source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_at(const char *syscallname,
  90                                   double elapsed,
  91                                   const struct files_struct *dir_fsp,
  92                                   const struct smb_filename *smb_fname)
  93 {
  94         char *msg = NULL;
  95
  96         msg = talloc_asprintf(talloc_tos(),
  97                               "filename = \"%s/%s/%s\"",
  98                               dir_fsp->conn->connectpath,
  99                               dir_fsp->fsp_name->base_name,
 100                               smb_fname->base_name);
 101
 102         smb_time_audit_log_msg(syscallname, elapsed, msg);
 103         TALLOC_FREE(msg);
 104 }
 105
 106 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
 107                                     const char *fname)
 108 {
 109         char cwd[PATH_MAX];
 110         char *msg = NULL;
 111
 112         if (getcwd(cwd, sizeof(cwd)) == NULL) {
 113                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
 114         }
 115         if (fname != NULL) {
 116                 msg = talloc_asprintf(talloc_tos(),
 117                                       "cwd = \"%s\", filename = \"%s\"",
 118                                       cwd, fname);
 119         } else {
 120                 msg = talloc_asprintf(talloc_tos(),
 121                                       "cwd = \"%s\", filename = <NULL>",
 122                                       cwd);
 123         }
 124         smb_time_audit_log_msg(syscallname, elapsed, msg);
 125         TALLOC_FREE(msg);
 126 }
 127
 128 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 129                                        const struct smb_filename *smb_fname)
 130 {
 131         if (smb_fname != NULL) {
 132                 smb_time_audit_log_fname(syscallname, elapsed,
 133                                          smb_fname->base_name);
 134         } else {
 135                 smb_time_audit_log_fname(syscallname, elapsed,
 136                                          "smb_fname = <NULL>");
 137         }
 138 }
 139
 140 static int smb_time_audit_connect(vfs_handle_struct *handle,
 141                                   const char *svc, const char *user)
 142 {
 143         int result;
 144         struct timespec ts1,ts2;
 145         double timediff;
 146
 147         if (!handle) {
 148                 return -1;
 149         }
 150
 151         clock_gettime_mono(&ts1);
 152         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 153         clock_gettime_mono(&ts2);
 154         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 155         if (timediff > audit_timeout) {
 156                 smb_time_audit_log_msg("connect", timediff, user);
 157         }
 158         return result;
 159 }
 160
 161 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 162 {
 163         struct timespec ts1,ts2;
 164         double timediff;
 165
 166         clock_gettime_mono(&ts1);
 167         SMB_VFS_NEXT_DISCONNECT(handle);
 168         clock_gettime_mono(&ts2);
 169         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 170
 171         if (timediff > audit_timeout) {
 172                 smb_time_audit_log("disconnect", timediff);
 173         }
 174 }
 175
 176 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 177                                         const struct smb_filename *smb_fname,
 178                                         uint64_t *bsize,
 179                                         uint64_t *dfree,
 180                                         uint64_t *dsize)
 181 {
 182         uint64_t result;
 183         struct timespec ts1,ts2;
 184         double timediff;
 185
 186         clock_gettime_mono(&ts1);
 187         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
 188         clock_gettime_mono(&ts2);
 189         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 190
 191         /* Don't have a reasonable notion of failure here */
 192         if (timediff > audit_timeout) {
 193                 smb_time_audit_log_fname("disk_free",
 194                                 timediff,
 195                                 smb_fname->base_name);
 196         }
 197
 198         return result;
 199 }
 200
 201 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 202                                         const struct smb_filename *smb_fname,
 203                                         enum SMB_QUOTA_TYPE qtype,
 204                                         unid_t id,
 205                                         SMB_DISK_QUOTA *qt)
 206 {
 207         int result;
 208         struct timespec ts1,ts2;
 209         double timediff;
 210
 211         clock_gettime_mono(&ts1);
 212         result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
 213         clock_gettime_mono(&ts2);
 214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 215
 216         if (timediff > audit_timeout) {
 217                 smb_time_audit_log_fname("get_quota",
 218                                 timediff,
 219                                 smb_fname->base_name);
 220         }
 221         return result;
 222 }
 223
 224 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 225                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 226                                     SMB_DISK_QUOTA *qt)
 227 {
 228         int result;
 229         struct timespec ts1,ts2;
 230         double timediff;
 231
 232         clock_gettime_mono(&ts1);
 233         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 234         clock_gettime_mono(&ts2);
 235         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 236
 237         if (timediff > audit_timeout) {
 238                 smb_time_audit_log("set_quota", timediff);
 239         }
 240
 241         return result;
 242 }
 243
 244 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 245                                                struct files_struct *fsp,
 246                                                struct shadow_copy_data *shadow_copy_data,
 247                                                bool labels)
 248 {
 249         int result;
 250         struct timespec ts1,ts2;
 251         double timediff;
 252
 253         clock_gettime_mono(&ts1);
 254         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 255                                                    shadow_copy_data, labels);
 256         clock_gettime_mono(&ts2);
 257         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 258
 259         if (timediff > audit_timeout) {
 260                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 261         }
 262
 263         return result;
 264 }
 265
 266 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 267                                   const struct smb_filename *smb_fname,
 268                                   struct vfs_statvfs_struct *statbuf)
 269 {
 270         int result;
 271         struct timespec ts1,ts2;
 272         double timediff;
 273
 274         clock_gettime_mono(&ts1);
 275         result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
 276         clock_gettime_mono(&ts2);
 277         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 278
 279         if (timediff > audit_timeout) {
 280                 smb_time_audit_log_fname("statvfs", timediff,
 281                         smb_fname->base_name);
 282         }
 283
 284         return result;
 285 }
 286
 287 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 288                                                enum timestamp_set_resolution *p_ts_res)
 289 {
 290         uint32_t result;
 291         struct timespec ts1,ts2;
 292         double timediff;
 293
 294         clock_gettime_mono(&ts1);
 295         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 296         clock_gettime_mono(&ts2);
 297         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 298
 299         if (timediff > audit_timeout) {
 300                 smb_time_audit_log("fs_capabilities", timediff);
 301         }
 302
 303         return result;
 304 }
 305
 306 static NTSTATUS smb_time_audit_get_dfs_referrals(
 307                         struct vfs_handle_struct *handle,
 308                         struct dfs_GetDFSReferral *r)
 309 {
 310         NTSTATUS result;
 311         struct timespec ts1,ts2;
 312         double timediff;
 313
 314         clock_gettime_mono(&ts1);
 315         result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
 316         clock_gettime_mono(&ts2);
 317         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 318
 319         if (timediff > audit_timeout) {
 320                 smb_time_audit_log("get_dfs_referrals", timediff);
 321         }
 322
 323         return result;
 324 }
 325
 326 static NTSTATUS smb_time_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
 327                         struct files_struct *dirfsp,
 328                         const struct smb_filename *smb_fname,
 329                         const struct referral *reflist,
 330                         size_t referral_count)
 331 {
 332         NTSTATUS result;
 333         struct timespec ts1,ts2;
 334         double timediff;
 335
 336         clock_gettime_mono(&ts1);
 337         result = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
 338                         dirfsp,
 339                         smb_fname,
 340                         reflist,
 341                         referral_count);
 342         clock_gettime_mono(&ts2);
 343         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 344
 345         if (timediff > audit_timeout) {
 346                 smb_time_audit_log("get_dfs_referrals", timediff);
 347         }
 348
 349         return result;
 350 }
 351
 352 static NTSTATUS smb_time_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
 353                         TALLOC_CTX *mem_ctx,
 354                         struct files_struct *dirfsp,
 355                         struct smb_filename *smb_fname,
 356                         struct referral **ppreflist,
 357                         size_t *preferral_count)
 358 {
 359         NTSTATUS result;
 360         struct timespec ts1,ts2;
 361         double timediff;
 362
 363         clock_gettime_mono(&ts1);
 364         result = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
 365                         mem_ctx,
 366                         dirfsp,
 367                         smb_fname,
 368                         ppreflist,
 369                         preferral_count);
 370         clock_gettime_mono(&ts2);
 371         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 372
 373         if (timediff > audit_timeout) {
 374                 smb_time_audit_log("read_dfs_pathat", timediff);
 375         }
 376
 377         return result;
 378 }
 379
 380 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 381                                                TALLOC_CTX *mem_ctx,
 382                                                const char *service_path,
 383                                                char **base_volume)
 384 {
 385         NTSTATUS status;
 386         struct timespec ts1,ts2;
 387         double timediff;
 388
 389         clock_gettime_mono(&ts1);
 390         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 391                                               base_volume);
 392         clock_gettime_mono(&ts2);
 393         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 394
 395         if (timediff > audit_timeout) {
 396                 smb_time_audit_log("snap_check_path", timediff);
 397         }
 398
 399         return status;
 400 }
 401
 402 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 403                                            TALLOC_CTX *mem_ctx,
 404                                            const char *base_volume,
 405                                            time_t *tstamp,
 406                                            bool rw,
 407                                            char **base_path,
 408                                            char **snap_path)
 409 {
 410         NTSTATUS status;
 411         struct timespec ts1,ts2;
 412         double timediff;
 413
 414         clock_gettime_mono(&ts1);
 415         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 416                                           rw, base_path, snap_path);
 417         clock_gettime_mono(&ts2);
 418         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 419
 420         if (timediff > audit_timeout) {
 421                 smb_time_audit_log("snap_create", timediff);
 422         }
 423
 424         return status;
 425 }
 426
 427 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 428                                            TALLOC_CTX *mem_ctx,
 429                                            char *base_path,
 430                                            char *snap_path)
 431 {
 432         NTSTATUS status;
 433         struct timespec ts1,ts2;
 434         double timediff;
 435
 436         clock_gettime_mono(&ts1);
 437         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 438                                           snap_path);
 439         clock_gettime_mono(&ts2);
 440         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 441
 442         if (timediff > audit_timeout) {
 443                 smb_time_audit_log("snap_delete", timediff);
 444         }
 445
 446         return status;
 447 }
 448
 449 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 450                                               files_struct *fsp,
 451                                               const char *mask, uint32_t attr)
 452 {
 453         DIR *result;
 454         struct timespec ts1,ts2;
 455         double timediff;
 456
 457         clock_gettime_mono(&ts1);
 458         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 459         clock_gettime_mono(&ts2);
 460         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 461
 462         if (timediff > audit_timeout) {
 463                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 464         }
 465
 466         return result;
 467 }
 468
 469 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 470                                                  DIR *dirp,
 471                                                  SMB_STRUCT_STAT *sbuf)
 472 {
 473         struct dirent *result;
 474         struct timespec ts1,ts2;
 475         double timediff;
 476
 477         clock_gettime_mono(&ts1);
 478         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 479         clock_gettime_mono(&ts2);
 480         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 481
 482         if (timediff > audit_timeout) {
 483                 smb_time_audit_log("readdir", timediff);
 484         }
 485
 486         return result;
 487 }
 488
 489 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 490                                    DIR *dirp, long offset)
 491 {
 492         struct timespec ts1,ts2;
 493         double timediff;
 494
 495         clock_gettime_mono(&ts1);
 496         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 497         clock_gettime_mono(&ts2);
 498         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 499
 500         if (timediff > audit_timeout) {
 501                 smb_time_audit_log("seekdir", timediff);
 502         }
 503
 504 }
 505
 506 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 507                                    DIR *dirp)
 508 {
 509         long result;
 510         struct timespec ts1,ts2;
 511         double timediff;
 512
 513         clock_gettime_mono(&ts1);
 514         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 515         clock_gettime_mono(&ts2);
 516         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 517
 518         if (timediff > audit_timeout) {
 519                 smb_time_audit_log("telldir", timediff);
 520         }
 521
 522         return result;
 523 }
 524
 525 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 526                                      DIR *dirp)
 527 {
 528         struct timespec ts1,ts2;
 529         double timediff;
 530
 531         clock_gettime_mono(&ts1);
 532         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 533         clock_gettime_mono(&ts2);
 534         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 535
 536         if (timediff > audit_timeout) {
 537                 smb_time_audit_log("rewinddir", timediff);
 538         }
 539
 540 }
 541
 542 static int smb_time_audit_mkdirat(vfs_handle_struct *handle,
 543                                 struct files_struct *dirfsp,
 544                                 const struct smb_filename *smb_fname,
 545                                 mode_t mode)
 546 {
 547         int result;
 548         struct timespec ts1,ts2;
 549         double timediff;
 550
 551         clock_gettime_mono(&ts1);
 552         result = SMB_VFS_NEXT_MKDIRAT(handle,
 553                                 dirfsp,
 554                                 smb_fname,
 555                                 mode);
 556         clock_gettime_mono(&ts2);
 557         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 558
 559         if (timediff > audit_timeout) {
 560                 smb_time_audit_log_smb_fname("mkdirat",
 561                         timediff,
 562                         smb_fname);
 563         }
 564
 565         return result;
 566 }
 567
 568 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 569                                    DIR *dirp)
 570 {
 571         int result;
 572         struct timespec ts1,ts2;
 573         double timediff;
 574
 575         clock_gettime_mono(&ts1);
 576         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 577         clock_gettime_mono(&ts2);
 578         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 579
 580         if (timediff > audit_timeout) {
 581                 smb_time_audit_log("closedir", timediff);
 582         }
 583
 584         return result;
 585 }
 586
 587 static int smb_time_audit_openat(vfs_handle_struct *handle,
 588                                  const struct files_struct *dirfsp,
 589                                  const struct smb_filename *smb_fname,
 590                                  struct files_struct *fsp,
 591                                  int flags,
 592                                  mode_t mode)
 593 {
 594         int result;
 595         struct timespec ts1,ts2;
 596         double timediff;
 597
 598         clock_gettime_mono(&ts1);
 599         result = SMB_VFS_NEXT_OPENAT(handle,
 600                                      dirfsp,
 601                                      smb_fname,
 602                                      fsp,
 603                                      flags,
 604                                      mode);
 605         clock_gettime_mono(&ts2);
 606         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 607
 608         if (timediff > audit_timeout) {
 609                 smb_time_audit_log_fsp("openat", timediff, fsp);
 610         }
 611
 612         return result;
 613 }
 614
 615 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 616                                            struct smb_request *req,
 617                                            struct smb_filename *fname,
 618                                            uint32_t access_mask,
 619                                            uint32_t share_access,
 620                                            uint32_t create_disposition,
 621                                            uint32_t create_options,
 622                                            uint32_t file_attributes,
 623                                            uint32_t oplock_request,
 624                                            const struct smb2_lease *lease,
 625                                            uint64_t allocation_size,
 626                                            uint32_t private_flags,
 627                                            struct security_descriptor *sd,
 628                                            struct ea_list *ea_list,
 629                                            files_struct **result_fsp,
 630                                            int *pinfo,
 631                                            const struct smb2_create_blobs *in_context_blobs,
 632                                            struct smb2_create_blobs *out_context_blobs)
 633 {
 634         NTSTATUS result;
 635         struct timespec ts1,ts2;
 636         double timediff;
 637
 638         clock_gettime_mono(&ts1);
 639         result = SMB_VFS_NEXT_CREATE_FILE(
 640                 handle,                                 /* handle */
 641                 req,                                    /* req */
 642                 fname,                                  /* fname */
 643                 access_mask,                            /* access_mask */
 644                 share_access,                           /* share_access */
 645                 create_disposition,                     /* create_disposition*/
 646                 create_options,                         /* create_options */
 647                 file_attributes,                        /* file_attributes */
 648                 oplock_request,                         /* oplock_request */
 649                 lease,                                  /* lease */
 650                 allocation_size,                        /* allocation_size */
 651                 private_flags,
 652                 sd,                                     /* sd */
 653                 ea_list,                                /* ea_list */
 654                 result_fsp,                             /* result */
 655                 pinfo,
 656                 in_context_blobs, out_context_blobs);   /* create context */
 657         clock_gettime_mono(&ts2);
 658         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 659
 660         if (timediff > audit_timeout) {
 661                 /*
 662                  * can't use result_fsp this time, may have
 663                  * invalid content causing smbd crash
 664                  */
 665                 smb_time_audit_log_smb_fname("create_file", timediff,
 666                                            fname);
 667         }
 668
 669         return result;
 670 }
 671
 672 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 673 {
 674         int result;
 675         struct timespec ts1,ts2;
 676         double timediff;
 677
 678         clock_gettime_mono(&ts1);
 679         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 680         clock_gettime_mono(&ts2);
 681         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 682
 683         if (timediff > audit_timeout) {
 684                 smb_time_audit_log_fsp("close", timediff, fsp);
 685         }
 686
 687         return result;
 688 }
 689
 690 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 691                                     files_struct *fsp,
 692                                     void *data, size_t n, off_t offset)
 693 {
 694         ssize_t result;
 695         struct timespec ts1,ts2;
 696         double timediff;
 697
 698         clock_gettime_mono(&ts1);
 699         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 700         clock_gettime_mono(&ts2);
 701         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 702
 703         if (timediff > audit_timeout) {
 704                 smb_time_audit_log_fsp("pread", timediff, fsp);
 705         }
 706
 707         return result;
 708 }
 709
 710 struct smb_time_audit_pread_state {
 711         struct files_struct *fsp;
 712         ssize_t ret;
 713         struct vfs_aio_state vfs_aio_state;
 714 };
 715
 716 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 717
 718 static struct tevent_req *smb_time_audit_pread_send(
 719         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 720         struct tevent_context *ev, struct files_struct *fsp,
 721         void *data, size_t n, off_t offset)
 722 {
 723         struct tevent_req *req, *subreq;
 724         struct smb_time_audit_pread_state *state;
 725
 726         req = tevent_req_create(mem_ctx, &state,
 727                                 struct smb_time_audit_pread_state);
 728         if (req == NULL) {
 729                 return NULL;
 730         }
 731         state->fsp = fsp;
 732
 733         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 734                                          n, offset);
 735         if (tevent_req_nomem(subreq, req)) {
 736                 return tevent_req_post(req, ev);
 737         }
 738         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 739         return req;
 740 }
 741
 742 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 743 {
 744         struct tevent_req *req = tevent_req_callback_data(
 745                 subreq, struct tevent_req);
 746         struct smb_time_audit_pread_state *state = tevent_req_data(
 747                 req, struct smb_time_audit_pread_state);
 748
 749         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
 750         TALLOC_FREE(subreq);
 751         tevent_req_done(req);
 752 }
 753
 754 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
 755                                          struct vfs_aio_state *vfs_aio_state)
 756 {
 757         struct smb_time_audit_pread_state *state = tevent_req_data(
 758                 req, struct smb_time_audit_pread_state);
 759         double timediff;
 760
 761         timediff = state->vfs_aio_state.duration * 1.0e-9;
 762
 763         if (timediff > audit_timeout) {
 764                 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
 765         }
 766
 767         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 768                 return -1;
 769         }
 770         *vfs_aio_state = state->vfs_aio_state;
 771         return state->ret;
 772 }
 773
 774 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 775                                      files_struct *fsp,
 776                                      const void *data, size_t n,
 777                                      off_t offset)
 778 {
 779         ssize_t result;
 780         struct timespec ts1,ts2;
 781         double timediff;
 782
 783         clock_gettime_mono(&ts1);
 784         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 785         clock_gettime_mono(&ts2);
 786         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 787
 788         if (timediff > audit_timeout) {
 789                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 790         }
 791
 792         return result;
 793 }
 794
 795 struct smb_time_audit_pwrite_state {
 796         struct files_struct *fsp;
 797         ssize_t ret;
 798         struct vfs_aio_state vfs_aio_state;
 799 };
 800
 801 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 802
 803 static struct tevent_req *smb_time_audit_pwrite_send(
 804         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 805         struct tevent_context *ev, struct files_struct *fsp,
 806         const void *data, size_t n, off_t offset)
 807 {
 808         struct tevent_req *req, *subreq;
 809         struct smb_time_audit_pwrite_state *state;
 810
 811         req = tevent_req_create(mem_ctx, &state,
 812                                 struct smb_time_audit_pwrite_state);
 813         if (req == NULL) {
 814                 return NULL;
 815         }
 816         state->fsp = fsp;
 817
 818         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 819                                          n, offset);
 820         if (tevent_req_nomem(subreq, req)) {
 821                 return tevent_req_post(req, ev);
 822         }
 823         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 824         return req;
 825 }
 826
 827 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 828 {
 829         struct tevent_req *req = tevent_req_callback_data(
 830                 subreq, struct tevent_req);
 831         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 832                 req, struct smb_time_audit_pwrite_state);
 833
 834         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
 835         TALLOC_FREE(subreq);
 836         tevent_req_done(req);
 837 }
 838
 839 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
 840                                           struct vfs_aio_state *vfs_aio_state)
 841 {
 842         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 843                 req, struct smb_time_audit_pwrite_state);
 844         double timediff;
 845
 846         timediff = state->vfs_aio_state.duration * 1.0e-9;
 847
 848         if (timediff > audit_timeout) {
 849                 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
 850         }
 851
 852         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 853                 return -1;
 854         }
 855         *vfs_aio_state = state->vfs_aio_state;
 856         return state->ret;
 857 }
 858
 859 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 860                                       files_struct *fsp,
 861                                       off_t offset, int whence)
 862 {
 863         off_t result;
 864         struct timespec ts1,ts2;
 865         double timediff;
 866
 867         clock_gettime_mono(&ts1);
 868         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 869         clock_gettime_mono(&ts2);
 870         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 871
 872         if (timediff > audit_timeout) {
 873                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 874         }
 875
 876         return result;
 877 }
 878
 879 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 880                                        files_struct *fromfsp,
 881                                        const DATA_BLOB *hdr, off_t offset,
 882                                        size_t n)
 883 {
 884         ssize_t result;
 885         struct timespec ts1,ts2;
 886         double timediff;
 887
 888         clock_gettime_mono(&ts1);
 889         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 890         clock_gettime_mono(&ts2);
 891         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 892
 893         if (timediff > audit_timeout) {
 894                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 895         }
 896
 897         return result;
 898 }
 899
 900 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 901                                        files_struct *tofsp,
 902                                        off_t offset,
 903                                        size_t n)
 904 {
 905         ssize_t result;
 906         struct timespec ts1,ts2;
 907         double timediff;
 908
 909         clock_gettime_mono(&ts1);
 910         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 911         clock_gettime_mono(&ts2);
 912         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 913
 914         if (timediff > audit_timeout) {
 915                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 916         }
 917
 918         return result;
 919 }
 920
 921 static int smb_time_audit_renameat(vfs_handle_struct *handle,
 922                                 files_struct *srcfsp,
 923                                 const struct smb_filename *oldname,
 924                                 files_struct *dstfsp,
 925                                 const struct smb_filename *newname)
 926 {
 927         int result;
 928         struct timespec ts1,ts2;
 929         double timediff;
 930
 931         clock_gettime_mono(&ts1);
 932         result = SMB_VFS_NEXT_RENAMEAT(handle,
 933                         srcfsp,
 934                         oldname,
 935                         dstfsp,
 936                         newname);
 937         clock_gettime_mono(&ts2);
 938         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 939
 940         if (timediff > audit_timeout) {
 941                 smb_time_audit_log_smb_fname("renameat", timediff, newname);
 942         }
 943
 944         return result;
 945 }
 946
 947 struct smb_time_audit_fsync_state {
 948         struct files_struct *fsp;
 949         int ret;
 950         struct vfs_aio_state vfs_aio_state;
 951 };
 952
 953 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 954
 955 static struct tevent_req *smb_time_audit_fsync_send(
 956         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 957         struct tevent_context *ev, struct files_struct *fsp)
 958 {
 959         struct tevent_req *req, *subreq;
 960         struct smb_time_audit_fsync_state *state;
 961
 962         req = tevent_req_create(mem_ctx, &state,
 963                                 struct smb_time_audit_fsync_state);
 964         if (req == NULL) {
 965                 return NULL;
 966         }
 967         state->fsp = fsp;
 968
 969         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 970         if (tevent_req_nomem(subreq, req)) {
 971                 return tevent_req_post(req, ev);
 972         }
 973         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 974         return req;
 975 }
 976
 977 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
 978 {
 979         struct tevent_req *req = tevent_req_callback_data(
 980                 subreq, struct tevent_req);
 981         struct smb_time_audit_fsync_state *state = tevent_req_data(
 982                 req, struct smb_time_audit_fsync_state);
 983
 984         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
 985         TALLOC_FREE(subreq);
 986         tevent_req_done(req);
 987 }
 988
 989 static int smb_time_audit_fsync_recv(struct tevent_req *req,
 990                                      struct vfs_aio_state *vfs_aio_state)
 991 {
 992         struct smb_time_audit_fsync_state *state = tevent_req_data(
 993                 req, struct smb_time_audit_fsync_state);
 994         double timediff;
 995
 996         timediff = state->vfs_aio_state.duration * 1.0e-9;
 997
 998         if (timediff > audit_timeout) {
 999                 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
1000         }
1001
1002         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1003                 return -1;
1004         }
1005         *vfs_aio_state = state->vfs_aio_state;
1006         return state->ret;
1007 }
1008
1009 static int smb_time_audit_stat(vfs_handle_struct *handle,
1010                                struct smb_filename *fname)
1011 {
1012         int result;
1013         struct timespec ts1,ts2;
1014         double timediff;
1015
1016         clock_gettime_mono(&ts1);
1017         result = SMB_VFS_NEXT_STAT(handle, fname);
1018         clock_gettime_mono(&ts2);
1019         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1020
1021         if (timediff > audit_timeout) {
1022                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1023         }
1024
1025         return result;
1026 }
1027
1028 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1029                                 SMB_STRUCT_STAT *sbuf)
1030 {
1031         int result;
1032         struct timespec ts1,ts2;
1033         double timediff;
1034
1035         clock_gettime_mono(&ts1);
1036         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1037         clock_gettime_mono(&ts2);
1038         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1039
1040         if (timediff > audit_timeout) {
1041                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1042         }
1043
1044         return result;
1045 }
1046
1047 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1048                                 struct smb_filename *path)
1049 {
1050         int result;
1051         struct timespec ts1,ts2;
1052         double timediff;
1053
1054         clock_gettime_mono(&ts1);
1055         result = SMB_VFS_NEXT_LSTAT(handle, path);
1056         clock_gettime_mono(&ts2);
1057         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1058
1059         if (timediff > audit_timeout) {
1060                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1061         }
1062
1063         return result;
1064 }
1065
1066 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1067                                               files_struct *fsp,
1068                                               const SMB_STRUCT_STAT *sbuf)
1069 {
1070         uint64_t result;
1071         struct timespec ts1,ts2;
1072         double timediff;
1073
1074         clock_gettime_mono(&ts1);
1075         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1076         clock_gettime_mono(&ts2);
1077         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1078
1079         if (timediff > audit_timeout) {
1080                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1081         }
1082
1083         return result;
1084 }
1085
1086 static int smb_time_audit_unlinkat(vfs_handle_struct *handle,
1087                         struct files_struct *dirfsp,
1088                         const struct smb_filename *path,
1089                         int flags)
1090 {
1091         int result;
1092         struct timespec ts1,ts2;
1093         double timediff;
1094
1095         clock_gettime_mono(&ts1);
1096         result = SMB_VFS_NEXT_UNLINKAT(handle,
1097                                 dirfsp,
1098                                 path,
1099                                 flags);
1100         clock_gettime_mono(&ts2);
1101         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1102
1103         if (timediff > audit_timeout) {
1104                 smb_time_audit_log_smb_fname("unlinkat", timediff, path);
1105         }
1106
1107         return result;
1108 }
1109
1110 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1111                         const struct smb_filename *smb_fname,
1112                         mode_t mode)
1113 {
1114         int result;
1115         struct timespec ts1,ts2;
1116         double timediff;
1117
1118         clock_gettime_mono(&ts1);
1119         result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1120         clock_gettime_mono(&ts2);
1121         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1122
1123         if (timediff > audit_timeout) {
1124                 smb_time_audit_log_fname("chmod",
1125                         timediff,
1126                         smb_fname->base_name);
1127         }
1128
1129         return result;
1130 }
1131
1132 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1133                                  mode_t mode)
1134 {
1135         int result;
1136         struct timespec ts1,ts2;
1137         double timediff;
1138
1139         clock_gettime_mono(&ts1);
1140         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1141         clock_gettime_mono(&ts2);
1142         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1143
1144         if (timediff > audit_timeout) {
1145                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1146         }
1147
1148         return result;
1149 }
1150
1151 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1152                                  uid_t uid, gid_t gid)
1153 {
1154         int result;
1155         struct timespec ts1,ts2;
1156         double timediff;
1157
1158         clock_gettime_mono(&ts1);
1159         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1160         clock_gettime_mono(&ts2);
1161         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1162
1163         if (timediff > audit_timeout) {
1164                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1165         }
1166
1167         return result;
1168 }
1169
1170 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1171                         const struct smb_filename *smb_fname,
1172                         uid_t uid,
1173                         gid_t gid)
1174 {
1175         int result;
1176         struct timespec ts1,ts2;
1177         double timediff;
1178
1179         clock_gettime_mono(&ts1);
1180         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1181         clock_gettime_mono(&ts2);
1182         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1183
1184         if (timediff > audit_timeout) {
1185                 smb_time_audit_log_fname("lchown",
1186                         timediff,
1187                         smb_fname->base_name);
1188         }
1189
1190         return result;
1191 }
1192
1193 static int smb_time_audit_chdir(vfs_handle_struct *handle,
1194                         const struct smb_filename *smb_fname)
1195 {
1196         int result;
1197         struct timespec ts1,ts2;
1198         double timediff;
1199
1200         clock_gettime_mono(&ts1);
1201         result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1202         clock_gettime_mono(&ts2);
1203         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1204
1205         if (timediff > audit_timeout) {
1206                 smb_time_audit_log_fname("chdir",
1207                         timediff,
1208                         smb_fname->base_name);
1209         }
1210
1211         return result;
1212 }
1213
1214 static struct smb_filename *smb_time_audit_getwd(vfs_handle_struct *handle,
1215                                         TALLOC_CTX *mem_ctx)
1216 {
1217         struct smb_filename *result;
1218         struct timespec ts1,ts2;
1219         double timediff;
1220
1221         clock_gettime_mono(&ts1);
1222         result = SMB_VFS_NEXT_GETWD(handle, mem_ctx);
1223         clock_gettime_mono(&ts2);
1224         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1225
1226         if (timediff > audit_timeout) {
1227                 smb_time_audit_log("getwd", timediff);
1228         }
1229
1230         return result;
1231 }
1232
1233 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1234                                  const struct smb_filename *path,
1235                                  struct smb_file_time *ft)
1236 {
1237         int result;
1238         struct timespec ts1,ts2;
1239         double timediff;
1240
1241         clock_gettime_mono(&ts1);
1242         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1243         clock_gettime_mono(&ts2);
1244         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1245
1246         if (timediff > audit_timeout) {
1247                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1248         }
1249
1250         return result;
1251 }
1252
1253 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1254                                     files_struct *fsp,
1255                                     off_t len)
1256 {
1257         int result;
1258         struct timespec ts1,ts2;
1259         double timediff;
1260
1261         clock_gettime_mono(&ts1);
1262         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1263         clock_gettime_mono(&ts2);
1264         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1265
1266         if (timediff > audit_timeout) {
1267                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1268         }
1269
1270         return result;
1271 }
1272
1273 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1274                                     files_struct *fsp,
1275                                     uint32_t mode,
1276                                     off_t offset,
1277                                     off_t len)
1278 {
1279         int result;
1280         int saved_errno = 0;
1281         struct timespec ts1,ts2;
1282         double timediff;
1283
1284         clock_gettime_mono(&ts1);
1285         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1286         if (result == -1) {
1287                 saved_errno = errno;
1288         }
1289         clock_gettime_mono(&ts2);
1290         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1291
1292         if (timediff > audit_timeout) {
1293                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1294         }
1295         if (result == -1) {
1296                 errno = saved_errno;
1297         }
1298         return result;
1299 }
1300
1301 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1302                                 int op, off_t offset, off_t count,
1303                                 int type)
1304 {
1305         bool result;
1306         struct timespec ts1,ts2;
1307         double timediff;
1308
1309         clock_gettime_mono(&ts1);
1310         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1311         clock_gettime_mono(&ts2);
1312         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1313
1314         if (timediff > audit_timeout) {
1315                 smb_time_audit_log_fsp("lock", timediff, fsp);
1316         }
1317
1318         return result;
1319 }
1320
1321 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1322                                        struct files_struct *fsp,
1323                                        uint32_t share_access,
1324                                        uint32_t access_mask)
1325 {
1326         int result;
1327         struct timespec ts1,ts2;
1328         double timediff;
1329
1330         clock_gettime_mono(&ts1);
1331         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_access,
1332                                            access_mask);
1333         clock_gettime_mono(&ts2);
1334         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1335
1336         if (timediff > audit_timeout) {
1337                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1338         }
1339
1340         return result;
1341 }
1342
1343 static int smb_time_audit_fcntl(struct vfs_handle_struct *handle,
1344                                 struct files_struct *fsp,
1345                                 int cmd, va_list cmd_arg)
1346 {
1347         void *arg;
1348         va_list dup_cmd_arg;
1349         int result;
1350         struct timespec ts1,ts2;
1351         double timediff;
1352
1353         va_copy(dup_cmd_arg, cmd_arg);
1354         arg = va_arg(dup_cmd_arg, void *);
1355         clock_gettime_mono(&ts1);
1356         result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1357         clock_gettime_mono(&ts2);
1358         va_end(dup_cmd_arg);
1359
1360         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1361         if (timediff > audit_timeout) {
1362                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1363         }
1364
1365         return result;
1366 }
1367
1368 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1369                                          files_struct *fsp,
1370                                          int leasetype)
1371 {
1372         int result;
1373         struct timespec ts1,ts2;
1374         double timediff;
1375
1376         clock_gettime_mono(&ts1);
1377         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1378         clock_gettime_mono(&ts2);
1379         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1380
1381         if (timediff > audit_timeout) {
1382                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1383         }
1384
1385         return result;
1386 }
1387
1388 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1389                                    files_struct *fsp,
1390                                    off_t *poffset, off_t *pcount,
1391                                    int *ptype, pid_t *ppid)
1392 {
1393         bool result;
1394         struct timespec ts1,ts2;
1395         double timediff;
1396
1397         clock_gettime_mono(&ts1);
1398         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1399                                       ppid);
1400         clock_gettime_mono(&ts2);
1401         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1402
1403         if (timediff > audit_timeout) {
1404                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1405         }
1406
1407         return result;
1408 }
1409
1410 static int smb_time_audit_symlinkat(vfs_handle_struct *handle,
1411                                 const struct smb_filename *link_contents,
1412                                 struct files_struct *dirfsp,
1413                                 const struct smb_filename *new_smb_fname)
1414 {
1415         int result;
1416         struct timespec ts1,ts2;
1417         double timediff;
1418
1419         clock_gettime_mono(&ts1);
1420         result = SMB_VFS_NEXT_SYMLINKAT(handle,
1421                                 link_contents,
1422                                 dirfsp,
1423                                 new_smb_fname);
1424         clock_gettime_mono(&ts2);
1425         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1426
1427         if (timediff > audit_timeout) {
1428                 smb_time_audit_log_fname("symlinkat", timediff,
1429                         new_smb_fname->base_name);
1430         }
1431
1432         return result;
1433 }
1434
1435 static int smb_time_audit_readlinkat(vfs_handle_struct *handle,
1436                                 const struct files_struct *dirfsp,
1437                                 const struct smb_filename *smb_fname,
1438                                 char *buf,
1439                                 size_t bufsiz)
1440 {
1441         int result;
1442         struct timespec ts1,ts2;
1443         double timediff;
1444
1445         clock_gettime_mono(&ts1);
1446         result = SMB_VFS_NEXT_READLINKAT(handle,
1447                                 dirfsp,
1448                                 smb_fname,
1449                                 buf,
1450                                 bufsiz);
1451         clock_gettime_mono(&ts2);
1452         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1453
1454         if (timediff > audit_timeout) {
1455                 smb_time_audit_log_fname("readlinkat", timediff,
1456                                 smb_fname->base_name);
1457         }
1458
1459         return result;
1460 }
1461
1462 static int smb_time_audit_linkat(vfs_handle_struct *handle,
1463                                 files_struct *srcfsp,
1464                                 const struct smb_filename *old_smb_fname,
1465                                 files_struct *dstfsp,
1466                                 const struct smb_filename *new_smb_fname,
1467                                 int flags)
1468 {
1469         int result;
1470         struct timespec ts1,ts2;
1471         double timediff;
1472
1473         clock_gettime_mono(&ts1);
1474         result = SMB_VFS_NEXT_LINKAT(handle,
1475                         srcfsp,
1476                         old_smb_fname,
1477                         dstfsp,
1478                         new_smb_fname,
1479                         flags);
1480         clock_gettime_mono(&ts2);
1481         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1482
1483         if (timediff > audit_timeout) {
1484                 smb_time_audit_log_fname("linkat", timediff,
1485                         new_smb_fname->base_name);
1486         }
1487
1488         return result;
1489 }
1490
1491 static int smb_time_audit_mknodat(vfs_handle_struct *handle,
1492                                 files_struct *dirfsp,
1493                                 const struct smb_filename *smb_fname,
1494                                 mode_t mode,
1495                                 SMB_DEV_T dev)
1496 {
1497         int result;
1498         struct timespec ts1,ts2;
1499         double timediff;
1500
1501         clock_gettime_mono(&ts1);
1502         result = SMB_VFS_NEXT_MKNODAT(handle,
1503                                 dirfsp,
1504                                 smb_fname,
1505                                 mode,
1506                                 dev);
1507         clock_gettime_mono(&ts2);
1508         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1509
1510         if (timediff > audit_timeout) {
1511                 smb_time_audit_log_smb_fname("mknodat", timediff, smb_fname);
1512         }
1513
1514         return result;
1515 }
1516
1517 static struct smb_filename *smb_time_audit_realpath(vfs_handle_struct *handle,
1518                                 TALLOC_CTX *ctx,
1519                                 const struct smb_filename *smb_fname)
1520 {
1521         struct smb_filename *result_fname;
1522         struct timespec ts1,ts2;
1523         double timediff;
1524
1525         clock_gettime_mono(&ts1);
1526         result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1527         clock_gettime_mono(&ts2);
1528         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1529
1530         if (timediff > audit_timeout) {
1531                 smb_time_audit_log_fname("realpath", timediff,
1532                                 smb_fname->base_name);
1533         }
1534
1535         return result_fname;
1536 }
1537
1538 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1539                                 const struct smb_filename *smb_fname,
1540                                 unsigned int flags)
1541 {
1542         int result;
1543         struct timespec ts1,ts2;
1544         double timediff;
1545
1546         clock_gettime_mono(&ts1);
1547         result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1548         clock_gettime_mono(&ts2);
1549         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1550
1551         if (timediff > audit_timeout) {
1552                 smb_time_audit_log_smb_fname("chflags", timediff, smb_fname);
1553         }
1554
1555         return result;
1556 }
1557
1558 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1559                                                     const SMB_STRUCT_STAT *sbuf)
1560 {
1561         struct file_id id_zero;
1562         struct file_id result;
1563         struct timespec ts1,ts2;
1564         double timediff;
1565
1566         ZERO_STRUCT(id_zero);
1567
1568         clock_gettime_mono(&ts1);
1569         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1570         clock_gettime_mono(&ts2);
1571         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1572
1573         if (timediff > audit_timeout) {
1574                 smb_time_audit_log("file_id_create", timediff);
1575         }
1576
1577         return result;
1578 }
1579
1580 static uint64_t smb_time_audit_fs_file_id(struct vfs_handle_struct *handle,
1581                                           const SMB_STRUCT_STAT *sbuf)
1582 {
1583         uint64_t result;
1584         struct timespec ts1,ts2;
1585         double timediff;
1586
1587         clock_gettime_mono(&ts1);
1588         result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
1589         clock_gettime_mono(&ts2);
1590         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1591
1592         if (timediff > audit_timeout) {
1593                 smb_time_audit_log("fs_file_id", timediff);
1594         }
1595
1596         return result;
1597 }
1598
1599 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1600                                           struct files_struct *fsp,
1601                                           const struct smb_filename *smb_fname,
1602                                           TALLOC_CTX *mem_ctx,
1603                                           unsigned int *pnum_streams,
1604                                           struct stream_struct **pstreams)
1605 {
1606         NTSTATUS result;
1607         struct timespec ts1,ts2;
1608         double timediff;
1609
1610         clock_gettime_mono(&ts1);
1611         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1612                                          pnum_streams, pstreams);
1613         clock_gettime_mono(&ts2);
1614         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1615
1616         if (timediff > audit_timeout) {
1617                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1618         }
1619
1620         return result;
1621 }
1622
1623 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1624                                             const struct smb_filename *path,
1625                                             const char *name,
1626                                             TALLOC_CTX *mem_ctx,
1627                                             char **found_name)
1628 {
1629         int result;
1630         struct timespec ts1,ts2;
1631         double timediff;
1632
1633         clock_gettime_mono(&ts1);
1634         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1635                                                 found_name);
1636         clock_gettime_mono(&ts2);
1637         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1638
1639         if (timediff > audit_timeout) {
1640                 smb_time_audit_log_fname("get_real_filename",
1641                                          timediff, path->base_name);
1642         }
1643
1644         return result;
1645 }
1646
1647 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1648                                         const struct smb_filename *smb_fname)
1649 {
1650         const char *result;
1651         struct timespec ts1,ts2;
1652         double timediff;
1653
1654         clock_gettime_mono(&ts1);
1655         result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1656         clock_gettime_mono(&ts2);
1657         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1658
1659         if (timediff > audit_timeout) {
1660                 smb_time_audit_log_fname("connectpath", timediff,
1661                         smb_fname->base_name);
1662         }
1663
1664         return result;
1665 }
1666
1667 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1668                                                 struct byte_range_lock *br_lck,
1669                                                 struct lock_struct *plock)
1670 {
1671         NTSTATUS result;
1672         struct timespec ts1,ts2;
1673         double timediff;
1674
1675         clock_gettime_mono(&ts1);
1676         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
1677         clock_gettime_mono(&ts2);
1678         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1679
1680         if (timediff > audit_timeout) {
1681                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1682                                        brl_fsp(br_lck));
1683         }
1684
1685         return result;
1686 }
1687
1688 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1689                                               struct byte_range_lock *br_lck,
1690                                               const struct lock_struct *plock)
1691 {
1692         bool result;
1693         struct timespec ts1,ts2;
1694         double timediff;
1695
1696         clock_gettime_mono(&ts1);
1697         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
1698         clock_gettime_mono(&ts2);
1699         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1700
1701         if (timediff > audit_timeout) {
1702                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1703                                        brl_fsp(br_lck));
1704         }
1705
1706         return result;
1707 }
1708
1709 static bool smb_time_audit_strict_lock_check(struct vfs_handle_struct *handle,
1710                                              struct files_struct *fsp,
1711                                              struct lock_struct *plock)
1712 {
1713         bool result;
1714         struct timespec ts1,ts2;
1715         double timediff;
1716
1717         clock_gettime_mono(&ts1);
1718         result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1719         clock_gettime_mono(&ts2);
1720         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1721
1722         if (timediff > audit_timeout) {
1723                 smb_time_audit_log_fsp("strict_lock_check", timediff, fsp);
1724         }
1725
1726         return result;
1727 }
1728
1729 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1730                                               const char *name,
1731                                               enum vfs_translate_direction direction,
1732                                               TALLOC_CTX *mem_ctx,
1733                                               char **mapped_name)
1734 {
1735         NTSTATUS result;
1736         struct timespec ts1,ts2;
1737         double timediff;
1738
1739         clock_gettime_mono(&ts1);
1740         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1741                                              mapped_name);
1742         clock_gettime_mono(&ts2);
1743         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1744
1745         if (timediff > audit_timeout) {
1746                 smb_time_audit_log_fname("translate_name", timediff, name);
1747         }
1748
1749         return result;
1750 }
1751
1752 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1753                                 struct files_struct *fsp,
1754                                 TALLOC_CTX *ctx,
1755                                 uint32_t function,
1756                                 uint16_t req_flags,
1757                                 const uint8_t *_in_data,
1758                                 uint32_t in_len,
1759                                 uint8_t **_out_data,
1760                                 uint32_t max_out_len,
1761                                 uint32_t *out_len)
1762 {
1763         NTSTATUS result;
1764         struct timespec ts1,ts2;
1765         double timediff;
1766
1767         clock_gettime_mono(&ts1);
1768         result = SMB_VFS_NEXT_FSCTL(handle,
1769                                 fsp,
1770                                 ctx,
1771                                 function,
1772                                 req_flags,
1773                                 _in_data,
1774                                 in_len,
1775                                 _out_data,
1776                                 max_out_len,
1777                                 out_len);
1778         clock_gettime_mono(&ts2);
1779         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1780
1781         if (timediff > audit_timeout) {
1782                 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1783         }
1784
1785         return result;
1786 }
1787
1788 static NTSTATUS smb_time_get_dos_attributes(struct vfs_handle_struct *handle,
1789                                         struct smb_filename *smb_fname,
1790                                         uint32_t *dosmode)
1791 {
1792         NTSTATUS result;
1793         struct timespec ts1,ts2;
1794         double timediff;
1795
1796         clock_gettime_mono(&ts1);
1797         result = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
1798                                 smb_fname,
1799                                 dosmode);
1800         clock_gettime_mono(&ts2);
1801         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1802
1803         if (timediff > audit_timeout) {
1804                 smb_time_audit_log_fname("get_dos_attributes",
1805                                 timediff,
1806                                 smb_fname->base_name);
1807         }
1808
1809         return result;
1810 }
1811
1812 struct smb_time_audit_get_dos_attributes_state {
1813         struct vfs_aio_state aio_state;
1814         files_struct *dir_fsp;
1815         const struct smb_filename *smb_fname;
1816         uint32_t dosmode;
1817 };
1818
1819 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq);
1820
1821 static struct tevent_req *smb_time_audit_get_dos_attributes_send(
1822                         TALLOC_CTX *mem_ctx,
1823                         struct tevent_context *ev,
1824                         struct vfs_handle_struct *handle,
1825                         files_struct *dir_fsp,
1826                         struct smb_filename *smb_fname)
1827 {
1828         struct tevent_req *req = NULL;
1829         struct smb_time_audit_get_dos_attributes_state *state = NULL;
1830         struct tevent_req *subreq = NULL;
1831
1832         req = tevent_req_create(mem_ctx, &state,
1833                                 struct smb_time_audit_get_dos_attributes_state);
1834         if (req == NULL) {
1835                 return NULL;
1836         }
1837         *state = (struct smb_time_audit_get_dos_attributes_state) {
1838                 .dir_fsp = dir_fsp,
1839                 .smb_fname = smb_fname,
1840         };
1841
1842         subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
1843                                                       ev,
1844                                                       handle,
1845                                                       dir_fsp,
1846                                                       smb_fname);
1847         if (tevent_req_nomem(subreq, req)) {
1848                 return tevent_req_post(req, ev);
1849         }
1850         tevent_req_set_callback(subreq,
1851                                 smb_time_audit_get_dos_attributes_done,
1852                                 req);
1853
1854         return req;
1855 }
1856
1857 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq)
1858 {
1859         struct tevent_req *req =
1860                 tevent_req_callback_data(subreq,
1861                 struct tevent_req);
1862         struct smb_time_audit_get_dos_attributes_state *state =
1863                 tevent_req_data(req,
1864                 struct smb_time_audit_get_dos_attributes_state);
1865         NTSTATUS status;
1866
1867         status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
1868                                                       &state->aio_state,
1869                                                       &state->dosmode);
1870         TALLOC_FREE(subreq);
1871         if (tevent_req_nterror(req, status)) {
1872                 return;
1873         }
1874
1875         tevent_req_done(req);
1876         return;
1877 }
1878
1879 static NTSTATUS smb_time_audit_get_dos_attributes_recv(struct tevent_req *req,
1880                                                 struct vfs_aio_state *aio_state,
1881                                                 uint32_t *dosmode)
1882 {
1883         struct smb_time_audit_get_dos_attributes_state *state =
1884                 tevent_req_data(req,
1885                 struct smb_time_audit_get_dos_attributes_state);
1886         NTSTATUS status;
1887         double timediff;
1888
1889         timediff = state->aio_state.duration * 1.0e-9;
1890
1891         if (timediff > audit_timeout) {
1892                 smb_time_audit_log_at("async get_dos_attributes",
1893                                       timediff,
1894                                       state->dir_fsp,
1895                                       state->smb_fname);
1896         }
1897
1898         if (tevent_req_is_nterror(req, &status)) {
1899                 tevent_req_received(req);
1900                 return status;
1901         }
1902
1903         *aio_state = state->aio_state;
1904         *dosmode = state->dosmode;
1905         tevent_req_received(req);
1906         return NT_STATUS_OK;
1907 }
1908
1909 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1910                                         struct files_struct *fsp,
1911                                         uint32_t *dosmode)
1912 {
1913         NTSTATUS result;
1914         struct timespec ts1,ts2;
1915         double timediff;
1916
1917         clock_gettime_mono(&ts1);
1918         result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1919                                 fsp,
1920                                 dosmode);
1921         clock_gettime_mono(&ts2);
1922         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1923
1924         if (timediff > audit_timeout) {
1925                 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1926         }
1927
1928         return result;
1929 }
1930
1931 static NTSTATUS smb_time_set_dos_attributes(struct vfs_handle_struct *handle,
1932                                         const struct smb_filename *smb_fname,
1933                                         uint32_t dosmode)
1934 {
1935         NTSTATUS result;
1936         struct timespec ts1,ts2;
1937         double timediff;
1938
1939         clock_gettime_mono(&ts1);
1940         result = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
1941                                 smb_fname,
1942                                 dosmode);
1943         clock_gettime_mono(&ts2);
1944         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1945
1946         if (timediff > audit_timeout) {
1947                 smb_time_audit_log_fname("set_dos_attributes",
1948                                 timediff,
1949                                 smb_fname->base_name);
1950         }
1951
1952         return result;
1953 }
1954
1955 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
1956                                         struct files_struct *fsp,
1957                                         uint32_t dosmode)
1958 {
1959         NTSTATUS result;
1960         struct timespec ts1,ts2;
1961         double timediff;
1962
1963         clock_gettime_mono(&ts1);
1964         result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
1965                                 fsp,
1966                                 dosmode);
1967         clock_gettime_mono(&ts2);
1968         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1969
1970         if (timediff > audit_timeout) {
1971                 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
1972         }
1973
1974         return result;
1975 }
1976
1977 struct time_audit_offload_read_state {
1978         struct vfs_handle_struct *handle;
1979         struct timespec ts_send;
1980         DATA_BLOB token_blob;
1981 };
1982
1983 static void smb_time_audit_offload_read_done(struct tevent_req *subreq);
1984
1985 static struct tevent_req *smb_time_audit_offload_read_send(
1986         TALLOC_CTX *mem_ctx,
1987         struct tevent_context *ev,
1988         struct vfs_handle_struct *handle,
1989         struct files_struct *fsp,
1990         uint32_t fsctl,
1991         uint32_t ttl,
1992         off_t offset,
1993         size_t to_copy)
1994 {
1995         struct tevent_req *req = NULL;
1996         struct tevent_req *subreq = NULL;
1997         struct time_audit_offload_read_state *state = NULL;
1998
1999         req = tevent_req_create(mem_ctx, &state,
2000                                 struct time_audit_offload_read_state);
2001         if (req == NULL) {
2002                 return NULL;
2003         }
2004         state->handle = handle;
2005         clock_gettime_mono(&state->ts_send);
2006
2007         subreq = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev,
2008                                                 handle, fsp,
2009                                                 fsctl, ttl,
2010                                                 offset, to_copy);
2011         if (tevent_req_nomem(subreq, req)) {
2012                 return tevent_req_post(req, ev);
2013         }
2014
2015         tevent_req_set_callback(subreq, smb_time_audit_offload_read_done, req);
2016         return req;
2017 }
2018
2019 static void smb_time_audit_offload_read_done(struct tevent_req *subreq)
2020 {
2021         struct tevent_req *req = tevent_req_callback_data(
2022                 subreq, struct tevent_req);
2023         struct time_audit_offload_read_state *state = tevent_req_data(
2024                 req, struct time_audit_offload_read_state);
2025         NTSTATUS status;
2026
2027         status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(subreq,
2028                                                 state->handle,
2029                                                 state,
2030                                                 &state->token_blob);
2031         TALLOC_FREE(subreq);
2032         if (tevent_req_nterror(req, status)) {
2033                 return;
2034         }
2035         tevent_req_done(req);
2036 }
2037
2038 static NTSTATUS smb_time_audit_offload_read_recv(
2039         struct tevent_req *req,
2040         struct vfs_handle_struct *handle,
2041         TALLOC_CTX *mem_ctx,
2042         DATA_BLOB *token_blob)
2043 {
2044         struct time_audit_offload_read_state *state = tevent_req_data(
2045                 req, struct time_audit_offload_read_state);
2046         struct timespec ts_recv;
2047         double timediff;
2048         NTSTATUS status;
2049
2050         clock_gettime_mono(&ts_recv);
2051         timediff = nsec_time_diff(&ts_recv, &state->ts_send) * 1.0e-9;
2052         if (timediff > audit_timeout) {
2053                 smb_time_audit_log("offload_read", timediff);
2054         }
2055
2056         if (tevent_req_is_nterror(req, &status)) {
2057                 tevent_req_received(req);
2058                 return status;
2059         }
2060
2061         token_blob->length = state->token_blob.length;
2062         token_blob->data = talloc_move(mem_ctx, &state->token_blob.data);
2063
2064         tevent_req_received(req);
2065         return NT_STATUS_OK;
2066 }
2067
2068 struct time_audit_offload_write_state {
2069         struct timespec ts_send;
2070         struct vfs_handle_struct *handle;
2071         off_t copied;
2072 };
2073 static void smb_time_audit_offload_write_done(struct tevent_req *subreq);
2074
2075 static struct tevent_req *smb_time_audit_offload_write_send(struct vfs_handle_struct *handle,
2076                                                          TALLOC_CTX *mem_ctx,
2077                                                          struct tevent_context *ev,
2078                                                          uint32_t fsctl,
2079                                                          DATA_BLOB *token,
2080                                                          off_t transfer_offset,
2081                                                          struct files_struct *dest_fsp,
2082                                                          off_t dest_off,
2083                                                          off_t num)
2084 {
2085         struct tevent_req *req;
2086         struct tevent_req *subreq;
2087         struct time_audit_offload_write_state *state;
2088
2089         req = tevent_req_create(mem_ctx, &state,
2090                                 struct time_audit_offload_write_state);
2091         if (req == NULL) {
2092                 return NULL;
2093         }
2094
2095         state->handle = handle;
2096         clock_gettime_mono(&state->ts_send);
2097         subreq = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, state, ev,
2098                                               fsctl, token, transfer_offset,
2099                                               dest_fsp, dest_off, num);
2100         if (tevent_req_nomem(subreq, req)) {
2101                 return tevent_req_post(req, ev);
2102         }
2103
2104         tevent_req_set_callback(subreq, smb_time_audit_offload_write_done, req);
2105         return req;
2106 }
2107
2108 static void smb_time_audit_offload_write_done(struct tevent_req *subreq)
2109 {
2110         struct tevent_req *req = tevent_req_callback_data(
2111                 subreq, struct tevent_req);
2112         struct time_audit_offload_write_state *state = tevent_req_data(
2113                 req, struct time_audit_offload_write_state);
2114         NTSTATUS status;
2115
2116         status = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(state->handle,
2117                                               subreq,
2118                                               &state->copied);
2119         TALLOC_FREE(subreq);
2120         if (tevent_req_nterror(req, status)) {
2121                 return;
2122         }
2123         tevent_req_done(req);
2124 }
2125
2126 static NTSTATUS smb_time_audit_offload_write_recv(struct vfs_handle_struct *handle,
2127                                                struct tevent_req *req,
2128                                                off_t *copied)
2129 {
2130         struct time_audit_offload_write_state *state = tevent_req_data(
2131                 req, struct time_audit_offload_write_state);
2132         struct timespec ts_recv;
2133         double timediff;
2134         NTSTATUS status;
2135
2136         clock_gettime_mono(&ts_recv);
2137         timediff = nsec_time_diff(&ts_recv, &state->ts_send)*1.0e-9;
2138         if (timediff > audit_timeout) {
2139                 smb_time_audit_log("offload_write", timediff);
2140         }
2141
2142         *copied = state->copied;
2143         if (tevent_req_is_nterror(req, &status)) {
2144                 tevent_req_received(req);
2145                 return status;
2146         }
2147
2148         tevent_req_received(req);
2149         return NT_STATUS_OK;
2150 }
2151
2152 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
2153                                                TALLOC_CTX *mem_ctx,
2154                                                struct files_struct *fsp,
2155                                                struct smb_filename *smb_fname,
2156                                                uint16_t *_compression_fmt)
2157 {
2158         NTSTATUS result;
2159         struct timespec ts1,ts2;
2160         double timediff;
2161
2162         clock_gettime_mono(&ts1);
2163         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2164                                               _compression_fmt);
2165         clock_gettime_mono(&ts2);
2166         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2167
2168         if (timediff > audit_timeout) {
2169                 if (fsp !=  NULL) {
2170                         smb_time_audit_log_fsp("get_compression",
2171                                                timediff, fsp);
2172                 } else {
2173                         smb_time_audit_log_smb_fname("get_compression",
2174                                                      timediff, smb_fname);
2175                 }
2176         }
2177
2178         return result;
2179 }
2180
2181 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
2182                                                TALLOC_CTX *mem_ctx,
2183                                                struct files_struct *fsp,
2184                                                uint16_t compression_fmt)
2185 {
2186         NTSTATUS result;
2187         struct timespec ts1,ts2;
2188         double timediff;
2189
2190         clock_gettime_mono(&ts1);
2191         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2192                                               compression_fmt);
2193         clock_gettime_mono(&ts2);
2194         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2195
2196         if (timediff > audit_timeout) {
2197                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2198         }
2199
2200         return result;
2201 }
2202
2203 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
2204                                             const struct smb_filename *fname,
2205                                             TALLOC_CTX *mem_ctx,
2206                                             struct readdir_attr_data **pattr_data)
2207 {
2208         NTSTATUS status;
2209         struct timespec ts1,ts2;
2210         double timediff;
2211
2212         clock_gettime_mono(&ts1);
2213         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2214         clock_gettime_mono(&ts2);
2215         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2216
2217         if (timediff > audit_timeout) {
2218                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
2219         }
2220
2221         return status;
2222 }
2223
2224 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2225                                            files_struct *fsp,
2226                                            uint32_t security_info,
2227                                            TALLOC_CTX *mem_ctx,
2228                                            struct security_descriptor **ppdesc)
2229 {
2230         NTSTATUS result;
2231         struct timespec ts1,ts2;
2232         double timediff;
2233
2234         clock_gettime_mono(&ts1);
2235         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2236                                           mem_ctx, ppdesc);
2237         clock_gettime_mono(&ts2);
2238         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2239
2240         if (timediff > audit_timeout) {
2241                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2242         }
2243
2244         return result;
2245 }
2246
2247 static NTSTATUS smb_time_audit_get_nt_acl_at(vfs_handle_struct *handle,
2248                                 struct files_struct *dirfsp,
2249                                 const struct smb_filename *smb_fname,
2250                                 uint32_t security_info,
2251                                 TALLOC_CTX *mem_ctx,
2252                                 struct security_descriptor **ppdesc)
2253 {
2254         NTSTATUS result;
2255         struct timespec ts1,ts2;
2256         double timediff;
2257
2258         clock_gettime_mono(&ts1);
2259         result = SMB_VFS_NEXT_GET_NT_ACL_AT(handle,
2260                                         dirfsp,
2261                                         smb_fname,
2262                                         security_info,
2263                                         mem_ctx,
2264                                         ppdesc);
2265         clock_gettime_mono(&ts2);
2266         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2267
2268         if (timediff > audit_timeout) {
2269                 smb_time_audit_log_fname("get_nt_acl",
2270                         timediff,
2271                         smb_fname->base_name);
2272         }
2273
2274         return result;
2275 }
2276
2277 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2278                                            files_struct *fsp,
2279                                            uint32_t security_info_sent,
2280                                            const struct security_descriptor *psd)
2281 {
2282         NTSTATUS result;
2283         struct timespec ts1,ts2;
2284         double timediff;
2285
2286         clock_gettime_mono(&ts1);
2287         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2288                                           psd);
2289         clock_gettime_mono(&ts2);
2290         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2291
2292         if (timediff > audit_timeout) {
2293                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2294         }
2295
2296         return result;
2297 }
2298
2299 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2300                                 struct smb_filename *smb_fname,
2301                                 struct security_acl *sacl,
2302                                 uint32_t access_requested,
2303                                 uint32_t access_denied)
2304 {
2305         NTSTATUS result;
2306         struct timespec ts1,ts2;
2307         double timediff;
2308
2309         clock_gettime_mono(&ts1);
2310         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2311                                         smb_fname,
2312                                         sacl,
2313                                         access_requested,
2314                                         access_denied);
2315         clock_gettime_mono(&ts2);
2316         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2317
2318         if (timediff > audit_timeout) {
2319                 smb_time_audit_log_fname("audit_file",
2320                         timediff,
2321                         smb_fname->base_name);
2322         }
2323
2324         return result;
2325 }
2326
2327 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2328                                         const struct smb_filename *smb_fname,
2329                                         SMB_ACL_TYPE_T type,
2330                                         TALLOC_CTX *mem_ctx)
2331 {
2332         SMB_ACL_T result;
2333         struct timespec ts1,ts2;
2334         double timediff;
2335
2336         clock_gettime_mono(&ts1);
2337         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2338                                 type, mem_ctx);
2339         clock_gettime_mono(&ts2);
2340         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2341
2342         if (timediff > audit_timeout) {
2343                 smb_time_audit_log_fname("sys_acl_get_file", timediff,
2344                         smb_fname->base_name);
2345         }
2346
2347         return result;
2348 }
2349
2350 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2351                                                files_struct *fsp,
2352                                                TALLOC_CTX *mem_ctx)
2353 {
2354         SMB_ACL_T result;
2355         struct timespec ts1,ts2;
2356         double timediff;
2357
2358         clock_gettime_mono(&ts1);
2359         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2360         clock_gettime_mono(&ts2);
2361         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2362
2363         if (timediff > audit_timeout) {
2364                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2365         }
2366
2367         return result;
2368 }
2369
2370
2371 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2372                                 const struct smb_filename *smb_fname,
2373                                 TALLOC_CTX *mem_ctx,
2374                                 char **blob_description,
2375                                 DATA_BLOB *blob)
2376 {
2377         int result;
2378         struct timespec ts1,ts2;
2379         double timediff;
2380
2381         clock_gettime_mono(&ts1);
2382         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2383                                 mem_ctx, blob_description, blob);
2384         clock_gettime_mono(&ts2);
2385         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2386
2387         if (timediff > audit_timeout) {
2388                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2389         }
2390
2391         return result;
2392 }
2393
2394 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2395                                               files_struct *fsp,
2396                                               TALLOC_CTX *mem_ctx,
2397                                               char **blob_description,
2398                                               DATA_BLOB *blob)
2399 {
2400         int result;
2401         struct timespec ts1,ts2;
2402         double timediff;
2403
2404         clock_gettime_mono(&ts1);
2405         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2406         clock_gettime_mono(&ts2);
2407         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2408
2409         if (timediff > audit_timeout) {
2410                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2411         }
2412
2413         return result;
2414 }
2415
2416 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2417                                            const struct smb_filename *smb_fname,
2418                                            SMB_ACL_TYPE_T acltype,
2419                                            SMB_ACL_T theacl)
2420 {
2421         int result;
2422         struct timespec ts1,ts2;
2423         double timediff;
2424
2425         clock_gettime_mono(&ts1);
2426         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2427                                                theacl);
2428         clock_gettime_mono(&ts2);
2429         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2430
2431         if (timediff > audit_timeout) {
2432                 smb_time_audit_log_fname("sys_acl_set_file", timediff,
2433                         smb_fname->base_name);
2434         }
2435
2436         return result;
2437 }
2438
2439 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2440                                          files_struct *fsp,
2441                                          SMB_ACL_T theacl)
2442 {
2443         int result;
2444         struct timespec ts1,ts2;
2445         double timediff;
2446
2447         clock_gettime_mono(&ts1);
2448         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2449         clock_gettime_mono(&ts2);
2450         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2451
2452         if (timediff > audit_timeout) {
2453                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2454         }
2455
2456         return result;
2457 }
2458
2459 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2460                                 const struct smb_filename *smb_fname)
2461 {
2462         int result;
2463         struct timespec ts1,ts2;
2464         double timediff;
2465
2466         clock_gettime_mono(&ts1);
2467         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2468         clock_gettime_mono(&ts2);
2469         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2470
2471         if (timediff > audit_timeout) {
2472                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff,
2473                         smb_fname->base_name);
2474         }
2475
2476         return result;
2477 }
2478
2479 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2480                                 const struct smb_filename *smb_fname,
2481                                 const char *name,
2482                                 void *value,
2483                                 size_t size)
2484 {
2485         ssize_t result;
2486         struct timespec ts1,ts2;
2487         double timediff;
2488
2489         clock_gettime_mono(&ts1);
2490         result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2491         clock_gettime_mono(&ts2);
2492         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2493
2494         if (timediff > audit_timeout) {
2495                 smb_time_audit_log_fname("getxattr", timediff,
2496                         smb_fname->base_name);
2497         }
2498
2499         return result;
2500 }
2501
2502 struct smb_time_audit_getxattrat_state {
2503         struct vfs_aio_state aio_state;
2504         files_struct *dir_fsp;
2505         const struct smb_filename *smb_fname;
2506         const char *xattr_name;
2507         ssize_t xattr_size;
2508         uint8_t *xattr_value;
2509 };
2510
2511 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq);
2512
2513 static struct tevent_req *smb_time_audit_getxattrat_send(
2514                         TALLOC_CTX *mem_ctx,
2515                         struct tevent_context *ev,
2516                         struct vfs_handle_struct *handle,
2517                         files_struct *dir_fsp,
2518                         const struct smb_filename *smb_fname,
2519                         const char *xattr_name,
2520                         size_t alloc_hint)
2521 {
2522         struct tevent_req *req = NULL;
2523         struct tevent_req *subreq = NULL;
2524         struct smb_time_audit_getxattrat_state *state = NULL;
2525
2526         req = tevent_req_create(mem_ctx, &state,
2527                                 struct smb_time_audit_getxattrat_state);
2528         if (req == NULL) {
2529                 return NULL;
2530         }
2531         *state = (struct smb_time_audit_getxattrat_state) {
2532                 .dir_fsp = dir_fsp,
2533                 .smb_fname = smb_fname,
2534                 .xattr_name = xattr_name,
2535         };
2536
2537         subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2538                                               ev,
2539                                               handle,
2540                                               dir_fsp,
2541                                               smb_fname,
2542                                               xattr_name,
2543                                               alloc_hint);
2544         if (tevent_req_nomem(subreq, req)) {
2545                 return tevent_req_post(req, ev);
2546         }
2547         tevent_req_set_callback(subreq, smb_time_audit_getxattrat_done, req);
2548
2549         return req;
2550 }
2551
2552 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq)
2553 {
2554         struct tevent_req *req = tevent_req_callback_data(
2555                 subreq, struct tevent_req);
2556         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2557                 req, struct smb_time_audit_getxattrat_state);
2558
2559         state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2560                                                          &state->aio_state,
2561                                                          state,
2562                                                          &state->xattr_value);
2563         TALLOC_FREE(subreq);
2564         if (state->xattr_size == -1) {
2565                 tevent_req_error(req, state->aio_state.error);
2566                 return;
2567         }
2568
2569         tevent_req_done(req);
2570 }
2571
2572 static ssize_t smb_time_audit_getxattrat_recv(struct tevent_req *req,
2573                                               struct vfs_aio_state *aio_state,
2574                                               TALLOC_CTX *mem_ctx,
2575                                               uint8_t **xattr_value)
2576 {
2577         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2578                 req, struct smb_time_audit_getxattrat_state);
2579         ssize_t xattr_size;
2580         double timediff;
2581
2582         timediff = state->aio_state.duration * 1.0e-9;
2583
2584         if (timediff > audit_timeout) {
2585                 smb_time_audit_log_at("async getxattrat",
2586                                       timediff,
2587                                       state->dir_fsp,
2588                                       state->smb_fname);
2589         }
2590
2591         if (tevent_req_is_unix_error(req, &aio_state->error)) {
2592                 tevent_req_received(req);
2593                 return -1;
2594         }
2595
2596         *aio_state = state->aio_state;
2597         xattr_size = state->xattr_size;
2598         if (xattr_value != NULL) {
2599                 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2600         }
2601
2602         tevent_req_received(req);
2603         return xattr_size;
2604 }
2605
2606 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2607                                         struct files_struct *fsp,
2608                                         const char *name, void *value,
2609                                         size_t size)
2610 {
2611         ssize_t result;
2612         struct timespec ts1,ts2;
2613         double timediff;
2614
2615         clock_gettime_mono(&ts1);
2616         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2617         clock_gettime_mono(&ts2);
2618         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2619
2620         if (timediff > audit_timeout) {
2621                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2622         }
2623
2624         return result;
2625 }
2626
2627 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2628                                         const struct smb_filename *smb_fname,
2629                                         char *list,
2630                                         size_t size)
2631 {
2632         ssize_t result;
2633         struct timespec ts1,ts2;
2634         double timediff;
2635
2636         clock_gettime_mono(&ts1);
2637         result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2638         clock_gettime_mono(&ts2);
2639         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2640
2641         if (timediff > audit_timeout) {
2642                 smb_time_audit_log_fname("listxattr", timediff,
2643                                 smb_fname->base_name);
2644         }
2645
2646         return result;
2647 }
2648
2649 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2650                                          struct files_struct *fsp, char *list,
2651                                          size_t size)
2652 {
2653         ssize_t result;
2654         struct timespec ts1,ts2;
2655         double timediff;
2656
2657         clock_gettime_mono(&ts1);
2658         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2659         clock_gettime_mono(&ts2);
2660         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2661
2662         if (timediff > audit_timeout) {
2663                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2664         }
2665
2666         return result;
2667 }
2668
2669 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2670                                 const struct smb_filename *smb_fname,
2671                                 const char *name)
2672 {
2673         int result;
2674         struct timespec ts1,ts2;
2675         double timediff;
2676
2677         clock_gettime_mono(&ts1);
2678         result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2679         clock_gettime_mono(&ts2);
2680         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2681
2682         if (timediff > audit_timeout) {
2683                 smb_time_audit_log_fname("removexattr", timediff,
2684                         smb_fname->base_name);
2685         }
2686
2687         return result;
2688 }
2689
2690 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2691                                        struct files_struct *fsp,
2692                                        const char *name)
2693 {
2694         int result;
2695         struct timespec ts1,ts2;
2696         double timediff;
2697
2698         clock_gettime_mono(&ts1);
2699         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2700         clock_gettime_mono(&ts2);
2701         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2702
2703         if (timediff > audit_timeout) {
2704                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2705         }
2706
2707         return result;
2708 }
2709
2710 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2711                                 const struct smb_filename *smb_fname,
2712                                 const char *name,
2713                                 const void *value,
2714                                 size_t size,
2715                                 int flags)
2716 {
2717         int result;
2718         struct timespec ts1,ts2;
2719         double timediff;
2720
2721         clock_gettime_mono(&ts1);
2722         result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2723                                        flags);
2724         clock_gettime_mono(&ts2);
2725         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2726
2727         if (timediff > audit_timeout) {
2728                 smb_time_audit_log_fname("setxattr", timediff,
2729                                 smb_fname->base_name);
2730         }
2731
2732         return result;
2733 }
2734
2735 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2736                                     struct files_struct *fsp, const char *name,
2737                                     const void *value, size_t size, int flags)
2738 {
2739         int result;
2740         struct timespec ts1,ts2;
2741         double timediff;
2742
2743         clock_gettime_mono(&ts1);
2744         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2745         clock_gettime_mono(&ts2);
2746         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2747
2748         if (timediff > audit_timeout) {
2749                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2750         }
2751
2752         return result;
2753 }
2754
2755 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2756                                      struct files_struct *fsp)
2757 {
2758         bool result;
2759         struct timespec ts1,ts2;
2760         double timediff;
2761
2762         clock_gettime_mono(&ts1);
2763         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2764         clock_gettime_mono(&ts2);
2765         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2766
2767         if (timediff > audit_timeout) {
2768                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2769         }
2770
2771         return result;
2772 }
2773
2774 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2775                                               struct files_struct *fsp,
2776                                               TALLOC_CTX *mem_ctx,
2777                                               DATA_BLOB *cookie)
2778 {
2779         NTSTATUS result;
2780         struct timespec ts1,ts2;
2781         double timediff;
2782
2783         clock_gettime_mono(&ts1);
2784         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2785         clock_gettime_mono(&ts2);
2786         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2787
2788         if (timediff > audit_timeout) {
2789                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2790         }
2791
2792         return result;
2793 }
2794
2795 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2796                                                   struct files_struct *fsp,
2797                                                   const DATA_BLOB old_cookie,
2798                                                   TALLOC_CTX *mem_ctx,
2799                                                   DATA_BLOB *new_cookie)
2800 {
2801         NTSTATUS result;
2802         struct timespec ts1,ts2;
2803         double timediff;
2804
2805         clock_gettime_mono(&ts1);
2806         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2807                                                  mem_ctx, new_cookie);
2808         clock_gettime_mono(&ts2);
2809         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2810
2811         if (timediff > audit_timeout) {
2812                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2813         }
2814
2815         return result;
2816 }
2817
2818 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2819                                                  struct smb_request *smb1req,
2820                                                  struct smbXsrv_open *op,
2821                                                  const DATA_BLOB old_cookie,
2822                                                  TALLOC_CTX *mem_ctx,
2823                                                  struct files_struct **fsp,
2824                                                  DATA_BLOB *new_cookie)
2825 {
2826         NTSTATUS result;
2827         struct timespec ts1,ts2;
2828         double timediff;
2829
2830         clock_gettime_mono(&ts1);
2831         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2832                                                 mem_ctx, fsp, new_cookie);
2833         clock_gettime_mono(&ts2);
2834         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2835
2836         if (timediff > audit_timeout) {
2837                 smb_time_audit_log("durable_reconnect", timediff);
2838         }
2839
2840         return result;
2841 }
2842
2843 /* VFS operations */
2844
2845 static struct vfs_fn_pointers vfs_time_audit_fns = {
2846         .connect_fn = smb_time_audit_connect,
2847         .disconnect_fn = smb_time_audit_disconnect,
2848         .disk_free_fn = smb_time_audit_disk_free,
2849         .get_quota_fn = smb_time_audit_get_quota,
2850         .set_quota_fn = smb_time_audit_set_quota,
2851         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2852         .statvfs_fn = smb_time_audit_statvfs,
2853         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2854         .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2855         .create_dfs_pathat_fn = smb_time_audit_create_dfs_pathat,
2856         .read_dfs_pathat_fn = smb_time_audit_read_dfs_pathat,
2857         .fdopendir_fn = smb_time_audit_fdopendir,
2858         .readdir_fn = smb_time_audit_readdir,
2859         .seekdir_fn = smb_time_audit_seekdir,
2860         .telldir_fn = smb_time_audit_telldir,
2861         .rewind_dir_fn = smb_time_audit_rewinddir,
2862         .mkdirat_fn = smb_time_audit_mkdirat,
2863         .closedir_fn = smb_time_audit_closedir,
2864         .openat_fn = smb_time_audit_openat,
2865         .create_file_fn = smb_time_audit_create_file,
2866         .close_fn = smb_time_audit_close,
2867         .pread_fn = smb_time_audit_pread,
2868         .pread_send_fn = smb_time_audit_pread_send,
2869         .pread_recv_fn = smb_time_audit_pread_recv,
2870         .pwrite_fn = smb_time_audit_pwrite,
2871         .pwrite_send_fn = smb_time_audit_pwrite_send,
2872         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2873         .lseek_fn = smb_time_audit_lseek,
2874         .sendfile_fn = smb_time_audit_sendfile,
2875         .recvfile_fn = smb_time_audit_recvfile,
2876         .renameat_fn = smb_time_audit_renameat,
2877         .fsync_send_fn = smb_time_audit_fsync_send,
2878         .fsync_recv_fn = smb_time_audit_fsync_recv,
2879         .stat_fn = smb_time_audit_stat,
2880         .fstat_fn = smb_time_audit_fstat,
2881         .lstat_fn = smb_time_audit_lstat,
2882         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2883         .unlinkat_fn = smb_time_audit_unlinkat,
2884         .chmod_fn = smb_time_audit_chmod,
2885         .fchmod_fn = smb_time_audit_fchmod,
2886         .fchown_fn = smb_time_audit_fchown,
2887         .lchown_fn = smb_time_audit_lchown,
2888         .chdir_fn = smb_time_audit_chdir,
2889         .getwd_fn = smb_time_audit_getwd,
2890         .ntimes_fn = smb_time_audit_ntimes,
2891         .ftruncate_fn = smb_time_audit_ftruncate,
2892         .fallocate_fn = smb_time_audit_fallocate,
2893         .lock_fn = smb_time_audit_lock,
2894         .kernel_flock_fn = smb_time_audit_kernel_flock,
2895         .fcntl_fn = smb_time_audit_fcntl,
2896         .linux_setlease_fn = smb_time_audit_linux_setlease,
2897         .getlock_fn = smb_time_audit_getlock,
2898         .symlinkat_fn = smb_time_audit_symlinkat,
2899         .readlinkat_fn = smb_time_audit_readlinkat,
2900         .linkat_fn = smb_time_audit_linkat,
2901         .mknodat_fn = smb_time_audit_mknodat,
2902         .realpath_fn = smb_time_audit_realpath,
2903         .chflags_fn = smb_time_audit_chflags,
2904         .file_id_create_fn = smb_time_audit_file_id_create,
2905         .fs_file_id_fn = smb_time_audit_fs_file_id,
2906         .offload_read_send_fn = smb_time_audit_offload_read_send,
2907         .offload_read_recv_fn = smb_time_audit_offload_read_recv,
2908         .offload_write_send_fn = smb_time_audit_offload_write_send,
2909         .offload_write_recv_fn = smb_time_audit_offload_write_recv,
2910         .get_compression_fn = smb_time_audit_get_compression,
2911         .set_compression_fn = smb_time_audit_set_compression,
2912         .snap_check_path_fn = smb_time_audit_snap_check_path,
2913         .snap_create_fn = smb_time_audit_snap_create,
2914         .snap_delete_fn = smb_time_audit_snap_delete,
2915         .streaminfo_fn = smb_time_audit_streaminfo,
2916         .get_real_filename_fn = smb_time_audit_get_real_filename,
2917         .connectpath_fn = smb_time_audit_connectpath,
2918         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2919         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2920         .strict_lock_check_fn = smb_time_audit_strict_lock_check,
2921         .translate_name_fn = smb_time_audit_translate_name,
2922         .fsctl_fn = smb_time_audit_fsctl,
2923         .get_dos_attributes_fn = smb_time_get_dos_attributes,
2924         .get_dos_attributes_send_fn = smb_time_audit_get_dos_attributes_send,
2925         .get_dos_attributes_recv_fn = smb_time_audit_get_dos_attributes_recv,
2926         .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2927         .set_dos_attributes_fn = smb_time_set_dos_attributes,
2928         .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2929         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2930         .get_nt_acl_at_fn = smb_time_audit_get_nt_acl_at,
2931         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2932         .audit_file_fn = smb_time_audit_audit_file,
2933         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2934         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2935         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2936         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2937         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2938         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2939         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2940         .getxattr_fn = smb_time_audit_getxattr,
2941         .getxattrat_send_fn = smb_time_audit_getxattrat_send,
2942         .getxattrat_recv_fn = smb_time_audit_getxattrat_recv,
2943         .fgetxattr_fn = smb_time_audit_fgetxattr,
2944         .listxattr_fn = smb_time_audit_listxattr,
2945         .flistxattr_fn = smb_time_audit_flistxattr,
2946         .removexattr_fn = smb_time_audit_removexattr,
2947         .fremovexattr_fn = smb_time_audit_fremovexattr,
2948         .setxattr_fn = smb_time_audit_setxattr,
2949         .fsetxattr_fn = smb_time_audit_fsetxattr,
2950         .aio_force_fn = smb_time_audit_aio_force,
2951         .durable_cookie_fn = smb_time_audit_durable_cookie,
2952         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2953         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2954         .readdir_attr_fn = smb_time_audit_readdir_attr,
2955 };
2956
2957
2958 static_decl_vfs;
2959 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2960 {
2961         smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2962
2963         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2964                                             10000) / 1000.0;
2965         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2966                                 &vfs_time_audit_fns);
2967 }