New metadata module

include/yaramod/types/modules/metadata_module.h

@@ -0,0 +1,35 @@
+/**
+ * @file src/types/modules/metadata_module.h
+ * @brief Declaration of MetadataModule.
+ * @copyright (c) 2017 Avast Software, licensed under the MIT license
+ */
+
+#pragma once
+
+#include "yaramod/types/modules/module.h"
+
+namespace yaramod {
+
+/**
+ * Class representing @c metadata module.
+ */
+class MetadataModule : public Module
+{
+public:
+    /// @name Constructors
+    /// @{
+    MetadataModule();
+    /// @}
+
+    /// @name Destructor
+    /// @{
+    virtual ~MetadataModule() override = default;
+    /// @}
+
+    /// @name Initialization method
+    /// @{
+    virtual bool initialize(ImportFeatures features) override;
+    /// @}
+};
+
+}

include/yaramod/types/modules/modules.h

@@ -15,6 +15,7 @@
 #include "yaramod/types/modules/macho_module.h"
 #include "yaramod/types/modules/magic_module.h"
 #include "yaramod/types/modules/math_module.h"
+#include "yaramod/types/modules/metadata_module.h"
 #include "yaramod/types/modules/pe_module.h"
 #include "yaramod/types/modules/phish_module.h"
 #include "yaramod/types/modules/time_module.h"

include/yaramod/types/modules/modules_pool.h

@@ -53,6 +53,7 @@ class ModulesPool {
 		{ "macho",      std::make_shared<MachoModule>()      },
 		{ "magic",      std::make_shared<MagicModule>()      },
 		{ "math",       std::make_shared<MathModule>()       },
+		{ "metadata",   std::make_shared<MetadataModule>()   },
 		{ "pe",         std::make_shared<PeModule>()         },
 		{ "phish",      std::make_shared<PhishModule>()      },
 		{ "time",       std::make_shared<TimeModule>()       }

src/CMakeLists.txt

@@ -25,6 +25,7 @@ set(SOURCES
 	types/modules/pe_module.cpp
 	types/modules/phish_module.cpp
 	types/modules/time_module.cpp
+	types/modules/metadata_module.cpp
 	types/plain_string.cpp
 	types/rule.cpp
 	types/token.cpp

src/types/modules/metadata_module.cpp

@@ -0,0 +1,50 @@
+/**
+ * @file src/types/modules/metadata_module.cpp
+ * @brief Implementation of MetadataModule.
+ * @copyright (c) 2017 Avast Software, licensed under the MIT license
+ */
+
+#include "yaramod/types/expression.h"
+#include "yaramod/types/modules/metadata_module.h"
+#include "yaramod/types/symbol.h"
+
+namespace yaramod {
+
+/**
+ * Constructor.
+ */
+MetadataModule::MetadataModule() : Module("metadata", ImportFeatures::Basic)
+{
+}
+
+/**
+ * Initializes module structure.
+ *
+ * @return @c true if success, otherwise @c false.
+ */
+bool MetadataModule::initialize(ImportFeatures features)
+{
+	using Type = Expression::Type;
+	auto metadataStruct = std::make_shared<StructureSymbol>("metadata");
+
+	auto fileStruct = std::make_shared<StructureSymbol>("file");
+	if (features & ImportFeatures::AvastOnly)
+	{
+		fileStruct->addAttribute(std::make_shared<FunctionSymbol>("name", Type::Int, Type::String));
+		fileStruct->addAttribute(std::make_shared<FunctionSymbol>("name", Type::Int, Type::Regexp));
+	}
+	metadataStruct->addAttribute(fileStruct);
+
+	auto detectionStruct = std::make_shared<StructureSymbol>("detection");
+	if (features & ImportFeatures::AvastOnly)
+	{
+		detectionStruct->addAttribute(std::make_shared<FunctionSymbol>("name", Type::Int, Type::Regexp));
+		detectionStruct->addAttribute(std::make_shared<FunctionSymbol>("name", Type::Int, Type::String, Type::Regexp));
+	}
+	metadataStruct->addAttribute(detectionStruct);
+
+	_structure = metadataStruct;
+	return true;
+}
+
+}

tests/cpp/parser_tests.cpp

@@ -2697,6 +2697,61 @@ rule dummy_rule
 	}
 }
 
+TEST_F(ParserTests,
+MetadataModuleWorks) {
+	prepareInput(
+R"(
+import "metadata"
+
+rule dummny_rule
+{
+	condition:
+		metadata.file.name("filename.txt") and
+		metadata.file.name(/regexp/) and
+		metadata.detection.name(/regexp/) and
+		metadata.detection.name("vps", /regexp/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(metadata.file.name("filename.txt") and metadata.file.name(/regexp/) and metadata.detection.name(/regexp/) and metadata.detection.name("vps", /regexp/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+
+}
+
+TEST_F(ParserTests,
+MetadataModuleUnrecognized) {
+	prepareInput(
+R"(
+import "metadata"
+
+rule dummy_rule
+{
+	condition:
+		metadata.file.name("filename.txt")
+}
+)");
+
+	ParserDriver driverNoAvastSymbols(ImportFeatures::VirusTotal);
+	std::stringstream input2(input_text);
+
+try
+	{
+		driverNoAvastSymbols.parse(input2);
+		FAIL() << "Parser did not throw an exception.";
+	}
+	catch (const ParserError& err)
+	{
+		EXPECT_EQ(0u, driverNoAvastSymbols.getParsedFile().getRules().size());
+		ASSERT_EQ(1u, driverNoAvastSymbols.getParsedFile().getImports().size());
+		EXPECT_EQ("Error at 7.17-20: Unrecognized identifier 'name' referenced", err.getErrorMessage());
+	}
+}
+
 TEST_F(ParserTests,
 CuckooModuleWorks) {
 	prepareInput(