Merge remote-tracking branch 'origin/master' into topic/seth/faf-updates

Conflicts:
	scripts/base/frameworks/files/main.bro
	scripts/base/init-bare.bro
	scripts/base/protocols/ftp/file-analysis.bro
	scripts/base/protocols/http/file-analysis.bro
	scripts/base/protocols/irc/file-analysis.bro
	scripts/base/protocols/smtp/file-analysis.bro
	src/const.bif
	src/event.bif
	src/file_analysis/Analyzer.h
	src/file_analysis/file_analysis.bif

src/file_analysis/analyzer/data_event/CMakeLists.txt

@@ -0,0 +1,8 @@
+include(BroPlugin)
+
+include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}
+                           ${CMAKE_CURRENT_BINARY_DIR})
+
+bro_plugin_begin(Bro FileDataEvent)
+bro_plugin_cc(DataEvent.cc Plugin.cc)
+bro_plugin_end()

src/file_analysis/analyzer/data_event/DataEvent.cc

@@ -0,0 +1,67 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#include <string>
+
+#include "DataEvent.h"
+#include "EventRegistry.h"
+#include "Event.h"
+#include "util.h"
+
+using namespace file_analysis;
+
+DataEvent::DataEvent(RecordVal* args, File* file,
+                     EventHandlerPtr ce, EventHandlerPtr se)
+    : file_analysis::Analyzer(args, file), chunk_event(ce), stream_event(se)
+	{
+	}
+
+file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
+	{
+	using BifType::Record::Files::AnalyzerArgs;
+
+	int chunk_off = AnalyzerArgs->FieldOffset("chunk_event");
+	int stream_off = AnalyzerArgs->FieldOffset("stream_event");
+
+	Val* chunk_val = args->Lookup(chunk_off);
+	Val* stream_val = args->Lookup(stream_off);
+
+	if ( ! chunk_val && ! stream_val ) return 0;
+
+	EventHandlerPtr chunk;
+	EventHandlerPtr stream;
+
+	if ( chunk_val )
+		chunk = event_registry->Lookup(chunk_val->AsFunc()->Name());
+
+	if ( stream_val )
+		stream = event_registry->Lookup(stream_val->AsFunc()->Name());
+
+	return new DataEvent(args, file, chunk, stream);
+	}
+
+bool DataEvent::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
+	{
+	if ( ! chunk_event ) return true;
+
+	val_list* args = new val_list;
+	args->append(GetFile()->GetVal()->Ref());
+	args->append(new StringVal(new BroString(data, len, 0)));
+	args->append(new Val(offset, TYPE_COUNT));
+
+	mgr.QueueEvent(chunk_event, args);
+
+	return true;
+	}
+
+bool DataEvent::DeliverStream(const u_char* data, uint64 len)
+	{
+	if ( ! stream_event ) return true;
+
+	val_list* args = new val_list;
+	args->append(GetFile()->GetVal()->Ref());
+	args->append(new StringVal(new BroString(data, len, 0)));
+
+	mgr.QueueEvent(stream_event, args);
+
+	return true;
+	}

src/file_analysis/analyzer/data_event/DataEvent.h

@@ -0,0 +1,69 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#ifndef FILE_ANALYSIS_DATAEVENT_H
+#define FILE_ANALYSIS_DATAEVENT_H
+
+#include <string>
+
+#include "Val.h"
+#include "File.h"
+#include "Analyzer.h"
+
+namespace file_analysis {
+
+/**
+ * An analyzer to send file data to script-layer via events.
+ */
+class DataEvent : public file_analysis::Analyzer {
+public:
+
+	/**
+	 * Generates the event, if any, specified by the "chunk_event" field of this
+	 * analyzer's \c AnalyzerArgs.  This is for non-sequential file data input.
+	 * @param data pointer to start of file data chunk.
+	 * @param len number of bytes in the data chunk.
+	 * @param offset number of bytes from start of file at which chunk occurs.
+	 * @return always true
+	 */
+	virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
+
+	/**
+	 * Generates the event, if any, specified by the "stream_event" field of
+	 * this analyzer's \c AnalyzerArgs.  This is for sequential file data input.
+	 * @param data pointer to start of file data chunk.
+	 * @param len number of bytes in the data chunk.
+	 * @return always true
+	 */
+	virtual bool DeliverStream(const u_char* data, uint64 len);
+
+	/**
+	 * Create a new instance of a DataEvent analyzer.
+	 * @param args the \c AnalyzerArgs value which represents the analyzer.
+	 * @param file the file to which the analyzer will be attached.
+	 * @return the new DataEvent analyzer instance or a null pointer if
+	 *         no "chunk_event" or "stream_event" field was specfied in \a args.
+	 */
+	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+
+protected:
+
+	/**
+	 * Constructor.
+	 * @param args the \c AnalyzerArgs value which represents the analyzer.
+	 * @param file the file to which the analyzer will be attached.
+	 * @param ce pointer to event handler which will be called to receive
+	 *        non-sequential file data.
+	 * @param se pointer to event handler which will be called to receive
+	 *        sequential file data.
+	 */
+	DataEvent(RecordVal* args, File* file,
+	          EventHandlerPtr ce, EventHandlerPtr se);
+
+private:
+	EventHandlerPtr chunk_event;
+	EventHandlerPtr stream_event;
+};
+
+} // namespace file_analysis
+
+#endif

src/file_analysis/analyzer/data_event/Plugin.cc

@@ -0,0 +1,26 @@
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
+
+#include "DataEvent.h"
+
+namespace plugin { namespace Bro_FileDataEvent {
+
+class Plugin : public plugin::Plugin {
+protected:
+	void InitPreScript()
+		{
+		SetName("Bro::FileDataEvent");
+		SetVersion(-1);
+		SetAPIVersion(BRO_PLUGIN_API_VERSION);
+		SetDynamicPlugin(false);
+
+		SetDescription("Delivers file content via events");
+
+		AddComponent(new ::file_analysis::Component("DATA_EVENT",
+		        ::file_analysis::DataEvent::Instantiate));
+		}
+};
+
+Plugin __plugin;
+
+} }