2 * traffic-analyzer VFS module. Measure the smb traffic users create
5 * Copyright (C) Holger Hetterich, 2008
6 * Copyright (C) Jeremy Allison, 2008
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 /* abstraction for the send_over_network function */
26 enum sock_type
{INTERNET_SOCKET
= 0, UNIX_DOMAIN_SOCKET
};
28 #define LOCAL_PATHNAME "/var/tmp/stadsocket"
30 static int vfs_smb_traffic_analyzer_debug_level
= DBGC_VFS
;
32 static enum sock_type
smb_traffic_analyzer_connMode(vfs_handle_struct
*handle
)
34 connection_struct
*conn
= handle
->conn
;
36 Mode
=lp_parm_const_string(SNUM(conn
), "smb_traffic_analyzer","mode", \
38 if (strstr(Mode
,"unix_domain_socket")) {
39 return UNIX_DOMAIN_SOCKET
;
41 return INTERNET_SOCKET
;
46 /* Connect to an internet socket */
48 static int smb_traffic_analyzer_connect_inet_socket(vfs_handle_struct
*handle
,
49 const char *name
, uint16_t port
)
51 /* Create a streaming Socket */
53 struct addrinfo hints
;
54 struct addrinfo
*ailist
= NULL
;
55 struct addrinfo
*res
= NULL
;
59 /* By default make sure it supports TCP. */
60 hints
.ai_socktype
= SOCK_STREAM
;
61 hints
.ai_flags
= AI_ADDRCONFIG
;
63 ret
= getaddrinfo(name
,
69 DEBUG(3,("smb_traffic_analyzer_connect_inet_socket: "
70 "getaddrinfo failed for name %s [%s]\n",
76 DEBUG(3,("smb_traffic_analyzer: Internet socket mode. Hostname: %s,"
77 "Port: %i\n", name
, port
));
79 for (res
= ailist
; res
; res
= res
->ai_next
) {
80 struct sockaddr_storage ss
;
82 if (!res
->ai_addr
|| res
->ai_addrlen
== 0) {
87 memcpy(&ss
, res
->ai_addr
, res
->ai_addrlen
);
89 sockfd
= open_socket_out(SOCK_STREAM
, &ss
, port
, 10000);
100 DEBUG(1, ("smb_traffic_analyzer: unable to create "
101 "socket, error is %s",
109 /* Connect to a unix domain socket */
111 static int smb_traffic_analyzer_connect_unix_socket(vfs_handle_struct
*handle
,
114 /* Create the socket to stad */
116 struct sockaddr_un remote
;
118 DEBUG(7, ("smb_traffic_analyzer_connect_unix_socket: "
119 "Unix domain socket mode. Using %s\n",
122 if ((sock
= socket(AF_UNIX
, SOCK_STREAM
, 0)) == -1) {
123 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
124 "Couldn't create socket, "
125 "make sure stad is running!\n"));
128 remote
.sun_family
= AF_UNIX
;
129 strlcpy(remote
.sun_path
, name
,
130 sizeof(remote
.sun_path
));
131 len
=strlen(remote
.sun_path
) + sizeof(remote
.sun_family
);
132 if (connect(sock
, (struct sockaddr
*)&remote
, len
) == -1 ) {
133 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
134 "Could not connect to "
135 "socket, make sure\nstad is running!\n"));
142 /* Private data allowing shared connection sockets. */
144 struct refcounted_sock
{
145 struct refcounted_sock
*next
, *prev
;
149 unsigned int ref_count
;
152 /* Send data over a socket */
154 static void smb_traffic_analyzer_send_data(vfs_handle_struct
*handle
,
156 const char *file_name
,
159 struct refcounted_sock
*rf_sock
= NULL
;
162 struct tm
*tm
= NULL
;
165 char *username
= NULL
;
166 const char *anon_prefix
= NULL
;
167 const char *total_anonymization
= NULL
;
170 SMB_VFS_HANDLE_GET_DATA(handle
, rf_sock
, struct refcounted_sock
, return);
172 if (rf_sock
== NULL
|| rf_sock
->sock
== -1) {
173 DEBUG(1, ("smb_traffic_analyzer_send_data: socket is "
179 tv_sec
= convert_timespec_to_time_t(convert_timeval_to_timespec(tv
));
180 tm
= localtime(&tv_sec
);
184 seconds
=(float) (tv
.tv_usec
/ 1000);
186 /* check if anonymization is required */
188 total_anonymization
=lp_parm_const_string(SNUM(handle
->conn
),"smb_traffic_analyzer",
189 "total_anonymization", NULL
);
191 anon_prefix
=lp_parm_const_string(SNUM(handle
->conn
),"smb_traffic_analyzer",\
192 "anonymize_prefix", NULL
);
193 if (anon_prefix
!=NULL
) {
194 if (total_anonymization
!=NULL
) {
195 username
= talloc_asprintf(talloc_tos(),
199 username
= talloc_asprintf(talloc_tos(),
203 handle
->conn
->server_info
->sanitized_username
) );
207 username
= handle
->conn
->server_info
->sanitized_username
;
214 str
= talloc_asprintf(talloc_tos(),
215 "V1,%u,\"%s\",\"%s\",\"%c\",\"%s\",\"%s\","
216 "\"%04d-%02d-%02d %02d:%02d:%02d.%03d\"\n",
217 (unsigned int)result
,
219 pdb_get_domain(handle
->conn
->server_info
->sam_account
),
221 handle
->conn
->connectpath
,
237 DEBUG(10, ("smb_traffic_analyzer_send_data_socket: sending %s\n",
239 if (write_data(rf_sock
->sock
, str
, len
) != len
) {
240 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
241 "error sending data to socket!\n"));
246 static struct refcounted_sock
*sock_list
;
248 static void smb_traffic_analyzer_free_data(void **pptr
)
250 struct refcounted_sock
*rf_sock
= *(struct refcounted_sock
**)pptr
;
251 if (rf_sock
== NULL
) {
254 rf_sock
->ref_count
--;
255 if (rf_sock
->ref_count
!= 0) {
258 if (rf_sock
->sock
!= -1) {
259 close(rf_sock
->sock
);
261 DLIST_REMOVE(sock_list
, rf_sock
);
262 TALLOC_FREE(rf_sock
);
265 static int smb_traffic_analyzer_connect(struct vfs_handle_struct
*handle
,
269 connection_struct
*conn
= handle
->conn
;
270 enum sock_type st
= smb_traffic_analyzer_connMode(handle
);
271 struct refcounted_sock
*rf_sock
= NULL
;
272 const char *name
= (st
== UNIX_DOMAIN_SOCKET
) ? LOCAL_PATHNAME
:
273 lp_parm_const_string(SNUM(conn
),
274 "smb_traffic_analyzer",
275 "host", "localhost");
276 uint16_t port
= (st
== UNIX_DOMAIN_SOCKET
) ? 0 :
277 atoi( lp_parm_const_string(SNUM(conn
),
278 "smb_traffic_analyzer", "port", "9430"));
280 /* Are we already connected ? */
281 for (rf_sock
= sock_list
; rf_sock
; rf_sock
= rf_sock
->next
) {
282 if (port
== rf_sock
->port
&&
283 (strcmp(name
, rf_sock
->name
) == 0)) {
288 /* If we're connected already, just increase the
289 * reference count. */
291 rf_sock
->ref_count
++;
293 /* New connection. */
294 rf_sock
= TALLOC_ZERO_P(NULL
, struct refcounted_sock
);
295 if (rf_sock
== NULL
) {
299 rf_sock
->name
= talloc_strdup(rf_sock
, name
);
300 if (rf_sock
->name
== NULL
) {
301 TALLOC_FREE(rf_sock
);
305 rf_sock
->port
= port
;
306 rf_sock
->ref_count
= 1;
308 if (st
== UNIX_DOMAIN_SOCKET
) {
309 rf_sock
->sock
= smb_traffic_analyzer_connect_unix_socket(handle
,
313 rf_sock
->sock
= smb_traffic_analyzer_connect_inet_socket(handle
,
317 if (rf_sock
->sock
== -1) {
318 TALLOC_FREE(rf_sock
);
321 DLIST_ADD(sock_list
, rf_sock
);
324 /* Store the private data. */
325 SMB_VFS_HANDLE_SET_DATA(handle
, rf_sock
, smb_traffic_analyzer_free_data
,
326 struct refcounted_sock
, return -1);
327 return SMB_VFS_NEXT_CONNECT(handle
, service
, user
);
330 /* VFS Functions: write, read, pread, pwrite for now */
332 static ssize_t
smb_traffic_analyzer_read(vfs_handle_struct
*handle
, \
333 files_struct
*fsp
, void *data
, size_t n
)
337 result
= SMB_VFS_NEXT_READ(handle
, fsp
, data
, n
);
338 DEBUG(10, ("smb_traffic_analyzer_read: READ: %s\n", fsp
->fsp_name
));
340 smb_traffic_analyzer_send_data(handle
,
348 static ssize_t
smb_traffic_analyzer_pread(vfs_handle_struct
*handle
, \
349 files_struct
*fsp
, void *data
, size_t n
, SMB_OFF_T offset
)
353 result
= SMB_VFS_NEXT_PREAD(handle
, fsp
, data
, n
, offset
);
355 DEBUG(10, ("smb_traffic_analyzer_pread: PREAD: %s\n", fsp
->fsp_name
));
357 smb_traffic_analyzer_send_data(handle
,
365 static ssize_t
smb_traffic_analyzer_write(vfs_handle_struct
*handle
, \
366 files_struct
*fsp
, const void *data
, size_t n
)
370 result
= SMB_VFS_NEXT_WRITE(handle
, fsp
, data
, n
);
372 DEBUG(10, ("smb_traffic_analyzer_write: WRITE: %s\n", fsp
->fsp_name
));
374 smb_traffic_analyzer_send_data(handle
,
381 static ssize_t
smb_traffic_analyzer_pwrite(vfs_handle_struct
*handle
, \
382 files_struct
*fsp
, const void *data
, size_t n
, SMB_OFF_T offset
)
386 result
= SMB_VFS_NEXT_PWRITE(handle
, fsp
, data
, n
, offset
);
388 DEBUG(10, ("smb_traffic_analyzer_pwrite: PWRITE: %s\n", fsp
->fsp_name
));
390 smb_traffic_analyzer_send_data(handle
,
397 /* VFS operations we use */
399 static vfs_op_tuple smb_traffic_analyzer_tuples
[] = {
401 {SMB_VFS_OP(smb_traffic_analyzer_connect
), SMB_VFS_OP_CONNECT
,
402 SMB_VFS_LAYER_LOGGER
},
403 {SMB_VFS_OP(smb_traffic_analyzer_read
), SMB_VFS_OP_READ
,
404 SMB_VFS_LAYER_LOGGER
},
405 {SMB_VFS_OP(smb_traffic_analyzer_pread
), SMB_VFS_OP_PREAD
,
406 SMB_VFS_LAYER_LOGGER
},
407 {SMB_VFS_OP(smb_traffic_analyzer_write
), SMB_VFS_OP_WRITE
,
408 SMB_VFS_LAYER_LOGGER
},
409 {SMB_VFS_OP(smb_traffic_analyzer_pwrite
), SMB_VFS_OP_PWRITE
,
410 SMB_VFS_LAYER_LOGGER
},
411 {SMB_VFS_OP(NULL
),SMB_VFS_OP_NOOP
,SMB_VFS_LAYER_NOOP
}
414 /* Module initialization */
416 NTSTATUS
vfs_smb_traffic_analyzer_init(void)
418 NTSTATUS ret
= smb_register_vfs(SMB_VFS_INTERFACE_VERSION
, \
419 "smb_traffic_analyzer", smb_traffic_analyzer_tuples
);
421 if (!NT_STATUS_IS_OK(ret
)) {
425 vfs_smb_traffic_analyzer_debug_level
=
426 debug_add_class("smb_traffic_analyzer");
428 if (vfs_smb_traffic_analyzer_debug_level
== -1) {
429 vfs_smb_traffic_analyzer_debug_level
= DBGC_VFS
;
430 DEBUG(1, ("smb_traffic_analyzer_init: Couldn't register custom"
431 "debugging class!\n"));
433 DEBUG(3, ("smb_traffic_analyzer_init: Debug class number of"
434 "'smb_traffic_analyzer': %d\n", \
435 vfs_smb_traffic_analyzer_debug_level
));