#! /usr/bin/perl -w

# vim:syntax=perl

use strict;
use lib '/usr/local/share/perl5';

package Lire::FTP::IISFtp;

use vars qw/ @ISA /;

use Lire::DlfSchema;
use Lire::W3CExtendedLog;
use Lire::Program qw( :msg );

BEGIN {
    @ISA = qw/Lire::W3CExtendedLog/;
}

my $schema	= Lire::DlfSchema::load_schema( "ftp" );

sub new {
    my $class = shift;
    my $self = $class->SUPER::new( @_ );

    # Use URI type to parse method which looks like [54]created
    $self->{identifier2type}{method} = "uri";
    $self->{ftp_sessions} = {};

    $self;
}

sub build_parser {
    my ( $self ) = shift;
    $self->SUPER::build_parser( @_ );

    my @fields = split /\s+/, $self->{fields};
    my %fields = map { $_ => 1 } @fields;

    # We absolutely need those fields
    die "missing cs-method field\n"
      unless exists $fields{'cs-method'};
    die "missing cs-uri-stem field\n"
      unless exists $fields{'cs-uri-stem'};

    # Create the DLF maker function
    my @dlf_fields = qw/username direction filename/;
    push @dlf_fields, "time"
      if $fields{time};
    push @dlf_fields, "transfer_time"
      if $fields{'time-taken'};
    push @dlf_fields, "file_size"
      if $fields{'cs-bytes'};
    push @dlf_fields, "remote_host"
      if $fields{'c-ip'} || $fields{'c-dns'};

    lr_info( "mapped DLF fields: ", join( ", ", @dlf_fields ) );

    my $dlf_maker = $schema->make_hashref2asciidlf_func( @dlf_fields );
    $self->{ftp_dlf_converter} = sub {
	my $w3c = $self->{w3c_parser}->( $_[0] );

	my( $sess_id, $command ) = $w3c->{'cs-method'} =~ /^\[(\d+)\](.*)$/
	  or die "failed to parse cs-method: $w3c->{'cs-method'}\n";

	my $user = $self->{ftp_sessions}{$sess_id};

	if ( $command eq "USER" ) {
	    $self->{ftp_sessions}{$sess_id} = $w3c->{'cs-uri-stem'};
	} elsif ( $command eq "QUIT" || $command eq 'closed' ) {
	    delete $self->{ftp_sessions}{$sess_id};
	} elsif ( $command eq "created" || $command eq "sent" ) {
	    my %dlf = (
		       time	    => $w3c->{lire_time},
		       username	    => $w3c->{'cs-username'} || $user,
		       filename	    => $w3c->{'cs-uri-stem'},
		       file_size    => $w3c->{'cs-bytes'},
		      );
	    $dlf{transfer_time} = $w3c->{'time-taken'} + 0
	      if ( exists $w3c->{'time-taken'} );

	    $dlf{direction} = $command eq 'created' ? "upload" : "download";

	    if ( $w3c->{'c-dns'} && $w3c->{'c-dns'} ne '-' ) {
		$dlf{remote_host} = $w3c->{'c-dns'};
	    } else {
		$dlf{remote_host} = $w3c->{'c-ip'};
	    }

	    return $dlf_maker->( \%dlf );
	} elsif ( $command eq "PASS" ) {
	    # Nothing to do here;
	} else {
	    lr_warn( "unknown FTP command: $command" );
	}
	return;
    }
}

package main;

use Lire::Program qw( :msg :dlf );

my $lines	= 0;
my $dlflines    = 0;
my $errorlines	= 0;

init_dlf_converter( "ftp" );

my $parser = new Lire::FTP::IISFtp;

# Parse the header
my $line;
while (defined( $line = <> )) {
    last unless $line =~ /^#/;
    $parser->parse_directive( $line );
}

lr_err( "invalid Microsoft FTP IIS Log File: must start by Version and Fields directives" )
  unless defined $parser->{fields} && defined $parser->{version};

my $todlf = $parser->{ftp_dlf_converter};
# Transform into DLF
do {
    $lines++;

    if ( $line =~ /^#/ ) {
	eval {
	    $parser->parse_directive( $line );
	};
	if ( $@ ) {
	    lr_err( $@ );
	    $errorlines++;
	    last;
	}
    } else {
	eval {
	    my $dlf = $todlf->( $line );
	    # Check if line resulted in a file transfer
	    if ( $dlf ) {
		print join( " ", @$dlf), "\n";
		$dlflines++;
	    } 
	};
	if ($@) {
	    lr_warn( $@ );
	    lr_notice( qq{cannot convert line $. "$line" to ftp dlf, skipping} );
	}
    }
    $line = <>;
} while (defined $line);

end_dlf_converter( $lines, $dlflines, $errorlines );

exit 0;

__END__

=pod

=head1 NAME

iis_ftp2dlf - convert Microsoft Ftp Server Logs into DLF

=head1 SYNOPSIS

B<iis_ftp2dlf> I<file>

=head1 DESCRIPTION

B<iis_ftp2dlf> converts Microsoft FTP Server log files into the FTP
DLF format. Those log files are in a format which is based on the W3C
Extended Log Format.

To have the maximum information in you reports, we suggests that you log
the following fields :

time, time-taken, c-dns or c-ip, cs-uri-stem, sc-bytes

We also support the cs-uri field.

Other fields will be ignored.

=head1 LIMITATIONS

The converter doesn't handle aggregation (record with count field) and
will refuse to process those logs. Also it doesn't support changing
the fields in the middle of the log file. This means that all records
in the log file must have the same format.

=head1 AUTHORS

Francis J. Lacoste <flacoste@logreport.org>

=head1 VERSION

$Id: iis_ftp2dlf.in,v 1.2 2002/07/14 21:08:55 flacoste Exp $

=head1 COPYRIGHT

Copyright (C) 2001 Stichting LogReport Foundation LogReport@LogReport.org
 
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
 
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
 
You should have received a copy of the GNU General Public License
along with this program (see COPYING); if not, check with
http://www.gnu.org/copyleft/gpl.html or write to the Free Software 
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.

=cut

# Local Variables:
# mode: cperl
# End:
