Merge remote-tracking branch 'origin/master' into topic/seth/faf-updates

Conflicts:
	scripts/base/frameworks/files/main.bro
	scripts/base/init-bare.bro
	scripts/base/protocols/ftp/file-analysis.bro
	scripts/base/protocols/http/file-analysis.bro
	scripts/base/protocols/irc/file-analysis.bro
	scripts/base/protocols/smtp/file-analysis.bro
	src/const.bif
	src/event.bif
	src/file_analysis/Analyzer.h
	src/file_analysis/file_analysis.bif

src/file_analysis/analyzer/extract/CMakeLists.txt

@@ -0,0 +1,8 @@
+include(BroPlugin)
+
+include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}
+                           ${CMAKE_CURRENT_BINARY_DIR})
+
+bro_plugin_begin(Bro FileExtract)
+bro_plugin_cc(Extract.cc Plugin.cc)
+bro_plugin_end()

src/file_analysis/analyzer/extract/Extract.cc

@@ -0,0 +1,48 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#include <string>
+
+#include "Extract.h"
+#include "util.h"
+
+using namespace file_analysis;
+
+Extract::Extract(RecordVal* args, File* file, const string& arg_filename)
+    : file_analysis::Analyzer(args, file), filename(arg_filename)
+	{
+	fd = open(filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0666);
+
+	if ( fd < 0 )
+		{
+		fd = 0;
+		char buf[128];
+		strerror_r(errno, buf, sizeof(buf));
+		reporter->Error("cannot open %s: %s", filename.c_str(), buf);
+		}
+	}
+
+Extract::~Extract()
+	{
+	if ( fd )
+		safe_close(fd);
+	}
+
+file_analysis::Analyzer* Extract::Instantiate(RecordVal* args, File* file)
+	{
+	using BifType::Record::Files::AnalyzerArgs;
+	Val* v = args->Lookup(AnalyzerArgs->FieldOffset("extract_filename"));
+
+	if ( ! v )
+		return 0;
+
+	return new Extract(args, file, v->AsString()->CheckString());
+	}
+
+bool Extract::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
+	{
+	if ( ! fd )
+		return false;
+
+	safe_pwrite(fd, data, len, offset);
+	return true;
+	}

src/file_analysis/analyzer/extract/Extract.h

@@ -0,0 +1,62 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#ifndef FILE_ANALYSIS_EXTRACT_H
+#define FILE_ANALYSIS_EXTRACT_H
+
+#include <string>
+
+#include "Val.h"
+#include "File.h"
+#include "Analyzer.h"
+
+namespace file_analysis {
+
+/**
+ * An analyzer to extract content of files to local disk.
+ */
+class Extract : public file_analysis::Analyzer {
+public:
+
+	/**
+	 * Destructor.  Will close the file that was used for data extraction.
+	 */
+	virtual ~Extract();
+
+	/**
+	 * Write a chunk of file data to the local extraction file.
+	 * @param data pointer to a chunk of file data.
+	 * @param len number of bytes in the data chunk.
+	 * @param offset number of bytes from start of file at which chunk starts.
+	 * @return false if there was no extraction file open and the data couldn't
+	 *         be written, else true.
+	 */
+	virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
+
+	/**
+	 * Create a new instance of an Extract analyzer.
+	 * @param args the \c AnalyzerArgs value which represents the analyzer.
+	 * @param file the file to which the analyzer will be attached.
+	 * @return the new Extract analyzer instance or a null pointer if the
+	 *         the "extraction_file" field of \a args wasn't set.
+	 */
+	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+
+protected:
+
+	/**
+	 * Constructor.
+	 * @param args the \c AnalyzerArgs value which represents the analyzer.
+	 * @param file the file to which the analyzer will be attached.
+	 * @param arg_filename a file system path which specifies the local file
+	 *        to which the contents of the file will be extracted/written.
+	 */
+	Extract(RecordVal* args, File* file, const string& arg_filename);
+
+private:
+	string filename;
+	int fd;
+};
+
+} // namespace file_analysis
+
+#endif

src/file_analysis/analyzer/extract/Plugin.cc

@@ -0,0 +1,26 @@
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
+
+#include "Extract.h"
+
+namespace plugin { namespace Bro_FileExtract {
+
+class Plugin : public plugin::Plugin {
+protected:
+	void InitPreScript()
+		{
+		SetName("Bro::FileExtract");
+		SetVersion(-1);
+		SetAPIVersion(BRO_PLUGIN_API_VERSION);
+		SetDynamicPlugin(false);
+
+		SetDescription("Extract file content to local file system");
+
+		AddComponent(new ::file_analysis::Component("EXTRACT",
+		        ::file_analysis::Extract::Instantiate));
+		}
+};
+
+Plugin __plugin;
+
+} }