2 * Time auditing VFS module for samba. Log time taken for VFS call to syslog
5 * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 * This module implements logging for time taken for all Samba VFS operations.
24 * vfs objects = time_audit
29 #include "smbd/smbd.h"
31 #include "lib/util/tevent_unix.h"
32 #include "lib/util/tevent_ntstatus.h"
35 #define DBGC_CLASS DBGC_VFS
37 static double audit_timeout;
39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
42 DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
43 "(%.2f seconds) %s%s-- Validate that file and storage "
44 "subsystems are operating normally\n", syscallname,
45 elapsed, (msg != NULL) ? msg : "",
46 (msg != NULL) ? " " : ""));
49 static void smb_time_audit_log(const char *syscallname, double elapsed)
51 smb_time_audit_log_msg(syscallname, elapsed, NULL);
54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
55 const struct files_struct *fsp)
57 char *base_name = NULL;
58 char *connectpath = NULL;
62 smb_time_audit_log(syscallname, elapsed);
66 connectpath = fsp->conn->connectpath;
68 base_name = fsp->fsp_name->base_name;
70 if (connectpath != NULL && base_name != NULL) {
71 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
72 connectpath, base_name);
73 } else if (connectpath != NULL && base_name == NULL) {
74 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
77 } else if (connectpath == NULL && base_name != NULL) {
78 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
81 } else { /* connectpath == NULL && base_name == NULL */
82 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
83 "base_name = <NULL>");
85 smb_time_audit_log_msg(syscallname, elapsed, msg);
89 static void smb_time_audit_log_at(const char *syscallname,
91 const struct files_struct *dir_fsp,
92 const struct smb_filename *smb_fname)
96 msg = talloc_asprintf(talloc_tos(),
97 "filename = \"%s/%s/%s\"",
98 dir_fsp->conn->connectpath,
99 dir_fsp->fsp_name->base_name,
100 smb_fname->base_name);
102 smb_time_audit_log_msg(syscallname, elapsed, msg);
106 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
112 if (getcwd(cwd, sizeof(cwd)) == NULL) {
113 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
116 msg = talloc_asprintf(talloc_tos(),
117 "cwd = \"%s\", filename = \"%s\"",
120 msg = talloc_asprintf(talloc_tos(),
121 "cwd = \"%s\", filename = <NULL>",
124 smb_time_audit_log_msg(syscallname, elapsed, msg);
128 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
129 const struct smb_filename *smb_fname)
131 if (smb_fname != NULL) {
132 smb_time_audit_log_fname(syscallname, elapsed,
133 smb_fname->base_name);
135 smb_time_audit_log_fname(syscallname, elapsed,
136 "smb_fname = <NULL>");
140 static int smb_time_audit_connect(vfs_handle_struct *handle,
141 const char *svc, const char *user)
144 struct timespec ts1,ts2;
151 clock_gettime_mono(&ts1);
152 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
153 clock_gettime_mono(&ts2);
154 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
155 if (timediff > audit_timeout) {
156 smb_time_audit_log_msg("connect", timediff, user);
161 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
163 struct timespec ts1,ts2;
166 clock_gettime_mono(&ts1);
167 SMB_VFS_NEXT_DISCONNECT(handle);
168 clock_gettime_mono(&ts2);
169 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
171 if (timediff > audit_timeout) {
172 smb_time_audit_log("disconnect", timediff);
176 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
177 const struct smb_filename *smb_fname,
183 struct timespec ts1,ts2;
186 clock_gettime_mono(&ts1);
187 result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
188 clock_gettime_mono(&ts2);
189 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
191 /* Don't have a reasonable notion of failure here */
192 if (timediff > audit_timeout) {
193 smb_time_audit_log_fname("disk_free",
195 smb_fname->base_name);
201 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
202 const struct smb_filename *smb_fname,
203 enum SMB_QUOTA_TYPE qtype,
208 struct timespec ts1,ts2;
211 clock_gettime_mono(&ts1);
212 result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
213 clock_gettime_mono(&ts2);
214 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
216 if (timediff > audit_timeout) {
217 smb_time_audit_log_fname("get_quota",
219 smb_fname->base_name);
224 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
225 enum SMB_QUOTA_TYPE qtype, unid_t id,
229 struct timespec ts1,ts2;
232 clock_gettime_mono(&ts1);
233 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
234 clock_gettime_mono(&ts2);
235 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
237 if (timediff > audit_timeout) {
238 smb_time_audit_log("set_quota", timediff);
244 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
245 struct files_struct *fsp,
246 struct shadow_copy_data *shadow_copy_data,
250 struct timespec ts1,ts2;
253 clock_gettime_mono(&ts1);
254 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
255 shadow_copy_data, labels);
256 clock_gettime_mono(&ts2);
257 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
259 if (timediff > audit_timeout) {
260 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
266 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
267 const struct smb_filename *smb_fname,
268 struct vfs_statvfs_struct *statbuf)
271 struct timespec ts1,ts2;
274 clock_gettime_mono(&ts1);
275 result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
276 clock_gettime_mono(&ts2);
277 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
279 if (timediff > audit_timeout) {
280 smb_time_audit_log_fname("statvfs", timediff,
281 smb_fname->base_name);
287 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
288 enum timestamp_set_resolution *p_ts_res)
291 struct timespec ts1,ts2;
294 clock_gettime_mono(&ts1);
295 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
296 clock_gettime_mono(&ts2);
297 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
299 if (timediff > audit_timeout) {
300 smb_time_audit_log("fs_capabilities", timediff);
306 static NTSTATUS smb_time_audit_get_dfs_referrals(
307 struct vfs_handle_struct *handle,
308 struct dfs_GetDFSReferral *r)
311 struct timespec ts1,ts2;
314 clock_gettime_mono(&ts1);
315 result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
316 clock_gettime_mono(&ts2);
317 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
319 if (timediff > audit_timeout) {
320 smb_time_audit_log("get_dfs_referrals", timediff);
326 static NTSTATUS smb_time_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
327 struct files_struct *dirfsp,
328 const struct smb_filename *smb_fname,
329 const struct referral *reflist,
330 size_t referral_count)
333 struct timespec ts1,ts2;
336 clock_gettime_mono(&ts1);
337 result = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
342 clock_gettime_mono(&ts2);
343 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
345 if (timediff > audit_timeout) {
346 smb_time_audit_log("get_dfs_referrals", timediff);
352 static NTSTATUS smb_time_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
354 struct files_struct *dirfsp,
355 const struct smb_filename *smb_fname,
356 struct referral **ppreflist,
357 size_t *preferral_count)
360 struct timespec ts1,ts2;
363 clock_gettime_mono(&ts1);
364 result = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
370 clock_gettime_mono(&ts2);
371 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
373 if (timediff > audit_timeout) {
374 smb_time_audit_log("read_dfs_pathat", timediff);
380 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
382 const char *service_path,
386 struct timespec ts1,ts2;
389 clock_gettime_mono(&ts1);
390 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
392 clock_gettime_mono(&ts2);
393 timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
395 if (timediff > audit_timeout) {
396 smb_time_audit_log("snap_check_path", timediff);
402 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
404 const char *base_volume,
411 struct timespec ts1,ts2;
414 clock_gettime_mono(&ts1);
415 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
416 rw, base_path, snap_path);
417 clock_gettime_mono(&ts2);
418 timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
420 if (timediff > audit_timeout) {
421 smb_time_audit_log("snap_create", timediff);
427 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
433 struct timespec ts1,ts2;
436 clock_gettime_mono(&ts1);
437 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
439 clock_gettime_mono(&ts2);
440 timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
442 if (timediff > audit_timeout) {
443 smb_time_audit_log("snap_delete", timediff);
449 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
450 const struct smb_filename *smb_fname,
451 const char *mask, uint32_t attr)
454 struct timespec ts1,ts2;
457 clock_gettime_mono(&ts1);
458 result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
459 clock_gettime_mono(&ts2);
460 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
462 if (timediff > audit_timeout) {
463 smb_time_audit_log_smb_fname("opendir", timediff, smb_fname);
469 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
471 const char *mask, uint32_t attr)
474 struct timespec ts1,ts2;
477 clock_gettime_mono(&ts1);
478 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
479 clock_gettime_mono(&ts2);
480 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
482 if (timediff > audit_timeout) {
483 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
489 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
491 SMB_STRUCT_STAT *sbuf)
493 struct dirent *result;
494 struct timespec ts1,ts2;
497 clock_gettime_mono(&ts1);
498 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
499 clock_gettime_mono(&ts2);
500 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
502 if (timediff > audit_timeout) {
503 smb_time_audit_log("readdir", timediff);
509 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
510 DIR *dirp, long offset)
512 struct timespec ts1,ts2;
515 clock_gettime_mono(&ts1);
516 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
517 clock_gettime_mono(&ts2);
518 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
520 if (timediff > audit_timeout) {
521 smb_time_audit_log("seekdir", timediff);
526 static long smb_time_audit_telldir(vfs_handle_struct *handle,
530 struct timespec ts1,ts2;
533 clock_gettime_mono(&ts1);
534 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
535 clock_gettime_mono(&ts2);
536 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
538 if (timediff > audit_timeout) {
539 smb_time_audit_log("telldir", timediff);
545 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
548 struct timespec ts1,ts2;
551 clock_gettime_mono(&ts1);
552 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
553 clock_gettime_mono(&ts2);
554 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
556 if (timediff > audit_timeout) {
557 smb_time_audit_log("rewinddir", timediff);
562 static int smb_time_audit_mkdirat(vfs_handle_struct *handle,
563 struct files_struct *dirfsp,
564 const struct smb_filename *smb_fname,
568 struct timespec ts1,ts2;
571 clock_gettime_mono(&ts1);
572 result = SMB_VFS_NEXT_MKDIRAT(handle,
576 clock_gettime_mono(&ts2);
577 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
579 if (timediff > audit_timeout) {
580 smb_time_audit_log_smb_fname("mkdirat",
588 static int smb_time_audit_closedir(vfs_handle_struct *handle,
592 struct timespec ts1,ts2;
595 clock_gettime_mono(&ts1);
596 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
597 clock_gettime_mono(&ts2);
598 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
600 if (timediff > audit_timeout) {
601 smb_time_audit_log("closedir", timediff);
607 static int smb_time_audit_open(vfs_handle_struct *handle,
608 struct smb_filename *fname,
610 int flags, mode_t mode)
613 struct timespec ts1,ts2;
616 clock_gettime_mono(&ts1);
617 result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
618 clock_gettime_mono(&ts2);
619 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
621 if (timediff > audit_timeout) {
622 smb_time_audit_log_fsp("open", timediff, fsp);
628 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
629 struct smb_request *req,
630 uint16_t root_dir_fid,
631 struct smb_filename *fname,
632 uint32_t access_mask,
633 uint32_t share_access,
634 uint32_t create_disposition,
635 uint32_t create_options,
636 uint32_t file_attributes,
637 uint32_t oplock_request,
638 const struct smb2_lease *lease,
639 uint64_t allocation_size,
640 uint32_t private_flags,
641 struct security_descriptor *sd,
642 struct ea_list *ea_list,
643 files_struct **result_fsp,
645 const struct smb2_create_blobs *in_context_blobs,
646 struct smb2_create_blobs *out_context_blobs)
649 struct timespec ts1,ts2;
652 clock_gettime_mono(&ts1);
653 result = SMB_VFS_NEXT_CREATE_FILE(
656 root_dir_fid, /* root_dir_fid */
658 access_mask, /* access_mask */
659 share_access, /* share_access */
660 create_disposition, /* create_disposition*/
661 create_options, /* create_options */
662 file_attributes, /* file_attributes */
663 oplock_request, /* oplock_request */
665 allocation_size, /* allocation_size */
668 ea_list, /* ea_list */
669 result_fsp, /* result */
671 in_context_blobs, out_context_blobs); /* create context */
672 clock_gettime_mono(&ts2);
673 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
675 if (timediff > audit_timeout) {
677 * can't use result_fsp this time, may have
678 * invalid content causing smbd crash
680 smb_time_audit_log_smb_fname("create_file", timediff,
687 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
690 struct timespec ts1,ts2;
693 clock_gettime_mono(&ts1);
694 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
695 clock_gettime_mono(&ts2);
696 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
698 if (timediff > audit_timeout) {
699 smb_time_audit_log_fsp("close", timediff, fsp);
705 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
707 void *data, size_t n, off_t offset)
710 struct timespec ts1,ts2;
713 clock_gettime_mono(&ts1);
714 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
715 clock_gettime_mono(&ts2);
716 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
718 if (timediff > audit_timeout) {
719 smb_time_audit_log_fsp("pread", timediff, fsp);
725 struct smb_time_audit_pread_state {
726 struct files_struct *fsp;
728 struct vfs_aio_state vfs_aio_state;
731 static void smb_time_audit_pread_done(struct tevent_req *subreq);
733 static struct tevent_req *smb_time_audit_pread_send(
734 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
735 struct tevent_context *ev, struct files_struct *fsp,
736 void *data, size_t n, off_t offset)
738 struct tevent_req *req, *subreq;
739 struct smb_time_audit_pread_state *state;
741 req = tevent_req_create(mem_ctx, &state,
742 struct smb_time_audit_pread_state);
748 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
750 if (tevent_req_nomem(subreq, req)) {
751 return tevent_req_post(req, ev);
753 tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
757 static void smb_time_audit_pread_done(struct tevent_req *subreq)
759 struct tevent_req *req = tevent_req_callback_data(
760 subreq, struct tevent_req);
761 struct smb_time_audit_pread_state *state = tevent_req_data(
762 req, struct smb_time_audit_pread_state);
764 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
766 tevent_req_done(req);
769 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
770 struct vfs_aio_state *vfs_aio_state)
772 struct smb_time_audit_pread_state *state = tevent_req_data(
773 req, struct smb_time_audit_pread_state);
776 timediff = state->vfs_aio_state.duration * 1.0e-9;
778 if (timediff > audit_timeout) {
779 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
782 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
785 *vfs_aio_state = state->vfs_aio_state;
789 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
791 const void *data, size_t n,
795 struct timespec ts1,ts2;
798 clock_gettime_mono(&ts1);
799 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
800 clock_gettime_mono(&ts2);
801 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
803 if (timediff > audit_timeout) {
804 smb_time_audit_log_fsp("pwrite", timediff, fsp);
810 struct smb_time_audit_pwrite_state {
811 struct files_struct *fsp;
813 struct vfs_aio_state vfs_aio_state;
816 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
818 static struct tevent_req *smb_time_audit_pwrite_send(
819 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
820 struct tevent_context *ev, struct files_struct *fsp,
821 const void *data, size_t n, off_t offset)
823 struct tevent_req *req, *subreq;
824 struct smb_time_audit_pwrite_state *state;
826 req = tevent_req_create(mem_ctx, &state,
827 struct smb_time_audit_pwrite_state);
833 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
835 if (tevent_req_nomem(subreq, req)) {
836 return tevent_req_post(req, ev);
838 tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
842 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
844 struct tevent_req *req = tevent_req_callback_data(
845 subreq, struct tevent_req);
846 struct smb_time_audit_pwrite_state *state = tevent_req_data(
847 req, struct smb_time_audit_pwrite_state);
849 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
851 tevent_req_done(req);
854 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
855 struct vfs_aio_state *vfs_aio_state)
857 struct smb_time_audit_pwrite_state *state = tevent_req_data(
858 req, struct smb_time_audit_pwrite_state);
861 timediff = state->vfs_aio_state.duration * 1.0e-9;
863 if (timediff > audit_timeout) {
864 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
867 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
870 *vfs_aio_state = state->vfs_aio_state;
874 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
876 off_t offset, int whence)
879 struct timespec ts1,ts2;
882 clock_gettime_mono(&ts1);
883 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
884 clock_gettime_mono(&ts2);
885 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
887 if (timediff > audit_timeout) {
888 smb_time_audit_log_fsp("lseek", timediff, fsp);
894 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
895 files_struct *fromfsp,
896 const DATA_BLOB *hdr, off_t offset,
900 struct timespec ts1,ts2;
903 clock_gettime_mono(&ts1);
904 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
905 clock_gettime_mono(&ts2);
906 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
908 if (timediff > audit_timeout) {
909 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
915 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
921 struct timespec ts1,ts2;
924 clock_gettime_mono(&ts1);
925 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
926 clock_gettime_mono(&ts2);
927 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
929 if (timediff > audit_timeout) {
930 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
936 static int smb_time_audit_renameat(vfs_handle_struct *handle,
937 files_struct *srcfsp,
938 const struct smb_filename *oldname,
939 files_struct *dstfsp,
940 const struct smb_filename *newname)
943 struct timespec ts1,ts2;
946 clock_gettime_mono(&ts1);
947 result = SMB_VFS_NEXT_RENAMEAT(handle,
952 clock_gettime_mono(&ts2);
953 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
955 if (timediff > audit_timeout) {
956 smb_time_audit_log_smb_fname("renameat", timediff, newname);
962 struct smb_time_audit_fsync_state {
963 struct files_struct *fsp;
965 struct vfs_aio_state vfs_aio_state;
968 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
970 static struct tevent_req *smb_time_audit_fsync_send(
971 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
972 struct tevent_context *ev, struct files_struct *fsp)
974 struct tevent_req *req, *subreq;
975 struct smb_time_audit_fsync_state *state;
977 req = tevent_req_create(mem_ctx, &state,
978 struct smb_time_audit_fsync_state);
984 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
985 if (tevent_req_nomem(subreq, req)) {
986 return tevent_req_post(req, ev);
988 tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
992 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
994 struct tevent_req *req = tevent_req_callback_data(
995 subreq, struct tevent_req);
996 struct smb_time_audit_fsync_state *state = tevent_req_data(
997 req, struct smb_time_audit_fsync_state);
999 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1000 TALLOC_FREE(subreq);
1001 tevent_req_done(req);
1004 static int smb_time_audit_fsync_recv(struct tevent_req *req,
1005 struct vfs_aio_state *vfs_aio_state)
1007 struct smb_time_audit_fsync_state *state = tevent_req_data(
1008 req, struct smb_time_audit_fsync_state);
1011 timediff = state->vfs_aio_state.duration * 1.0e-9;
1013 if (timediff > audit_timeout) {
1014 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
1017 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1020 *vfs_aio_state = state->vfs_aio_state;
1024 static int smb_time_audit_stat(vfs_handle_struct *handle,
1025 struct smb_filename *fname)
1028 struct timespec ts1,ts2;
1031 clock_gettime_mono(&ts1);
1032 result = SMB_VFS_NEXT_STAT(handle, fname);
1033 clock_gettime_mono(&ts2);
1034 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1036 if (timediff > audit_timeout) {
1037 smb_time_audit_log_smb_fname("stat", timediff, fname);
1043 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1044 SMB_STRUCT_STAT *sbuf)
1047 struct timespec ts1,ts2;
1050 clock_gettime_mono(&ts1);
1051 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1052 clock_gettime_mono(&ts2);
1053 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1055 if (timediff > audit_timeout) {
1056 smb_time_audit_log_fsp("fstat", timediff, fsp);
1062 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1063 struct smb_filename *path)
1066 struct timespec ts1,ts2;
1069 clock_gettime_mono(&ts1);
1070 result = SMB_VFS_NEXT_LSTAT(handle, path);
1071 clock_gettime_mono(&ts2);
1072 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1074 if (timediff > audit_timeout) {
1075 smb_time_audit_log_smb_fname("lstat", timediff, path);
1081 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1083 const SMB_STRUCT_STAT *sbuf)
1086 struct timespec ts1,ts2;
1089 clock_gettime_mono(&ts1);
1090 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1091 clock_gettime_mono(&ts2);
1092 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1094 if (timediff > audit_timeout) {
1095 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1101 static int smb_time_audit_unlinkat(vfs_handle_struct *handle,
1102 struct files_struct *dirfsp,
1103 const struct smb_filename *path,
1107 struct timespec ts1,ts2;
1110 clock_gettime_mono(&ts1);
1111 result = SMB_VFS_NEXT_UNLINKAT(handle,
1115 clock_gettime_mono(&ts2);
1116 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1118 if (timediff > audit_timeout) {
1119 smb_time_audit_log_smb_fname("unlinkat", timediff, path);
1125 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1126 const struct smb_filename *smb_fname,
1130 struct timespec ts1,ts2;
1133 clock_gettime_mono(&ts1);
1134 result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1135 clock_gettime_mono(&ts2);
1136 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1138 if (timediff > audit_timeout) {
1139 smb_time_audit_log_fname("chmod",
1141 smb_fname->base_name);
1147 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1151 struct timespec ts1,ts2;
1154 clock_gettime_mono(&ts1);
1155 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1156 clock_gettime_mono(&ts2);
1157 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1159 if (timediff > audit_timeout) {
1160 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1166 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1167 uid_t uid, gid_t gid)
1170 struct timespec ts1,ts2;
1173 clock_gettime_mono(&ts1);
1174 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1175 clock_gettime_mono(&ts2);
1176 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1178 if (timediff > audit_timeout) {
1179 smb_time_audit_log_fsp("fchown", timediff, fsp);
1185 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1186 const struct smb_filename *smb_fname,
1191 struct timespec ts1,ts2;
1194 clock_gettime_mono(&ts1);
1195 result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1196 clock_gettime_mono(&ts2);
1197 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1199 if (timediff > audit_timeout) {
1200 smb_time_audit_log_fname("lchown",
1202 smb_fname->base_name);
1208 static int smb_time_audit_chdir(vfs_handle_struct *handle,
1209 const struct smb_filename *smb_fname)
1212 struct timespec ts1,ts2;
1215 clock_gettime_mono(&ts1);
1216 result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1217 clock_gettime_mono(&ts2);
1218 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1220 if (timediff > audit_timeout) {
1221 smb_time_audit_log_fname("chdir",
1223 smb_fname->base_name);
1229 static struct smb_filename *smb_time_audit_getwd(vfs_handle_struct *handle,
1230 TALLOC_CTX *mem_ctx)
1232 struct smb_filename *result;
1233 struct timespec ts1,ts2;
1236 clock_gettime_mono(&ts1);
1237 result = SMB_VFS_NEXT_GETWD(handle, mem_ctx);
1238 clock_gettime_mono(&ts2);
1239 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1241 if (timediff > audit_timeout) {
1242 smb_time_audit_log("getwd", timediff);
1248 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1249 const struct smb_filename *path,
1250 struct smb_file_time *ft)
1253 struct timespec ts1,ts2;
1256 clock_gettime_mono(&ts1);
1257 result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1258 clock_gettime_mono(&ts2);
1259 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1261 if (timediff > audit_timeout) {
1262 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1268 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1273 struct timespec ts1,ts2;
1276 clock_gettime_mono(&ts1);
1277 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1278 clock_gettime_mono(&ts2);
1279 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1281 if (timediff > audit_timeout) {
1282 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1288 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1295 int saved_errno = 0;
1296 struct timespec ts1,ts2;
1299 clock_gettime_mono(&ts1);
1300 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1302 saved_errno = errno;
1304 clock_gettime_mono(&ts2);
1305 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1307 if (timediff > audit_timeout) {
1308 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1311 errno = saved_errno;
1316 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1317 int op, off_t offset, off_t count,
1321 struct timespec ts1,ts2;
1324 clock_gettime_mono(&ts1);
1325 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1326 clock_gettime_mono(&ts2);
1327 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1329 if (timediff > audit_timeout) {
1330 smb_time_audit_log_fsp("lock", timediff, fsp);
1336 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1337 struct files_struct *fsp,
1338 uint32_t share_access,
1339 uint32_t access_mask)
1342 struct timespec ts1,ts2;
1345 clock_gettime_mono(&ts1);
1346 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_access,
1348 clock_gettime_mono(&ts2);
1349 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1351 if (timediff > audit_timeout) {
1352 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1358 static int smb_time_audit_fcntl(struct vfs_handle_struct *handle,
1359 struct files_struct *fsp,
1360 int cmd, va_list cmd_arg)
1363 va_list dup_cmd_arg;
1365 struct timespec ts1,ts2;
1368 va_copy(dup_cmd_arg, cmd_arg);
1369 arg = va_arg(dup_cmd_arg, void *);
1370 clock_gettime_mono(&ts1);
1371 result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1372 clock_gettime_mono(&ts2);
1373 va_end(dup_cmd_arg);
1375 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1376 if (timediff > audit_timeout) {
1377 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1383 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1388 struct timespec ts1,ts2;
1391 clock_gettime_mono(&ts1);
1392 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1393 clock_gettime_mono(&ts2);
1394 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1396 if (timediff > audit_timeout) {
1397 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1403 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1405 off_t *poffset, off_t *pcount,
1406 int *ptype, pid_t *ppid)
1409 struct timespec ts1,ts2;
1412 clock_gettime_mono(&ts1);
1413 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1415 clock_gettime_mono(&ts2);
1416 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1418 if (timediff > audit_timeout) {
1419 smb_time_audit_log_fsp("getlock", timediff, fsp);
1425 static int smb_time_audit_symlinkat(vfs_handle_struct *handle,
1426 const char *link_contents,
1427 struct files_struct *dirfsp,
1428 const struct smb_filename *new_smb_fname)
1431 struct timespec ts1,ts2;
1434 clock_gettime_mono(&ts1);
1435 result = SMB_VFS_NEXT_SYMLINKAT(handle,
1439 clock_gettime_mono(&ts2);
1440 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1442 if (timediff > audit_timeout) {
1443 smb_time_audit_log_fname("symlinkat", timediff,
1444 new_smb_fname->base_name);
1450 static int smb_time_audit_readlinkat(vfs_handle_struct *handle,
1451 files_struct *dirfsp,
1452 const struct smb_filename *smb_fname,
1457 struct timespec ts1,ts2;
1460 clock_gettime_mono(&ts1);
1461 result = SMB_VFS_NEXT_READLINKAT(handle,
1466 clock_gettime_mono(&ts2);
1467 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1469 if (timediff > audit_timeout) {
1470 smb_time_audit_log_fname("readlinkat", timediff,
1471 smb_fname->base_name);
1477 static int smb_time_audit_linkat(vfs_handle_struct *handle,
1478 files_struct *srcfsp,
1479 const struct smb_filename *old_smb_fname,
1480 files_struct *dstfsp,
1481 const struct smb_filename *new_smb_fname,
1485 struct timespec ts1,ts2;
1488 clock_gettime_mono(&ts1);
1489 result = SMB_VFS_NEXT_LINKAT(handle,
1495 clock_gettime_mono(&ts2);
1496 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1498 if (timediff > audit_timeout) {
1499 smb_time_audit_log_fname("linkat", timediff,
1500 new_smb_fname->base_name);
1506 static int smb_time_audit_mknodat(vfs_handle_struct *handle,
1507 files_struct *dirfsp,
1508 const struct smb_filename *smb_fname,
1513 struct timespec ts1,ts2;
1516 clock_gettime_mono(&ts1);
1517 result = SMB_VFS_NEXT_MKNODAT(handle,
1522 clock_gettime_mono(&ts2);
1523 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1525 if (timediff > audit_timeout) {
1526 smb_time_audit_log_smb_fname("mknodat", timediff, smb_fname);
1532 static struct smb_filename *smb_time_audit_realpath(vfs_handle_struct *handle,
1534 const struct smb_filename *smb_fname)
1536 struct smb_filename *result_fname;
1537 struct timespec ts1,ts2;
1540 clock_gettime_mono(&ts1);
1541 result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1542 clock_gettime_mono(&ts2);
1543 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1545 if (timediff > audit_timeout) {
1546 smb_time_audit_log_fname("realpath", timediff,
1547 smb_fname->base_name);
1550 return result_fname;
1553 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1554 const struct smb_filename *smb_fname,
1558 struct timespec ts1,ts2;
1561 clock_gettime_mono(&ts1);
1562 result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1563 clock_gettime_mono(&ts2);
1564 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1566 if (timediff > audit_timeout) {
1567 smb_time_audit_log_smb_fname("chflags", timediff, smb_fname);
1573 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1574 const SMB_STRUCT_STAT *sbuf)
1576 struct file_id id_zero;
1577 struct file_id result;
1578 struct timespec ts1,ts2;
1581 ZERO_STRUCT(id_zero);
1583 clock_gettime_mono(&ts1);
1584 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1585 clock_gettime_mono(&ts2);
1586 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1588 if (timediff > audit_timeout) {
1589 smb_time_audit_log("file_id_create", timediff);
1595 static uint64_t smb_time_audit_fs_file_id(struct vfs_handle_struct *handle,
1596 const SMB_STRUCT_STAT *sbuf)
1599 struct timespec ts1,ts2;
1602 clock_gettime_mono(&ts1);
1603 result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
1604 clock_gettime_mono(&ts2);
1605 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1607 if (timediff > audit_timeout) {
1608 smb_time_audit_log("fs_file_id", timediff);
1614 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1615 struct files_struct *fsp,
1616 const struct smb_filename *smb_fname,
1617 TALLOC_CTX *mem_ctx,
1618 unsigned int *pnum_streams,
1619 struct stream_struct **pstreams)
1622 struct timespec ts1,ts2;
1625 clock_gettime_mono(&ts1);
1626 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1627 pnum_streams, pstreams);
1628 clock_gettime_mono(&ts2);
1629 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1631 if (timediff > audit_timeout) {
1632 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1638 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1641 TALLOC_CTX *mem_ctx,
1645 struct timespec ts1,ts2;
1648 clock_gettime_mono(&ts1);
1649 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1651 clock_gettime_mono(&ts2);
1652 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1654 if (timediff > audit_timeout) {
1655 smb_time_audit_log_fname("get_real_filename", timediff, path);
1661 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1662 const struct smb_filename *smb_fname)
1665 struct timespec ts1,ts2;
1668 clock_gettime_mono(&ts1);
1669 result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1670 clock_gettime_mono(&ts2);
1671 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1673 if (timediff > audit_timeout) {
1674 smb_time_audit_log_fname("connectpath", timediff,
1675 smb_fname->base_name);
1681 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1682 struct byte_range_lock *br_lck,
1683 struct lock_struct *plock)
1686 struct timespec ts1,ts2;
1689 clock_gettime_mono(&ts1);
1690 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
1691 clock_gettime_mono(&ts2);
1692 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1694 if (timediff > audit_timeout) {
1695 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1702 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1703 struct byte_range_lock *br_lck,
1704 const struct lock_struct *plock)
1707 struct timespec ts1,ts2;
1710 clock_gettime_mono(&ts1);
1711 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
1712 clock_gettime_mono(&ts2);
1713 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1715 if (timediff > audit_timeout) {
1716 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1723 static bool smb_time_audit_strict_lock_check(struct vfs_handle_struct *handle,
1724 struct files_struct *fsp,
1725 struct lock_struct *plock)
1728 struct timespec ts1,ts2;
1731 clock_gettime_mono(&ts1);
1732 result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1733 clock_gettime_mono(&ts2);
1734 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1736 if (timediff > audit_timeout) {
1737 smb_time_audit_log_fsp("strict_lock_check", timediff, fsp);
1743 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1745 enum vfs_translate_direction direction,
1746 TALLOC_CTX *mem_ctx,
1750 struct timespec ts1,ts2;
1753 clock_gettime_mono(&ts1);
1754 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1756 clock_gettime_mono(&ts2);
1757 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1759 if (timediff > audit_timeout) {
1760 smb_time_audit_log_fname("translate_name", timediff, name);
1766 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1767 struct files_struct *fsp,
1771 const uint8_t *_in_data,
1773 uint8_t **_out_data,
1774 uint32_t max_out_len,
1778 struct timespec ts1,ts2;
1781 clock_gettime_mono(&ts1);
1782 result = SMB_VFS_NEXT_FSCTL(handle,
1792 clock_gettime_mono(&ts2);
1793 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1795 if (timediff > audit_timeout) {
1796 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1802 static NTSTATUS smb_time_get_dos_attributes(struct vfs_handle_struct *handle,
1803 struct smb_filename *smb_fname,
1807 struct timespec ts1,ts2;
1810 clock_gettime_mono(&ts1);
1811 result = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
1814 clock_gettime_mono(&ts2);
1815 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1817 if (timediff > audit_timeout) {
1818 smb_time_audit_log_fname("get_dos_attributes",
1820 smb_fname->base_name);
1826 struct smb_time_audit_get_dos_attributes_state {
1827 struct vfs_aio_state aio_state;
1828 files_struct *dir_fsp;
1829 const struct smb_filename *smb_fname;
1833 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq);
1835 static struct tevent_req *smb_time_audit_get_dos_attributes_send(
1836 TALLOC_CTX *mem_ctx,
1837 struct tevent_context *ev,
1838 struct vfs_handle_struct *handle,
1839 files_struct *dir_fsp,
1840 struct smb_filename *smb_fname)
1842 struct tevent_req *req = NULL;
1843 struct smb_time_audit_get_dos_attributes_state *state = NULL;
1844 struct tevent_req *subreq = NULL;
1846 req = tevent_req_create(mem_ctx, &state,
1847 struct smb_time_audit_get_dos_attributes_state);
1851 *state = (struct smb_time_audit_get_dos_attributes_state) {
1853 .smb_fname = smb_fname,
1856 subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
1861 if (tevent_req_nomem(subreq, req)) {
1862 return tevent_req_post(req, ev);
1864 tevent_req_set_callback(subreq,
1865 smb_time_audit_get_dos_attributes_done,
1871 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq)
1873 struct tevent_req *req =
1874 tevent_req_callback_data(subreq,
1876 struct smb_time_audit_get_dos_attributes_state *state =
1877 tevent_req_data(req,
1878 struct smb_time_audit_get_dos_attributes_state);
1881 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
1884 TALLOC_FREE(subreq);
1885 if (tevent_req_nterror(req, status)) {
1889 tevent_req_done(req);
1893 static NTSTATUS smb_time_audit_get_dos_attributes_recv(struct tevent_req *req,
1894 struct vfs_aio_state *aio_state,
1897 struct smb_time_audit_get_dos_attributes_state *state =
1898 tevent_req_data(req,
1899 struct smb_time_audit_get_dos_attributes_state);
1903 timediff = state->aio_state.duration * 1.0e-9;
1905 if (timediff > audit_timeout) {
1906 smb_time_audit_log_at("async get_dos_attributes",
1912 if (tevent_req_is_nterror(req, &status)) {
1913 tevent_req_received(req);
1917 *aio_state = state->aio_state;
1918 *dosmode = state->dosmode;
1919 tevent_req_received(req);
1920 return NT_STATUS_OK;
1923 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1924 struct files_struct *fsp,
1928 struct timespec ts1,ts2;
1931 clock_gettime_mono(&ts1);
1932 result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1935 clock_gettime_mono(&ts2);
1936 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1938 if (timediff > audit_timeout) {
1939 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1945 static NTSTATUS smb_time_set_dos_attributes(struct vfs_handle_struct *handle,
1946 const struct smb_filename *smb_fname,
1950 struct timespec ts1,ts2;
1953 clock_gettime_mono(&ts1);
1954 result = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
1957 clock_gettime_mono(&ts2);
1958 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1960 if (timediff > audit_timeout) {
1961 smb_time_audit_log_fname("set_dos_attributes",
1963 smb_fname->base_name);
1969 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
1970 struct files_struct *fsp,
1974 struct timespec ts1,ts2;
1977 clock_gettime_mono(&ts1);
1978 result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
1981 clock_gettime_mono(&ts2);
1982 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1984 if (timediff > audit_timeout) {
1985 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
1991 struct time_audit_offload_read_state {
1992 struct vfs_handle_struct *handle;
1993 struct timespec ts_send;
1994 DATA_BLOB token_blob;
1997 static void smb_time_audit_offload_read_done(struct tevent_req *subreq);
1999 static struct tevent_req *smb_time_audit_offload_read_send(
2000 TALLOC_CTX *mem_ctx,
2001 struct tevent_context *ev,
2002 struct vfs_handle_struct *handle,
2003 struct files_struct *fsp,
2009 struct tevent_req *req = NULL;
2010 struct tevent_req *subreq = NULL;
2011 struct time_audit_offload_read_state *state = NULL;
2013 req = tevent_req_create(mem_ctx, &state,
2014 struct time_audit_offload_read_state);
2018 state->handle = handle;
2019 clock_gettime_mono(&state->ts_send);
2021 subreq = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev,
2025 if (tevent_req_nomem(subreq, req)) {
2026 return tevent_req_post(req, ev);
2029 tevent_req_set_callback(subreq, smb_time_audit_offload_read_done, req);
2033 static void smb_time_audit_offload_read_done(struct tevent_req *subreq)
2035 struct tevent_req *req = tevent_req_callback_data(
2036 subreq, struct tevent_req);
2037 struct time_audit_offload_read_state *state = tevent_req_data(
2038 req, struct time_audit_offload_read_state);
2041 status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(subreq,
2044 &state->token_blob);
2045 TALLOC_FREE(subreq);
2046 if (tevent_req_nterror(req, status)) {
2049 tevent_req_done(req);
2052 static NTSTATUS smb_time_audit_offload_read_recv(
2053 struct tevent_req *req,
2054 struct vfs_handle_struct *handle,
2055 TALLOC_CTX *mem_ctx,
2056 DATA_BLOB *token_blob)
2058 struct time_audit_offload_read_state *state = tevent_req_data(
2059 req, struct time_audit_offload_read_state);
2060 struct timespec ts_recv;
2064 clock_gettime_mono(&ts_recv);
2065 timediff = nsec_time_diff(&ts_recv, &state->ts_send) * 1.0e-9;
2066 if (timediff > audit_timeout) {
2067 smb_time_audit_log("offload_read", timediff);
2070 if (tevent_req_is_nterror(req, &status)) {
2071 tevent_req_received(req);
2075 token_blob->length = state->token_blob.length;
2076 token_blob->data = talloc_move(mem_ctx, &state->token_blob.data);
2078 tevent_req_received(req);
2079 return NT_STATUS_OK;
2082 struct time_audit_offload_write_state {
2083 struct timespec ts_send;
2084 struct vfs_handle_struct *handle;
2087 static void smb_time_audit_offload_write_done(struct tevent_req *subreq);
2089 static struct tevent_req *smb_time_audit_offload_write_send(struct vfs_handle_struct *handle,
2090 TALLOC_CTX *mem_ctx,
2091 struct tevent_context *ev,
2094 off_t transfer_offset,
2095 struct files_struct *dest_fsp,
2099 struct tevent_req *req;
2100 struct tevent_req *subreq;
2101 struct time_audit_offload_write_state *state;
2103 req = tevent_req_create(mem_ctx, &state,
2104 struct time_audit_offload_write_state);
2109 state->handle = handle;
2110 clock_gettime_mono(&state->ts_send);
2111 subreq = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, state, ev,
2112 fsctl, token, transfer_offset,
2113 dest_fsp, dest_off, num);
2114 if (tevent_req_nomem(subreq, req)) {
2115 return tevent_req_post(req, ev);
2118 tevent_req_set_callback(subreq, smb_time_audit_offload_write_done, req);
2122 static void smb_time_audit_offload_write_done(struct tevent_req *subreq)
2124 struct tevent_req *req = tevent_req_callback_data(
2125 subreq, struct tevent_req);
2126 struct time_audit_offload_write_state *state = tevent_req_data(
2127 req, struct time_audit_offload_write_state);
2130 status = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(state->handle,
2133 TALLOC_FREE(subreq);
2134 if (tevent_req_nterror(req, status)) {
2137 tevent_req_done(req);
2140 static NTSTATUS smb_time_audit_offload_write_recv(struct vfs_handle_struct *handle,
2141 struct tevent_req *req,
2144 struct time_audit_offload_write_state *state = tevent_req_data(
2145 req, struct time_audit_offload_write_state);
2146 struct timespec ts_recv;
2150 clock_gettime_mono(&ts_recv);
2151 timediff = nsec_time_diff(&ts_recv, &state->ts_send)*1.0e-9;
2152 if (timediff > audit_timeout) {
2153 smb_time_audit_log("offload_write", timediff);
2156 *copied = state->copied;
2157 if (tevent_req_is_nterror(req, &status)) {
2158 tevent_req_received(req);
2162 tevent_req_received(req);
2163 return NT_STATUS_OK;
2166 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
2167 TALLOC_CTX *mem_ctx,
2168 struct files_struct *fsp,
2169 struct smb_filename *smb_fname,
2170 uint16_t *_compression_fmt)
2173 struct timespec ts1,ts2;
2176 clock_gettime_mono(&ts1);
2177 result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2179 clock_gettime_mono(&ts2);
2180 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2182 if (timediff > audit_timeout) {
2184 smb_time_audit_log_fsp("get_compression",
2187 smb_time_audit_log_smb_fname("get_compression",
2188 timediff, smb_fname);
2195 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
2196 TALLOC_CTX *mem_ctx,
2197 struct files_struct *fsp,
2198 uint16_t compression_fmt)
2201 struct timespec ts1,ts2;
2204 clock_gettime_mono(&ts1);
2205 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2207 clock_gettime_mono(&ts2);
2208 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2210 if (timediff > audit_timeout) {
2211 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2217 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
2218 const struct smb_filename *fname,
2219 TALLOC_CTX *mem_ctx,
2220 struct readdir_attr_data **pattr_data)
2223 struct timespec ts1,ts2;
2226 clock_gettime_mono(&ts1);
2227 status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2228 clock_gettime_mono(&ts2);
2229 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2231 if (timediff > audit_timeout) {
2232 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
2238 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2240 uint32_t security_info,
2241 TALLOC_CTX *mem_ctx,
2242 struct security_descriptor **ppdesc)
2245 struct timespec ts1,ts2;
2248 clock_gettime_mono(&ts1);
2249 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2251 clock_gettime_mono(&ts2);
2252 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2254 if (timediff > audit_timeout) {
2255 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2261 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
2262 const struct smb_filename *smb_fname,
2263 uint32_t security_info,
2264 TALLOC_CTX *mem_ctx,
2265 struct security_descriptor **ppdesc)
2268 struct timespec ts1,ts2;
2271 clock_gettime_mono(&ts1);
2272 result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2274 clock_gettime_mono(&ts2);
2275 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2277 if (timediff > audit_timeout) {
2278 smb_time_audit_log_fname("get_nt_acl",
2280 smb_fname->base_name);
2286 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2288 uint32_t security_info_sent,
2289 const struct security_descriptor *psd)
2292 struct timespec ts1,ts2;
2295 clock_gettime_mono(&ts1);
2296 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2298 clock_gettime_mono(&ts2);
2299 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2301 if (timediff > audit_timeout) {
2302 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2308 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2309 struct smb_filename *smb_fname,
2310 struct security_acl *sacl,
2311 uint32_t access_requested,
2312 uint32_t access_denied)
2315 struct timespec ts1,ts2;
2318 clock_gettime_mono(&ts1);
2319 result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2324 clock_gettime_mono(&ts2);
2325 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2327 if (timediff > audit_timeout) {
2328 smb_time_audit_log_fname("audit_file",
2330 smb_fname->base_name);
2336 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2337 const struct smb_filename *smb_fname,
2338 SMB_ACL_TYPE_T type,
2339 TALLOC_CTX *mem_ctx)
2342 struct timespec ts1,ts2;
2345 clock_gettime_mono(&ts1);
2346 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2348 clock_gettime_mono(&ts2);
2349 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2351 if (timediff > audit_timeout) {
2352 smb_time_audit_log_fname("sys_acl_get_file", timediff,
2353 smb_fname->base_name);
2359 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2361 TALLOC_CTX *mem_ctx)
2364 struct timespec ts1,ts2;
2367 clock_gettime_mono(&ts1);
2368 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2369 clock_gettime_mono(&ts2);
2370 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2372 if (timediff > audit_timeout) {
2373 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2380 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2381 const struct smb_filename *smb_fname,
2382 TALLOC_CTX *mem_ctx,
2383 char **blob_description,
2387 struct timespec ts1,ts2;
2390 clock_gettime_mono(&ts1);
2391 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2392 mem_ctx, blob_description, blob);
2393 clock_gettime_mono(&ts2);
2394 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2396 if (timediff > audit_timeout) {
2397 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2403 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2405 TALLOC_CTX *mem_ctx,
2406 char **blob_description,
2410 struct timespec ts1,ts2;
2413 clock_gettime_mono(&ts1);
2414 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2415 clock_gettime_mono(&ts2);
2416 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2418 if (timediff > audit_timeout) {
2419 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2425 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2426 const struct smb_filename *smb_fname,
2427 SMB_ACL_TYPE_T acltype,
2431 struct timespec ts1,ts2;
2434 clock_gettime_mono(&ts1);
2435 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2437 clock_gettime_mono(&ts2);
2438 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2440 if (timediff > audit_timeout) {
2441 smb_time_audit_log_fname("sys_acl_set_file", timediff,
2442 smb_fname->base_name);
2448 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2453 struct timespec ts1,ts2;
2456 clock_gettime_mono(&ts1);
2457 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2458 clock_gettime_mono(&ts2);
2459 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2461 if (timediff > audit_timeout) {
2462 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2468 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2469 const struct smb_filename *smb_fname)
2472 struct timespec ts1,ts2;
2475 clock_gettime_mono(&ts1);
2476 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2477 clock_gettime_mono(&ts2);
2478 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2480 if (timediff > audit_timeout) {
2481 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff,
2482 smb_fname->base_name);
2488 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2489 const struct smb_filename *smb_fname,
2495 struct timespec ts1,ts2;
2498 clock_gettime_mono(&ts1);
2499 result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2500 clock_gettime_mono(&ts2);
2501 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2503 if (timediff > audit_timeout) {
2504 smb_time_audit_log_fname("getxattr", timediff,
2505 smb_fname->base_name);
2511 struct smb_time_audit_getxattrat_state {
2512 struct vfs_aio_state aio_state;
2513 files_struct *dir_fsp;
2514 const struct smb_filename *smb_fname;
2515 const char *xattr_name;
2517 uint8_t *xattr_value;
2520 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq);
2522 static struct tevent_req *smb_time_audit_getxattrat_send(
2523 TALLOC_CTX *mem_ctx,
2524 struct tevent_context *ev,
2525 struct vfs_handle_struct *handle,
2526 files_struct *dir_fsp,
2527 const struct smb_filename *smb_fname,
2528 const char *xattr_name,
2531 struct tevent_req *req = NULL;
2532 struct tevent_req *subreq = NULL;
2533 struct smb_time_audit_getxattrat_state *state = NULL;
2535 req = tevent_req_create(mem_ctx, &state,
2536 struct smb_time_audit_getxattrat_state);
2540 *state = (struct smb_time_audit_getxattrat_state) {
2542 .smb_fname = smb_fname,
2543 .xattr_name = xattr_name,
2546 subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2553 if (tevent_req_nomem(subreq, req)) {
2554 return tevent_req_post(req, ev);
2556 tevent_req_set_callback(subreq, smb_time_audit_getxattrat_done, req);
2561 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq)
2563 struct tevent_req *req = tevent_req_callback_data(
2564 subreq, struct tevent_req);
2565 struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2566 req, struct smb_time_audit_getxattrat_state);
2568 state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2571 &state->xattr_value);
2572 TALLOC_FREE(subreq);
2573 if (state->xattr_size == -1) {
2574 tevent_req_error(req, state->aio_state.error);
2578 tevent_req_done(req);
2581 static ssize_t smb_time_audit_getxattrat_recv(struct tevent_req *req,
2582 struct vfs_aio_state *aio_state,
2583 TALLOC_CTX *mem_ctx,
2584 uint8_t **xattr_value)
2586 struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2587 req, struct smb_time_audit_getxattrat_state);
2591 timediff = state->aio_state.duration * 1.0e-9;
2593 if (timediff > audit_timeout) {
2594 smb_time_audit_log_at("async getxattrat",
2600 if (tevent_req_is_unix_error(req, &aio_state->error)) {
2601 tevent_req_received(req);
2605 *aio_state = state->aio_state;
2606 xattr_size = state->xattr_size;
2607 if (xattr_value != NULL) {
2608 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2611 tevent_req_received(req);
2615 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2616 struct files_struct *fsp,
2617 const char *name, void *value,
2621 struct timespec ts1,ts2;
2624 clock_gettime_mono(&ts1);
2625 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2626 clock_gettime_mono(&ts2);
2627 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2629 if (timediff > audit_timeout) {
2630 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2636 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2637 const struct smb_filename *smb_fname,
2642 struct timespec ts1,ts2;
2645 clock_gettime_mono(&ts1);
2646 result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2647 clock_gettime_mono(&ts2);
2648 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2650 if (timediff > audit_timeout) {
2651 smb_time_audit_log_fname("listxattr", timediff,
2652 smb_fname->base_name);
2658 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2659 struct files_struct *fsp, char *list,
2663 struct timespec ts1,ts2;
2666 clock_gettime_mono(&ts1);
2667 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2668 clock_gettime_mono(&ts2);
2669 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2671 if (timediff > audit_timeout) {
2672 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2678 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2679 const struct smb_filename *smb_fname,
2683 struct timespec ts1,ts2;
2686 clock_gettime_mono(&ts1);
2687 result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2688 clock_gettime_mono(&ts2);
2689 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2691 if (timediff > audit_timeout) {
2692 smb_time_audit_log_fname("removexattr", timediff,
2693 smb_fname->base_name);
2699 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2700 struct files_struct *fsp,
2704 struct timespec ts1,ts2;
2707 clock_gettime_mono(&ts1);
2708 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2709 clock_gettime_mono(&ts2);
2710 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2712 if (timediff > audit_timeout) {
2713 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2719 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2720 const struct smb_filename *smb_fname,
2727 struct timespec ts1,ts2;
2730 clock_gettime_mono(&ts1);
2731 result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2733 clock_gettime_mono(&ts2);
2734 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2736 if (timediff > audit_timeout) {
2737 smb_time_audit_log_fname("setxattr", timediff,
2738 smb_fname->base_name);
2744 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2745 struct files_struct *fsp, const char *name,
2746 const void *value, size_t size, int flags)
2749 struct timespec ts1,ts2;
2752 clock_gettime_mono(&ts1);
2753 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2754 clock_gettime_mono(&ts2);
2755 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2757 if (timediff > audit_timeout) {
2758 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2764 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2765 struct files_struct *fsp)
2768 struct timespec ts1,ts2;
2771 clock_gettime_mono(&ts1);
2772 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2773 clock_gettime_mono(&ts2);
2774 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2776 if (timediff > audit_timeout) {
2777 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2783 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2784 struct files_struct *fsp,
2785 TALLOC_CTX *mem_ctx,
2789 struct timespec ts1,ts2;
2792 clock_gettime_mono(&ts1);
2793 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2794 clock_gettime_mono(&ts2);
2795 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2797 if (timediff > audit_timeout) {
2798 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2804 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2805 struct files_struct *fsp,
2806 const DATA_BLOB old_cookie,
2807 TALLOC_CTX *mem_ctx,
2808 DATA_BLOB *new_cookie)
2811 struct timespec ts1,ts2;
2814 clock_gettime_mono(&ts1);
2815 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2816 mem_ctx, new_cookie);
2817 clock_gettime_mono(&ts2);
2818 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2820 if (timediff > audit_timeout) {
2821 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2827 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2828 struct smb_request *smb1req,
2829 struct smbXsrv_open *op,
2830 const DATA_BLOB old_cookie,
2831 TALLOC_CTX *mem_ctx,
2832 struct files_struct **fsp,
2833 DATA_BLOB *new_cookie)
2836 struct timespec ts1,ts2;
2839 clock_gettime_mono(&ts1);
2840 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2841 mem_ctx, fsp, new_cookie);
2842 clock_gettime_mono(&ts2);
2843 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2845 if (timediff > audit_timeout) {
2846 smb_time_audit_log("durable_reconnect", timediff);
2852 /* VFS operations */
2854 static struct vfs_fn_pointers vfs_time_audit_fns = {
2855 .connect_fn = smb_time_audit_connect,
2856 .disconnect_fn = smb_time_audit_disconnect,
2857 .disk_free_fn = smb_time_audit_disk_free,
2858 .get_quota_fn = smb_time_audit_get_quota,
2859 .set_quota_fn = smb_time_audit_set_quota,
2860 .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2861 .statvfs_fn = smb_time_audit_statvfs,
2862 .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2863 .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2864 .create_dfs_pathat_fn = smb_time_audit_create_dfs_pathat,
2865 .read_dfs_pathat_fn = smb_time_audit_read_dfs_pathat,
2866 .opendir_fn = smb_time_audit_opendir,
2867 .fdopendir_fn = smb_time_audit_fdopendir,
2868 .readdir_fn = smb_time_audit_readdir,
2869 .seekdir_fn = smb_time_audit_seekdir,
2870 .telldir_fn = smb_time_audit_telldir,
2871 .rewind_dir_fn = smb_time_audit_rewinddir,
2872 .mkdirat_fn = smb_time_audit_mkdirat,
2873 .closedir_fn = smb_time_audit_closedir,
2874 .open_fn = smb_time_audit_open,
2875 .create_file_fn = smb_time_audit_create_file,
2876 .close_fn = smb_time_audit_close,
2877 .pread_fn = smb_time_audit_pread,
2878 .pread_send_fn = smb_time_audit_pread_send,
2879 .pread_recv_fn = smb_time_audit_pread_recv,
2880 .pwrite_fn = smb_time_audit_pwrite,
2881 .pwrite_send_fn = smb_time_audit_pwrite_send,
2882 .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2883 .lseek_fn = smb_time_audit_lseek,
2884 .sendfile_fn = smb_time_audit_sendfile,
2885 .recvfile_fn = smb_time_audit_recvfile,
2886 .renameat_fn = smb_time_audit_renameat,
2887 .fsync_send_fn = smb_time_audit_fsync_send,
2888 .fsync_recv_fn = smb_time_audit_fsync_recv,
2889 .stat_fn = smb_time_audit_stat,
2890 .fstat_fn = smb_time_audit_fstat,
2891 .lstat_fn = smb_time_audit_lstat,
2892 .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2893 .unlinkat_fn = smb_time_audit_unlinkat,
2894 .chmod_fn = smb_time_audit_chmod,
2895 .fchmod_fn = smb_time_audit_fchmod,
2896 .fchown_fn = smb_time_audit_fchown,
2897 .lchown_fn = smb_time_audit_lchown,
2898 .chdir_fn = smb_time_audit_chdir,
2899 .getwd_fn = smb_time_audit_getwd,
2900 .ntimes_fn = smb_time_audit_ntimes,
2901 .ftruncate_fn = smb_time_audit_ftruncate,
2902 .fallocate_fn = smb_time_audit_fallocate,
2903 .lock_fn = smb_time_audit_lock,
2904 .kernel_flock_fn = smb_time_audit_kernel_flock,
2905 .fcntl_fn = smb_time_audit_fcntl,
2906 .linux_setlease_fn = smb_time_audit_linux_setlease,
2907 .getlock_fn = smb_time_audit_getlock,
2908 .symlinkat_fn = smb_time_audit_symlinkat,
2909 .readlinkat_fn = smb_time_audit_readlinkat,
2910 .linkat_fn = smb_time_audit_linkat,
2911 .mknodat_fn = smb_time_audit_mknodat,
2912 .realpath_fn = smb_time_audit_realpath,
2913 .chflags_fn = smb_time_audit_chflags,
2914 .file_id_create_fn = smb_time_audit_file_id_create,
2915 .fs_file_id_fn = smb_time_audit_fs_file_id,
2916 .offload_read_send_fn = smb_time_audit_offload_read_send,
2917 .offload_read_recv_fn = smb_time_audit_offload_read_recv,
2918 .offload_write_send_fn = smb_time_audit_offload_write_send,
2919 .offload_write_recv_fn = smb_time_audit_offload_write_recv,
2920 .get_compression_fn = smb_time_audit_get_compression,
2921 .set_compression_fn = smb_time_audit_set_compression,
2922 .snap_check_path_fn = smb_time_audit_snap_check_path,
2923 .snap_create_fn = smb_time_audit_snap_create,
2924 .snap_delete_fn = smb_time_audit_snap_delete,
2925 .streaminfo_fn = smb_time_audit_streaminfo,
2926 .get_real_filename_fn = smb_time_audit_get_real_filename,
2927 .connectpath_fn = smb_time_audit_connectpath,
2928 .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2929 .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2930 .strict_lock_check_fn = smb_time_audit_strict_lock_check,
2931 .translate_name_fn = smb_time_audit_translate_name,
2932 .fsctl_fn = smb_time_audit_fsctl,
2933 .get_dos_attributes_fn = smb_time_get_dos_attributes,
2934 .get_dos_attributes_send_fn = smb_time_audit_get_dos_attributes_send,
2935 .get_dos_attributes_recv_fn = smb_time_audit_get_dos_attributes_recv,
2936 .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2937 .set_dos_attributes_fn = smb_time_set_dos_attributes,
2938 .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2939 .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2940 .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2941 .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2942 .audit_file_fn = smb_time_audit_audit_file,
2943 .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2944 .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2945 .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2946 .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2947 .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2948 .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2949 .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2950 .getxattr_fn = smb_time_audit_getxattr,
2951 .getxattrat_send_fn = smb_time_audit_getxattrat_send,
2952 .getxattrat_recv_fn = smb_time_audit_getxattrat_recv,
2953 .fgetxattr_fn = smb_time_audit_fgetxattr,
2954 .listxattr_fn = smb_time_audit_listxattr,
2955 .flistxattr_fn = smb_time_audit_flistxattr,
2956 .removexattr_fn = smb_time_audit_removexattr,
2957 .fremovexattr_fn = smb_time_audit_fremovexattr,
2958 .setxattr_fn = smb_time_audit_setxattr,
2959 .fsetxattr_fn = smb_time_audit_fsetxattr,
2960 .aio_force_fn = smb_time_audit_aio_force,
2961 .durable_cookie_fn = smb_time_audit_durable_cookie,
2962 .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2963 .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2964 .readdir_attr_fn = smb_time_audit_readdir_attr,
2969 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2971 smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2973 audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2975 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2976 &vfs_time_audit_fns);