2 * traffic-analyzer VFS module. Measure the smb traffic users create
5 * Copyright (C) Holger Hetterich, 2008
6 * Copyright (C) Jeremy Allison, 2008
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 #include "../lib/crypto/crypto.h"
25 /* abstraction for the send_over_network function */
26 enum sock_type {INTERNET_SOCKET = 0, UNIX_DOMAIN_SOCKET};
28 #define LOCAL_PATHNAME "/var/tmp/stadsocket"
32 * Protocol version 2.0 description
34 * The following table shows the exact assembly of the 2.0 protocol.
37 * The protocol header is always send first, and contains various
38 * information about the data block to come.
39 * The header is always of fixed length, and will be send unencrypted.
41 * Byte Number/Bytes Description
42 * 00-02 Contains always the string "V2."
43 * 03 This byte contains a possible subrelease number of the
44 * protocol. This enables the receiver to make a version
45 * check to ensure the compatibility and allows us to
46 * release 2.x versions of the protocol with bugfixes or
48 * 04 Usually, this byte contains the character '0'. If the
49 * VFS module is configured for anonymization, this is
50 * set to 'A'. This information can be useful for the
52 * 05 Usually, this byte contains the character '0'. If the
53 * VFS module is configured for encryption of the data,
54 * this byte is set to 'E'.
55 * 06-09 These bytes contain the character '0' by default, and
56 * are reserved for possible future extensions. They have
58 * 10-27 17 bytes containing a string representation of the
59 * number of bytes to come in the following data block.
60 * It is right aligned and filled from the left with '0'.
63 * The data block is send immediately after the header was send. It's length
64 * is exactly what was given in bytes 11-28 from in the header.
66 * The data block may be send encrypted.
68 * To make the data block easy for the receiver to read, it is divided into
69 * several sub-blocks, each with it's own header of four byte length. In each
70 * of the sub-headers, a string representation of the length of this block is
73 * Thus the formal structure is very simple:
75 * [HEADER]data[HEADER]data[HEADER]data[END]
77 * whereas [END] is exactly at the position given in bytes 11-28 of the
80 * Some data the VFS module is capturing is of use for any VFS operation.
81 * Therefore, there is a "common set" of data, that will be send with any
82 * data block. The following provides a list of this data.
83 * - the VFS function identifier (see VFS function ifentifier table below).
84 * - a timestamp to the millisecond.
85 * - the username (as text) who runs the VFS operation.
86 * - the SID of the user who run the VFS operation.
87 * - the domain under which the VFS operation has happened.
93 * VFS Functions identifier table. In protocol version 2, every vfs
94 * function is given a unique id.
98 * care for the order here, required for compatibility
99 * with protocol version 1.
105 /* end of protocol version 1 identifiers. */
113 * Specific data sets for the VFS functions.
114 * A compatible receiver has to have the exact same dataset.
138 /* rw_data used for read/write/pread/pwrite */
144 static int vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
146 static enum sock_type smb_traffic_analyzer_connMode(vfs_handle_struct *handle)
148 connection_struct *conn = handle->conn;
150 Mode=lp_parm_const_string(SNUM(conn), "smb_traffic_analyzer","mode", \
152 if (strstr(Mode,"unix_domain_socket")) {
153 return UNIX_DOMAIN_SOCKET;
155 return INTERNET_SOCKET;
160 /* Connect to an internet socket */
161 static int smb_traffic_analyzer_connect_inet_socket(vfs_handle_struct *handle,
162 const char *name, uint16_t port)
164 /* Create a streaming Socket */
166 struct addrinfo hints;
167 struct addrinfo *ailist = NULL;
168 struct addrinfo *res = NULL;
172 /* By default make sure it supports TCP. */
173 hints.ai_socktype = SOCK_STREAM;
174 hints.ai_flags = AI_ADDRCONFIG;
176 ret = getaddrinfo(name,
182 DEBUG(3,("smb_traffic_analyzer_connect_inet_socket: "
183 "getaddrinfo failed for name %s [%s]\n",
185 gai_strerror(ret) ));
189 DEBUG(3,("smb_traffic_analyzer: Internet socket mode. Hostname: %s,"
190 "Port: %i\n", name, port));
192 for (res = ailist; res; res = res->ai_next) {
193 struct sockaddr_storage ss;
196 if (!res->ai_addr || res->ai_addrlen == 0) {
201 memcpy(&ss, res->ai_addr, res->ai_addrlen);
203 status = open_socket_out(&ss, port, 10000, &sockfd);
204 if (NT_STATUS_IS_OK(status)) {
210 freeaddrinfo(ailist);
214 DEBUG(1, ("smb_traffic_analyzer: unable to create "
215 "socket, error is %s",
223 /* Connect to a unix domain socket */
224 static int smb_traffic_analyzer_connect_unix_socket(vfs_handle_struct *handle,
227 /* Create the socket to stad */
229 struct sockaddr_un remote;
231 DEBUG(7, ("smb_traffic_analyzer_connect_unix_socket: "
232 "Unix domain socket mode. Using %s\n",
235 if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
236 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
237 "Couldn't create socket, "
238 "make sure stad is running!\n"));
241 remote.sun_family = AF_UNIX;
242 strlcpy(remote.sun_path, name,
243 sizeof(remote.sun_path));
244 len=strlen(remote.sun_path) + sizeof(remote.sun_family);
245 if (connect(sock, (struct sockaddr *)&remote, len) == -1 ) {
246 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
247 "Could not connect to "
248 "socket, make sure\nstad is running!\n"));
255 /* Private data allowing shared connection sockets. */
256 struct refcounted_sock {
257 struct refcounted_sock *next, *prev;
261 unsigned int ref_count;
265 /* The marshaller for the protocol version 2. */
266 static char *smb_traffic_analyzer_create_string( struct tm *tm, \
267 int seconds, vfs_handle_struct *handle, \
268 char *username, int vfs_operation, int count, ... )
276 char *timestr = NULL;
278 char *userSID = NULL;
280 /* first create the data that is transfered with any VFS op */
281 opstr = talloc_asprintf(talloc_tos(), "%i", vfs_operation);
283 buf = talloc_asprintf(talloc_tos(), "%04u%s", len, opstr);
284 len = strlen( username );
285 buf = talloc_asprintf_append(buf, "%04u%s", len, username);
286 userSID = dom_sid_string( talloc_tos(),
287 &handle->conn->server_info->ptok->user_sids[0]);
288 len = strlen( userSID );
289 buf = talloc_asprintf_append(buf, "%04u%s", len, userSID);
290 len = strlen( handle->conn->connectpath );
291 buf = talloc_asprintf_append( buf, "%04u%s", len, \
292 handle->conn->connectpath );
293 len = strlen( pdb_get_domain(handle->conn->server_info->sam_account) );
294 buf = talloc_asprintf_append( buf, "%04u%s", len, \
295 pdb_get_domain(handle->conn->server_info->sam_account) );
296 timestr = talloc_asprintf(talloc_tos(), \
297 "%04d-%02d-%02d %02d:%02d:%02d.%03d", \
305 len = strlen( timestr );
306 buf = talloc_asprintf_append( buf, "%04u%s", len, timestr);
308 va_start( ap, count );
310 arg = va_arg( ap, char * );
312 * protocol v2 sends a four byte string
313 * as a header to each block, including
314 * the numbers of bytes to come in the
318 buf = talloc_asprintf_append( buf, "%04u%s", len, arg);
324 static void smb_traffic_analyzer_send_data(vfs_handle_struct *handle,
326 enum vfs_id vfs_operation )
328 struct refcounted_sock *rf_sock = NULL;
331 struct tm *tm = NULL;
334 char *username = NULL;
336 const char *anon_prefix = NULL;
337 const char *total_anonymization = NULL;
338 const char *protocol_version = NULL;
341 char state_flags[9] = "000000\0";
343 SMB_VFS_HANDLE_GET_DATA(handle, rf_sock, struct refcounted_sock, return);
345 if (rf_sock == NULL || rf_sock->sock == -1) {
346 DEBUG(1, ("smb_traffic_analyzer_send_data: socket is "
352 tv_sec = convert_timespec_to_time_t(convert_timeval_to_timespec(tv));
353 tm = localtime(&tv_sec);
357 seconds=(float) (tv.tv_usec / 1000);
359 /* check if anonymization is required */
360 total_anonymization=lp_parm_const_string(SNUM(handle->conn),"smb_traffic_analyzer",
361 "total_anonymization", NULL);
363 anon_prefix=lp_parm_const_string(SNUM(handle->conn),"smb_traffic_analyzer",\
364 "anonymize_prefix", NULL );
365 if (anon_prefix!=NULL) {
366 state_flags[1] = 'A';
367 if (total_anonymization!=NULL) {
368 username = talloc_asprintf(talloc_tos(),
372 username = talloc_asprintf(talloc_tos(),
376 handle->conn->server_info->sanitized_username ) );
380 username = handle->conn->server_info->sanitized_username;
386 protocol_version = lp_parm_const_string(SNUM(handle->conn),
387 "smb_traffic_analyzer",
388 "protocol_version", NULL );
390 if ( protocol_version == NULL || strcmp( protocol_version,"V1") == 0) {
392 struct rw_data *s_data = (struct rw_data *) data;
395 * in case of protocol v1, ignore any vfs operations
396 * except read,pread,write,pwrite, and set the "Write"
397 * bool accordingly, send data and return.
399 if ( vfs_operation > vfs_id_pwrite ) return;
401 if ( vfs_operation <= vfs_id_pread ) Write=false;
404 str = talloc_asprintf(talloc_tos(),
405 "V1,%u,\"%s\",\"%s\",\"%c\",\"%s\",\"%s\","
406 "\"%04d-%02d-%02d %02d:%02d:%02d.%03d\"\n",
407 (unsigned int) s_data->len,
409 pdb_get_domain(handle->conn->server_info->sam_account),
411 handle->conn->connectpath,
420 if (write_data(rf_sock->sock, str, len) != len) {
421 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
422 "error sending V1 protocol data to socket!\n"));
426 } else if ( strcmp( protocol_version, "V2") == 0) {
428 switch( vfs_operation ) {
430 str = smb_traffic_analyzer_create_string( tm, \
431 seconds, handle, username, vfs_id_mkdir, 3,\
432 ((struct mkdir_data *) data)->path, \
433 talloc_asprintf( talloc_tos(), "%u", \
434 ((struct mkdir_data *) data)->mode), \
435 talloc_asprintf( talloc_tos(), "%u", \
436 ((struct mkdir_data *) data)->result ));
439 str = smb_traffic_analyzer_create_string( tm, \
440 seconds, handle, username, vfs_id_rmdir, 2,\
441 ((struct rmdir_data *) data)->path, \
442 talloc_asprintf( talloc_tos(), "%u", \
443 ((struct rmdir_data *) data)->result ));
445 case vfs_id_rename: ;
446 str = smb_traffic_analyzer_create_string( tm, \
447 seconds, handle, username, vfs_id_rename, 3,\
448 ((struct rename_data *) data)->src, \
449 ((struct rename_data *) data)->dst,
450 talloc_asprintf(talloc_tos(), "%u", \
451 ((struct rename_data *) data)->result));
454 str = smb_traffic_analyzer_create_string( tm, \
455 seconds, handle, username, vfs_id_chdir, 2,\
456 ((struct chdir_data *) data)->path, \
457 talloc_asprintf(talloc_tos(), "%u", \
458 ((struct chdir_data *) data)->result));
465 str = smb_traffic_analyzer_create_string( tm, \
466 seconds, handle, username, vfs_operation, 2,\
467 ((struct rw_data *) data)->filename, \
468 talloc_asprintf(talloc_tos(), "%u", \
469 ((struct rw_data *) data)->len));
472 DEBUG(1, ("smb_traffic_analyzer: error! "
473 "wrong VFS operation id detected!\n"));
478 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
479 "error, unkown protocol given!\n"));
484 DEBUG(1, ("smb_traffic_analyzer_send_data: "
485 "unable to create string to send!\n"));
491 * If configured, optain the key and run AES encryption
495 char *akey = secrets_fetch("smb_traffic_analyzer_key", &size);
496 if ( akey != NULL ) {
498 state_flags[2] = 'E';
499 DEBUG(10, ("smb_traffic_analyzer: a key was found, encrypting "
502 samba_AES_set_encrypt_key(akey, 128, key);
503 samba_AES_encrypt( str, crypted, key );
504 len = strlen( crypted );
505 header = talloc_asprintf( talloc_tos(), "V2.%s%017u",
508 DEBUG(10, ("smb_traffic_analyzer_send_data_socket:"
509 " header created for crypted data: %s", header));
510 len = strlen(header);
511 if (write_data(rf_sock->sock, header, len) != len) {
512 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
513 "error sending the header"
514 " over the socket!\n"));
516 len = strlen(crypted);
517 if (write_data(rf_sock->sock, crypted, len) != len) {
518 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
519 "error sending crypted data to socket!\n"));
526 header = talloc_asprintf(talloc_tos(), "V2.%s%017u", state_flags, len);
527 DEBUG(10, ("smb_traffic_analyzer_send_data_socket: header created:"
529 len = strlen(header);
530 if (write_data(rf_sock->sock, header, len) != len) {
531 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: error "
532 "sending the header over the socket!\n"));
535 DEBUG(10, ("smb_traffic_analyzer_send_data_socket: going to send "
536 "data block: %s\n",str));
537 if (write_data(rf_sock->sock, str, len) != len) {
538 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
539 "error sending data to socket!\n"));
544 static struct refcounted_sock *sock_list;
546 static void smb_traffic_analyzer_free_data(void **pptr)
548 struct refcounted_sock *rf_sock = *(struct refcounted_sock **)pptr;
549 if (rf_sock == NULL) {
552 rf_sock->ref_count--;
553 if (rf_sock->ref_count != 0) {
556 if (rf_sock->sock != -1) {
557 close(rf_sock->sock);
559 DLIST_REMOVE(sock_list, rf_sock);
560 TALLOC_FREE(rf_sock);
563 static int smb_traffic_analyzer_connect(struct vfs_handle_struct *handle,
567 connection_struct *conn = handle->conn;
568 enum sock_type st = smb_traffic_analyzer_connMode(handle);
569 struct refcounted_sock *rf_sock = NULL;
570 const char *name = (st == UNIX_DOMAIN_SOCKET) ? LOCAL_PATHNAME :
571 lp_parm_const_string(SNUM(conn),
572 "smb_traffic_analyzer",
573 "host", "localhost");
574 uint16_t port = (st == UNIX_DOMAIN_SOCKET) ? 0 :
575 atoi( lp_parm_const_string(SNUM(conn),
576 "smb_traffic_analyzer", "port", "9430"));
577 int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
583 /* Are we already connected ? */
584 for (rf_sock = sock_list; rf_sock; rf_sock = rf_sock->next) {
585 if (port == rf_sock->port &&
586 (strcmp(name, rf_sock->name) == 0)) {
591 /* If we're connected already, just increase the
592 * reference count. */
594 rf_sock->ref_count++;
596 /* New connection. */
597 rf_sock = TALLOC_ZERO_P(NULL, struct refcounted_sock);
598 if (rf_sock == NULL) {
599 SMB_VFS_NEXT_DISCONNECT(handle);
603 rf_sock->name = talloc_strdup(rf_sock, name);
604 if (rf_sock->name == NULL) {
605 SMB_VFS_NEXT_DISCONNECT(handle);
606 TALLOC_FREE(rf_sock);
610 rf_sock->port = port;
611 rf_sock->ref_count = 1;
613 if (st == UNIX_DOMAIN_SOCKET) {
614 rf_sock->sock = smb_traffic_analyzer_connect_unix_socket(handle,
618 rf_sock->sock = smb_traffic_analyzer_connect_inet_socket(handle,
622 if (rf_sock->sock == -1) {
623 SMB_VFS_NEXT_DISCONNECT(handle);
624 TALLOC_FREE(rf_sock);
627 DLIST_ADD(sock_list, rf_sock);
630 /* Store the private data. */
631 SMB_VFS_HANDLE_SET_DATA(handle, rf_sock, smb_traffic_analyzer_free_data,
632 struct refcounted_sock, return -1);
637 static int smb_traffic_analyzer_chdir(vfs_handle_struct *handle, \
640 struct chdir_data s_data;
641 s_data.result = SMB_VFS_NEXT_CHDIR(handle, path);
643 DEBUG(10, ("smb_traffic_analyzer_chdir: CHDIR: %s\n", path));
644 smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_chdir);
645 return s_data.result;
648 static int smb_traffic_analyzer_rename(vfs_handle_struct *handle, \
649 const struct smb_filename *smb_fname_src,
650 const struct smb_filename *smb_fname_dst)
652 struct rename_data s_data;
653 s_data.result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, \
655 s_data.src = smb_fname_src->base_name;
656 s_data.dst = smb_fname_dst->base_name;
657 DEBUG(10, ("smb_traffic_analyzer_rename: RENAME: %s / %s\n",
658 smb_fname_src->base_name,
659 smb_fname_dst->base_name));
660 smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_rename);
661 return s_data.result;
664 static int smb_traffic_analyzer_rmdir(vfs_handle_struct *handle, \
667 struct rmdir_data s_data;
668 s_data.result = SMB_VFS_NEXT_RMDIR(handle, path);
670 DEBUG(10, ("smb_traffic_analyzer_rmdir: RMDIR: %s\n", path));
671 smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_rmdir);
672 return s_data.result;
675 static int smb_traffic_analyzer_mkdir(vfs_handle_struct *handle, \
676 const char *path, mode_t mode)
678 struct mkdir_data s_data;
679 s_data.result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
682 DEBUG(10, ("smb_traffic_analyzer_mkdir: MKDIR: %s\n", path));
683 smb_traffic_analyzer_send_data(handle,
686 return s_data.result;
689 static ssize_t smb_traffic_analyzer_read(vfs_handle_struct *handle, \
690 files_struct *fsp, void *data, size_t n)
692 struct rw_data s_data;
694 s_data.len = SMB_VFS_NEXT_READ(handle, fsp, data, n);
695 s_data.filename = fsp->fsp_name->base_name;
696 DEBUG(10, ("smb_traffic_analyzer_read: READ: %s\n", fsp_str_dbg(fsp)));
698 smb_traffic_analyzer_send_data(handle,
705 static ssize_t smb_traffic_analyzer_pread(vfs_handle_struct *handle, \
706 files_struct *fsp, void *data, size_t n, SMB_OFF_T offset)
708 struct rw_data s_data;
710 s_data.len = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
711 s_data.filename = fsp->fsp_name->base_name;
712 DEBUG(10, ("smb_traffic_analyzer_pread: PREAD: %s\n",
715 smb_traffic_analyzer_send_data(handle,
722 static ssize_t smb_traffic_analyzer_write(vfs_handle_struct *handle, \
723 files_struct *fsp, const void *data, size_t n)
725 struct rw_data s_data;
727 s_data.len = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
728 s_data.filename = fsp->fsp_name->base_name;
729 DEBUG(10, ("smb_traffic_analyzer_write: WRITE: %s\n",
732 smb_traffic_analyzer_send_data(handle,
738 static ssize_t smb_traffic_analyzer_pwrite(vfs_handle_struct *handle, \
739 files_struct *fsp, const void *data, size_t n, SMB_OFF_T offset)
741 struct rw_data s_data;
743 s_data.len = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
744 s_data.filename = fsp->fsp_name->base_name;
745 DEBUG(10, ("smb_traffic_analyzer_pwrite: PWRITE: %s\n", \
748 smb_traffic_analyzer_send_data(handle,
754 static struct vfs_fn_pointers vfs_smb_traffic_analyzer_fns = {
755 .connect_fn = smb_traffic_analyzer_connect,
756 .vfs_read = smb_traffic_analyzer_read,
757 .pread = smb_traffic_analyzer_pread,
758 .write = smb_traffic_analyzer_write,
759 .pwrite = smb_traffic_analyzer_pwrite,
760 .mkdir = smb_traffic_analyzer_mkdir,
761 .rename = smb_traffic_analyzer_rename,
762 .chdir = smb_traffic_analyzer_chdir
765 /* Module initialization */
766 NTSTATUS vfs_smb_traffic_analyzer_init(void)
768 NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
769 "smb_traffic_analyzer",
770 &vfs_smb_traffic_analyzer_fns);
772 if (!NT_STATUS_IS_OK(ret)) {
776 vfs_smb_traffic_analyzer_debug_level =
777 debug_add_class("smb_traffic_analyzer");
779 if (vfs_smb_traffic_analyzer_debug_level == -1) {
780 vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
781 DEBUG(1, ("smb_traffic_analyzer_init: Couldn't register custom"
782 "debugging class!\n"));
784 DEBUG(3, ("smb_traffic_analyzer_init: Debug class number of"
785 "'smb_traffic_analyzer': %d\n", \
786 vfs_smb_traffic_analyzer_debug_level));