More file analysis updates.

- Recorrected the module name to Files.

  - Added Files::analyzer_name to get a more readable name for a
    file analyzer.

  - Improved and just overall better handled multipart mime
    transfers in HTTP and SMTP.  HTTP now has orig_fuids and resp_fuids
    log fields since multiple "files" can be transferred with
    multipart mime in a single request/response pair.  SMTP has
    an fuids field which has file unique IDs for all parts
    transferred. FTP and IRC have a log field named fuid added
    because only a single file can be transferred per irc and ftp
    log line.

scripts/base/protocols/irc/__load__.bro

@@ -1,3 +1,3 @@
 @load ./main
-#@load ./dcc-send
-@load ./file-analysis
+@load ./dcc-send
+@load ./files

scripts/base/protocols/irc/dcc-send.bro

@@ -49,13 +49,15 @@ function log_dcc(f: fa_file)
 		delete irc$dcc_file_name;
 		delete irc$dcc_file_size;
 		delete irc$dcc_mime_type;
+
+		delete dcc_expected_transfers[cid$resp_h, cid$resp_p];
 		return;
 		}
 	}
 
 event file_new(f: fa_file) &priority=-5
 	{
-	if ( f?$source && f$source == "IRC_DATA" ) 
+	if ( f$source == "IRC_DATA" ) 
 		log_dcc(f);
 	}
 

scripts/base/protocols/irc/files.bro

@@ -0,0 +1,41 @@
+@load ./dcc-send
+@load base/utils/conn-ids
+@load base/frameworks/files
+
+module IRC;
+
+export {
+	redef record Info += {
+		## File unique ID.
+		fuid: string &log &optional;
+	};
+
+	## Default file handle provider for IRC.
+	global get_file_handle: function(c: connection, is_orig: bool): string;
+}
+
+function get_file_handle(c: connection, is_orig: bool): string
+	{
+	if ( [c$id$resp_h, c$id$resp_p] !in dcc_expected_transfers ) 
+		return "";
+
+	return cat(Analyzer::ANALYZER_IRC_DATA, c$start_time, c$id, is_orig);
+	}
+
+event bro_init() &priority=5
+	{
+	Files::register_protocol(Analyzer::ANALYZER_IRC_DATA, IRC::get_file_handle);
+	}
+
+event file_over_new_connection(f: fa_file, c: connection) &priority=5
+	{
+	if ( [c$id$resp_h, c$id$resp_p] !in dcc_expected_transfers ) 
+		return;
+
+	local irc = dcc_expected_transfers[c$id$resp_h, c$id$resp_p];
+	irc$fuid = f$id;
+	if ( irc?$dcc_file_name )
+		f$info$filename = irc$dcc_file_name;
+	if ( f?$mime_type )
+		irc$dcc_mime_type = f$mime_type;
+	}