84f545bf3dc80300 Mon Sep 17 00:00:00 2001
From: Jesse Portnoy <jesse@packman.io>
Date: Tue, 25 Mar 2025 15:49:23 +0000
Subject: [PATCH] Added tcpdump lexer Some indentation fixes

---
 syntax_files/markdown.yaml   | 37 ++++++++++++++++++------------------
 syntax_files/server-log.yaml |  4 ++--
 syntax_files/sh.yaml         |  2 +-
 syntax_files/tcpdump.yaml    | 16 ++++++++++++++++
 4 files changed, 38 insertions(+), 21 deletions(-)
 create mode 100644 syntax_files/tcpdump.yaml

diff --git a/syntax_files/markdown.yaml b/syntax_files/markdown.yaml
index bcf629d..8376ff8 100644
--- a/syntax_files/markdown.yaml
+++ b/syntax_files/markdown.yaml
@@ -1,3 +1,4 @@
+---
 filetype: markdown
 
 detect:
@@ -7,43 +8,43 @@ rules:
     # Tables (Github extension)
     - type: ".*[ :]\\|[ :].*"
 
-      # quotes
-    - statement:  "^>.*"
+    # quotes
+    - statement: "^>.*"
 
-      # Emphasis
+    # Emphasis
     - type: "(^|[[:space:]])(_[^ ][^_]*_|\\*[^ ][^*]*\\*)"
 
-      # Strong emphasis
+    # Strong emphasis
     - type: "(^|[[:space:]])(__[^ ][^_]*__|\\*\\*[^ ][^*]*\\*\\*)"
 
-      # strike-through
+    # strike-through
     - type: "(^|[[:space:]])~~[^ ][^~]*~~"
 
-      # horizontal rules
+    # horizontal rules
     - special: "^(---+|===+|___+|\\*\\*\\*+)\\s*$"
 
-      # headlines
-    - special:  "^#{1,6}.*"
+    # headlines
+    - special: "^#{1,6}.*"
 
-      # lists
-    - identifier:   "^[[:space:]]*[\\*+-] |^[[:space:]]*[0-9]+\\. "
+    # lists
+    - identifier: "^[[:space:]]*[\\*+-] |^[[:space:]]*[0-9]+\\. "
 
-      # misc
-    - preproc:   "(\\(([CcRr]|[Tt][Mm])\\)|\\.{3}|(^|[[:space:]])\\-\\-($|[[:space:]]))"
+    # misc
+    - preproc: "(\\(([CcRr]|[Tt][Mm])\\)|\\.{3}|(^|[[:space:]])\\-\\-($|[[:space:]]))"
 
-      # links
+    # links
     - constant: "\\[[^]]+\\]"
     - constant: "\\[([^][]|\\[[^]]*\\])*\\]\\([^)]+\\)"
 
-      # images
+    # images
     - underlined: "!\\[[^][]*\\](\\([^)]+\\)|\\[[^]]+\\])"
 
-      # urls
+    # urls
     - underlined: "https?://[^ )>]+"
 
     - special: "^```$"
 
     - special:
-        start: "`"
-        end: "`"
-        rules: []
+          start: "`"
+          end: "`"
+          rules: []
diff --git a/syntax_files/server-log.yaml b/syntax_files/server-log.yaml
index a640a96..a7e1774 100644
--- a/syntax_files/server-log.yaml
+++ b/syntax_files/server-log.yaml
@@ -1,3 +1,4 @@
+---
 filetype: serverlog
 
 detect:
@@ -8,8 +9,7 @@ rules:
     - preproc: "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
     - preproc: "\\\\."
     - preproc: "(\\[(error|warning|info|warn)\\])"
-    - constant.specialChar: "((GET|POST|HEAD)\\ [^\\ ]+)" 
+    - constant.specialChar: "((GET|POST|HEAD)\\ [^\\ ]+)"
     - comment: "(referer\\: .*)"
     - statement: "[[:space:]]([0-9~:.]{2,}[-+:.0-9a-z~]+)[[:space:]]"
     - type: "(Mozilla|Chrome|Safari|Firefox|AppleWebKit|Linux x86_64|Gecko|Windows|Mac)"
-
diff --git a/syntax_files/sh.yaml b/syntax_files/sh.yaml
index e102845..b87026b 100644
--- a/syntax_files/sh.yaml
+++ b/syntax_files/sh.yaml
@@ -12,7 +12,7 @@ rules:
       # Shell commands
     - type: "\\b(cd|echo|export|let|set|umask|unset)\\b"
       # Common linux commands
-    - type: "\\b((g|ig)?awk|bash|dash|find|\\w{0,4}grep|kill|killall|\\w{0,4}less|make|pkill|sed|sh|tar|ping|traceroute|service|apt|apt-get|aptitude|yum)\\b"
+    - type: "\\b((g|ig)?awk|bash|dash|find|\\w{0,4}grep|kill|killall|\\w{0,4}less|make|pkill|sed|sh|tar|ping|traceroute|service|dpkg|apt|apt-get|apt-cache|aptitude|dpkg-buildpackage|yum)\\b"
       # Coreutils commands
     - type: "\\b(which|sudo|base64|basename|cat|chcon|chgrp|chmod|chown|chroot|cksum|comm|cp|csplit|cut|date|(l)?dd|df|dir|dircolors|dirname|du|env|expand|expr|factor|false|fmt|fold|head|hostid|id|install|join|link|ln|logname|ls|md5sum|mkdir|mkfifo|mknod|mktemp|mv|nice|nl|nohup|nproc|numfmt|od|paste|pathchk|pinky|pr|printenv|printf|ptx|pwd|readlink|realpath|rm|rmdir|runcon|seq|(sha1|sha224|sha256|sha384|sha512)sum|shred|shuf|sleep|sort|split|stat|stdbuf|stty|sum|sync|tac|tail|tee|test|time|timeout|touch|tr|true|truncate|tsort|tty|uname|unexpand|uniq|unlink|users|vdir|wc|who|whoami|yes)\\b"
     - identifier.var: "(^([[:space:]]+)?[A-Za-z0-9_]+)"
diff --git a/syntax_files/tcpdump.yaml b/syntax_files/tcpdump.yaml
new file mode 100644
index 0000000..fef583f
--- /dev/null
+++ b/syntax_files/tcpdump.yaml
@@ -0,0 +1,16 @@
+---
+filetype: tcpdump
+
+detect:
+    filename: "\\.tcpdump$"
+
+rules:
+    - yellow: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.([0-9]+|[a-z]+)"
+    - constant.number: "(\\[[^]]+\\])"
+    - preproc: "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
+    - cyan: "^(\\d+):(\\d+):(\\d+)"
+    - red: "(\\s+\\d+)/(\\w+).*"
+    - magenta: "options\\s\\[.*\\].*"
+    - magenta: "\\s+([a-zA-Z-]+)$"
+    - comment: "\\s(seq|ack|win|IP)\\s"
+    - yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"