?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-dsdb/objectclass: remove duplicated declaration for objectclass_do_add
[Samba.git] / source3 / modules / vfs_time_audit.c
bloba1e825aa09a9307afdda939ac01c4e0a17c5a6f9
1 /*
2 * Time auditing VFS module for samba. Log time taken for VFS call to syslog
3 * facility.
4 *
5 * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 /*
22 * This module implements logging for time taken for all Samba VFS operations.
23 *
24 * vfs objects = time_audit
25 */
26
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "ntioctl.h"
31 #include "lib/util/tevent_unix.h"
32 #include "lib/util/tevent_ntstatus.h"
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_VFS
36
37 static double audit_timeout;
38
39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
40 const char *msg)
41 {
42 DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
43 "(%.2f seconds) %s%s-- Validate that file and storage "
44 "subsystems are operating normally\n", syscallname,
45 elapsed, (msg != NULL) ? msg : "",
46 (msg != NULL) ? " " : ""));
47 }
48
49 static void smb_time_audit_log(const char *syscallname, double elapsed)
50 {
51 smb_time_audit_log_msg(syscallname, elapsed, NULL);
52 }
53
54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
55 const struct files_struct *fsp)
56 {
57 char *base_name = NULL;
58 char *connectpath = NULL;
59 char *msg = NULL;
60
61 if (fsp == NULL) {
62 smb_time_audit_log(syscallname, elapsed);
63 return;
64 }
65 if (fsp->conn)
66 connectpath = fsp->conn->connectpath;
67 if (fsp->fsp_name)
68 base_name = fsp->fsp_name->base_name;
69
70 if (connectpath != NULL && base_name != NULL) {
71 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
72 connectpath, base_name);
73 } else if (connectpath != NULL && base_name == NULL) {
74 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
75 "base_name = <NULL>",
76 connectpath);
77 } else if (connectpath == NULL && base_name != NULL) {
78 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
79 "base_name = \"%s\"",
80 base_name);
81 } else { /* connectpath == NULL && base_name == NULL */
82 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
83 "base_name = <NULL>");
84 }
85 smb_time_audit_log_msg(syscallname, elapsed, msg);
86 TALLOC_FREE(msg);
87 }
88
89 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
90 const char *fname)
91 {
92 char cwd[PATH_MAX];
93 char *msg = NULL;
94
95 if (getcwd(cwd, sizeof(cwd)) == NULL) {
96 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
97 }
98 if (fname != NULL) {
99 msg = talloc_asprintf(talloc_tos(),
100 "cwd = \"%s\", filename = \"%s\"",
101 cwd, fname);
102 } else {
103 msg = talloc_asprintf(talloc_tos(),
104 "cwd = \"%s\", filename = <NULL>",
105 cwd);
106 }
107 smb_time_audit_log_msg(syscallname, elapsed, msg);
108 TALLOC_FREE(msg);
109 }
110
111 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
112 const struct smb_filename *smb_fname)
113 {
114 if (smb_fname != NULL) {
115 smb_time_audit_log_fname(syscallname, elapsed,
116 smb_fname->base_name);
117 } else {
118 smb_time_audit_log_fname(syscallname, elapsed,
119 "smb_fname = <NULL>");
120 }
121 }
122
123 static int smb_time_audit_connect(vfs_handle_struct *handle,
124 const char *svc, const char *user)
125 {
126 int result;
127 struct timespec ts1,ts2;
128 double timediff;
129
130 if (!handle) {
131 return -1;
132 }
133
134 clock_gettime_mono(&ts1);
135 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
136 clock_gettime_mono(&ts2);
137 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
138 if (timediff > audit_timeout) {
139 smb_time_audit_log_msg("connect", timediff, user);
140 }
141 return result;
142 }
143
144 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
145 {
146 struct timespec ts1,ts2;
147 double timediff;
148
149 clock_gettime_mono(&ts1);
150 SMB_VFS_NEXT_DISCONNECT(handle);
151 clock_gettime_mono(&ts2);
152 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
153
154 if (timediff > audit_timeout) {
155 smb_time_audit_log("disconnect", timediff);
156 }
157 }
158
159 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
160 const char *path,
161 bool small_query, uint64_t *bsize,
162 uint64_t *dfree, uint64_t *dsize)
163 {
164 uint64_t result;
165 struct timespec ts1,ts2;
166 double timediff;
167
168 clock_gettime_mono(&ts1);
169 result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
170 dfree, dsize);
171 clock_gettime_mono(&ts2);
172 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
173
174 /* Don't have a reasonable notion of failure here */
175 if (timediff > audit_timeout) {
176 smb_time_audit_log_fname("disk_free", timediff, path);
177 }
178
179 return result;
180 }
181
182 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
183 enum SMB_QUOTA_TYPE qtype, unid_t id,
184 SMB_DISK_QUOTA *qt)
185 {
186 int result;
187 struct timespec ts1,ts2;
188 double timediff;
189
190 clock_gettime_mono(&ts1);
191 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
192 clock_gettime_mono(&ts2);
193 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
194
195 if (timediff > audit_timeout) {
196 smb_time_audit_log("get_quota", timediff);
197 }
198 return result;
199 }
200
201 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
202 enum SMB_QUOTA_TYPE qtype, unid_t id,
203 SMB_DISK_QUOTA *qt)
204 {
205 int result;
206 struct timespec ts1,ts2;
207 double timediff;
208
209 clock_gettime_mono(&ts1);
210 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
211 clock_gettime_mono(&ts2);
212 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
213
214 if (timediff > audit_timeout) {
215 smb_time_audit_log("set_quota", timediff);
216 }
217
218 return result;
219 }
220
221 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
222 struct files_struct *fsp,
223 struct shadow_copy_data *shadow_copy_data,
224 bool labels)
225 {
226 int result;
227 struct timespec ts1,ts2;
228 double timediff;
229
230 clock_gettime_mono(&ts1);
231 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
232 shadow_copy_data, labels);
233 clock_gettime_mono(&ts2);
234 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
235
236 if (timediff > audit_timeout) {
237 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
238 }
239
240 return result;
241 }
242
243 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
244 const char *path,
245 struct vfs_statvfs_struct *statbuf)
246 {
247 int result;
248 struct timespec ts1,ts2;
249 double timediff;
250
251 clock_gettime_mono(&ts1);
252 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
253 clock_gettime_mono(&ts2);
254 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
255
256 if (timediff > audit_timeout) {
257 smb_time_audit_log_fname("statvfs", timediff, path);
258 }
259
260 return result;
261 }
262
263 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
264 enum timestamp_set_resolution *p_ts_res)
265 {
266 uint32_t result;
267 struct timespec ts1,ts2;
268 double timediff;
269
270 clock_gettime_mono(&ts1);
271 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
272 clock_gettime_mono(&ts2);
273 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
274
275 if (timediff > audit_timeout) {
276 smb_time_audit_log("fs_capabilities", timediff);
277 }
278
279 return result;
280 }
281
282 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
283 const char *fname,
284 const char *mask, uint32 attr)
285 {
286 DIR *result;
287 struct timespec ts1,ts2;
288 double timediff;
289
290 clock_gettime_mono(&ts1);
291 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
292 clock_gettime_mono(&ts2);
293 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
294
295 if (timediff > audit_timeout) {
296 smb_time_audit_log_fname("opendir", timediff, fname);
297 }
298
299 return result;
300 }
301
302 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
303 files_struct *fsp,
304 const char *mask, uint32 attr)
305 {
306 DIR *result;
307 struct timespec ts1,ts2;
308 double timediff;
309
310 clock_gettime_mono(&ts1);
311 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
312 clock_gettime_mono(&ts2);
313 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
314
315 if (timediff > audit_timeout) {
316 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
317 }
318
319 return result;
320 }
321
322 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
323 DIR *dirp,
324 SMB_STRUCT_STAT *sbuf)
325 {
326 struct dirent *result;
327 struct timespec ts1,ts2;
328 double timediff;
329
330 clock_gettime_mono(&ts1);
331 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
332 clock_gettime_mono(&ts2);
333 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
334
335 if (timediff > audit_timeout) {
336 smb_time_audit_log("readdir", timediff);
337 }
338
339 return result;
340 }
341
342 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
343 DIR *dirp, long offset)
344 {
345 struct timespec ts1,ts2;
346 double timediff;
347
348 clock_gettime_mono(&ts1);
349 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
350 clock_gettime_mono(&ts2);
351 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
352
353 if (timediff > audit_timeout) {
354 smb_time_audit_log("seekdir", timediff);
355 }
356
357 }
358
359 static long smb_time_audit_telldir(vfs_handle_struct *handle,
360 DIR *dirp)
361 {
362 long result;
363 struct timespec ts1,ts2;
364 double timediff;
365
366 clock_gettime_mono(&ts1);
367 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
368 clock_gettime_mono(&ts2);
369 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
370
371 if (timediff > audit_timeout) {
372 smb_time_audit_log("telldir", timediff);
373 }
374
375 return result;
376 }
377
378 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
379 DIR *dirp)
380 {
381 struct timespec ts1,ts2;
382 double timediff;
383
384 clock_gettime_mono(&ts1);
385 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
386 clock_gettime_mono(&ts2);
387 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
388
389 if (timediff > audit_timeout) {
390 smb_time_audit_log("rewinddir", timediff);
391 }
392
393 }
394
395 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
396 const char *path, mode_t mode)
397 {
398 int result;
399 struct timespec ts1,ts2;
400 double timediff;
401
402 clock_gettime_mono(&ts1);
403 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
404 clock_gettime_mono(&ts2);
405 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
406
407 if (timediff > audit_timeout) {
408 smb_time_audit_log_fname("mkdir", timediff, path);
409 }
410
411 return result;
412 }
413
414 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
415 const char *path)
416 {
417 int result;
418 struct timespec ts1,ts2;
419 double timediff;
420
421 clock_gettime_mono(&ts1);
422 result = SMB_VFS_NEXT_RMDIR(handle, path);
423 clock_gettime_mono(&ts2);
424 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
425
426 if (timediff > audit_timeout) {
427 smb_time_audit_log_fname("rmdir", timediff, path);
428 }
429
430 return result;
431 }
432
433 static int smb_time_audit_closedir(vfs_handle_struct *handle,
434 DIR *dirp)
435 {
436 int result;
437 struct timespec ts1,ts2;
438 double timediff;
439
440 clock_gettime_mono(&ts1);
441 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
442 clock_gettime_mono(&ts2);
443 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
444
445 if (timediff > audit_timeout) {
446 smb_time_audit_log("closedir", timediff);
447 }
448
449 return result;
450 }
451
452 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
453 DIR *dirp)
454 {
455 struct timespec ts1,ts2;
456 double timediff;
457
458 clock_gettime_mono(&ts1);
459 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
460 clock_gettime_mono(&ts2);
461 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
462
463 if (timediff > audit_timeout) {
464 smb_time_audit_log("init_search_op", timediff);
465 }
466 }
467
468 static int smb_time_audit_open(vfs_handle_struct *handle,
469 struct smb_filename *fname,
470 files_struct *fsp,
471 int flags, mode_t mode)
472 {
473 int result;
474 struct timespec ts1,ts2;
475 double timediff;
476
477 clock_gettime_mono(&ts1);
478 result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
479 clock_gettime_mono(&ts2);
480 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
481
482 if (timediff > audit_timeout) {
483 smb_time_audit_log_fsp("open", timediff, fsp);
484 }
485
486 return result;
487 }
488
489 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
490 struct smb_request *req,
491 uint16_t root_dir_fid,
492 struct smb_filename *fname,
493 uint32_t access_mask,
494 uint32_t share_access,
495 uint32_t create_disposition,
496 uint32_t create_options,
497 uint32_t file_attributes,
498 uint32_t oplock_request,
499 struct smb2_lease *lease,
500 uint64_t allocation_size,
501 uint32_t private_flags,
502 struct security_descriptor *sd,
503 struct ea_list *ea_list,
504 files_struct **result_fsp,
505 int *pinfo,
506 const struct smb2_create_blobs *in_context_blobs,
507 struct smb2_create_blobs *out_context_blobs)
508 {
509 NTSTATUS result;
510 struct timespec ts1,ts2;
511 double timediff;
512
513 clock_gettime_mono(&ts1);
514 result = SMB_VFS_NEXT_CREATE_FILE(
515 handle, /* handle */
516 req, /* req */
517 root_dir_fid, /* root_dir_fid */
518 fname, /* fname */
519 access_mask, /* access_mask */
520 share_access, /* share_access */
521 create_disposition, /* create_disposition*/
522 create_options, /* create_options */
523 file_attributes, /* file_attributes */
524 oplock_request, /* oplock_request */
525 lease, /* lease */
526 allocation_size, /* allocation_size */
527 private_flags,
528 sd, /* sd */
529 ea_list, /* ea_list */
530 result_fsp, /* result */
531 pinfo,
532 in_context_blobs, out_context_blobs); /* create context */
533 clock_gettime_mono(&ts2);
534 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
535
536 if (timediff > audit_timeout) {
537 /*
538 * can't use result_fsp this time, may have
539 * invalid content causing smbd crash
540 */
541 smb_time_audit_log_smb_fname("create_file", timediff,
542 fname);
543 }
544
545 return result;
546 }
547
548 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
549 {
550 int result;
551 struct timespec ts1,ts2;
552 double timediff;
553
554 clock_gettime_mono(&ts1);
555 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
556 clock_gettime_mono(&ts2);
557 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
558
559 if (timediff > audit_timeout) {
560 smb_time_audit_log_fsp("close", timediff, fsp);
561 }
562
563 return result;
564 }
565
566 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
567 files_struct *fsp, void *data, size_t n)
568 {
569 ssize_t result;
570 struct timespec ts1,ts2;
571 double timediff;
572
573 clock_gettime_mono(&ts1);
574 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
575 clock_gettime_mono(&ts2);
576 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
577
578 if (timediff > audit_timeout) {
579 smb_time_audit_log_fsp("read", timediff, fsp);
580 }
581
582 return result;
583 }
584
585 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
586 files_struct *fsp,
587 void *data, size_t n, off_t offset)
588 {
589 ssize_t result;
590 struct timespec ts1,ts2;
591 double timediff;
592
593 clock_gettime_mono(&ts1);
594 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
595 clock_gettime_mono(&ts2);
596 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
597
598 if (timediff > audit_timeout) {
599 smb_time_audit_log_fsp("pread", timediff, fsp);
600 }
601
602 return result;
603 }
604
605 struct smb_time_audit_pread_state {
606 struct files_struct *fsp;
607 struct timespec ts1;
608 ssize_t ret;
609 int err;
610 };
611
612 static void smb_time_audit_pread_done(struct tevent_req *subreq);
613
614 static struct tevent_req *smb_time_audit_pread_send(
615 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
616 struct tevent_context *ev, struct files_struct *fsp,
617 void *data, size_t n, off_t offset)
618 {
619 struct tevent_req *req, *subreq;
620 struct smb_time_audit_pread_state *state;
621
622 req = tevent_req_create(mem_ctx, &state,
623 struct smb_time_audit_pread_state);
624 if (req == NULL) {
625 return NULL;
626 }
627 clock_gettime_mono(&state->ts1);
628 state->fsp = fsp;
629
630 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
631 n, offset);
632 if (tevent_req_nomem(subreq, req)) {
633 return tevent_req_post(req, ev);
634 }
635 tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
636 return req;
637 }
638
639 static void smb_time_audit_pread_done(struct tevent_req *subreq)
640 {
641 struct tevent_req *req = tevent_req_callback_data(
642 subreq, struct tevent_req);
643 struct smb_time_audit_pread_state *state = tevent_req_data(
644 req, struct smb_time_audit_pread_state);
645
646 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->err);
647 TALLOC_FREE(subreq);
648 tevent_req_done(req);
649 }
650
651 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req, int *err)
652 {
653 struct smb_time_audit_pread_state *state = tevent_req_data(
654 req, struct smb_time_audit_pread_state);
655 struct timespec ts2;
656 double timediff;
657
658 clock_gettime_mono(&ts2);
659 timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
660
661 if (timediff > audit_timeout) {
662 smb_time_audit_log_fsp("pread", timediff, state->fsp);
663 }
664
665 if (tevent_req_is_unix_error(req, err)) {
666 return -1;
667 }
668 *err = state->err;
669 return state->ret;
670 }
671
672 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
673 files_struct *fsp,
674 const void *data, size_t n)
675 {
676 ssize_t result;
677 struct timespec ts1,ts2;
678 double timediff;
679
680 clock_gettime_mono(&ts1);
681 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
682 clock_gettime_mono(&ts2);
683 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
684
685 if (timediff > audit_timeout) {
686 smb_time_audit_log_fsp("write", timediff, fsp);
687 }
688
689 return result;
690 }
691
692 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
693 files_struct *fsp,
694 const void *data, size_t n,
695 off_t offset)
696 {
697 ssize_t result;
698 struct timespec ts1,ts2;
699 double timediff;
700
701 clock_gettime_mono(&ts1);
702 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
703 clock_gettime_mono(&ts2);
704 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
705
706 if (timediff > audit_timeout) {
707 smb_time_audit_log_fsp("pwrite", timediff, fsp);
708 }
709
710 return result;
711 }
712
713 struct smb_time_audit_pwrite_state {
714 struct files_struct *fsp;
715 struct timespec ts1;
716 ssize_t ret;
717 int err;
718 };
719
720 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
721
722 static struct tevent_req *smb_time_audit_pwrite_send(
723 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
724 struct tevent_context *ev, struct files_struct *fsp,
725 const void *data, size_t n, off_t offset)
726 {
727 struct tevent_req *req, *subreq;
728 struct smb_time_audit_pwrite_state *state;
729
730 req = tevent_req_create(mem_ctx, &state,
731 struct smb_time_audit_pwrite_state);
732 if (req == NULL) {
733 return NULL;
734 }
735 clock_gettime_mono(&state->ts1);
736 state->fsp = fsp;
737
738 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
739 n, offset);
740 if (tevent_req_nomem(subreq, req)) {
741 return tevent_req_post(req, ev);
742 }
743 tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
744 return req;
745 }
746
747 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
748 {
749 struct tevent_req *req = tevent_req_callback_data(
750 subreq, struct tevent_req);
751 struct smb_time_audit_pwrite_state *state = tevent_req_data(
752 req, struct smb_time_audit_pwrite_state);
753
754 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->err);
755 TALLOC_FREE(subreq);
756 tevent_req_done(req);
757 }
758
759 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req, int *err)
760 {
761 struct smb_time_audit_pwrite_state *state = tevent_req_data(
762 req, struct smb_time_audit_pwrite_state);
763 struct timespec ts2;
764 double timediff;
765
766 clock_gettime_mono(&ts2);
767 timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
768
769 if (timediff > audit_timeout) {
770 smb_time_audit_log_fsp("pwrite", timediff, state->fsp);
771 }
772
773 if (tevent_req_is_unix_error(req, err)) {
774 return -1;
775 }
776 *err = state->err;
777 return state->ret;
778 }
779
780 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
781 files_struct *fsp,
782 off_t offset, int whence)
783 {
784 off_t result;
785 struct timespec ts1,ts2;
786 double timediff;
787
788 clock_gettime_mono(&ts1);
789 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
790 clock_gettime_mono(&ts2);
791 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
792
793 if (timediff > audit_timeout) {
794 smb_time_audit_log_fsp("lseek", timediff, fsp);
795 }
796
797 return result;
798 }
799
800 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
801 files_struct *fromfsp,
802 const DATA_BLOB *hdr, off_t offset,
803 size_t n)
804 {
805 ssize_t result;
806 struct timespec ts1,ts2;
807 double timediff;
808
809 clock_gettime_mono(&ts1);
810 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
811 clock_gettime_mono(&ts2);
812 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
813
814 if (timediff > audit_timeout) {
815 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
816 }
817
818 return result;
819 }
820
821 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
822 files_struct *tofsp,
823 off_t offset,
824 size_t n)
825 {
826 ssize_t result;
827 struct timespec ts1,ts2;
828 double timediff;
829
830 clock_gettime_mono(&ts1);
831 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
832 clock_gettime_mono(&ts2);
833 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
834
835 if (timediff > audit_timeout) {
836 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
837 }
838
839 return result;
840 }
841
842 static int smb_time_audit_rename(vfs_handle_struct *handle,
843 const struct smb_filename *oldname,
844 const struct smb_filename *newname)
845 {
846 int result;
847 struct timespec ts1,ts2;
848 double timediff;
849
850 clock_gettime_mono(&ts1);
851 result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
852 clock_gettime_mono(&ts2);
853 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
854
855 if (timediff > audit_timeout) {
856 smb_time_audit_log_smb_fname("rename", timediff, newname);
857 }
858
859 return result;
860 }
861
862 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
863 {
864 int result;
865 struct timespec ts1,ts2;
866 double timediff;
867
868 clock_gettime_mono(&ts1);
869 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
870 clock_gettime_mono(&ts2);
871 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
872
873 if (timediff > audit_timeout) {
874 smb_time_audit_log_fsp("fsync", timediff, fsp);
875 }
876
877 return result;
878 }
879
880 struct smb_time_audit_fsync_state {
881 struct files_struct *fsp;
882 struct timespec ts1;
883 int ret;
884 int err;
885 };
886
887 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
888
889 static struct tevent_req *smb_time_audit_fsync_send(
890 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
891 struct tevent_context *ev, struct files_struct *fsp)
892 {
893 struct tevent_req *req, *subreq;
894 struct smb_time_audit_fsync_state *state;
895
896 req = tevent_req_create(mem_ctx, &state,
897 struct smb_time_audit_fsync_state);
898 if (req == NULL) {
899 return NULL;
900 }
901 clock_gettime_mono(&state->ts1);
902 state->fsp = fsp;
903
904 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
905 if (tevent_req_nomem(subreq, req)) {
906 return tevent_req_post(req, ev);
907 }
908 tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
909 return req;
910 }
911
912 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
913 {
914 struct tevent_req *req = tevent_req_callback_data(
915 subreq, struct tevent_req);
916 struct smb_time_audit_fsync_state *state = tevent_req_data(
917 req, struct smb_time_audit_fsync_state);
918
919 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->err);
920 TALLOC_FREE(subreq);
921 tevent_req_done(req);
922 }
923
924 static int smb_time_audit_fsync_recv(struct tevent_req *req, int *err)
925 {
926 struct smb_time_audit_fsync_state *state = tevent_req_data(
927 req, struct smb_time_audit_fsync_state);
928 struct timespec ts2;
929 double timediff;
930
931 clock_gettime_mono(&ts2);
932 timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
933
934 if (timediff > audit_timeout) {
935 smb_time_audit_log_fsp("fsync", timediff, state->fsp);
936 }
937
938 if (tevent_req_is_unix_error(req, err)) {
939 return -1;
940 }
941 *err = state->err;
942 return state->ret;
943 }
944
945 static int smb_time_audit_stat(vfs_handle_struct *handle,
946 struct smb_filename *fname)
947 {
948 int result;
949 struct timespec ts1,ts2;
950 double timediff;
951
952 clock_gettime_mono(&ts1);
953 result = SMB_VFS_NEXT_STAT(handle, fname);
954 clock_gettime_mono(&ts2);
955 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
956
957 if (timediff > audit_timeout) {
958 smb_time_audit_log_smb_fname("stat", timediff, fname);
959 }
960
961 return result;
962 }
963
964 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
965 SMB_STRUCT_STAT *sbuf)
966 {
967 int result;
968 struct timespec ts1,ts2;
969 double timediff;
970
971 clock_gettime_mono(&ts1);
972 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
973 clock_gettime_mono(&ts2);
974 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
975
976 if (timediff > audit_timeout) {
977 smb_time_audit_log_fsp("fstat", timediff, fsp);
978 }
979
980 return result;
981 }
982
983 static int smb_time_audit_lstat(vfs_handle_struct *handle,
984 struct smb_filename *path)
985 {
986 int result;
987 struct timespec ts1,ts2;
988 double timediff;
989
990 clock_gettime_mono(&ts1);
991 result = SMB_VFS_NEXT_LSTAT(handle, path);
992 clock_gettime_mono(&ts2);
993 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
994
995 if (timediff > audit_timeout) {
996 smb_time_audit_log_smb_fname("lstat", timediff, path);
997 }
998
999 return result;
1000 }
1001
1002 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1003 files_struct *fsp,
1004 const SMB_STRUCT_STAT *sbuf)
1005 {
1006 uint64_t result;
1007 struct timespec ts1,ts2;
1008 double timediff;
1009
1010 clock_gettime_mono(&ts1);
1011 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1012 clock_gettime_mono(&ts2);
1013 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1014
1015 if (timediff > audit_timeout) {
1016 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1017 }
1018
1019 return result;
1020 }
1021
1022 static int smb_time_audit_unlink(vfs_handle_struct *handle,
1023 const struct smb_filename *path)
1024 {
1025 int result;
1026 struct timespec ts1,ts2;
1027 double timediff;
1028
1029 clock_gettime_mono(&ts1);
1030 result = SMB_VFS_NEXT_UNLINK(handle, path);
1031 clock_gettime_mono(&ts2);
1032 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1033
1034 if (timediff > audit_timeout) {
1035 smb_time_audit_log_smb_fname("unlink", timediff, path);
1036 }
1037
1038 return result;
1039 }
1040
1041 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1042 const char *path, mode_t mode)
1043 {
1044 int result;
1045 struct timespec ts1,ts2;
1046 double timediff;
1047
1048 clock_gettime_mono(&ts1);
1049 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1050 clock_gettime_mono(&ts2);
1051 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1052
1053 if (timediff > audit_timeout) {
1054 smb_time_audit_log_fname("chmod", timediff, path);
1055 }
1056
1057 return result;
1058 }
1059
1060 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1061 mode_t mode)
1062 {
1063 int result;
1064 struct timespec ts1,ts2;
1065 double timediff;
1066
1067 clock_gettime_mono(&ts1);
1068 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1069 clock_gettime_mono(&ts2);
1070 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1071
1072 if (timediff > audit_timeout) {
1073 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1074 }
1075
1076 return result;
1077 }
1078
1079 static int smb_time_audit_chown(vfs_handle_struct *handle,
1080 const char *path, uid_t uid, gid_t gid)
1081 {
1082 int result;
1083 struct timespec ts1,ts2;
1084 double timediff;
1085
1086 clock_gettime_mono(&ts1);
1087 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1088 clock_gettime_mono(&ts2);
1089 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1090
1091 if (timediff > audit_timeout) {
1092 smb_time_audit_log_fname("chown", timediff, path);
1093 }
1094
1095 return result;
1096 }
1097
1098 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1099 uid_t uid, gid_t gid)
1100 {
1101 int result;
1102 struct timespec ts1,ts2;
1103 double timediff;
1104
1105 clock_gettime_mono(&ts1);
1106 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1107 clock_gettime_mono(&ts2);
1108 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1109
1110 if (timediff > audit_timeout) {
1111 smb_time_audit_log_fsp("fchown", timediff, fsp);
1112 }
1113
1114 return result;
1115 }
1116
1117 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1118 const char *path, uid_t uid, gid_t gid)
1119 {
1120 int result;
1121 struct timespec ts1,ts2;
1122 double timediff;
1123
1124 clock_gettime_mono(&ts1);
1125 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1126 clock_gettime_mono(&ts2);
1127 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1128
1129 if (timediff > audit_timeout) {
1130 smb_time_audit_log_fname("lchown", timediff, path);
1131 }
1132
1133 return result;
1134 }
1135
1136 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
1137 {
1138 int result;
1139 struct timespec ts1,ts2;
1140 double timediff;
1141
1142 clock_gettime_mono(&ts1);
1143 result = SMB_VFS_NEXT_CHDIR(handle, path);
1144 clock_gettime_mono(&ts2);
1145 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1146
1147 if (timediff > audit_timeout) {
1148 smb_time_audit_log_fname("chdir", timediff, path);
1149 }
1150
1151 return result;
1152 }
1153
1154 static char *smb_time_audit_getwd(vfs_handle_struct *handle)
1155 {
1156 char *result;
1157 struct timespec ts1,ts2;
1158 double timediff;
1159
1160 clock_gettime_mono(&ts1);
1161 result = SMB_VFS_NEXT_GETWD(handle);
1162 clock_gettime_mono(&ts2);
1163 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1164
1165 if (timediff > audit_timeout) {
1166 smb_time_audit_log("getwd", timediff);
1167 }
1168
1169 return result;
1170 }
1171
1172 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1173 const struct smb_filename *path,
1174 struct smb_file_time *ft)
1175 {
1176 int result;
1177 struct timespec ts1,ts2;
1178 double timediff;
1179
1180 clock_gettime_mono(&ts1);
1181 result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1182 clock_gettime_mono(&ts2);
1183 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1184
1185 if (timediff > audit_timeout) {
1186 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1187 }
1188
1189 return result;
1190 }
1191
1192 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1193 files_struct *fsp,
1194 off_t len)
1195 {
1196 int result;
1197 struct timespec ts1,ts2;
1198 double timediff;
1199
1200 clock_gettime_mono(&ts1);
1201 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1202 clock_gettime_mono(&ts2);
1203 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1204
1205 if (timediff > audit_timeout) {
1206 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1207 }
1208
1209 return result;
1210 }
1211
1212 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1213 files_struct *fsp,
1214 enum vfs_fallocate_mode mode,
1215 off_t offset,
1216 off_t len)
1217 {
1218 int result;
1219 int saved_errno = 0;
1220 struct timespec ts1,ts2;
1221 double timediff;
1222
1223 clock_gettime_mono(&ts1);
1224 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1225 if (result == -1) {
1226 saved_errno = errno;
1227 }
1228 clock_gettime_mono(&ts2);
1229 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1230
1231 if (timediff > audit_timeout) {
1232 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1233 }
1234 if (result == -1) {
1235 errno = saved_errno;
1236 }
1237 return result;
1238 }
1239
1240 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1241 int op, off_t offset, off_t count,
1242 int type)
1243 {
1244 bool result;
1245 struct timespec ts1,ts2;
1246 double timediff;
1247
1248 clock_gettime_mono(&ts1);
1249 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1250 clock_gettime_mono(&ts2);
1251 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1252
1253 if (timediff > audit_timeout) {
1254 smb_time_audit_log_fsp("lock", timediff, fsp);
1255 }
1256
1257 return result;
1258 }
1259
1260 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1261 struct files_struct *fsp,
1262 uint32 share_mode, uint32 access_mask)
1263 {
1264 int result;
1265 struct timespec ts1,ts2;
1266 double timediff;
1267
1268 clock_gettime_mono(&ts1);
1269 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
1270 access_mask);
1271 clock_gettime_mono(&ts2);
1272 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1273
1274 if (timediff > audit_timeout) {
1275 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1276 }
1277
1278 return result;
1279 }
1280
1281 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1282 files_struct *fsp,
1283 int leasetype)
1284 {
1285 int result;
1286 struct timespec ts1,ts2;
1287 double timediff;
1288
1289 clock_gettime_mono(&ts1);
1290 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1291 clock_gettime_mono(&ts2);
1292 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1293
1294 if (timediff > audit_timeout) {
1295 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1296 }
1297
1298 return result;
1299 }
1300
1301 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1302 files_struct *fsp,
1303 off_t *poffset, off_t *pcount,
1304 int *ptype, pid_t *ppid)
1305 {
1306 bool result;
1307 struct timespec ts1,ts2;
1308 double timediff;
1309
1310 clock_gettime_mono(&ts1);
1311 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1312 ppid);
1313 clock_gettime_mono(&ts2);
1314 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1315
1316 if (timediff > audit_timeout) {
1317 smb_time_audit_log_fsp("getlock", timediff, fsp);
1318 }
1319
1320 return result;
1321 }
1322
1323 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1324 const char *oldpath, const char *newpath)
1325 {
1326 int result;
1327 struct timespec ts1,ts2;
1328 double timediff;
1329
1330 clock_gettime_mono(&ts1);
1331 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1332 clock_gettime_mono(&ts2);
1333 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1334
1335 if (timediff > audit_timeout) {
1336 smb_time_audit_log_fname("symlink", timediff, newpath);
1337 }
1338
1339 return result;
1340 }
1341
1342 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1343 const char *path, char *buf, size_t bufsiz)
1344 {
1345 int result;
1346 struct timespec ts1,ts2;
1347 double timediff;
1348
1349 clock_gettime_mono(&ts1);
1350 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1351 clock_gettime_mono(&ts2);
1352 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1353
1354 if (timediff > audit_timeout) {
1355 smb_time_audit_log_fname("readlink", timediff, path);
1356 }
1357
1358 return result;
1359 }
1360
1361 static int smb_time_audit_link(vfs_handle_struct *handle,
1362 const char *oldpath, const char *newpath)
1363 {
1364 int result;
1365 struct timespec ts1,ts2;
1366 double timediff;
1367
1368 clock_gettime_mono(&ts1);
1369 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1370 clock_gettime_mono(&ts2);
1371 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1372
1373 if (timediff > audit_timeout) {
1374 smb_time_audit_log_fname("link", timediff, newpath);
1375 }
1376
1377 return result;
1378 }
1379
1380 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1381 const char *pathname, mode_t mode,
1382 SMB_DEV_T dev)
1383 {
1384 int result;
1385 struct timespec ts1,ts2;
1386 double timediff;
1387
1388 clock_gettime_mono(&ts1);
1389 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1390 clock_gettime_mono(&ts2);
1391 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1392
1393 if (timediff > audit_timeout) {
1394 smb_time_audit_log_fname("mknod", timediff, pathname);
1395 }
1396
1397 return result;
1398 }
1399
1400 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1401 const char *path)
1402 {
1403 char *result;
1404 struct timespec ts1,ts2;
1405 double timediff;
1406
1407 clock_gettime_mono(&ts1);
1408 result = SMB_VFS_NEXT_REALPATH(handle, path);
1409 clock_gettime_mono(&ts2);
1410 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1411
1412 if (timediff > audit_timeout) {
1413 smb_time_audit_log_fname("realpath", timediff, path);
1414 }
1415
1416 return result;
1417 }
1418
1419 static NTSTATUS smb_time_audit_notify_watch(struct vfs_handle_struct *handle,
1420 struct sys_notify_context *ctx,
1421 const char *path,
1422 uint32_t *filter,
1423 uint32_t *subdir_filter,
1424 void (*callback)(struct sys_notify_context *ctx,
1425 void *private_data,
1426 struct notify_event *ev),
1427 void *private_data, void *handle_p)
1428 {
1429 NTSTATUS result;
1430 struct timespec ts1,ts2;
1431 double timediff;
1432
1433 clock_gettime_mono(&ts1);
1434 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, path,
1435 filter, subdir_filter, callback,
1436 private_data, handle_p);
1437 clock_gettime_mono(&ts2);
1438 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1439
1440 if (timediff > audit_timeout) {
1441 smb_time_audit_log_fname("notify_watch", timediff, path);
1442 }
1443
1444 return result;
1445 }
1446
1447 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1448 const char *path, unsigned int flags)
1449 {
1450 int result;
1451 struct timespec ts1,ts2;
1452 double timediff;
1453
1454 clock_gettime_mono(&ts1);
1455 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1456 clock_gettime_mono(&ts2);
1457 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1458
1459 if (timediff > audit_timeout) {
1460 smb_time_audit_log_fname("chflags", timediff, path);
1461 }
1462
1463 return result;
1464 }
1465
1466 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1467 const SMB_STRUCT_STAT *sbuf)
1468 {
1469 struct file_id id_zero;
1470 struct file_id result;
1471 struct timespec ts1,ts2;
1472 double timediff;
1473
1474 ZERO_STRUCT(id_zero);
1475
1476 clock_gettime_mono(&ts1);
1477 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1478 clock_gettime_mono(&ts2);
1479 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1480
1481 if (timediff > audit_timeout) {
1482 smb_time_audit_log("file_id_create", timediff);
1483 }
1484
1485 return result;
1486 }
1487
1488 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1489 struct files_struct *fsp,
1490 const char *fname,
1491 TALLOC_CTX *mem_ctx,
1492 unsigned int *pnum_streams,
1493 struct stream_struct **pstreams)
1494 {
1495 NTSTATUS result;
1496 struct timespec ts1,ts2;
1497 double timediff;
1498
1499 clock_gettime_mono(&ts1);
1500 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1501 pnum_streams, pstreams);
1502 clock_gettime_mono(&ts2);
1503 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1504
1505 if (timediff > audit_timeout) {
1506 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1507 }
1508
1509 return result;
1510 }
1511
1512 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1513 const char *path,
1514 const char *name,
1515 TALLOC_CTX *mem_ctx,
1516 char **found_name)
1517 {
1518 int result;
1519 struct timespec ts1,ts2;
1520 double timediff;
1521
1522 clock_gettime_mono(&ts1);
1523 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1524 found_name);
1525 clock_gettime_mono(&ts2);
1526 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1527
1528 if (timediff > audit_timeout) {
1529 smb_time_audit_log_fname("get_real_filename", timediff, path);
1530 }
1531
1532 return result;
1533 }
1534
1535 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1536 const char *fname)
1537 {
1538 const char *result;
1539 struct timespec ts1,ts2;
1540 double timediff;
1541
1542 clock_gettime_mono(&ts1);
1543 result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1544 clock_gettime_mono(&ts2);
1545 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1546
1547 if (timediff > audit_timeout) {
1548 smb_time_audit_log_fname("connectpath", timediff, fname);
1549 }
1550
1551 return result;
1552 }
1553
1554 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1555 struct byte_range_lock *br_lck,
1556 struct lock_struct *plock,
1557 bool blocking_lock)
1558 {
1559 NTSTATUS result;
1560 struct timespec ts1,ts2;
1561 double timediff;
1562
1563 clock_gettime_mono(&ts1);
1564 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1565 blocking_lock);
1566 clock_gettime_mono(&ts2);
1567 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1568
1569 if (timediff > audit_timeout) {
1570 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1571 brl_fsp(br_lck));
1572 }
1573
1574 return result;
1575 }
1576
1577 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1578 struct messaging_context *msg_ctx,
1579 struct byte_range_lock *br_lck,
1580 const struct lock_struct *plock)
1581 {
1582 bool result;
1583 struct timespec ts1,ts2;
1584 double timediff;
1585
1586 clock_gettime_mono(&ts1);
1587 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1588 plock);
1589 clock_gettime_mono(&ts2);
1590 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1591
1592 if (timediff > audit_timeout) {
1593 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1594 brl_fsp(br_lck));
1595 }
1596
1597 return result;
1598 }
1599
1600 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1601 struct byte_range_lock *br_lck,
1602 struct lock_struct *plock)
1603 {
1604 bool result;
1605 struct timespec ts1,ts2;
1606 double timediff;
1607
1608 clock_gettime_mono(&ts1);
1609 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1610 clock_gettime_mono(&ts2);
1611 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1612
1613 if (timediff > audit_timeout) {
1614 smb_time_audit_log_fsp("brl_cancel_windows", timediff,
1615 brl_fsp(br_lck));
1616 }
1617
1618 return result;
1619 }
1620
1621 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1622 struct files_struct *fsp,
1623 struct lock_struct *plock)
1624 {
1625 bool result;
1626 struct timespec ts1,ts2;
1627 double timediff;
1628
1629 clock_gettime_mono(&ts1);
1630 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1631 clock_gettime_mono(&ts2);
1632 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1633
1634 if (timediff > audit_timeout) {
1635 smb_time_audit_log_fsp("strict_lock", timediff, fsp);
1636 }
1637
1638 return result;
1639 }
1640
1641 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1642 struct files_struct *fsp,
1643 struct lock_struct *plock)
1644 {
1645 struct timespec ts1,ts2;
1646 double timediff;
1647
1648 clock_gettime_mono(&ts1);
1649 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1650 clock_gettime_mono(&ts2);
1651 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1652
1653 if (timediff > audit_timeout) {
1654 smb_time_audit_log_fsp("strict_unlock", timediff, fsp);
1655 }
1656 }
1657
1658 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1659 const char *name,
1660 enum vfs_translate_direction direction,
1661 TALLOC_CTX *mem_ctx,
1662 char **mapped_name)
1663 {
1664 NTSTATUS result;
1665 struct timespec ts1,ts2;
1666 double timediff;
1667
1668 clock_gettime_mono(&ts1);
1669 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1670 mapped_name);
1671 clock_gettime_mono(&ts2);
1672 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1673
1674 if (timediff > audit_timeout) {
1675 smb_time_audit_log_fname("translate_name", timediff, name);
1676 }
1677
1678 return result;
1679 }
1680
1681 struct time_audit_cc_state {
1682 struct timespec ts_send;
1683 struct vfs_handle_struct *handle;
1684 off_t copied;
1685 };
1686 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq);
1687
1688 static struct tevent_req *smb_time_audit_copy_chunk_send(struct vfs_handle_struct *handle,
1689 TALLOC_CTX *mem_ctx,
1690 struct tevent_context *ev,
1691 struct files_struct *src_fsp,
1692 off_t src_off,
1693 struct files_struct *dest_fsp,
1694 off_t dest_off,
1695 off_t num)
1696 {
1697 struct tevent_req *req;
1698 struct tevent_req *subreq;
1699 struct time_audit_cc_state *cc_state;
1700
1701 req = tevent_req_create(mem_ctx, &cc_state, struct time_audit_cc_state);
1702 if (req == NULL) {
1703 return NULL;
1704 }
1705
1706 cc_state->handle = handle;
1707 clock_gettime_mono(&cc_state->ts_send);
1708 subreq = SMB_VFS_NEXT_COPY_CHUNK_SEND(handle, cc_state, ev,
1709 src_fsp, src_off,
1710 dest_fsp, dest_off, num);
1711 if (tevent_req_nomem(subreq, req)) {
1712 return tevent_req_post(req, ev);
1713 }
1714
1715 tevent_req_set_callback(subreq, smb_time_audit_copy_chunk_done, req);
1716 return req;
1717 }
1718
1719 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq)
1720 {
1721 struct tevent_req *req = tevent_req_callback_data(
1722 subreq, struct tevent_req);
1723 struct time_audit_cc_state *cc_state
1724 = tevent_req_data(req, struct time_audit_cc_state);
1725 NTSTATUS status;
1726
1727 status = SMB_VFS_NEXT_COPY_CHUNK_RECV(cc_state->handle,
1728 subreq,
1729 &cc_state->copied);
1730 TALLOC_FREE(subreq);
1731 if (tevent_req_nterror(req, status)) {
1732 return;
1733 }
1734 tevent_req_done(req);
1735 }
1736
1737 static NTSTATUS smb_time_audit_copy_chunk_recv(struct vfs_handle_struct *handle,
1738 struct tevent_req *req,
1739 off_t *copied)
1740 {
1741 struct time_audit_cc_state *cc_state
1742 = tevent_req_data(req, struct time_audit_cc_state);
1743 struct timespec ts_recv;
1744 double timediff;
1745 NTSTATUS status;
1746
1747 clock_gettime_mono(&ts_recv);
1748 timediff = nsec_time_diff(&ts_recv, &cc_state->ts_send)*1.0e-9;
1749 if (timediff > audit_timeout) {
1750 smb_time_audit_log("copy_chunk", timediff);
1751 }
1752
1753 *copied = cc_state->copied;
1754 if (tevent_req_is_nterror(req, &status)) {
1755 tevent_req_received(req);
1756 return status;
1757 }
1758
1759 tevent_req_received(req);
1760 return NT_STATUS_OK;
1761 }
1762
1763 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
1764 TALLOC_CTX *mem_ctx,
1765 struct files_struct *fsp,
1766 struct smb_filename *smb_fname,
1767 uint16_t *_compression_fmt)
1768 {
1769 NTSTATUS result;
1770 struct timespec ts1,ts2;
1771 double timediff;
1772
1773 clock_gettime_mono(&ts1);
1774 result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1775 _compression_fmt);
1776 clock_gettime_mono(&ts2);
1777 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1778
1779 if (timediff > audit_timeout) {
1780 if (fsp != NULL) {
1781 smb_time_audit_log_fsp("get_compression",
1782 timediff, fsp);
1783 } else {
1784 smb_time_audit_log_smb_fname("get_compression",
1785 timediff, smb_fname);
1786 }
1787 }
1788
1789 return result;
1790 }
1791
1792 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
1793 TALLOC_CTX *mem_ctx,
1794 struct files_struct *fsp,
1795 uint16_t compression_fmt)
1796 {
1797 NTSTATUS result;
1798 struct timespec ts1,ts2;
1799 double timediff;
1800
1801 clock_gettime_mono(&ts1);
1802 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
1803 compression_fmt);
1804 clock_gettime_mono(&ts2);
1805 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1806
1807 if (timediff > audit_timeout) {
1808 smb_time_audit_log_fsp("set_compression", timediff, fsp);
1809 }
1810
1811 return result;
1812 }
1813
1814 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
1815 const struct smb_filename *fname,
1816 TALLOC_CTX *mem_ctx,
1817 struct readdir_attr_data **pattr_data)
1818 {
1819 NTSTATUS status;
1820 struct timespec ts1,ts2;
1821 double timediff;
1822
1823 clock_gettime_mono(&ts1);
1824 status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
1825 clock_gettime_mono(&ts2);
1826 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1827
1828 if (timediff > audit_timeout) {
1829 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
1830 }
1831
1832 return status;
1833 }
1834
1835 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
1836 files_struct *fsp,
1837 uint32 security_info,
1838 TALLOC_CTX *mem_ctx,
1839 struct security_descriptor **ppdesc)
1840 {
1841 NTSTATUS result;
1842 struct timespec ts1,ts2;
1843 double timediff;
1844
1845 clock_gettime_mono(&ts1);
1846 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
1847 mem_ctx, ppdesc);
1848 clock_gettime_mono(&ts2);
1849 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1850
1851 if (timediff > audit_timeout) {
1852 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
1853 }
1854
1855 return result;
1856 }
1857
1858 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
1859 const char *name,
1860 uint32 security_info,
1861 TALLOC_CTX *mem_ctx,
1862 struct security_descriptor **ppdesc)
1863 {
1864 NTSTATUS result;
1865 struct timespec ts1,ts2;
1866 double timediff;
1867
1868 clock_gettime_mono(&ts1);
1869 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
1870 mem_ctx, ppdesc);
1871 clock_gettime_mono(&ts2);
1872 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1873
1874 if (timediff > audit_timeout) {
1875 smb_time_audit_log_fname("get_nt_acl", timediff, name);
1876 }
1877
1878 return result;
1879 }
1880
1881 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
1882 files_struct *fsp,
1883 uint32 security_info_sent,
1884 const struct security_descriptor *psd)
1885 {
1886 NTSTATUS result;
1887 struct timespec ts1,ts2;
1888 double timediff;
1889
1890 clock_gettime_mono(&ts1);
1891 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
1892 psd);
1893 clock_gettime_mono(&ts2);
1894 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1895
1896 if (timediff > audit_timeout) {
1897 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
1898 }
1899
1900 return result;
1901 }
1902
1903 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
1904 const char *path, mode_t mode)
1905 {
1906 int result;
1907 struct timespec ts1,ts2;
1908 double timediff;
1909
1910 clock_gettime_mono(&ts1);
1911 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1912 clock_gettime_mono(&ts2);
1913 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1914
1915 if (timediff > audit_timeout) {
1916 smb_time_audit_log_fname("chmod_acl", timediff, path);
1917 }
1918
1919 return result;
1920 }
1921
1922 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
1923 files_struct *fsp, mode_t mode)
1924 {
1925 int result;
1926 struct timespec ts1,ts2;
1927 double timediff;
1928
1929 clock_gettime_mono(&ts1);
1930 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1931 clock_gettime_mono(&ts2);
1932 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1933
1934 if (timediff > audit_timeout) {
1935 smb_time_audit_log_fsp("fchmod_acl", timediff, fsp);
1936 }
1937
1938 return result;
1939 }
1940
1941 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
1942 const char *path_p,
1943 SMB_ACL_TYPE_T type,
1944 TALLOC_CTX *mem_ctx)
1945 {
1946 SMB_ACL_T result;
1947 struct timespec ts1,ts2;
1948 double timediff;
1949
1950 clock_gettime_mono(&ts1);
1951 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
1952 clock_gettime_mono(&ts2);
1953 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1954
1955 if (timediff > audit_timeout) {
1956 smb_time_audit_log_fname("sys_acl_get_file", timediff, path_p);
1957 }
1958
1959 return result;
1960 }
1961
1962 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1963 files_struct *fsp,
1964 TALLOC_CTX *mem_ctx)
1965 {
1966 SMB_ACL_T result;
1967 struct timespec ts1,ts2;
1968 double timediff;
1969
1970 clock_gettime_mono(&ts1);
1971 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
1972 clock_gettime_mono(&ts2);
1973 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1974
1975 if (timediff > audit_timeout) {
1976 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
1977 }
1978
1979 return result;
1980 }
1981
1982
1983 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
1984 const char *path_p,
1985 TALLOC_CTX *mem_ctx,
1986 char **blob_description,
1987 DATA_BLOB *blob)
1988 {
1989 int result;
1990 struct timespec ts1,ts2;
1991 double timediff;
1992
1993 clock_gettime_mono(&ts1);
1994 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, path_p, mem_ctx, blob_description, blob);
1995 clock_gettime_mono(&ts2);
1996 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1997
1998 if (timediff > audit_timeout) {
1999 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2000 }
2001
2002 return result;
2003 }
2004
2005 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2006 files_struct *fsp,
2007 TALLOC_CTX *mem_ctx,
2008 char **blob_description,
2009 DATA_BLOB *blob)
2010 {
2011 int result;
2012 struct timespec ts1,ts2;
2013 double timediff;
2014
2015 clock_gettime_mono(&ts1);
2016 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2017 clock_gettime_mono(&ts2);
2018 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2019
2020 if (timediff > audit_timeout) {
2021 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2022 }
2023
2024 return result;
2025 }
2026
2027 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2028 const char *name,
2029 SMB_ACL_TYPE_T acltype,
2030 SMB_ACL_T theacl)
2031 {
2032 int result;
2033 struct timespec ts1,ts2;
2034 double timediff;
2035
2036 clock_gettime_mono(&ts1);
2037 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
2038 theacl);
2039 clock_gettime_mono(&ts2);
2040 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2041
2042 if (timediff > audit_timeout) {
2043 smb_time_audit_log_fname("sys_acl_set_file", timediff, name);
2044 }
2045
2046 return result;
2047 }
2048
2049 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2050 files_struct *fsp,
2051 SMB_ACL_T theacl)
2052 {
2053 int result;
2054 struct timespec ts1,ts2;
2055 double timediff;
2056
2057 clock_gettime_mono(&ts1);
2058 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2059 clock_gettime_mono(&ts2);
2060 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2061
2062 if (timediff > audit_timeout) {
2063 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2064 }
2065
2066 return result;
2067 }
2068
2069 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2070 const char *path)
2071 {
2072 int result;
2073 struct timespec ts1,ts2;
2074 double timediff;
2075
2076 clock_gettime_mono(&ts1);
2077 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2078 clock_gettime_mono(&ts2);
2079 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2080
2081 if (timediff > audit_timeout) {
2082 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff, path);
2083 }
2084
2085 return result;
2086 }
2087
2088 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2089 const char *path, const char *name,
2090 void *value, size_t size)
2091 {
2092 ssize_t result;
2093 struct timespec ts1,ts2;
2094 double timediff;
2095
2096 clock_gettime_mono(&ts1);
2097 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2098 clock_gettime_mono(&ts2);
2099 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2100
2101 if (timediff > audit_timeout) {
2102 smb_time_audit_log_fname("getxattr", timediff, path);
2103 }
2104
2105 return result;
2106 }
2107
2108 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2109 struct files_struct *fsp,
2110 const char *name, void *value,
2111 size_t size)
2112 {
2113 ssize_t result;
2114 struct timespec ts1,ts2;
2115 double timediff;
2116
2117 clock_gettime_mono(&ts1);
2118 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2119 clock_gettime_mono(&ts2);
2120 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2121
2122 if (timediff > audit_timeout) {
2123 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2124 }
2125
2126 return result;
2127 }
2128
2129 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2130 const char *path, char *list,
2131 size_t size)
2132 {
2133 ssize_t result;
2134 struct timespec ts1,ts2;
2135 double timediff;
2136
2137 clock_gettime_mono(&ts1);
2138 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2139 clock_gettime_mono(&ts2);
2140 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2141
2142 if (timediff > audit_timeout) {
2143 smb_time_audit_log_fname("listxattr", timediff, path);
2144 }
2145
2146 return result;
2147 }
2148
2149 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2150 struct files_struct *fsp, char *list,
2151 size_t size)
2152 {
2153 ssize_t result;
2154 struct timespec ts1,ts2;
2155 double timediff;
2156
2157 clock_gettime_mono(&ts1);
2158 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2159 clock_gettime_mono(&ts2);
2160 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2161
2162 if (timediff > audit_timeout) {
2163 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2164 }
2165
2166 return result;
2167 }
2168
2169 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2170 const char *path, const char *name)
2171 {
2172 int result;
2173 struct timespec ts1,ts2;
2174 double timediff;
2175
2176 clock_gettime_mono(&ts1);
2177 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2178 clock_gettime_mono(&ts2);
2179 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2180
2181 if (timediff > audit_timeout) {
2182 smb_time_audit_log_fname("removexattr", timediff, path);
2183 }
2184
2185 return result;
2186 }
2187
2188 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2189 struct files_struct *fsp,
2190 const char *name)
2191 {
2192 int result;
2193 struct timespec ts1,ts2;
2194 double timediff;
2195
2196 clock_gettime_mono(&ts1);
2197 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2198 clock_gettime_mono(&ts2);
2199 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2200
2201 if (timediff > audit_timeout) {
2202 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2203 }
2204
2205 return result;
2206 }
2207
2208 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2209 const char *path, const char *name,
2210 const void *value, size_t size,
2211 int flags)
2212 {
2213 int result;
2214 struct timespec ts1,ts2;
2215 double timediff;
2216
2217 clock_gettime_mono(&ts1);
2218 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2219 flags);
2220 clock_gettime_mono(&ts2);
2221 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2222
2223 if (timediff > audit_timeout) {
2224 smb_time_audit_log_fname("setxattr", timediff, path);
2225 }
2226
2227 return result;
2228 }
2229
2230 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2231 struct files_struct *fsp, const char *name,
2232 const void *value, size_t size, int flags)
2233 {
2234 int result;
2235 struct timespec ts1,ts2;
2236 double timediff;
2237
2238 clock_gettime_mono(&ts1);
2239 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2240 clock_gettime_mono(&ts2);
2241 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2242
2243 if (timediff > audit_timeout) {
2244 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2245 }
2246
2247 return result;
2248 }
2249
2250 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2251 struct files_struct *fsp)
2252 {
2253 bool result;
2254 struct timespec ts1,ts2;
2255 double timediff;
2256
2257 clock_gettime_mono(&ts1);
2258 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2259 clock_gettime_mono(&ts2);
2260 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2261
2262 if (timediff > audit_timeout) {
2263 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2264 }
2265
2266 return result;
2267 }
2268
2269 static bool smb_time_audit_is_offline(struct vfs_handle_struct *handle,
2270 const struct smb_filename *fname,
2271 SMB_STRUCT_STAT *sbuf)
2272 {
2273 bool result;
2274 struct timespec ts1,ts2;
2275 double timediff;
2276
2277 clock_gettime_mono(&ts1);
2278 result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
2279 clock_gettime_mono(&ts2);
2280 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2281
2282 if (timediff > audit_timeout) {
2283 smb_time_audit_log_smb_fname("is_offline", timediff, fname);
2284 }
2285
2286 return result;
2287 }
2288
2289 static int smb_time_audit_set_offline(struct vfs_handle_struct *handle,
2290 const struct smb_filename *fname)
2291 {
2292 int result;
2293 struct timespec ts1,ts2;
2294 double timediff;
2295
2296 clock_gettime_mono(&ts1);
2297 result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2298 clock_gettime_mono(&ts2);
2299 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2300
2301 if (timediff > audit_timeout) {
2302 smb_time_audit_log_smb_fname("set_offline", timediff, fname);
2303 }
2304
2305 return result;
2306 }
2307
2308 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2309 struct files_struct *fsp,
2310 TALLOC_CTX *mem_ctx,
2311 DATA_BLOB *cookie)
2312 {
2313 NTSTATUS result;
2314 struct timespec ts1,ts2;
2315 double timediff;
2316
2317 clock_gettime_mono(&ts1);
2318 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2319 clock_gettime_mono(&ts2);
2320 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2321
2322 if (timediff > audit_timeout) {
2323 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2324 }
2325
2326 return result;
2327 }
2328
2329 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2330 struct files_struct *fsp,
2331 const DATA_BLOB old_cookie,
2332 TALLOC_CTX *mem_ctx,
2333 DATA_BLOB *new_cookie)
2334 {
2335 NTSTATUS result;
2336 struct timespec ts1,ts2;
2337 double timediff;
2338
2339 clock_gettime_mono(&ts1);
2340 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2341 mem_ctx, new_cookie);
2342 clock_gettime_mono(&ts2);
2343 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2344
2345 if (timediff > audit_timeout) {
2346 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2347 }
2348
2349 return result;
2350 }
2351
2352 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2353 struct smb_request *smb1req,
2354 struct smbXsrv_open *op,
2355 const DATA_BLOB old_cookie,
2356 TALLOC_CTX *mem_ctx,
2357 struct files_struct **fsp,
2358 DATA_BLOB *new_cookie)
2359 {
2360 NTSTATUS result;
2361 struct timespec ts1,ts2;
2362 double timediff;
2363
2364 clock_gettime_mono(&ts1);
2365 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2366 mem_ctx, fsp, new_cookie);
2367 clock_gettime_mono(&ts2);
2368 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2369
2370 if (timediff > audit_timeout) {
2371 smb_time_audit_log("durable_reconnect", timediff);
2372 }
2373
2374 return result;
2375 }
2376
2377 /* VFS operations */
2378
2379 static struct vfs_fn_pointers vfs_time_audit_fns = {
2380 .connect_fn = smb_time_audit_connect,
2381 .disconnect_fn = smb_time_audit_disconnect,
2382 .disk_free_fn = smb_time_audit_disk_free,
2383 .get_quota_fn = smb_time_audit_get_quota,
2384 .set_quota_fn = smb_time_audit_set_quota,
2385 .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2386 .statvfs_fn = smb_time_audit_statvfs,
2387 .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2388 .opendir_fn = smb_time_audit_opendir,
2389 .fdopendir_fn = smb_time_audit_fdopendir,
2390 .readdir_fn = smb_time_audit_readdir,
2391 .seekdir_fn = smb_time_audit_seekdir,
2392 .telldir_fn = smb_time_audit_telldir,
2393 .rewind_dir_fn = smb_time_audit_rewinddir,
2394 .mkdir_fn = smb_time_audit_mkdir,
2395 .rmdir_fn = smb_time_audit_rmdir,
2396 .closedir_fn = smb_time_audit_closedir,
2397 .init_search_op_fn = smb_time_audit_init_search_op,
2398 .open_fn = smb_time_audit_open,
2399 .create_file_fn = smb_time_audit_create_file,
2400 .close_fn = smb_time_audit_close,
2401 .read_fn = smb_time_audit_read,
2402 .pread_fn = smb_time_audit_pread,
2403 .pread_send_fn = smb_time_audit_pread_send,
2404 .pread_recv_fn = smb_time_audit_pread_recv,
2405 .write_fn = smb_time_audit_write,
2406 .pwrite_fn = smb_time_audit_pwrite,
2407 .pwrite_send_fn = smb_time_audit_pwrite_send,
2408 .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2409 .lseek_fn = smb_time_audit_lseek,
2410 .sendfile_fn = smb_time_audit_sendfile,
2411 .recvfile_fn = smb_time_audit_recvfile,
2412 .rename_fn = smb_time_audit_rename,
2413 .fsync_fn = smb_time_audit_fsync,
2414 .fsync_send_fn = smb_time_audit_fsync_send,
2415 .fsync_recv_fn = smb_time_audit_fsync_recv,
2416 .stat_fn = smb_time_audit_stat,
2417 .fstat_fn = smb_time_audit_fstat,
2418 .lstat_fn = smb_time_audit_lstat,
2419 .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2420 .unlink_fn = smb_time_audit_unlink,
2421 .chmod_fn = smb_time_audit_chmod,
2422 .fchmod_fn = smb_time_audit_fchmod,
2423 .chown_fn = smb_time_audit_chown,
2424 .fchown_fn = smb_time_audit_fchown,
2425 .lchown_fn = smb_time_audit_lchown,
2426 .chdir_fn = smb_time_audit_chdir,
2427 .getwd_fn = smb_time_audit_getwd,
2428 .ntimes_fn = smb_time_audit_ntimes,
2429 .ftruncate_fn = smb_time_audit_ftruncate,
2430 .fallocate_fn = smb_time_audit_fallocate,
2431 .lock_fn = smb_time_audit_lock,
2432 .kernel_flock_fn = smb_time_audit_kernel_flock,
2433 .linux_setlease_fn = smb_time_audit_linux_setlease,
2434 .getlock_fn = smb_time_audit_getlock,
2435 .symlink_fn = smb_time_audit_symlink,
2436 .readlink_fn = smb_time_audit_readlink,
2437 .link_fn = smb_time_audit_link,
2438 .mknod_fn = smb_time_audit_mknod,
2439 .realpath_fn = smb_time_audit_realpath,
2440 .notify_watch_fn = smb_time_audit_notify_watch,
2441 .chflags_fn = smb_time_audit_chflags,
2442 .file_id_create_fn = smb_time_audit_file_id_create,
2443 .streaminfo_fn = smb_time_audit_streaminfo,
2444 .get_real_filename_fn = smb_time_audit_get_real_filename,
2445 .connectpath_fn = smb_time_audit_connectpath,
2446 .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2447 .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2448 .brl_cancel_windows_fn = smb_time_audit_brl_cancel_windows,
2449 .strict_lock_fn = smb_time_audit_strict_lock,
2450 .strict_unlock_fn = smb_time_audit_strict_unlock,
2451 .translate_name_fn = smb_time_audit_translate_name,
2452 .copy_chunk_send_fn = smb_time_audit_copy_chunk_send,
2453 .copy_chunk_recv_fn = smb_time_audit_copy_chunk_recv,
2454 .get_compression_fn = smb_time_audit_get_compression,
2455 .set_compression_fn = smb_time_audit_set_compression,
2456 .readdir_attr_fn = smb_time_audit_readdir_attr,
2457 .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2458 .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2459 .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2460 .chmod_acl_fn = smb_time_audit_chmod_acl,
2461 .fchmod_acl_fn = smb_time_audit_fchmod_acl,
2462 .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2463 .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2464 .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2465 .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2466 .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2467 .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2468 .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2469 .getxattr_fn = smb_time_audit_getxattr,
2470 .fgetxattr_fn = smb_time_audit_fgetxattr,
2471 .listxattr_fn = smb_time_audit_listxattr,
2472 .flistxattr_fn = smb_time_audit_flistxattr,
2473 .removexattr_fn = smb_time_audit_removexattr,
2474 .fremovexattr_fn = smb_time_audit_fremovexattr,
2475 .setxattr_fn = smb_time_audit_setxattr,
2476 .fsetxattr_fn = smb_time_audit_fsetxattr,
2477 .aio_force_fn = smb_time_audit_aio_force,
2478 .is_offline_fn = smb_time_audit_is_offline,
2479 .set_offline_fn = smb_time_audit_set_offline,
2480 .durable_cookie_fn = smb_time_audit_durable_cookie,
2481 .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2482 .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2483 };
2484
2485
2486 NTSTATUS vfs_time_audit_init(void);
2487 NTSTATUS vfs_time_audit_init(void)
2488 {
2489 audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2490 10000) / 1000.0;
2491 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2492 &vfs_time_audit_fns);
2493 }
Samba GIT mirror