source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_at(const char *syscallname,
  90                                   double elapsed,
  91                                   const struct files_struct *dir_fsp,
  92                                   const struct smb_filename *smb_fname)
  93 {
  94         char *msg = NULL;
  95
  96         msg = talloc_asprintf(talloc_tos(),
  97                               "filename = \"%s/%s/%s\"",
  98                               dir_fsp->conn->connectpath,
  99                               dir_fsp->fsp_name->base_name,
 100                               smb_fname->base_name);
 101
 102         smb_time_audit_log_msg(syscallname, elapsed, msg);
 103         TALLOC_FREE(msg);
 104 }
 105
 106 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
 107                                     const char *fname)
 108 {
 109         char cwd[PATH_MAX];
 110         char *msg = NULL;
 111
 112         if (getcwd(cwd, sizeof(cwd)) == NULL) {
 113                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
 114         }
 115         if (fname != NULL) {
 116                 msg = talloc_asprintf(talloc_tos(),
 117                                       "cwd = \"%s\", filename = \"%s\"",
 118                                       cwd, fname);
 119         } else {
 120                 msg = talloc_asprintf(talloc_tos(),
 121                                       "cwd = \"%s\", filename = <NULL>",
 122                                       cwd);
 123         }
 124         smb_time_audit_log_msg(syscallname, elapsed, msg);
 125         TALLOC_FREE(msg);
 126 }
 127
 128 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 129                                        const struct smb_filename *smb_fname)
 130 {
 131         if (smb_fname != NULL) {
 132                 smb_time_audit_log_fname(syscallname, elapsed,
 133                                          smb_fname->base_name);
 134         } else {
 135                 smb_time_audit_log_fname(syscallname, elapsed,
 136                                          "smb_fname = <NULL>");
 137         }
 138 }
 139
 140 static int smb_time_audit_connect(vfs_handle_struct *handle,
 141                                   const char *svc, const char *user)
 142 {
 143         int result;
 144         struct timespec ts1,ts2;
 145         double timediff;
 146
 147         if (!handle) {
 148                 return -1;
 149         }
 150
 151         clock_gettime_mono(&ts1);
 152         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 153         clock_gettime_mono(&ts2);
 154         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 155         if (timediff > audit_timeout) {
 156                 smb_time_audit_log_msg("connect", timediff, user);
 157         }
 158         return result;
 159 }
 160
 161 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 162 {
 163         struct timespec ts1,ts2;
 164         double timediff;
 165
 166         clock_gettime_mono(&ts1);
 167         SMB_VFS_NEXT_DISCONNECT(handle);
 168         clock_gettime_mono(&ts2);
 169         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 170
 171         if (timediff > audit_timeout) {
 172                 smb_time_audit_log("disconnect", timediff);
 173         }
 174 }
 175
 176 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 177                                         const struct smb_filename *smb_fname,
 178                                         uint64_t *bsize,
 179                                         uint64_t *dfree,
 180                                         uint64_t *dsize)
 181 {
 182         uint64_t result;
 183         struct timespec ts1,ts2;
 184         double timediff;
 185
 186         clock_gettime_mono(&ts1);
 187         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
 188         clock_gettime_mono(&ts2);
 189         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 190
 191         /* Don't have a reasonable notion of failure here */
 192         if (timediff > audit_timeout) {
 193                 smb_time_audit_log_fname("disk_free",
 194                                 timediff,
 195                                 smb_fname->base_name);
 196         }
 197
 198         return result;
 199 }
 200
 201 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 202                                         const struct smb_filename *smb_fname,
 203                                         enum SMB_QUOTA_TYPE qtype,
 204                                         unid_t id,
 205                                         SMB_DISK_QUOTA *qt)
 206 {
 207         int result;
 208         struct timespec ts1,ts2;
 209         double timediff;
 210
 211         clock_gettime_mono(&ts1);
 212         result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
 213         clock_gettime_mono(&ts2);
 214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 215
 216         if (timediff > audit_timeout) {
 217                 smb_time_audit_log_fname("get_quota",
 218                                 timediff,
 219                                 smb_fname->base_name);
 220         }
 221         return result;
 222 }
 223
 224 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 225                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 226                                     SMB_DISK_QUOTA *qt)
 227 {
 228         int result;
 229         struct timespec ts1,ts2;
 230         double timediff;
 231
 232         clock_gettime_mono(&ts1);
 233         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 234         clock_gettime_mono(&ts2);
 235         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 236
 237         if (timediff > audit_timeout) {
 238                 smb_time_audit_log("set_quota", timediff);
 239         }
 240
 241         return result;
 242 }
 243
 244 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 245                                                struct files_struct *fsp,
 246                                                struct shadow_copy_data *shadow_copy_data,
 247                                                bool labels)
 248 {
 249         int result;
 250         struct timespec ts1,ts2;
 251         double timediff;
 252
 253         clock_gettime_mono(&ts1);
 254         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 255                                                    shadow_copy_data, labels);
 256         clock_gettime_mono(&ts2);
 257         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 258
 259         if (timediff > audit_timeout) {
 260                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 261         }
 262
 263         return result;
 264 }
 265
 266 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 267                                   const struct smb_filename *smb_fname,
 268                                   struct vfs_statvfs_struct *statbuf)
 269 {
 270         int result;
 271         struct timespec ts1,ts2;
 272         double timediff;
 273
 274         clock_gettime_mono(&ts1);
 275         result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
 276         clock_gettime_mono(&ts2);
 277         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 278
 279         if (timediff > audit_timeout) {
 280                 smb_time_audit_log_fname("statvfs", timediff,
 281                         smb_fname->base_name);
 282         }
 283
 284         return result;
 285 }
 286
 287 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 288                                                enum timestamp_set_resolution *p_ts_res)
 289 {
 290         uint32_t result;
 291         struct timespec ts1,ts2;
 292         double timediff;
 293
 294         clock_gettime_mono(&ts1);
 295         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 296         clock_gettime_mono(&ts2);
 297         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 298
 299         if (timediff > audit_timeout) {
 300                 smb_time_audit_log("fs_capabilities", timediff);
 301         }
 302
 303         return result;
 304 }
 305
 306 static NTSTATUS smb_time_audit_get_dfs_referrals(
 307                         struct vfs_handle_struct *handle,
 308                         struct dfs_GetDFSReferral *r)
 309 {
 310         NTSTATUS result;
 311         struct timespec ts1,ts2;
 312         double timediff;
 313
 314         clock_gettime_mono(&ts1);
 315         result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
 316         clock_gettime_mono(&ts2);
 317         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 318
 319         if (timediff > audit_timeout) {
 320                 smb_time_audit_log("get_dfs_referrals", timediff);
 321         }
 322
 323         return result;
 324 }
 325
 326 static NTSTATUS smb_time_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
 327                         struct files_struct *dirfsp,
 328                         const struct smb_filename *smb_fname,
 329                         const struct referral *reflist,
 330                         size_t referral_count)
 331 {
 332         NTSTATUS result;
 333         struct timespec ts1,ts2;
 334         double timediff;
 335
 336         clock_gettime_mono(&ts1);
 337         result = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
 338                         dirfsp,
 339                         smb_fname,
 340                         reflist,
 341                         referral_count);
 342         clock_gettime_mono(&ts2);
 343         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 344
 345         if (timediff > audit_timeout) {
 346                 smb_time_audit_log("get_dfs_referrals", timediff);
 347         }
 348
 349         return result;
 350 }
 351
 352 static NTSTATUS smb_time_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
 353                         TALLOC_CTX *mem_ctx,
 354                         struct files_struct *dirfsp,
 355                         struct smb_filename *smb_fname,
 356                         struct referral **ppreflist,
 357                         size_t *preferral_count)
 358 {
 359         NTSTATUS result;
 360         struct timespec ts1,ts2;
 361         double timediff;
 362
 363         clock_gettime_mono(&ts1);
 364         result = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
 365                         mem_ctx,
 366                         dirfsp,
 367                         smb_fname,
 368                         ppreflist,
 369                         preferral_count);
 370         clock_gettime_mono(&ts2);
 371         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 372
 373         if (timediff > audit_timeout) {
 374                 smb_time_audit_log("read_dfs_pathat", timediff);
 375         }
 376
 377         return result;
 378 }
 379
 380 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 381                                                TALLOC_CTX *mem_ctx,
 382                                                const char *service_path,
 383                                                char **base_volume)
 384 {
 385         NTSTATUS status;
 386         struct timespec ts1,ts2;
 387         double timediff;
 388
 389         clock_gettime_mono(&ts1);
 390         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 391                                               base_volume);
 392         clock_gettime_mono(&ts2);
 393         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 394
 395         if (timediff > audit_timeout) {
 396                 smb_time_audit_log("snap_check_path", timediff);
 397         }
 398
 399         return status;
 400 }
 401
 402 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 403                                            TALLOC_CTX *mem_ctx,
 404                                            const char *base_volume,
 405                                            time_t *tstamp,
 406                                            bool rw,
 407                                            char **base_path,
 408                                            char **snap_path)
 409 {
 410         NTSTATUS status;
 411         struct timespec ts1,ts2;
 412         double timediff;
 413
 414         clock_gettime_mono(&ts1);
 415         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 416                                           rw, base_path, snap_path);
 417         clock_gettime_mono(&ts2);
 418         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 419
 420         if (timediff > audit_timeout) {
 421                 smb_time_audit_log("snap_create", timediff);
 422         }
 423
 424         return status;
 425 }
 426
 427 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 428                                            TALLOC_CTX *mem_ctx,
 429                                            char *base_path,
 430                                            char *snap_path)
 431 {
 432         NTSTATUS status;
 433         struct timespec ts1,ts2;
 434         double timediff;
 435
 436         clock_gettime_mono(&ts1);
 437         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 438                                           snap_path);
 439         clock_gettime_mono(&ts2);
 440         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 441
 442         if (timediff > audit_timeout) {
 443                 smb_time_audit_log("snap_delete", timediff);
 444         }
 445
 446         return status;
 447 }
 448
 449 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 450                                               files_struct *fsp,
 451                                               const char *mask, uint32_t attr)
 452 {
 453         DIR *result;
 454         struct timespec ts1,ts2;
 455         double timediff;
 456
 457         clock_gettime_mono(&ts1);
 458         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 459         clock_gettime_mono(&ts2);
 460         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 461
 462         if (timediff > audit_timeout) {
 463                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 464         }
 465
 466         return result;
 467 }
 468
 469 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 470                                                  DIR *dirp,
 471                                                  SMB_STRUCT_STAT *sbuf)
 472 {
 473         struct dirent *result;
 474         struct timespec ts1,ts2;
 475         double timediff;
 476
 477         clock_gettime_mono(&ts1);
 478         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 479         clock_gettime_mono(&ts2);
 480         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 481
 482         if (timediff > audit_timeout) {
 483                 smb_time_audit_log("readdir", timediff);
 484         }
 485
 486         return result;
 487 }
 488
 489 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 490                                    DIR *dirp, long offset)
 491 {
 492         struct timespec ts1,ts2;
 493         double timediff;
 494
 495         clock_gettime_mono(&ts1);
 496         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 497         clock_gettime_mono(&ts2);
 498         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 499
 500         if (timediff > audit_timeout) {
 501                 smb_time_audit_log("seekdir", timediff);
 502         }
 503
 504 }
 505
 506 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 507                                    DIR *dirp)
 508 {
 509         long result;
 510         struct timespec ts1,ts2;
 511         double timediff;
 512
 513         clock_gettime_mono(&ts1);
 514         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 515         clock_gettime_mono(&ts2);
 516         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 517
 518         if (timediff > audit_timeout) {
 519                 smb_time_audit_log("telldir", timediff);
 520         }
 521
 522         return result;
 523 }
 524
 525 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 526                                      DIR *dirp)
 527 {
 528         struct timespec ts1,ts2;
 529         double timediff;
 530
 531         clock_gettime_mono(&ts1);
 532         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 533         clock_gettime_mono(&ts2);
 534         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 535
 536         if (timediff > audit_timeout) {
 537                 smb_time_audit_log("rewinddir", timediff);
 538         }
 539
 540 }
 541
 542 static int smb_time_audit_mkdirat(vfs_handle_struct *handle,
 543                                 struct files_struct *dirfsp,
 544                                 const struct smb_filename *smb_fname,
 545                                 mode_t mode)
 546 {
 547         int result;
 548         struct timespec ts1,ts2;
 549         double timediff;
 550
 551         clock_gettime_mono(&ts1);
 552         result = SMB_VFS_NEXT_MKDIRAT(handle,
 553                                 dirfsp,
 554                                 smb_fname,
 555                                 mode);
 556         clock_gettime_mono(&ts2);
 557         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 558
 559         if (timediff > audit_timeout) {
 560                 smb_time_audit_log_smb_fname("mkdirat",
 561                         timediff,
 562                         smb_fname);
 563         }
 564
 565         return result;
 566 }
 567
 568 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 569                                    DIR *dirp)
 570 {
 571         int result;
 572         struct timespec ts1,ts2;
 573         double timediff;
 574
 575         clock_gettime_mono(&ts1);
 576         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 577         clock_gettime_mono(&ts2);
 578         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 579
 580         if (timediff > audit_timeout) {
 581                 smb_time_audit_log("closedir", timediff);
 582         }
 583
 584         return result;
 585 }
 586
 587 static int smb_time_audit_openat(vfs_handle_struct *handle,
 588                                  const struct files_struct *dirfsp,
 589                                  const struct smb_filename *smb_fname,
 590                                  struct files_struct *fsp,
 591                                  int flags,
 592                                  mode_t mode)
 593 {
 594         int result;
 595         struct timespec ts1,ts2;
 596         double timediff;
 597
 598         clock_gettime_mono(&ts1);
 599         result = SMB_VFS_NEXT_OPENAT(handle,
 600                                      dirfsp,
 601                                      smb_fname,
 602                                      fsp,
 603                                      flags,
 604                                      mode);
 605         clock_gettime_mono(&ts2);
 606         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 607
 608         if (timediff > audit_timeout) {
 609                 smb_time_audit_log_fsp("openat", timediff, fsp);
 610         }
 611
 612         return result;
 613 }
 614
 615 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 616                                            struct smb_request *req,
 617                                            struct files_struct **dirfsp,
 618                                            struct smb_filename *fname,
 619                                            uint32_t access_mask,
 620                                            uint32_t share_access,
 621                                            uint32_t create_disposition,
 622                                            uint32_t create_options,
 623                                            uint32_t file_attributes,
 624                                            uint32_t oplock_request,
 625                                            const struct smb2_lease *lease,
 626                                            uint64_t allocation_size,
 627                                            uint32_t private_flags,
 628                                            struct security_descriptor *sd,
 629                                            struct ea_list *ea_list,
 630                                            files_struct **result_fsp,
 631                                            int *pinfo,
 632                                            const struct smb2_create_blobs *in_context_blobs,
 633                                            struct smb2_create_blobs *out_context_blobs)
 634 {
 635         NTSTATUS result;
 636         struct timespec ts1,ts2;
 637         double timediff;
 638
 639         clock_gettime_mono(&ts1);
 640         result = SMB_VFS_NEXT_CREATE_FILE(
 641                 handle,                                 /* handle */
 642                 req,                                    /* req */
 643                 dirfsp,                                 /* dirfsp */
 644                 fname,                                  /* fname */
 645                 access_mask,                            /* access_mask */
 646                 share_access,                           /* share_access */
 647                 create_disposition,                     /* create_disposition*/
 648                 create_options,                         /* create_options */
 649                 file_attributes,                        /* file_attributes */
 650                 oplock_request,                         /* oplock_request */
 651                 lease,                                  /* lease */
 652                 allocation_size,                        /* allocation_size */
 653                 private_flags,
 654                 sd,                                     /* sd */
 655                 ea_list,                                /* ea_list */
 656                 result_fsp,                             /* result */
 657                 pinfo,
 658                 in_context_blobs, out_context_blobs);   /* create context */
 659         clock_gettime_mono(&ts2);
 660         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 661
 662         if (timediff > audit_timeout) {
 663                 /*
 664                  * can't use result_fsp this time, may have
 665                  * invalid content causing smbd crash
 666                  */
 667                 smb_time_audit_log_smb_fname("create_file", timediff,
 668                                            fname);
 669         }
 670
 671         return result;
 672 }
 673
 674 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 675 {
 676         int result;
 677         struct timespec ts1,ts2;
 678         double timediff;
 679
 680         clock_gettime_mono(&ts1);
 681         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 682         clock_gettime_mono(&ts2);
 683         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 684
 685         if (timediff > audit_timeout) {
 686                 smb_time_audit_log_fsp("close", timediff, fsp);
 687         }
 688
 689         return result;
 690 }
 691
 692 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 693                                     files_struct *fsp,
 694                                     void *data, size_t n, off_t offset)
 695 {
 696         ssize_t result;
 697         struct timespec ts1,ts2;
 698         double timediff;
 699
 700         clock_gettime_mono(&ts1);
 701         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 702         clock_gettime_mono(&ts2);
 703         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 704
 705         if (timediff > audit_timeout) {
 706                 smb_time_audit_log_fsp("pread", timediff, fsp);
 707         }
 708
 709         return result;
 710 }
 711
 712 struct smb_time_audit_pread_state {
 713         struct files_struct *fsp;
 714         ssize_t ret;
 715         struct vfs_aio_state vfs_aio_state;
 716 };
 717
 718 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 719
 720 static struct tevent_req *smb_time_audit_pread_send(
 721         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 722         struct tevent_context *ev, struct files_struct *fsp,
 723         void *data, size_t n, off_t offset)
 724 {
 725         struct tevent_req *req, *subreq;
 726         struct smb_time_audit_pread_state *state;
 727
 728         req = tevent_req_create(mem_ctx, &state,
 729                                 struct smb_time_audit_pread_state);
 730         if (req == NULL) {
 731                 return NULL;
 732         }
 733         state->fsp = fsp;
 734
 735         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 736                                          n, offset);
 737         if (tevent_req_nomem(subreq, req)) {
 738                 return tevent_req_post(req, ev);
 739         }
 740         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 741         return req;
 742 }
 743
 744 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 745 {
 746         struct tevent_req *req = tevent_req_callback_data(
 747                 subreq, struct tevent_req);
 748         struct smb_time_audit_pread_state *state = tevent_req_data(
 749                 req, struct smb_time_audit_pread_state);
 750
 751         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
 752         TALLOC_FREE(subreq);
 753         tevent_req_done(req);
 754 }
 755
 756 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
 757                                          struct vfs_aio_state *vfs_aio_state)
 758 {
 759         struct smb_time_audit_pread_state *state = tevent_req_data(
 760                 req, struct smb_time_audit_pread_state);
 761         double timediff;
 762
 763         timediff = state->vfs_aio_state.duration * 1.0e-9;
 764
 765         if (timediff > audit_timeout) {
 766                 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
 767         }
 768
 769         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 770                 return -1;
 771         }
 772         *vfs_aio_state = state->vfs_aio_state;
 773         return state->ret;
 774 }
 775
 776 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 777                                      files_struct *fsp,
 778                                      const void *data, size_t n,
 779                                      off_t offset)
 780 {
 781         ssize_t result;
 782         struct timespec ts1,ts2;
 783         double timediff;
 784
 785         clock_gettime_mono(&ts1);
 786         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 787         clock_gettime_mono(&ts2);
 788         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 789
 790         if (timediff > audit_timeout) {
 791                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 792         }
 793
 794         return result;
 795 }
 796
 797 struct smb_time_audit_pwrite_state {
 798         struct files_struct *fsp;
 799         ssize_t ret;
 800         struct vfs_aio_state vfs_aio_state;
 801 };
 802
 803 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 804
 805 static struct tevent_req *smb_time_audit_pwrite_send(
 806         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 807         struct tevent_context *ev, struct files_struct *fsp,
 808         const void *data, size_t n, off_t offset)
 809 {
 810         struct tevent_req *req, *subreq;
 811         struct smb_time_audit_pwrite_state *state;
 812
 813         req = tevent_req_create(mem_ctx, &state,
 814                                 struct smb_time_audit_pwrite_state);
 815         if (req == NULL) {
 816                 return NULL;
 817         }
 818         state->fsp = fsp;
 819
 820         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 821                                          n, offset);
 822         if (tevent_req_nomem(subreq, req)) {
 823                 return tevent_req_post(req, ev);
 824         }
 825         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 826         return req;
 827 }
 828
 829 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 830 {
 831         struct tevent_req *req = tevent_req_callback_data(
 832                 subreq, struct tevent_req);
 833         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 834                 req, struct smb_time_audit_pwrite_state);
 835
 836         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
 837         TALLOC_FREE(subreq);
 838         tevent_req_done(req);
 839 }
 840
 841 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
 842                                           struct vfs_aio_state *vfs_aio_state)
 843 {
 844         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 845                 req, struct smb_time_audit_pwrite_state);
 846         double timediff;
 847
 848         timediff = state->vfs_aio_state.duration * 1.0e-9;
 849
 850         if (timediff > audit_timeout) {
 851                 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
 852         }
 853
 854         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 855                 return -1;
 856         }
 857         *vfs_aio_state = state->vfs_aio_state;
 858         return state->ret;
 859 }
 860
 861 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 862                                       files_struct *fsp,
 863                                       off_t offset, int whence)
 864 {
 865         off_t result;
 866         struct timespec ts1,ts2;
 867         double timediff;
 868
 869         clock_gettime_mono(&ts1);
 870         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 871         clock_gettime_mono(&ts2);
 872         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 873
 874         if (timediff > audit_timeout) {
 875                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 876         }
 877
 878         return result;
 879 }
 880
 881 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 882                                        files_struct *fromfsp,
 883                                        const DATA_BLOB *hdr, off_t offset,
 884                                        size_t n)
 885 {
 886         ssize_t result;
 887         struct timespec ts1,ts2;
 888         double timediff;
 889
 890         clock_gettime_mono(&ts1);
 891         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 892         clock_gettime_mono(&ts2);
 893         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 894
 895         if (timediff > audit_timeout) {
 896                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 897         }
 898
 899         return result;
 900 }
 901
 902 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 903                                        files_struct *tofsp,
 904                                        off_t offset,
 905                                        size_t n)
 906 {
 907         ssize_t result;
 908         struct timespec ts1,ts2;
 909         double timediff;
 910
 911         clock_gettime_mono(&ts1);
 912         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 913         clock_gettime_mono(&ts2);
 914         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 915
 916         if (timediff > audit_timeout) {
 917                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 918         }
 919
 920         return result;
 921 }
 922
 923 static int smb_time_audit_renameat(vfs_handle_struct *handle,
 924                                 files_struct *srcfsp,
 925                                 const struct smb_filename *oldname,
 926                                 files_struct *dstfsp,
 927                                 const struct smb_filename *newname)
 928 {
 929         int result;
 930         struct timespec ts1,ts2;
 931         double timediff;
 932
 933         clock_gettime_mono(&ts1);
 934         result = SMB_VFS_NEXT_RENAMEAT(handle,
 935                         srcfsp,
 936                         oldname,
 937                         dstfsp,
 938                         newname);
 939         clock_gettime_mono(&ts2);
 940         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 941
 942         if (timediff > audit_timeout) {
 943                 smb_time_audit_log_smb_fname("renameat", timediff, newname);
 944         }
 945
 946         return result;
 947 }
 948
 949 struct smb_time_audit_fsync_state {
 950         struct files_struct *fsp;
 951         int ret;
 952         struct vfs_aio_state vfs_aio_state;
 953 };
 954
 955 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 956
 957 static struct tevent_req *smb_time_audit_fsync_send(
 958         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 959         struct tevent_context *ev, struct files_struct *fsp)
 960 {
 961         struct tevent_req *req, *subreq;
 962         struct smb_time_audit_fsync_state *state;
 963
 964         req = tevent_req_create(mem_ctx, &state,
 965                                 struct smb_time_audit_fsync_state);
 966         if (req == NULL) {
 967                 return NULL;
 968         }
 969         state->fsp = fsp;
 970
 971         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 972         if (tevent_req_nomem(subreq, req)) {
 973                 return tevent_req_post(req, ev);
 974         }
 975         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 976         return req;
 977 }
 978
 979 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
 980 {
 981         struct tevent_req *req = tevent_req_callback_data(
 982                 subreq, struct tevent_req);
 983         struct smb_time_audit_fsync_state *state = tevent_req_data(
 984                 req, struct smb_time_audit_fsync_state);
 985
 986         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
 987         TALLOC_FREE(subreq);
 988         tevent_req_done(req);
 989 }
 990
 991 static int smb_time_audit_fsync_recv(struct tevent_req *req,
 992                                      struct vfs_aio_state *vfs_aio_state)
 993 {
 994         struct smb_time_audit_fsync_state *state = tevent_req_data(
 995                 req, struct smb_time_audit_fsync_state);
 996         double timediff;
 997
 998         timediff = state->vfs_aio_state.duration * 1.0e-9;
 999
1000         if (timediff > audit_timeout) {
1001                 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
1002         }
1003
1004         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1005                 return -1;
1006         }
1007         *vfs_aio_state = state->vfs_aio_state;
1008         return state->ret;
1009 }
1010
1011 static int smb_time_audit_stat(vfs_handle_struct *handle,
1012                                struct smb_filename *fname)
1013 {
1014         int result;
1015         struct timespec ts1,ts2;
1016         double timediff;
1017
1018         clock_gettime_mono(&ts1);
1019         result = SMB_VFS_NEXT_STAT(handle, fname);
1020         clock_gettime_mono(&ts2);
1021         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1022
1023         if (timediff > audit_timeout) {
1024                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1025         }
1026
1027         return result;
1028 }
1029
1030 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1031                                 SMB_STRUCT_STAT *sbuf)
1032 {
1033         int result;
1034         struct timespec ts1,ts2;
1035         double timediff;
1036
1037         clock_gettime_mono(&ts1);
1038         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1039         clock_gettime_mono(&ts2);
1040         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1041
1042         if (timediff > audit_timeout) {
1043                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1044         }
1045
1046         return result;
1047 }
1048
1049 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1050                                 struct smb_filename *path)
1051 {
1052         int result;
1053         struct timespec ts1,ts2;
1054         double timediff;
1055
1056         clock_gettime_mono(&ts1);
1057         result = SMB_VFS_NEXT_LSTAT(handle, path);
1058         clock_gettime_mono(&ts2);
1059         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1060
1061         if (timediff > audit_timeout) {
1062                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1063         }
1064
1065         return result;
1066 }
1067
1068 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1069                                               files_struct *fsp,
1070                                               const SMB_STRUCT_STAT *sbuf)
1071 {
1072         uint64_t result;
1073         struct timespec ts1,ts2;
1074         double timediff;
1075
1076         clock_gettime_mono(&ts1);
1077         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1078         clock_gettime_mono(&ts2);
1079         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1080
1081         if (timediff > audit_timeout) {
1082                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1083         }
1084
1085         return result;
1086 }
1087
1088 static int smb_time_audit_unlinkat(vfs_handle_struct *handle,
1089                         struct files_struct *dirfsp,
1090                         const struct smb_filename *path,
1091                         int flags)
1092 {
1093         int result;
1094         struct timespec ts1,ts2;
1095         double timediff;
1096
1097         clock_gettime_mono(&ts1);
1098         result = SMB_VFS_NEXT_UNLINKAT(handle,
1099                                 dirfsp,
1100                                 path,
1101                                 flags);
1102         clock_gettime_mono(&ts2);
1103         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1104
1105         if (timediff > audit_timeout) {
1106                 smb_time_audit_log_smb_fname("unlinkat", timediff, path);
1107         }
1108
1109         return result;
1110 }
1111
1112 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1113                         const struct smb_filename *smb_fname,
1114                         mode_t mode)
1115 {
1116         int result;
1117         struct timespec ts1,ts2;
1118         double timediff;
1119
1120         clock_gettime_mono(&ts1);
1121         result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1122         clock_gettime_mono(&ts2);
1123         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1124
1125         if (timediff > audit_timeout) {
1126                 smb_time_audit_log_fname("chmod",
1127                         timediff,
1128                         smb_fname->base_name);
1129         }
1130
1131         return result;
1132 }
1133
1134 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1135                                  mode_t mode)
1136 {
1137         int result;
1138         struct timespec ts1,ts2;
1139         double timediff;
1140
1141         clock_gettime_mono(&ts1);
1142         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1143         clock_gettime_mono(&ts2);
1144         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1145
1146         if (timediff > audit_timeout) {
1147                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1148         }
1149
1150         return result;
1151 }
1152
1153 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1154                                  uid_t uid, gid_t gid)
1155 {
1156         int result;
1157         struct timespec ts1,ts2;
1158         double timediff;
1159
1160         clock_gettime_mono(&ts1);
1161         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1162         clock_gettime_mono(&ts2);
1163         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1164
1165         if (timediff > audit_timeout) {
1166                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1167         }
1168
1169         return result;
1170 }
1171
1172 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1173                         const struct smb_filename *smb_fname,
1174                         uid_t uid,
1175                         gid_t gid)
1176 {
1177         int result;
1178         struct timespec ts1,ts2;
1179         double timediff;
1180
1181         clock_gettime_mono(&ts1);
1182         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1183         clock_gettime_mono(&ts2);
1184         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1185
1186         if (timediff > audit_timeout) {
1187                 smb_time_audit_log_fname("lchown",
1188                         timediff,
1189                         smb_fname->base_name);
1190         }
1191
1192         return result;
1193 }
1194
1195 static int smb_time_audit_chdir(vfs_handle_struct *handle,
1196                         const struct smb_filename *smb_fname)
1197 {
1198         int result;
1199         struct timespec ts1,ts2;
1200         double timediff;
1201
1202         clock_gettime_mono(&ts1);
1203         result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1204         clock_gettime_mono(&ts2);
1205         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1206
1207         if (timediff > audit_timeout) {
1208                 smb_time_audit_log_fname("chdir",
1209                         timediff,
1210                         smb_fname->base_name);
1211         }
1212
1213         return result;
1214 }
1215
1216 static struct smb_filename *smb_time_audit_getwd(vfs_handle_struct *handle,
1217                                         TALLOC_CTX *mem_ctx)
1218 {
1219         struct smb_filename *result;
1220         struct timespec ts1,ts2;
1221         double timediff;
1222
1223         clock_gettime_mono(&ts1);
1224         result = SMB_VFS_NEXT_GETWD(handle, mem_ctx);
1225         clock_gettime_mono(&ts2);
1226         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1227
1228         if (timediff > audit_timeout) {
1229                 smb_time_audit_log("getwd", timediff);
1230         }
1231
1232         return result;
1233 }
1234
1235 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1236                                  const struct smb_filename *path,
1237                                  struct smb_file_time *ft)
1238 {
1239         int result;
1240         struct timespec ts1,ts2;
1241         double timediff;
1242
1243         clock_gettime_mono(&ts1);
1244         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1245         clock_gettime_mono(&ts2);
1246         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1247
1248         if (timediff > audit_timeout) {
1249                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1250         }
1251
1252         return result;
1253 }
1254
1255 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1256                                     files_struct *fsp,
1257                                     off_t len)
1258 {
1259         int result;
1260         struct timespec ts1,ts2;
1261         double timediff;
1262
1263         clock_gettime_mono(&ts1);
1264         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1265         clock_gettime_mono(&ts2);
1266         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1267
1268         if (timediff > audit_timeout) {
1269                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1270         }
1271
1272         return result;
1273 }
1274
1275 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1276                                     files_struct *fsp,
1277                                     uint32_t mode,
1278                                     off_t offset,
1279                                     off_t len)
1280 {
1281         int result;
1282         int saved_errno = 0;
1283         struct timespec ts1,ts2;
1284         double timediff;
1285
1286         clock_gettime_mono(&ts1);
1287         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1288         if (result == -1) {
1289                 saved_errno = errno;
1290         }
1291         clock_gettime_mono(&ts2);
1292         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1293
1294         if (timediff > audit_timeout) {
1295                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1296         }
1297         if (result == -1) {
1298                 errno = saved_errno;
1299         }
1300         return result;
1301 }
1302
1303 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1304                                 int op, off_t offset, off_t count,
1305                                 int type)
1306 {
1307         bool result;
1308         struct timespec ts1,ts2;
1309         double timediff;
1310
1311         clock_gettime_mono(&ts1);
1312         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1313         clock_gettime_mono(&ts2);
1314         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1315
1316         if (timediff > audit_timeout) {
1317                 smb_time_audit_log_fsp("lock", timediff, fsp);
1318         }
1319
1320         return result;
1321 }
1322
1323 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1324                                        struct files_struct *fsp,
1325                                        uint32_t share_access,
1326                                        uint32_t access_mask)
1327 {
1328         int result;
1329         struct timespec ts1,ts2;
1330         double timediff;
1331
1332         clock_gettime_mono(&ts1);
1333         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_access,
1334                                            access_mask);
1335         clock_gettime_mono(&ts2);
1336         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1337
1338         if (timediff > audit_timeout) {
1339                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1340         }
1341
1342         return result;
1343 }
1344
1345 static int smb_time_audit_fcntl(struct vfs_handle_struct *handle,
1346                                 struct files_struct *fsp,
1347                                 int cmd, va_list cmd_arg)
1348 {
1349         void *arg;
1350         va_list dup_cmd_arg;
1351         int result;
1352         struct timespec ts1,ts2;
1353         double timediff;
1354
1355         va_copy(dup_cmd_arg, cmd_arg);
1356         arg = va_arg(dup_cmd_arg, void *);
1357         clock_gettime_mono(&ts1);
1358         result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1359         clock_gettime_mono(&ts2);
1360         va_end(dup_cmd_arg);
1361
1362         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1363         if (timediff > audit_timeout) {
1364                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1365         }
1366
1367         return result;
1368 }
1369
1370 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1371                                          files_struct *fsp,
1372                                          int leasetype)
1373 {
1374         int result;
1375         struct timespec ts1,ts2;
1376         double timediff;
1377
1378         clock_gettime_mono(&ts1);
1379         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1380         clock_gettime_mono(&ts2);
1381         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382
1383         if (timediff > audit_timeout) {
1384                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1385         }
1386
1387         return result;
1388 }
1389
1390 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1391                                    files_struct *fsp,
1392                                    off_t *poffset, off_t *pcount,
1393                                    int *ptype, pid_t *ppid)
1394 {
1395         bool result;
1396         struct timespec ts1,ts2;
1397         double timediff;
1398
1399         clock_gettime_mono(&ts1);
1400         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1401                                       ppid);
1402         clock_gettime_mono(&ts2);
1403         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1404
1405         if (timediff > audit_timeout) {
1406                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1407         }
1408
1409         return result;
1410 }
1411
1412 static int smb_time_audit_symlinkat(vfs_handle_struct *handle,
1413                                 const struct smb_filename *link_contents,
1414                                 struct files_struct *dirfsp,
1415                                 const struct smb_filename *new_smb_fname)
1416 {
1417         int result;
1418         struct timespec ts1,ts2;
1419         double timediff;
1420
1421         clock_gettime_mono(&ts1);
1422         result = SMB_VFS_NEXT_SYMLINKAT(handle,
1423                                 link_contents,
1424                                 dirfsp,
1425                                 new_smb_fname);
1426         clock_gettime_mono(&ts2);
1427         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1428
1429         if (timediff > audit_timeout) {
1430                 smb_time_audit_log_fname("symlinkat", timediff,
1431                         new_smb_fname->base_name);
1432         }
1433
1434         return result;
1435 }
1436
1437 static int smb_time_audit_readlinkat(vfs_handle_struct *handle,
1438                                 files_struct *dirfsp,
1439                                 const struct smb_filename *smb_fname,
1440                                 char *buf,
1441                                 size_t bufsiz)
1442 {
1443         int result;
1444         struct timespec ts1,ts2;
1445         double timediff;
1446
1447         clock_gettime_mono(&ts1);
1448         result = SMB_VFS_NEXT_READLINKAT(handle,
1449                                 dirfsp,
1450                                 smb_fname,
1451                                 buf,
1452                                 bufsiz);
1453         clock_gettime_mono(&ts2);
1454         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1455
1456         if (timediff > audit_timeout) {
1457                 smb_time_audit_log_fname("readlinkat", timediff,
1458                                 smb_fname->base_name);
1459         }
1460
1461         return result;
1462 }
1463
1464 static int smb_time_audit_linkat(vfs_handle_struct *handle,
1465                                 files_struct *srcfsp,
1466                                 const struct smb_filename *old_smb_fname,
1467                                 files_struct *dstfsp,
1468                                 const struct smb_filename *new_smb_fname,
1469                                 int flags)
1470 {
1471         int result;
1472         struct timespec ts1,ts2;
1473         double timediff;
1474
1475         clock_gettime_mono(&ts1);
1476         result = SMB_VFS_NEXT_LINKAT(handle,
1477                         srcfsp,
1478                         old_smb_fname,
1479                         dstfsp,
1480                         new_smb_fname,
1481                         flags);
1482         clock_gettime_mono(&ts2);
1483         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1484
1485         if (timediff > audit_timeout) {
1486                 smb_time_audit_log_fname("linkat", timediff,
1487                         new_smb_fname->base_name);
1488         }
1489
1490         return result;
1491 }
1492
1493 static int smb_time_audit_mknodat(vfs_handle_struct *handle,
1494                                 files_struct *dirfsp,
1495                                 const struct smb_filename *smb_fname,
1496                                 mode_t mode,
1497                                 SMB_DEV_T dev)
1498 {
1499         int result;
1500         struct timespec ts1,ts2;
1501         double timediff;
1502
1503         clock_gettime_mono(&ts1);
1504         result = SMB_VFS_NEXT_MKNODAT(handle,
1505                                 dirfsp,
1506                                 smb_fname,
1507                                 mode,
1508                                 dev);
1509         clock_gettime_mono(&ts2);
1510         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1511
1512         if (timediff > audit_timeout) {
1513                 smb_time_audit_log_smb_fname("mknodat", timediff, smb_fname);
1514         }
1515
1516         return result;
1517 }
1518
1519 static struct smb_filename *smb_time_audit_realpath(vfs_handle_struct *handle,
1520                                 TALLOC_CTX *ctx,
1521                                 const struct smb_filename *smb_fname)
1522 {
1523         struct smb_filename *result_fname;
1524         struct timespec ts1,ts2;
1525         double timediff;
1526
1527         clock_gettime_mono(&ts1);
1528         result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1529         clock_gettime_mono(&ts2);
1530         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1531
1532         if (timediff > audit_timeout) {
1533                 smb_time_audit_log_fname("realpath", timediff,
1534                                 smb_fname->base_name);
1535         }
1536
1537         return result_fname;
1538 }
1539
1540 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1541                                 const struct smb_filename *smb_fname,
1542                                 unsigned int flags)
1543 {
1544         int result;
1545         struct timespec ts1,ts2;
1546         double timediff;
1547
1548         clock_gettime_mono(&ts1);
1549         result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1550         clock_gettime_mono(&ts2);
1551         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1552
1553         if (timediff > audit_timeout) {
1554                 smb_time_audit_log_smb_fname("chflags", timediff, smb_fname);
1555         }
1556
1557         return result;
1558 }
1559
1560 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1561                                                     const SMB_STRUCT_STAT *sbuf)
1562 {
1563         struct file_id id_zero;
1564         struct file_id result;
1565         struct timespec ts1,ts2;
1566         double timediff;
1567
1568         ZERO_STRUCT(id_zero);
1569
1570         clock_gettime_mono(&ts1);
1571         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1572         clock_gettime_mono(&ts2);
1573         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1574
1575         if (timediff > audit_timeout) {
1576                 smb_time_audit_log("file_id_create", timediff);
1577         }
1578
1579         return result;
1580 }
1581
1582 static uint64_t smb_time_audit_fs_file_id(struct vfs_handle_struct *handle,
1583                                           const SMB_STRUCT_STAT *sbuf)
1584 {
1585         uint64_t result;
1586         struct timespec ts1,ts2;
1587         double timediff;
1588
1589         clock_gettime_mono(&ts1);
1590         result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
1591         clock_gettime_mono(&ts2);
1592         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1593
1594         if (timediff > audit_timeout) {
1595                 smb_time_audit_log("fs_file_id", timediff);
1596         }
1597
1598         return result;
1599 }
1600
1601 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1602                                           struct files_struct *fsp,
1603                                           const struct smb_filename *smb_fname,
1604                                           TALLOC_CTX *mem_ctx,
1605                                           unsigned int *pnum_streams,
1606                                           struct stream_struct **pstreams)
1607 {
1608         NTSTATUS result;
1609         struct timespec ts1,ts2;
1610         double timediff;
1611
1612         clock_gettime_mono(&ts1);
1613         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1614                                          pnum_streams, pstreams);
1615         clock_gettime_mono(&ts2);
1616         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1617
1618         if (timediff > audit_timeout) {
1619                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1620         }
1621
1622         return result;
1623 }
1624
1625 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1626                                             const struct smb_filename *path,
1627                                             const char *name,
1628                                             TALLOC_CTX *mem_ctx,
1629                                             char **found_name)
1630 {
1631         int result;
1632         struct timespec ts1,ts2;
1633         double timediff;
1634
1635         clock_gettime_mono(&ts1);
1636         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1637                                                 found_name);
1638         clock_gettime_mono(&ts2);
1639         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1640
1641         if (timediff > audit_timeout) {
1642                 smb_time_audit_log_fname("get_real_filename",
1643                                          timediff, path->base_name);
1644         }
1645
1646         return result;
1647 }
1648
1649 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1650                                         const struct smb_filename *smb_fname)
1651 {
1652         const char *result;
1653         struct timespec ts1,ts2;
1654         double timediff;
1655
1656         clock_gettime_mono(&ts1);
1657         result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1658         clock_gettime_mono(&ts2);
1659         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1660
1661         if (timediff > audit_timeout) {
1662                 smb_time_audit_log_fname("connectpath", timediff,
1663                         smb_fname->base_name);
1664         }
1665
1666         return result;
1667 }
1668
1669 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1670                                                 struct byte_range_lock *br_lck,
1671                                                 struct lock_struct *plock)
1672 {
1673         NTSTATUS result;
1674         struct timespec ts1,ts2;
1675         double timediff;
1676
1677         clock_gettime_mono(&ts1);
1678         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
1679         clock_gettime_mono(&ts2);
1680         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1681
1682         if (timediff > audit_timeout) {
1683                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1684                                        brl_fsp(br_lck));
1685         }
1686
1687         return result;
1688 }
1689
1690 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1691                                               struct byte_range_lock *br_lck,
1692                                               const struct lock_struct *plock)
1693 {
1694         bool result;
1695         struct timespec ts1,ts2;
1696         double timediff;
1697
1698         clock_gettime_mono(&ts1);
1699         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
1700         clock_gettime_mono(&ts2);
1701         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1702
1703         if (timediff > audit_timeout) {
1704                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1705                                        brl_fsp(br_lck));
1706         }
1707
1708         return result;
1709 }
1710
1711 static bool smb_time_audit_strict_lock_check(struct vfs_handle_struct *handle,
1712                                              struct files_struct *fsp,
1713                                              struct lock_struct *plock)
1714 {
1715         bool result;
1716         struct timespec ts1,ts2;
1717         double timediff;
1718
1719         clock_gettime_mono(&ts1);
1720         result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1721         clock_gettime_mono(&ts2);
1722         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1723
1724         if (timediff > audit_timeout) {
1725                 smb_time_audit_log_fsp("strict_lock_check", timediff, fsp);
1726         }
1727
1728         return result;
1729 }
1730
1731 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1732                                               const char *name,
1733                                               enum vfs_translate_direction direction,
1734                                               TALLOC_CTX *mem_ctx,
1735                                               char **mapped_name)
1736 {
1737         NTSTATUS result;
1738         struct timespec ts1,ts2;
1739         double timediff;
1740
1741         clock_gettime_mono(&ts1);
1742         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1743                                              mapped_name);
1744         clock_gettime_mono(&ts2);
1745         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1746
1747         if (timediff > audit_timeout) {
1748                 smb_time_audit_log_fname("translate_name", timediff, name);
1749         }
1750
1751         return result;
1752 }
1753
1754 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1755                                 struct files_struct *fsp,
1756                                 TALLOC_CTX *ctx,
1757                                 uint32_t function,
1758                                 uint16_t req_flags,
1759                                 const uint8_t *_in_data,
1760                                 uint32_t in_len,
1761                                 uint8_t **_out_data,
1762                                 uint32_t max_out_len,
1763                                 uint32_t *out_len)
1764 {
1765         NTSTATUS result;
1766         struct timespec ts1,ts2;
1767         double timediff;
1768
1769         clock_gettime_mono(&ts1);
1770         result = SMB_VFS_NEXT_FSCTL(handle,
1771                                 fsp,
1772                                 ctx,
1773                                 function,
1774                                 req_flags,
1775                                 _in_data,
1776                                 in_len,
1777                                 _out_data,
1778                                 max_out_len,
1779                                 out_len);
1780         clock_gettime_mono(&ts2);
1781         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1782
1783         if (timediff > audit_timeout) {
1784                 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1785         }
1786
1787         return result;
1788 }
1789
1790 static NTSTATUS smb_time_get_dos_attributes(struct vfs_handle_struct *handle,
1791                                         struct smb_filename *smb_fname,
1792                                         uint32_t *dosmode)
1793 {
1794         NTSTATUS result;
1795         struct timespec ts1,ts2;
1796         double timediff;
1797
1798         clock_gettime_mono(&ts1);
1799         result = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
1800                                 smb_fname,
1801                                 dosmode);
1802         clock_gettime_mono(&ts2);
1803         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1804
1805         if (timediff > audit_timeout) {
1806                 smb_time_audit_log_fname("get_dos_attributes",
1807                                 timediff,
1808                                 smb_fname->base_name);
1809         }
1810
1811         return result;
1812 }
1813
1814 struct smb_time_audit_get_dos_attributes_state {
1815         struct vfs_aio_state aio_state;
1816         files_struct *dir_fsp;
1817         const struct smb_filename *smb_fname;
1818         uint32_t dosmode;
1819 };
1820
1821 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq);
1822
1823 static struct tevent_req *smb_time_audit_get_dos_attributes_send(
1824                         TALLOC_CTX *mem_ctx,
1825                         struct tevent_context *ev,
1826                         struct vfs_handle_struct *handle,
1827                         files_struct *dir_fsp,
1828                         struct smb_filename *smb_fname)
1829 {
1830         struct tevent_req *req = NULL;
1831         struct smb_time_audit_get_dos_attributes_state *state = NULL;
1832         struct tevent_req *subreq = NULL;
1833
1834         req = tevent_req_create(mem_ctx, &state,
1835                                 struct smb_time_audit_get_dos_attributes_state);
1836         if (req == NULL) {
1837                 return NULL;
1838         }
1839         *state = (struct smb_time_audit_get_dos_attributes_state) {
1840                 .dir_fsp = dir_fsp,
1841                 .smb_fname = smb_fname,
1842         };
1843
1844         subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
1845                                                       ev,
1846                                                       handle,
1847                                                       dir_fsp,
1848                                                       smb_fname);
1849         if (tevent_req_nomem(subreq, req)) {
1850                 return tevent_req_post(req, ev);
1851         }
1852         tevent_req_set_callback(subreq,
1853                                 smb_time_audit_get_dos_attributes_done,
1854                                 req);
1855
1856         return req;
1857 }
1858
1859 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq)
1860 {
1861         struct tevent_req *req =
1862                 tevent_req_callback_data(subreq,
1863                 struct tevent_req);
1864         struct smb_time_audit_get_dos_attributes_state *state =
1865                 tevent_req_data(req,
1866                 struct smb_time_audit_get_dos_attributes_state);
1867         NTSTATUS status;
1868
1869         status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
1870                                                       &state->aio_state,
1871                                                       &state->dosmode);
1872         TALLOC_FREE(subreq);
1873         if (tevent_req_nterror(req, status)) {
1874                 return;
1875         }
1876
1877         tevent_req_done(req);
1878         return;
1879 }
1880
1881 static NTSTATUS smb_time_audit_get_dos_attributes_recv(struct tevent_req *req,
1882                                                 struct vfs_aio_state *aio_state,
1883                                                 uint32_t *dosmode)
1884 {
1885         struct smb_time_audit_get_dos_attributes_state *state =
1886                 tevent_req_data(req,
1887                 struct smb_time_audit_get_dos_attributes_state);
1888         NTSTATUS status;
1889         double timediff;
1890
1891         timediff = state->aio_state.duration * 1.0e-9;
1892
1893         if (timediff > audit_timeout) {
1894                 smb_time_audit_log_at("async get_dos_attributes",
1895                                       timediff,
1896                                       state->dir_fsp,
1897                                       state->smb_fname);
1898         }
1899
1900         if (tevent_req_is_nterror(req, &status)) {
1901                 tevent_req_received(req);
1902                 return status;
1903         }
1904
1905         *aio_state = state->aio_state;
1906         *dosmode = state->dosmode;
1907         tevent_req_received(req);
1908         return NT_STATUS_OK;
1909 }
1910
1911 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1912                                         struct files_struct *fsp,
1913                                         uint32_t *dosmode)
1914 {
1915         NTSTATUS result;
1916         struct timespec ts1,ts2;
1917         double timediff;
1918
1919         clock_gettime_mono(&ts1);
1920         result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1921                                 fsp,
1922                                 dosmode);
1923         clock_gettime_mono(&ts2);
1924         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1925
1926         if (timediff > audit_timeout) {
1927                 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1928         }
1929
1930         return result;
1931 }
1932
1933 static NTSTATUS smb_time_set_dos_attributes(struct vfs_handle_struct *handle,
1934                                         const struct smb_filename *smb_fname,
1935                                         uint32_t dosmode)
1936 {
1937         NTSTATUS result;
1938         struct timespec ts1,ts2;
1939         double timediff;
1940
1941         clock_gettime_mono(&ts1);
1942         result = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
1943                                 smb_fname,
1944                                 dosmode);
1945         clock_gettime_mono(&ts2);
1946         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1947
1948         if (timediff > audit_timeout) {
1949                 smb_time_audit_log_fname("set_dos_attributes",
1950                                 timediff,
1951                                 smb_fname->base_name);
1952         }
1953
1954         return result;
1955 }
1956
1957 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
1958                                         struct files_struct *fsp,
1959                                         uint32_t dosmode)
1960 {
1961         NTSTATUS result;
1962         struct timespec ts1,ts2;
1963         double timediff;
1964
1965         clock_gettime_mono(&ts1);
1966         result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
1967                                 fsp,
1968                                 dosmode);
1969         clock_gettime_mono(&ts2);
1970         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1971
1972         if (timediff > audit_timeout) {
1973                 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
1974         }
1975
1976         return result;
1977 }
1978
1979 struct time_audit_offload_read_state {
1980         struct vfs_handle_struct *handle;
1981         struct timespec ts_send;
1982         DATA_BLOB token_blob;
1983 };
1984
1985 static void smb_time_audit_offload_read_done(struct tevent_req *subreq);
1986
1987 static struct tevent_req *smb_time_audit_offload_read_send(
1988         TALLOC_CTX *mem_ctx,
1989         struct tevent_context *ev,
1990         struct vfs_handle_struct *handle,
1991         struct files_struct *fsp,
1992         uint32_t fsctl,
1993         uint32_t ttl,
1994         off_t offset,
1995         size_t to_copy)
1996 {
1997         struct tevent_req *req = NULL;
1998         struct tevent_req *subreq = NULL;
1999         struct time_audit_offload_read_state *state = NULL;
2000
2001         req = tevent_req_create(mem_ctx, &state,
2002                                 struct time_audit_offload_read_state);
2003         if (req == NULL) {
2004                 return NULL;
2005         }
2006         state->handle = handle;
2007         clock_gettime_mono(&state->ts_send);
2008
2009         subreq = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev,
2010                                                 handle, fsp,
2011                                                 fsctl, ttl,
2012                                                 offset, to_copy);
2013         if (tevent_req_nomem(subreq, req)) {
2014                 return tevent_req_post(req, ev);
2015         }
2016
2017         tevent_req_set_callback(subreq, smb_time_audit_offload_read_done, req);
2018         return req;
2019 }
2020
2021 static void smb_time_audit_offload_read_done(struct tevent_req *subreq)
2022 {
2023         struct tevent_req *req = tevent_req_callback_data(
2024                 subreq, struct tevent_req);
2025         struct time_audit_offload_read_state *state = tevent_req_data(
2026                 req, struct time_audit_offload_read_state);
2027         NTSTATUS status;
2028
2029         status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(subreq,
2030                                                 state->handle,
2031                                                 state,
2032                                                 &state->token_blob);
2033         TALLOC_FREE(subreq);
2034         if (tevent_req_nterror(req, status)) {
2035                 return;
2036         }
2037         tevent_req_done(req);
2038 }
2039
2040 static NTSTATUS smb_time_audit_offload_read_recv(
2041         struct tevent_req *req,
2042         struct vfs_handle_struct *handle,
2043         TALLOC_CTX *mem_ctx,
2044         DATA_BLOB *token_blob)
2045 {
2046         struct time_audit_offload_read_state *state = tevent_req_data(
2047                 req, struct time_audit_offload_read_state);
2048         struct timespec ts_recv;
2049         double timediff;
2050         NTSTATUS status;
2051
2052         clock_gettime_mono(&ts_recv);
2053         timediff = nsec_time_diff(&ts_recv, &state->ts_send) * 1.0e-9;
2054         if (timediff > audit_timeout) {
2055                 smb_time_audit_log("offload_read", timediff);
2056         }
2057
2058         if (tevent_req_is_nterror(req, &status)) {
2059                 tevent_req_received(req);
2060                 return status;
2061         }
2062
2063         token_blob->length = state->token_blob.length;
2064         token_blob->data = talloc_move(mem_ctx, &state->token_blob.data);
2065
2066         tevent_req_received(req);
2067         return NT_STATUS_OK;
2068 }
2069
2070 struct time_audit_offload_write_state {
2071         struct timespec ts_send;
2072         struct vfs_handle_struct *handle;
2073         off_t copied;
2074 };
2075 static void smb_time_audit_offload_write_done(struct tevent_req *subreq);
2076
2077 static struct tevent_req *smb_time_audit_offload_write_send(struct vfs_handle_struct *handle,
2078                                                          TALLOC_CTX *mem_ctx,
2079                                                          struct tevent_context *ev,
2080                                                          uint32_t fsctl,
2081                                                          DATA_BLOB *token,
2082                                                          off_t transfer_offset,
2083                                                          struct files_struct *dest_fsp,
2084                                                          off_t dest_off,
2085                                                          off_t num)
2086 {
2087         struct tevent_req *req;
2088         struct tevent_req *subreq;
2089         struct time_audit_offload_write_state *state;
2090
2091         req = tevent_req_create(mem_ctx, &state,
2092                                 struct time_audit_offload_write_state);
2093         if (req == NULL) {
2094                 return NULL;
2095         }
2096
2097         state->handle = handle;
2098         clock_gettime_mono(&state->ts_send);
2099         subreq = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, state, ev,
2100                                               fsctl, token, transfer_offset,
2101                                               dest_fsp, dest_off, num);
2102         if (tevent_req_nomem(subreq, req)) {
2103                 return tevent_req_post(req, ev);
2104         }
2105
2106         tevent_req_set_callback(subreq, smb_time_audit_offload_write_done, req);
2107         return req;
2108 }
2109
2110 static void smb_time_audit_offload_write_done(struct tevent_req *subreq)
2111 {
2112         struct tevent_req *req = tevent_req_callback_data(
2113                 subreq, struct tevent_req);
2114         struct time_audit_offload_write_state *state = tevent_req_data(
2115                 req, struct time_audit_offload_write_state);
2116         NTSTATUS status;
2117
2118         status = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(state->handle,
2119                                               subreq,
2120                                               &state->copied);
2121         TALLOC_FREE(subreq);
2122         if (tevent_req_nterror(req, status)) {
2123                 return;
2124         }
2125         tevent_req_done(req);
2126 }
2127
2128 static NTSTATUS smb_time_audit_offload_write_recv(struct vfs_handle_struct *handle,
2129                                                struct tevent_req *req,
2130                                                off_t *copied)
2131 {
2132         struct time_audit_offload_write_state *state = tevent_req_data(
2133                 req, struct time_audit_offload_write_state);
2134         struct timespec ts_recv;
2135         double timediff;
2136         NTSTATUS status;
2137
2138         clock_gettime_mono(&ts_recv);
2139         timediff = nsec_time_diff(&ts_recv, &state->ts_send)*1.0e-9;
2140         if (timediff > audit_timeout) {
2141                 smb_time_audit_log("offload_write", timediff);
2142         }
2143
2144         *copied = state->copied;
2145         if (tevent_req_is_nterror(req, &status)) {
2146                 tevent_req_received(req);
2147                 return status;
2148         }
2149
2150         tevent_req_received(req);
2151         return NT_STATUS_OK;
2152 }
2153
2154 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
2155                                                TALLOC_CTX *mem_ctx,
2156                                                struct files_struct *fsp,
2157                                                struct smb_filename *smb_fname,
2158                                                uint16_t *_compression_fmt)
2159 {
2160         NTSTATUS result;
2161         struct timespec ts1,ts2;
2162         double timediff;
2163
2164         clock_gettime_mono(&ts1);
2165         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2166                                               _compression_fmt);
2167         clock_gettime_mono(&ts2);
2168         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2169
2170         if (timediff > audit_timeout) {
2171                 if (fsp !=  NULL) {
2172                         smb_time_audit_log_fsp("get_compression",
2173                                                timediff, fsp);
2174                 } else {
2175                         smb_time_audit_log_smb_fname("get_compression",
2176                                                      timediff, smb_fname);
2177                 }
2178         }
2179
2180         return result;
2181 }
2182
2183 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
2184                                                TALLOC_CTX *mem_ctx,
2185                                                struct files_struct *fsp,
2186                                                uint16_t compression_fmt)
2187 {
2188         NTSTATUS result;
2189         struct timespec ts1,ts2;
2190         double timediff;
2191
2192         clock_gettime_mono(&ts1);
2193         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2194                                               compression_fmt);
2195         clock_gettime_mono(&ts2);
2196         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2197
2198         if (timediff > audit_timeout) {
2199                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2200         }
2201
2202         return result;
2203 }
2204
2205 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
2206                                             const struct smb_filename *fname,
2207                                             TALLOC_CTX *mem_ctx,
2208                                             struct readdir_attr_data **pattr_data)
2209 {
2210         NTSTATUS status;
2211         struct timespec ts1,ts2;
2212         double timediff;
2213
2214         clock_gettime_mono(&ts1);
2215         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2216         clock_gettime_mono(&ts2);
2217         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2218
2219         if (timediff > audit_timeout) {
2220                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
2221         }
2222
2223         return status;
2224 }
2225
2226 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2227                                            files_struct *fsp,
2228                                            uint32_t security_info,
2229                                            TALLOC_CTX *mem_ctx,
2230                                            struct security_descriptor **ppdesc)
2231 {
2232         NTSTATUS result;
2233         struct timespec ts1,ts2;
2234         double timediff;
2235
2236         clock_gettime_mono(&ts1);
2237         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2238                                           mem_ctx, ppdesc);
2239         clock_gettime_mono(&ts2);
2240         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2241
2242         if (timediff > audit_timeout) {
2243                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2244         }
2245
2246         return result;
2247 }
2248
2249 static NTSTATUS smb_time_audit_get_nt_acl_at(vfs_handle_struct *handle,
2250                                 struct files_struct *dirfsp,
2251                                 const struct smb_filename *smb_fname,
2252                                 uint32_t security_info,
2253                                 TALLOC_CTX *mem_ctx,
2254                                 struct security_descriptor **ppdesc)
2255 {
2256         NTSTATUS result;
2257         struct timespec ts1,ts2;
2258         double timediff;
2259
2260         clock_gettime_mono(&ts1);
2261         result = SMB_VFS_NEXT_GET_NT_ACL_AT(handle,
2262                                         dirfsp,
2263                                         smb_fname,
2264                                         security_info,
2265                                         mem_ctx,
2266                                         ppdesc);
2267         clock_gettime_mono(&ts2);
2268         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2269
2270         if (timediff > audit_timeout) {
2271                 smb_time_audit_log_fname("get_nt_acl",
2272                         timediff,
2273                         smb_fname->base_name);
2274         }
2275
2276         return result;
2277 }
2278
2279 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2280                                            files_struct *fsp,
2281                                            uint32_t security_info_sent,
2282                                            const struct security_descriptor *psd)
2283 {
2284         NTSTATUS result;
2285         struct timespec ts1,ts2;
2286         double timediff;
2287
2288         clock_gettime_mono(&ts1);
2289         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2290                                           psd);
2291         clock_gettime_mono(&ts2);
2292         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2293
2294         if (timediff > audit_timeout) {
2295                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2296         }
2297
2298         return result;
2299 }
2300
2301 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2302                                 struct smb_filename *smb_fname,
2303                                 struct security_acl *sacl,
2304                                 uint32_t access_requested,
2305                                 uint32_t access_denied)
2306 {
2307         NTSTATUS result;
2308         struct timespec ts1,ts2;
2309         double timediff;
2310
2311         clock_gettime_mono(&ts1);
2312         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2313                                         smb_fname,
2314                                         sacl,
2315                                         access_requested,
2316                                         access_denied);
2317         clock_gettime_mono(&ts2);
2318         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2319
2320         if (timediff > audit_timeout) {
2321                 smb_time_audit_log_fname("audit_file",
2322                         timediff,
2323                         smb_fname->base_name);
2324         }
2325
2326         return result;
2327 }
2328
2329 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2330                                         const struct smb_filename *smb_fname,
2331                                         SMB_ACL_TYPE_T type,
2332                                         TALLOC_CTX *mem_ctx)
2333 {
2334         SMB_ACL_T result;
2335         struct timespec ts1,ts2;
2336         double timediff;
2337
2338         clock_gettime_mono(&ts1);
2339         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2340                                 type, mem_ctx);
2341         clock_gettime_mono(&ts2);
2342         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2343
2344         if (timediff > audit_timeout) {
2345                 smb_time_audit_log_fname("sys_acl_get_file", timediff,
2346                         smb_fname->base_name);
2347         }
2348
2349         return result;
2350 }
2351
2352 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2353                                                files_struct *fsp,
2354                                                TALLOC_CTX *mem_ctx)
2355 {
2356         SMB_ACL_T result;
2357         struct timespec ts1,ts2;
2358         double timediff;
2359
2360         clock_gettime_mono(&ts1);
2361         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2362         clock_gettime_mono(&ts2);
2363         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2364
2365         if (timediff > audit_timeout) {
2366                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2367         }
2368
2369         return result;
2370 }
2371
2372
2373 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2374                                 const struct smb_filename *smb_fname,
2375                                 TALLOC_CTX *mem_ctx,
2376                                 char **blob_description,
2377                                 DATA_BLOB *blob)
2378 {
2379         int result;
2380         struct timespec ts1,ts2;
2381         double timediff;
2382
2383         clock_gettime_mono(&ts1);
2384         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2385                                 mem_ctx, blob_description, blob);
2386         clock_gettime_mono(&ts2);
2387         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2388
2389         if (timediff > audit_timeout) {
2390                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2391         }
2392
2393         return result;
2394 }
2395
2396 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2397                                               files_struct *fsp,
2398                                               TALLOC_CTX *mem_ctx,
2399                                               char **blob_description,
2400                                               DATA_BLOB *blob)
2401 {
2402         int result;
2403         struct timespec ts1,ts2;
2404         double timediff;
2405
2406         clock_gettime_mono(&ts1);
2407         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2408         clock_gettime_mono(&ts2);
2409         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2410
2411         if (timediff > audit_timeout) {
2412                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2413         }
2414
2415         return result;
2416 }
2417
2418 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2419                                            const struct smb_filename *smb_fname,
2420                                            SMB_ACL_TYPE_T acltype,
2421                                            SMB_ACL_T theacl)
2422 {
2423         int result;
2424         struct timespec ts1,ts2;
2425         double timediff;
2426
2427         clock_gettime_mono(&ts1);
2428         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2429                                                theacl);
2430         clock_gettime_mono(&ts2);
2431         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2432
2433         if (timediff > audit_timeout) {
2434                 smb_time_audit_log_fname("sys_acl_set_file", timediff,
2435                         smb_fname->base_name);
2436         }
2437
2438         return result;
2439 }
2440
2441 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2442                                          files_struct *fsp,
2443                                          SMB_ACL_T theacl)
2444 {
2445         int result;
2446         struct timespec ts1,ts2;
2447         double timediff;
2448
2449         clock_gettime_mono(&ts1);
2450         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2451         clock_gettime_mono(&ts2);
2452         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2453
2454         if (timediff > audit_timeout) {
2455                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2456         }
2457
2458         return result;
2459 }
2460
2461 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2462                                 const struct smb_filename *smb_fname)
2463 {
2464         int result;
2465         struct timespec ts1,ts2;
2466         double timediff;
2467
2468         clock_gettime_mono(&ts1);
2469         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2470         clock_gettime_mono(&ts2);
2471         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2472
2473         if (timediff > audit_timeout) {
2474                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff,
2475                         smb_fname->base_name);
2476         }
2477
2478         return result;
2479 }
2480
2481 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2482                                 const struct smb_filename *smb_fname,
2483                                 const char *name,
2484                                 void *value,
2485                                 size_t size)
2486 {
2487         ssize_t result;
2488         struct timespec ts1,ts2;
2489         double timediff;
2490
2491         clock_gettime_mono(&ts1);
2492         result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2493         clock_gettime_mono(&ts2);
2494         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2495
2496         if (timediff > audit_timeout) {
2497                 smb_time_audit_log_fname("getxattr", timediff,
2498                         smb_fname->base_name);
2499         }
2500
2501         return result;
2502 }
2503
2504 struct smb_time_audit_getxattrat_state {
2505         struct vfs_aio_state aio_state;
2506         files_struct *dir_fsp;
2507         const struct smb_filename *smb_fname;
2508         const char *xattr_name;
2509         ssize_t xattr_size;
2510         uint8_t *xattr_value;
2511 };
2512
2513 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq);
2514
2515 static struct tevent_req *smb_time_audit_getxattrat_send(
2516                         TALLOC_CTX *mem_ctx,
2517                         struct tevent_context *ev,
2518                         struct vfs_handle_struct *handle,
2519                         files_struct *dir_fsp,
2520                         const struct smb_filename *smb_fname,
2521                         const char *xattr_name,
2522                         size_t alloc_hint)
2523 {
2524         struct tevent_req *req = NULL;
2525         struct tevent_req *subreq = NULL;
2526         struct smb_time_audit_getxattrat_state *state = NULL;
2527
2528         req = tevent_req_create(mem_ctx, &state,
2529                                 struct smb_time_audit_getxattrat_state);
2530         if (req == NULL) {
2531                 return NULL;
2532         }
2533         *state = (struct smb_time_audit_getxattrat_state) {
2534                 .dir_fsp = dir_fsp,
2535                 .smb_fname = smb_fname,
2536                 .xattr_name = xattr_name,
2537         };
2538
2539         subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2540                                               ev,
2541                                               handle,
2542                                               dir_fsp,
2543                                               smb_fname,
2544                                               xattr_name,
2545                                               alloc_hint);
2546         if (tevent_req_nomem(subreq, req)) {
2547                 return tevent_req_post(req, ev);
2548         }
2549         tevent_req_set_callback(subreq, smb_time_audit_getxattrat_done, req);
2550
2551         return req;
2552 }
2553
2554 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq)
2555 {
2556         struct tevent_req *req = tevent_req_callback_data(
2557                 subreq, struct tevent_req);
2558         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2559                 req, struct smb_time_audit_getxattrat_state);
2560
2561         state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2562                                                          &state->aio_state,
2563                                                          state,
2564                                                          &state->xattr_value);
2565         TALLOC_FREE(subreq);
2566         if (state->xattr_size == -1) {
2567                 tevent_req_error(req, state->aio_state.error);
2568                 return;
2569         }
2570
2571         tevent_req_done(req);
2572 }
2573
2574 static ssize_t smb_time_audit_getxattrat_recv(struct tevent_req *req,
2575                                               struct vfs_aio_state *aio_state,
2576                                               TALLOC_CTX *mem_ctx,
2577                                               uint8_t **xattr_value)
2578 {
2579         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2580                 req, struct smb_time_audit_getxattrat_state);
2581         ssize_t xattr_size;
2582         double timediff;
2583
2584         timediff = state->aio_state.duration * 1.0e-9;
2585
2586         if (timediff > audit_timeout) {
2587                 smb_time_audit_log_at("async getxattrat",
2588                                       timediff,
2589                                       state->dir_fsp,
2590                                       state->smb_fname);
2591         }
2592
2593         if (tevent_req_is_unix_error(req, &aio_state->error)) {
2594                 tevent_req_received(req);
2595                 return -1;
2596         }
2597
2598         *aio_state = state->aio_state;
2599         xattr_size = state->xattr_size;
2600         if (xattr_value != NULL) {
2601                 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2602         }
2603
2604         tevent_req_received(req);
2605         return xattr_size;
2606 }
2607
2608 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2609                                         struct files_struct *fsp,
2610                                         const char *name, void *value,
2611                                         size_t size)
2612 {
2613         ssize_t result;
2614         struct timespec ts1,ts2;
2615         double timediff;
2616
2617         clock_gettime_mono(&ts1);
2618         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2619         clock_gettime_mono(&ts2);
2620         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2621
2622         if (timediff > audit_timeout) {
2623                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2624         }
2625
2626         return result;
2627 }
2628
2629 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2630                                         const struct smb_filename *smb_fname,
2631                                         char *list,
2632                                         size_t size)
2633 {
2634         ssize_t result;
2635         struct timespec ts1,ts2;
2636         double timediff;
2637
2638         clock_gettime_mono(&ts1);
2639         result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2640         clock_gettime_mono(&ts2);
2641         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2642
2643         if (timediff > audit_timeout) {
2644                 smb_time_audit_log_fname("listxattr", timediff,
2645                                 smb_fname->base_name);
2646         }
2647
2648         return result;
2649 }
2650
2651 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2652                                          struct files_struct *fsp, char *list,
2653                                          size_t size)
2654 {
2655         ssize_t result;
2656         struct timespec ts1,ts2;
2657         double timediff;
2658
2659         clock_gettime_mono(&ts1);
2660         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2661         clock_gettime_mono(&ts2);
2662         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2663
2664         if (timediff > audit_timeout) {
2665                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2666         }
2667
2668         return result;
2669 }
2670
2671 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2672                                 const struct smb_filename *smb_fname,
2673                                 const char *name)
2674 {
2675         int result;
2676         struct timespec ts1,ts2;
2677         double timediff;
2678
2679         clock_gettime_mono(&ts1);
2680         result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2681         clock_gettime_mono(&ts2);
2682         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2683
2684         if (timediff > audit_timeout) {
2685                 smb_time_audit_log_fname("removexattr", timediff,
2686                         smb_fname->base_name);
2687         }
2688
2689         return result;
2690 }
2691
2692 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2693                                        struct files_struct *fsp,
2694                                        const char *name)
2695 {
2696         int result;
2697         struct timespec ts1,ts2;
2698         double timediff;
2699
2700         clock_gettime_mono(&ts1);
2701         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2702         clock_gettime_mono(&ts2);
2703         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2704
2705         if (timediff > audit_timeout) {
2706                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2707         }
2708
2709         return result;
2710 }
2711
2712 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2713                                 const struct smb_filename *smb_fname,
2714                                 const char *name,
2715                                 const void *value,
2716                                 size_t size,
2717                                 int flags)
2718 {
2719         int result;
2720         struct timespec ts1,ts2;
2721         double timediff;
2722
2723         clock_gettime_mono(&ts1);
2724         result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2725                                        flags);
2726         clock_gettime_mono(&ts2);
2727         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2728
2729         if (timediff > audit_timeout) {
2730                 smb_time_audit_log_fname("setxattr", timediff,
2731                                 smb_fname->base_name);
2732         }
2733
2734         return result;
2735 }
2736
2737 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2738                                     struct files_struct *fsp, const char *name,
2739                                     const void *value, size_t size, int flags)
2740 {
2741         int result;
2742         struct timespec ts1,ts2;
2743         double timediff;
2744
2745         clock_gettime_mono(&ts1);
2746         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2747         clock_gettime_mono(&ts2);
2748         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2749
2750         if (timediff > audit_timeout) {
2751                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2752         }
2753
2754         return result;
2755 }
2756
2757 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2758                                      struct files_struct *fsp)
2759 {
2760         bool result;
2761         struct timespec ts1,ts2;
2762         double timediff;
2763
2764         clock_gettime_mono(&ts1);
2765         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2766         clock_gettime_mono(&ts2);
2767         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2768
2769         if (timediff > audit_timeout) {
2770                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2771         }
2772
2773         return result;
2774 }
2775
2776 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2777                                               struct files_struct *fsp,
2778                                               TALLOC_CTX *mem_ctx,
2779                                               DATA_BLOB *cookie)
2780 {
2781         NTSTATUS result;
2782         struct timespec ts1,ts2;
2783         double timediff;
2784
2785         clock_gettime_mono(&ts1);
2786         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2787         clock_gettime_mono(&ts2);
2788         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2789
2790         if (timediff > audit_timeout) {
2791                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2792         }
2793
2794         return result;
2795 }
2796
2797 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2798                                                   struct files_struct *fsp,
2799                                                   const DATA_BLOB old_cookie,
2800                                                   TALLOC_CTX *mem_ctx,
2801                                                   DATA_BLOB *new_cookie)
2802 {
2803         NTSTATUS result;
2804         struct timespec ts1,ts2;
2805         double timediff;
2806
2807         clock_gettime_mono(&ts1);
2808         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2809                                                  mem_ctx, new_cookie);
2810         clock_gettime_mono(&ts2);
2811         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2812
2813         if (timediff > audit_timeout) {
2814                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2815         }
2816
2817         return result;
2818 }
2819
2820 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2821                                                  struct smb_request *smb1req,
2822                                                  struct smbXsrv_open *op,
2823                                                  const DATA_BLOB old_cookie,
2824                                                  TALLOC_CTX *mem_ctx,
2825                                                  struct files_struct **fsp,
2826                                                  DATA_BLOB *new_cookie)
2827 {
2828         NTSTATUS result;
2829         struct timespec ts1,ts2;
2830         double timediff;
2831
2832         clock_gettime_mono(&ts1);
2833         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2834                                                 mem_ctx, fsp, new_cookie);
2835         clock_gettime_mono(&ts2);
2836         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2837
2838         if (timediff > audit_timeout) {
2839                 smb_time_audit_log("durable_reconnect", timediff);
2840         }
2841
2842         return result;
2843 }
2844
2845 /* VFS operations */
2846
2847 static struct vfs_fn_pointers vfs_time_audit_fns = {
2848         .connect_fn = smb_time_audit_connect,
2849         .disconnect_fn = smb_time_audit_disconnect,
2850         .disk_free_fn = smb_time_audit_disk_free,
2851         .get_quota_fn = smb_time_audit_get_quota,
2852         .set_quota_fn = smb_time_audit_set_quota,
2853         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2854         .statvfs_fn = smb_time_audit_statvfs,
2855         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2856         .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2857         .create_dfs_pathat_fn = smb_time_audit_create_dfs_pathat,
2858         .read_dfs_pathat_fn = smb_time_audit_read_dfs_pathat,
2859         .fdopendir_fn = smb_time_audit_fdopendir,
2860         .readdir_fn = smb_time_audit_readdir,
2861         .seekdir_fn = smb_time_audit_seekdir,
2862         .telldir_fn = smb_time_audit_telldir,
2863         .rewind_dir_fn = smb_time_audit_rewinddir,
2864         .mkdirat_fn = smb_time_audit_mkdirat,
2865         .closedir_fn = smb_time_audit_closedir,
2866         .openat_fn = smb_time_audit_openat,
2867         .create_file_fn = smb_time_audit_create_file,
2868         .close_fn = smb_time_audit_close,
2869         .pread_fn = smb_time_audit_pread,
2870         .pread_send_fn = smb_time_audit_pread_send,
2871         .pread_recv_fn = smb_time_audit_pread_recv,
2872         .pwrite_fn = smb_time_audit_pwrite,
2873         .pwrite_send_fn = smb_time_audit_pwrite_send,
2874         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2875         .lseek_fn = smb_time_audit_lseek,
2876         .sendfile_fn = smb_time_audit_sendfile,
2877         .recvfile_fn = smb_time_audit_recvfile,
2878         .renameat_fn = smb_time_audit_renameat,
2879         .fsync_send_fn = smb_time_audit_fsync_send,
2880         .fsync_recv_fn = smb_time_audit_fsync_recv,
2881         .stat_fn = smb_time_audit_stat,
2882         .fstat_fn = smb_time_audit_fstat,
2883         .lstat_fn = smb_time_audit_lstat,
2884         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2885         .unlinkat_fn = smb_time_audit_unlinkat,
2886         .chmod_fn = smb_time_audit_chmod,
2887         .fchmod_fn = smb_time_audit_fchmod,
2888         .fchown_fn = smb_time_audit_fchown,
2889         .lchown_fn = smb_time_audit_lchown,
2890         .chdir_fn = smb_time_audit_chdir,
2891         .getwd_fn = smb_time_audit_getwd,
2892         .ntimes_fn = smb_time_audit_ntimes,
2893         .ftruncate_fn = smb_time_audit_ftruncate,
2894         .fallocate_fn = smb_time_audit_fallocate,
2895         .lock_fn = smb_time_audit_lock,
2896         .kernel_flock_fn = smb_time_audit_kernel_flock,
2897         .fcntl_fn = smb_time_audit_fcntl,
2898         .linux_setlease_fn = smb_time_audit_linux_setlease,
2899         .getlock_fn = smb_time_audit_getlock,
2900         .symlinkat_fn = smb_time_audit_symlinkat,
2901         .readlinkat_fn = smb_time_audit_readlinkat,
2902         .linkat_fn = smb_time_audit_linkat,
2903         .mknodat_fn = smb_time_audit_mknodat,
2904         .realpath_fn = smb_time_audit_realpath,
2905         .chflags_fn = smb_time_audit_chflags,
2906         .file_id_create_fn = smb_time_audit_file_id_create,
2907         .fs_file_id_fn = smb_time_audit_fs_file_id,
2908         .offload_read_send_fn = smb_time_audit_offload_read_send,
2909         .offload_read_recv_fn = smb_time_audit_offload_read_recv,
2910         .offload_write_send_fn = smb_time_audit_offload_write_send,
2911         .offload_write_recv_fn = smb_time_audit_offload_write_recv,
2912         .get_compression_fn = smb_time_audit_get_compression,
2913         .set_compression_fn = smb_time_audit_set_compression,
2914         .snap_check_path_fn = smb_time_audit_snap_check_path,
2915         .snap_create_fn = smb_time_audit_snap_create,
2916         .snap_delete_fn = smb_time_audit_snap_delete,
2917         .streaminfo_fn = smb_time_audit_streaminfo,
2918         .get_real_filename_fn = smb_time_audit_get_real_filename,
2919         .connectpath_fn = smb_time_audit_connectpath,
2920         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2921         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2922         .strict_lock_check_fn = smb_time_audit_strict_lock_check,
2923         .translate_name_fn = smb_time_audit_translate_name,
2924         .fsctl_fn = smb_time_audit_fsctl,
2925         .get_dos_attributes_fn = smb_time_get_dos_attributes,
2926         .get_dos_attributes_send_fn = smb_time_audit_get_dos_attributes_send,
2927         .get_dos_attributes_recv_fn = smb_time_audit_get_dos_attributes_recv,
2928         .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2929         .set_dos_attributes_fn = smb_time_set_dos_attributes,
2930         .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2931         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2932         .get_nt_acl_at_fn = smb_time_audit_get_nt_acl_at,
2933         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2934         .audit_file_fn = smb_time_audit_audit_file,
2935         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2936         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2937         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2938         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2939         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2940         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2941         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2942         .getxattr_fn = smb_time_audit_getxattr,
2943         .getxattrat_send_fn = smb_time_audit_getxattrat_send,
2944         .getxattrat_recv_fn = smb_time_audit_getxattrat_recv,
2945         .fgetxattr_fn = smb_time_audit_fgetxattr,
2946         .listxattr_fn = smb_time_audit_listxattr,
2947         .flistxattr_fn = smb_time_audit_flistxattr,
2948         .removexattr_fn = smb_time_audit_removexattr,
2949         .fremovexattr_fn = smb_time_audit_fremovexattr,
2950         .setxattr_fn = smb_time_audit_setxattr,
2951         .fsetxattr_fn = smb_time_audit_fsetxattr,
2952         .aio_force_fn = smb_time_audit_aio_force,
2953         .durable_cookie_fn = smb_time_audit_durable_cookie,
2954         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2955         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2956         .readdir_attr_fn = smb_time_audit_readdir_attr,
2957 };
2958
2959
2960 static_decl_vfs;
2961 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2962 {
2963         smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2964
2965         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2966                                             10000) / 1000.0;
2967         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2968                                 &vfs_time_audit_fns);
2969 }