source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
  90                                     const char *fname)
  91 {
  92         char cwd[PATH_MAX];
  93         char *msg = NULL;
  94
  95         if (getcwd(cwd, sizeof(cwd)) == NULL) {
  96                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
  97         }
  98         if (fname != NULL) {
  99                 msg = talloc_asprintf(talloc_tos(),
 100                                       "cwd = \"%s\", filename = \"%s\"",
 101                                       cwd, fname);
 102         } else {
 103                 msg = talloc_asprintf(talloc_tos(),
 104                                       "cwd = \"%s\", filename = <NULL>",
 105                                       cwd);
 106         }
 107         smb_time_audit_log_msg(syscallname, elapsed, msg);
 108         TALLOC_FREE(msg);
 109 }
 110
 111 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 112                                        const struct smb_filename *smb_fname)
 113 {
 114         if (smb_fname != NULL) {
 115                 smb_time_audit_log_fname(syscallname, elapsed,
 116                                          smb_fname->base_name);
 117         } else {
 118                 smb_time_audit_log_fname(syscallname, elapsed,
 119                                          "smb_fname = <NULL>");
 120         }
 121 }
 122
 123 static int smb_time_audit_connect(vfs_handle_struct *handle,
 124                                   const char *svc, const char *user)
 125 {
 126         int result;
 127         struct timespec ts1,ts2;
 128         double timediff;
 129
 130         if (!handle) {
 131                 return -1;
 132         }
 133
 134         clock_gettime_mono(&ts1);
 135         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 136         clock_gettime_mono(&ts2);
 137         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 138         if (timediff > audit_timeout) {
 139                 smb_time_audit_log_msg("connect", timediff, user);
 140         }
 141         return result;
 142 }
 143
 144 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 145 {
 146         struct timespec ts1,ts2;
 147         double timediff;
 148
 149         clock_gettime_mono(&ts1);
 150         SMB_VFS_NEXT_DISCONNECT(handle);
 151         clock_gettime_mono(&ts2);
 152         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 153
 154         if (timediff > audit_timeout) {
 155                 smb_time_audit_log("disconnect", timediff);
 156         }
 157 }
 158
 159 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 160                                         const struct smb_filename *smb_fname,
 161                                         uint64_t *bsize,
 162                                         uint64_t *dfree,
 163                                         uint64_t *dsize)
 164 {
 165         uint64_t result;
 166         struct timespec ts1,ts2;
 167         double timediff;
 168
 169         clock_gettime_mono(&ts1);
 170         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
 171         clock_gettime_mono(&ts2);
 172         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 173
 174         /* Don't have a reasonable notion of failure here */
 175         if (timediff > audit_timeout) {
 176                 smb_time_audit_log_fname("disk_free",
 177                                 timediff,
 178                                 smb_fname->base_name);
 179         }
 180
 181         return result;
 182 }
 183
 184 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 185                                     const char *path, enum SMB_QUOTA_TYPE qtype,
 186                                     unid_t id, SMB_DISK_QUOTA *qt)
 187 {
 188         int result;
 189         struct timespec ts1,ts2;
 190         double timediff;
 191
 192         clock_gettime_mono(&ts1);
 193         result = SMB_VFS_NEXT_GET_QUOTA(handle, path, qtype, id, qt);
 194         clock_gettime_mono(&ts2);
 195         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 196
 197         if (timediff > audit_timeout) {
 198                 smb_time_audit_log("get_quota", timediff);
 199         }
 200         return result;
 201 }
 202
 203 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 204                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 205                                     SMB_DISK_QUOTA *qt)
 206 {
 207         int result;
 208         struct timespec ts1,ts2;
 209         double timediff;
 210
 211         clock_gettime_mono(&ts1);
 212         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 213         clock_gettime_mono(&ts2);
 214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 215
 216         if (timediff > audit_timeout) {
 217                 smb_time_audit_log("set_quota", timediff);
 218         }
 219
 220         return result;
 221 }
 222
 223 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 224                                                struct files_struct *fsp,
 225                                                struct shadow_copy_data *shadow_copy_data,
 226                                                bool labels)
 227 {
 228         int result;
 229         struct timespec ts1,ts2;
 230         double timediff;
 231
 232         clock_gettime_mono(&ts1);
 233         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 234                                                    shadow_copy_data, labels);
 235         clock_gettime_mono(&ts2);
 236         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 237
 238         if (timediff > audit_timeout) {
 239                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 240         }
 241
 242         return result;
 243 }
 244
 245 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 246                                   const char *path,
 247                                   struct vfs_statvfs_struct *statbuf)
 248 {
 249         int result;
 250         struct timespec ts1,ts2;
 251         double timediff;
 252
 253         clock_gettime_mono(&ts1);
 254         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
 255         clock_gettime_mono(&ts2);
 256         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 257
 258         if (timediff > audit_timeout) {
 259                 smb_time_audit_log_fname("statvfs", timediff, path);
 260         }
 261
 262         return result;
 263 }
 264
 265 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 266                                                enum timestamp_set_resolution *p_ts_res)
 267 {
 268         uint32_t result;
 269         struct timespec ts1,ts2;
 270         double timediff;
 271
 272         clock_gettime_mono(&ts1);
 273         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 274         clock_gettime_mono(&ts2);
 275         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 276
 277         if (timediff > audit_timeout) {
 278                 smb_time_audit_log("fs_capabilities", timediff);
 279         }
 280
 281         return result;
 282 }
 283
 284 static NTSTATUS smb_time_audit_get_dfs_referrals(
 285                         struct vfs_handle_struct *handle,
 286                         struct dfs_GetDFSReferral *r)
 287 {
 288         NTSTATUS result;
 289         struct timespec ts1,ts2;
 290         double timediff;
 291
 292         clock_gettime_mono(&ts1);
 293         result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
 294         clock_gettime_mono(&ts2);
 295         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 296
 297         if (timediff > audit_timeout) {
 298                 smb_time_audit_log("get_dfs_referrals(", timediff);
 299         }
 300
 301         return result;
 302 }
 303
 304 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 305                                                TALLOC_CTX *mem_ctx,
 306                                                const char *service_path,
 307                                                char **base_volume)
 308 {
 309         NTSTATUS status;
 310         struct timespec ts1,ts2;
 311         double timediff;
 312
 313         clock_gettime_mono(&ts1);
 314         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 315                                               base_volume);
 316         clock_gettime_mono(&ts2);
 317         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 318
 319         if (timediff > audit_timeout) {
 320                 smb_time_audit_log("snap_check_path", timediff);
 321         }
 322
 323         return status;
 324 }
 325
 326 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 327                                            TALLOC_CTX *mem_ctx,
 328                                            const char *base_volume,
 329                                            time_t *tstamp,
 330                                            bool rw,
 331                                            char **base_path,
 332                                            char **snap_path)
 333 {
 334         NTSTATUS status;
 335         struct timespec ts1,ts2;
 336         double timediff;
 337
 338         clock_gettime_mono(&ts1);
 339         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 340                                           rw, base_path, snap_path);
 341         clock_gettime_mono(&ts2);
 342         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 343
 344         if (timediff > audit_timeout) {
 345                 smb_time_audit_log("snap_create", timediff);
 346         }
 347
 348         return status;
 349 }
 350
 351 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 352                                            TALLOC_CTX *mem_ctx,
 353                                            char *base_path,
 354                                            char *snap_path)
 355 {
 356         NTSTATUS status;
 357         struct timespec ts1,ts2;
 358         double timediff;
 359
 360         clock_gettime_mono(&ts1);
 361         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 362                                           snap_path);
 363         clock_gettime_mono(&ts2);
 364         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 365
 366         if (timediff > audit_timeout) {
 367                 smb_time_audit_log("snap_delete", timediff);
 368         }
 369
 370         return status;
 371 }
 372
 373 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
 374                                    const struct smb_filename *smb_fname,
 375                                    const char *mask, uint32_t attr)
 376 {
 377         DIR *result;
 378         struct timespec ts1,ts2;
 379         double timediff;
 380
 381         clock_gettime_mono(&ts1);
 382         result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
 383         clock_gettime_mono(&ts2);
 384         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 385
 386         if (timediff > audit_timeout) {
 387                 smb_time_audit_log_smb_fname("opendir", timediff, smb_fname);
 388         }
 389
 390         return result;
 391 }
 392
 393 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 394                                               files_struct *fsp,
 395                                               const char *mask, uint32_t attr)
 396 {
 397         DIR *result;
 398         struct timespec ts1,ts2;
 399         double timediff;
 400
 401         clock_gettime_mono(&ts1);
 402         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 403         clock_gettime_mono(&ts2);
 404         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 405
 406         if (timediff > audit_timeout) {
 407                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 408         }
 409
 410         return result;
 411 }
 412
 413 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 414                                                  DIR *dirp,
 415                                                  SMB_STRUCT_STAT *sbuf)
 416 {
 417         struct dirent *result;
 418         struct timespec ts1,ts2;
 419         double timediff;
 420
 421         clock_gettime_mono(&ts1);
 422         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 423         clock_gettime_mono(&ts2);
 424         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 425
 426         if (timediff > audit_timeout) {
 427                 smb_time_audit_log("readdir", timediff);
 428         }
 429
 430         return result;
 431 }
 432
 433 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 434                                    DIR *dirp, long offset)
 435 {
 436         struct timespec ts1,ts2;
 437         double timediff;
 438
 439         clock_gettime_mono(&ts1);
 440         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 441         clock_gettime_mono(&ts2);
 442         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 443
 444         if (timediff > audit_timeout) {
 445                 smb_time_audit_log("seekdir", timediff);
 446         }
 447
 448 }
 449
 450 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 451                                    DIR *dirp)
 452 {
 453         long result;
 454         struct timespec ts1,ts2;
 455         double timediff;
 456
 457         clock_gettime_mono(&ts1);
 458         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 459         clock_gettime_mono(&ts2);
 460         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 461
 462         if (timediff > audit_timeout) {
 463                 smb_time_audit_log("telldir", timediff);
 464         }
 465
 466         return result;
 467 }
 468
 469 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 470                                      DIR *dirp)
 471 {
 472         struct timespec ts1,ts2;
 473         double timediff;
 474
 475         clock_gettime_mono(&ts1);
 476         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 477         clock_gettime_mono(&ts2);
 478         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 479
 480         if (timediff > audit_timeout) {
 481                 smb_time_audit_log("rewinddir", timediff);
 482         }
 483
 484 }
 485
 486 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
 487                                 const struct smb_filename *smb_fname,
 488                                 mode_t mode)
 489 {
 490         int result;
 491         struct timespec ts1,ts2;
 492         double timediff;
 493
 494         clock_gettime_mono(&ts1);
 495         result = SMB_VFS_NEXT_MKDIR(handle, smb_fname, mode);
 496         clock_gettime_mono(&ts2);
 497         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 498
 499         if (timediff > audit_timeout) {
 500                 smb_time_audit_log_smb_fname("mkdir",
 501                         timediff,
 502                         smb_fname);
 503         }
 504
 505         return result;
 506 }
 507
 508 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
 509                                 const struct smb_filename *smb_fname)
 510 {
 511         int result;
 512         struct timespec ts1,ts2;
 513         double timediff;
 514
 515         clock_gettime_mono(&ts1);
 516         result = SMB_VFS_NEXT_RMDIR(handle, smb_fname);
 517         clock_gettime_mono(&ts2);
 518         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 519
 520         if (timediff > audit_timeout) {
 521                 smb_time_audit_log_smb_fname("rmdir",
 522                         timediff,
 523                         smb_fname);
 524         }
 525
 526         return result;
 527 }
 528
 529 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 530                                    DIR *dirp)
 531 {
 532         int result;
 533         struct timespec ts1,ts2;
 534         double timediff;
 535
 536         clock_gettime_mono(&ts1);
 537         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 538         clock_gettime_mono(&ts2);
 539         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 540
 541         if (timediff > audit_timeout) {
 542                 smb_time_audit_log("closedir", timediff);
 543         }
 544
 545         return result;
 546 }
 547
 548 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
 549                                           DIR *dirp)
 550 {
 551         struct timespec ts1,ts2;
 552         double timediff;
 553
 554         clock_gettime_mono(&ts1);
 555         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
 556         clock_gettime_mono(&ts2);
 557         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 558
 559         if (timediff > audit_timeout) {
 560                 smb_time_audit_log("init_search_op", timediff);
 561         }
 562 }
 563
 564 static int smb_time_audit_open(vfs_handle_struct *handle,
 565                                struct smb_filename *fname,
 566                                files_struct *fsp,
 567                                int flags, mode_t mode)
 568 {
 569         int result;
 570         struct timespec ts1,ts2;
 571         double timediff;
 572
 573         clock_gettime_mono(&ts1);
 574         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
 575         clock_gettime_mono(&ts2);
 576         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 577
 578         if (timediff > audit_timeout) {
 579                 smb_time_audit_log_fsp("open", timediff, fsp);
 580         }
 581
 582         return result;
 583 }
 584
 585 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 586                                            struct smb_request *req,
 587                                            uint16_t root_dir_fid,
 588                                            struct smb_filename *fname,
 589                                            uint32_t access_mask,
 590                                            uint32_t share_access,
 591                                            uint32_t create_disposition,
 592                                            uint32_t create_options,
 593                                            uint32_t file_attributes,
 594                                            uint32_t oplock_request,
 595                                            struct smb2_lease *lease,
 596                                            uint64_t allocation_size,
 597                                            uint32_t private_flags,
 598                                            struct security_descriptor *sd,
 599                                            struct ea_list *ea_list,
 600                                            files_struct **result_fsp,
 601                                            int *pinfo,
 602                                            const struct smb2_create_blobs *in_context_blobs,
 603                                            struct smb2_create_blobs *out_context_blobs)
 604 {
 605         NTSTATUS result;
 606         struct timespec ts1,ts2;
 607         double timediff;
 608
 609         clock_gettime_mono(&ts1);
 610         result = SMB_VFS_NEXT_CREATE_FILE(
 611                 handle,                                 /* handle */
 612                 req,                                    /* req */
 613                 root_dir_fid,                           /* root_dir_fid */
 614                 fname,                                  /* fname */
 615                 access_mask,                            /* access_mask */
 616                 share_access,                           /* share_access */
 617                 create_disposition,                     /* create_disposition*/
 618                 create_options,                         /* create_options */
 619                 file_attributes,                        /* file_attributes */
 620                 oplock_request,                         /* oplock_request */
 621                 lease,                                  /* lease */
 622                 allocation_size,                        /* allocation_size */
 623                 private_flags,
 624                 sd,                                     /* sd */
 625                 ea_list,                                /* ea_list */
 626                 result_fsp,                             /* result */
 627                 pinfo,
 628                 in_context_blobs, out_context_blobs);   /* create context */
 629         clock_gettime_mono(&ts2);
 630         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 631
 632         if (timediff > audit_timeout) {
 633                 /*
 634                  * can't use result_fsp this time, may have
 635                  * invalid content causing smbd crash
 636                  */
 637                 smb_time_audit_log_smb_fname("create_file", timediff,
 638                                            fname);
 639         }
 640
 641         return result;
 642 }
 643
 644 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 645 {
 646         int result;
 647         struct timespec ts1,ts2;
 648         double timediff;
 649
 650         clock_gettime_mono(&ts1);
 651         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 652         clock_gettime_mono(&ts2);
 653         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 654
 655         if (timediff > audit_timeout) {
 656                 smb_time_audit_log_fsp("close", timediff, fsp);
 657         }
 658
 659         return result;
 660 }
 661
 662 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
 663                                    files_struct *fsp, void *data, size_t n)
 664 {
 665         ssize_t result;
 666         struct timespec ts1,ts2;
 667         double timediff;
 668
 669         clock_gettime_mono(&ts1);
 670         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
 671         clock_gettime_mono(&ts2);
 672         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 673
 674         if (timediff > audit_timeout) {
 675                 smb_time_audit_log_fsp("read", timediff, fsp);
 676         }
 677
 678         return result;
 679 }
 680
 681 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 682                                     files_struct *fsp,
 683                                     void *data, size_t n, off_t offset)
 684 {
 685         ssize_t result;
 686         struct timespec ts1,ts2;
 687         double timediff;
 688
 689         clock_gettime_mono(&ts1);
 690         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 691         clock_gettime_mono(&ts2);
 692         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 693
 694         if (timediff > audit_timeout) {
 695                 smb_time_audit_log_fsp("pread", timediff, fsp);
 696         }
 697
 698         return result;
 699 }
 700
 701 struct smb_time_audit_pread_state {
 702         struct files_struct *fsp;
 703         ssize_t ret;
 704         struct vfs_aio_state vfs_aio_state;
 705 };
 706
 707 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 708
 709 static struct tevent_req *smb_time_audit_pread_send(
 710         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 711         struct tevent_context *ev, struct files_struct *fsp,
 712         void *data, size_t n, off_t offset)
 713 {
 714         struct tevent_req *req, *subreq;
 715         struct smb_time_audit_pread_state *state;
 716
 717         req = tevent_req_create(mem_ctx, &state,
 718                                 struct smb_time_audit_pread_state);
 719         if (req == NULL) {
 720                 return NULL;
 721         }
 722         state->fsp = fsp;
 723
 724         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 725                                          n, offset);
 726         if (tevent_req_nomem(subreq, req)) {
 727                 return tevent_req_post(req, ev);
 728         }
 729         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 730         return req;
 731 }
 732
 733 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 734 {
 735         struct tevent_req *req = tevent_req_callback_data(
 736                 subreq, struct tevent_req);
 737         struct smb_time_audit_pread_state *state = tevent_req_data(
 738                 req, struct smb_time_audit_pread_state);
 739
 740         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
 741         TALLOC_FREE(subreq);
 742         tevent_req_done(req);
 743 }
 744
 745 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
 746                                          struct vfs_aio_state *vfs_aio_state)
 747 {
 748         struct smb_time_audit_pread_state *state = tevent_req_data(
 749                 req, struct smb_time_audit_pread_state);
 750         double timediff;
 751
 752         timediff = state->vfs_aio_state.duration * 1.0e-9;
 753
 754         if (timediff > audit_timeout) {
 755                 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
 756         }
 757
 758         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 759                 return -1;
 760         }
 761         *vfs_aio_state = state->vfs_aio_state;
 762         return state->ret;
 763 }
 764
 765 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
 766                                     files_struct *fsp,
 767                                     const void *data, size_t n)
 768 {
 769         ssize_t result;
 770         struct timespec ts1,ts2;
 771         double timediff;
 772
 773         clock_gettime_mono(&ts1);
 774         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
 775         clock_gettime_mono(&ts2);
 776         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 777
 778         if (timediff > audit_timeout) {
 779                 smb_time_audit_log_fsp("write", timediff, fsp);
 780         }
 781
 782         return result;
 783 }
 784
 785 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 786                                      files_struct *fsp,
 787                                      const void *data, size_t n,
 788                                      off_t offset)
 789 {
 790         ssize_t result;
 791         struct timespec ts1,ts2;
 792         double timediff;
 793
 794         clock_gettime_mono(&ts1);
 795         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 796         clock_gettime_mono(&ts2);
 797         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 798
 799         if (timediff > audit_timeout) {
 800                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 801         }
 802
 803         return result;
 804 }
 805
 806 struct smb_time_audit_pwrite_state {
 807         struct files_struct *fsp;
 808         ssize_t ret;
 809         struct vfs_aio_state vfs_aio_state;
 810 };
 811
 812 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 813
 814 static struct tevent_req *smb_time_audit_pwrite_send(
 815         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 816         struct tevent_context *ev, struct files_struct *fsp,
 817         const void *data, size_t n, off_t offset)
 818 {
 819         struct tevent_req *req, *subreq;
 820         struct smb_time_audit_pwrite_state *state;
 821
 822         req = tevent_req_create(mem_ctx, &state,
 823                                 struct smb_time_audit_pwrite_state);
 824         if (req == NULL) {
 825                 return NULL;
 826         }
 827         state->fsp = fsp;
 828
 829         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 830                                          n, offset);
 831         if (tevent_req_nomem(subreq, req)) {
 832                 return tevent_req_post(req, ev);
 833         }
 834         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 835         return req;
 836 }
 837
 838 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 839 {
 840         struct tevent_req *req = tevent_req_callback_data(
 841                 subreq, struct tevent_req);
 842         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 843                 req, struct smb_time_audit_pwrite_state);
 844
 845         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
 846         TALLOC_FREE(subreq);
 847         tevent_req_done(req);
 848 }
 849
 850 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
 851                                           struct vfs_aio_state *vfs_aio_state)
 852 {
 853         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 854                 req, struct smb_time_audit_pwrite_state);
 855         double timediff;
 856
 857         timediff = state->vfs_aio_state.duration * 1.0e-9;
 858
 859         if (timediff > audit_timeout) {
 860                 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
 861         }
 862
 863         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 864                 return -1;
 865         }
 866         *vfs_aio_state = state->vfs_aio_state;
 867         return state->ret;
 868 }
 869
 870 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 871                                       files_struct *fsp,
 872                                       off_t offset, int whence)
 873 {
 874         off_t result;
 875         struct timespec ts1,ts2;
 876         double timediff;
 877
 878         clock_gettime_mono(&ts1);
 879         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 880         clock_gettime_mono(&ts2);
 881         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 882
 883         if (timediff > audit_timeout) {
 884                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 885         }
 886
 887         return result;
 888 }
 889
 890 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 891                                        files_struct *fromfsp,
 892                                        const DATA_BLOB *hdr, off_t offset,
 893                                        size_t n)
 894 {
 895         ssize_t result;
 896         struct timespec ts1,ts2;
 897         double timediff;
 898
 899         clock_gettime_mono(&ts1);
 900         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 901         clock_gettime_mono(&ts2);
 902         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 903
 904         if (timediff > audit_timeout) {
 905                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 906         }
 907
 908         return result;
 909 }
 910
 911 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 912                                        files_struct *tofsp,
 913                                        off_t offset,
 914                                        size_t n)
 915 {
 916         ssize_t result;
 917         struct timespec ts1,ts2;
 918         double timediff;
 919
 920         clock_gettime_mono(&ts1);
 921         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 922         clock_gettime_mono(&ts2);
 923         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 924
 925         if (timediff > audit_timeout) {
 926                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 927         }
 928
 929         return result;
 930 }
 931
 932 static int smb_time_audit_rename(vfs_handle_struct *handle,
 933                                  const struct smb_filename *oldname,
 934                                  const struct smb_filename *newname)
 935 {
 936         int result;
 937         struct timespec ts1,ts2;
 938         double timediff;
 939
 940         clock_gettime_mono(&ts1);
 941         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
 942         clock_gettime_mono(&ts2);
 943         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 944
 945         if (timediff > audit_timeout) {
 946                 smb_time_audit_log_smb_fname("rename", timediff, newname);
 947         }
 948
 949         return result;
 950 }
 951
 952 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
 953 {
 954         int result;
 955         struct timespec ts1,ts2;
 956         double timediff;
 957
 958         clock_gettime_mono(&ts1);
 959         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
 960         clock_gettime_mono(&ts2);
 961         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 962
 963         if (timediff > audit_timeout) {
 964                 smb_time_audit_log_fsp("fsync", timediff, fsp);
 965         }
 966
 967         return result;
 968 }
 969
 970 struct smb_time_audit_fsync_state {
 971         struct files_struct *fsp;
 972         int ret;
 973         struct vfs_aio_state vfs_aio_state;
 974 };
 975
 976 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 977
 978 static struct tevent_req *smb_time_audit_fsync_send(
 979         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 980         struct tevent_context *ev, struct files_struct *fsp)
 981 {
 982         struct tevent_req *req, *subreq;
 983         struct smb_time_audit_fsync_state *state;
 984
 985         req = tevent_req_create(mem_ctx, &state,
 986                                 struct smb_time_audit_fsync_state);
 987         if (req == NULL) {
 988                 return NULL;
 989         }
 990         state->fsp = fsp;
 991
 992         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 993         if (tevent_req_nomem(subreq, req)) {
 994                 return tevent_req_post(req, ev);
 995         }
 996         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 997         return req;
 998 }
 999
1000 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
1001 {
1002         struct tevent_req *req = tevent_req_callback_data(
1003                 subreq, struct tevent_req);
1004         struct smb_time_audit_fsync_state *state = tevent_req_data(
1005                 req, struct smb_time_audit_fsync_state);
1006
1007         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1008         TALLOC_FREE(subreq);
1009         tevent_req_done(req);
1010 }
1011
1012 static int smb_time_audit_fsync_recv(struct tevent_req *req,
1013                                      struct vfs_aio_state *vfs_aio_state)
1014 {
1015         struct smb_time_audit_fsync_state *state = tevent_req_data(
1016                 req, struct smb_time_audit_fsync_state);
1017         double timediff;
1018
1019         timediff = state->vfs_aio_state.duration * 1.0e-9;
1020
1021         if (timediff > audit_timeout) {
1022                 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
1023         }
1024
1025         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1026                 return -1;
1027         }
1028         *vfs_aio_state = state->vfs_aio_state;
1029         return state->ret;
1030 }
1031
1032 static int smb_time_audit_stat(vfs_handle_struct *handle,
1033                                struct smb_filename *fname)
1034 {
1035         int result;
1036         struct timespec ts1,ts2;
1037         double timediff;
1038
1039         clock_gettime_mono(&ts1);
1040         result = SMB_VFS_NEXT_STAT(handle, fname);
1041         clock_gettime_mono(&ts2);
1042         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1043
1044         if (timediff > audit_timeout) {
1045                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1046         }
1047
1048         return result;
1049 }
1050
1051 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1052                                 SMB_STRUCT_STAT *sbuf)
1053 {
1054         int result;
1055         struct timespec ts1,ts2;
1056         double timediff;
1057
1058         clock_gettime_mono(&ts1);
1059         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1060         clock_gettime_mono(&ts2);
1061         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1062
1063         if (timediff > audit_timeout) {
1064                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1065         }
1066
1067         return result;
1068 }
1069
1070 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1071                                 struct smb_filename *path)
1072 {
1073         int result;
1074         struct timespec ts1,ts2;
1075         double timediff;
1076
1077         clock_gettime_mono(&ts1);
1078         result = SMB_VFS_NEXT_LSTAT(handle, path);
1079         clock_gettime_mono(&ts2);
1080         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1081
1082         if (timediff > audit_timeout) {
1083                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1084         }
1085
1086         return result;
1087 }
1088
1089 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1090                                               files_struct *fsp,
1091                                               const SMB_STRUCT_STAT *sbuf)
1092 {
1093         uint64_t result;
1094         struct timespec ts1,ts2;
1095         double timediff;
1096
1097         clock_gettime_mono(&ts1);
1098         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1099         clock_gettime_mono(&ts2);
1100         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1101
1102         if (timediff > audit_timeout) {
1103                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1104         }
1105
1106         return result;
1107 }
1108
1109 static int smb_time_audit_unlink(vfs_handle_struct *handle,
1110                                  const struct smb_filename *path)
1111 {
1112         int result;
1113         struct timespec ts1,ts2;
1114         double timediff;
1115
1116         clock_gettime_mono(&ts1);
1117         result = SMB_VFS_NEXT_UNLINK(handle, path);
1118         clock_gettime_mono(&ts2);
1119         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1120
1121         if (timediff > audit_timeout) {
1122                 smb_time_audit_log_smb_fname("unlink", timediff, path);
1123         }
1124
1125         return result;
1126 }
1127
1128 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1129                         const struct smb_filename *smb_fname,
1130                         mode_t mode)
1131 {
1132         int result;
1133         struct timespec ts1,ts2;
1134         double timediff;
1135
1136         clock_gettime_mono(&ts1);
1137         result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1138         clock_gettime_mono(&ts2);
1139         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1140
1141         if (timediff > audit_timeout) {
1142                 smb_time_audit_log_fname("chmod",
1143                         timediff,
1144                         smb_fname->base_name);
1145         }
1146
1147         return result;
1148 }
1149
1150 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1151                                  mode_t mode)
1152 {
1153         int result;
1154         struct timespec ts1,ts2;
1155         double timediff;
1156
1157         clock_gettime_mono(&ts1);
1158         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1159         clock_gettime_mono(&ts2);
1160         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1161
1162         if (timediff > audit_timeout) {
1163                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1164         }
1165
1166         return result;
1167 }
1168
1169 static int smb_time_audit_chown(vfs_handle_struct *handle,
1170                         const struct smb_filename *smb_fname,
1171                         uid_t uid,
1172                         gid_t gid)
1173 {
1174         int result;
1175         struct timespec ts1,ts2;
1176         double timediff;
1177
1178         clock_gettime_mono(&ts1);
1179         result = SMB_VFS_NEXT_CHOWN(handle, smb_fname, uid, gid);
1180         clock_gettime_mono(&ts2);
1181         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1182
1183         if (timediff > audit_timeout) {
1184                 smb_time_audit_log_fname("chown",
1185                         timediff,
1186                         smb_fname->base_name);
1187         }
1188
1189         return result;
1190 }
1191
1192 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1193                                  uid_t uid, gid_t gid)
1194 {
1195         int result;
1196         struct timespec ts1,ts2;
1197         double timediff;
1198
1199         clock_gettime_mono(&ts1);
1200         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1201         clock_gettime_mono(&ts2);
1202         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1203
1204         if (timediff > audit_timeout) {
1205                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1206         }
1207
1208         return result;
1209 }
1210
1211 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1212                         const struct smb_filename *smb_fname,
1213                         uid_t uid,
1214                         gid_t gid)
1215 {
1216         int result;
1217         struct timespec ts1,ts2;
1218         double timediff;
1219
1220         clock_gettime_mono(&ts1);
1221         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1222         clock_gettime_mono(&ts2);
1223         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1224
1225         if (timediff > audit_timeout) {
1226                 smb_time_audit_log_fname("lchown",
1227                         timediff,
1228                         smb_fname->base_name);
1229         }
1230
1231         return result;
1232 }
1233
1234 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
1235 {
1236         int result;
1237         struct timespec ts1,ts2;
1238         double timediff;
1239
1240         clock_gettime_mono(&ts1);
1241         result = SMB_VFS_NEXT_CHDIR(handle, path);
1242         clock_gettime_mono(&ts2);
1243         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1244
1245         if (timediff > audit_timeout) {
1246                 smb_time_audit_log_fname("chdir", timediff, path);
1247         }
1248
1249         return result;
1250 }
1251
1252 static char *smb_time_audit_getwd(vfs_handle_struct *handle)
1253 {
1254         char *result;
1255         struct timespec ts1,ts2;
1256         double timediff;
1257
1258         clock_gettime_mono(&ts1);
1259         result = SMB_VFS_NEXT_GETWD(handle);
1260         clock_gettime_mono(&ts2);
1261         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1262
1263         if (timediff > audit_timeout) {
1264                 smb_time_audit_log("getwd", timediff);
1265         }
1266
1267         return result;
1268 }
1269
1270 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1271                                  const struct smb_filename *path,
1272                                  struct smb_file_time *ft)
1273 {
1274         int result;
1275         struct timespec ts1,ts2;
1276         double timediff;
1277
1278         clock_gettime_mono(&ts1);
1279         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1280         clock_gettime_mono(&ts2);
1281         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1282
1283         if (timediff > audit_timeout) {
1284                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1285         }
1286
1287         return result;
1288 }
1289
1290 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1291                                     files_struct *fsp,
1292                                     off_t len)
1293 {
1294         int result;
1295         struct timespec ts1,ts2;
1296         double timediff;
1297
1298         clock_gettime_mono(&ts1);
1299         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1300         clock_gettime_mono(&ts2);
1301         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1302
1303         if (timediff > audit_timeout) {
1304                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1305         }
1306
1307         return result;
1308 }
1309
1310 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1311                                     files_struct *fsp,
1312                                     uint32_t mode,
1313                                     off_t offset,
1314                                     off_t len)
1315 {
1316         int result;
1317         int saved_errno = 0;
1318         struct timespec ts1,ts2;
1319         double timediff;
1320
1321         clock_gettime_mono(&ts1);
1322         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1323         if (result == -1) {
1324                 saved_errno = errno;
1325         }
1326         clock_gettime_mono(&ts2);
1327         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1328
1329         if (timediff > audit_timeout) {
1330                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1331         }
1332         if (result == -1) {
1333                 errno = saved_errno;
1334         }
1335         return result;
1336 }
1337
1338 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1339                                 int op, off_t offset, off_t count,
1340                                 int type)
1341 {
1342         bool result;
1343         struct timespec ts1,ts2;
1344         double timediff;
1345
1346         clock_gettime_mono(&ts1);
1347         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1348         clock_gettime_mono(&ts2);
1349         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1350
1351         if (timediff > audit_timeout) {
1352                 smb_time_audit_log_fsp("lock", timediff, fsp);
1353         }
1354
1355         return result;
1356 }
1357
1358 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1359                                        struct files_struct *fsp,
1360                                        uint32_t share_mode, uint32_t access_mask)
1361 {
1362         int result;
1363         struct timespec ts1,ts2;
1364         double timediff;
1365
1366         clock_gettime_mono(&ts1);
1367         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
1368                                            access_mask);
1369         clock_gettime_mono(&ts2);
1370         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1371
1372         if (timediff > audit_timeout) {
1373                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1374         }
1375
1376         return result;
1377 }
1378
1379 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1380                                          files_struct *fsp,
1381                                          int leasetype)
1382 {
1383         int result;
1384         struct timespec ts1,ts2;
1385         double timediff;
1386
1387         clock_gettime_mono(&ts1);
1388         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1389         clock_gettime_mono(&ts2);
1390         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1391
1392         if (timediff > audit_timeout) {
1393                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1394         }
1395
1396         return result;
1397 }
1398
1399 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1400                                    files_struct *fsp,
1401                                    off_t *poffset, off_t *pcount,
1402                                    int *ptype, pid_t *ppid)
1403 {
1404         bool result;
1405         struct timespec ts1,ts2;
1406         double timediff;
1407
1408         clock_gettime_mono(&ts1);
1409         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1410                                       ppid);
1411         clock_gettime_mono(&ts2);
1412         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1413
1414         if (timediff > audit_timeout) {
1415                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1416         }
1417
1418         return result;
1419 }
1420
1421 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1422                                   const char *oldpath, const char *newpath)
1423 {
1424         int result;
1425         struct timespec ts1,ts2;
1426         double timediff;
1427
1428         clock_gettime_mono(&ts1);
1429         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1430         clock_gettime_mono(&ts2);
1431         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1432
1433         if (timediff > audit_timeout) {
1434                 smb_time_audit_log_fname("symlink", timediff, newpath);
1435         }
1436
1437         return result;
1438 }
1439
1440 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1441                           const char *path, char *buf, size_t bufsiz)
1442 {
1443         int result;
1444         struct timespec ts1,ts2;
1445         double timediff;
1446
1447         clock_gettime_mono(&ts1);
1448         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1449         clock_gettime_mono(&ts2);
1450         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1451
1452         if (timediff > audit_timeout) {
1453                 smb_time_audit_log_fname("readlink", timediff, path);
1454         }
1455
1456         return result;
1457 }
1458
1459 static int smb_time_audit_link(vfs_handle_struct *handle,
1460                                const char *oldpath, const char *newpath)
1461 {
1462         int result;
1463         struct timespec ts1,ts2;
1464         double timediff;
1465
1466         clock_gettime_mono(&ts1);
1467         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1468         clock_gettime_mono(&ts2);
1469         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1470
1471         if (timediff > audit_timeout) {
1472                 smb_time_audit_log_fname("link", timediff, newpath);
1473         }
1474
1475         return result;
1476 }
1477
1478 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1479                                 const struct smb_filename *smb_fname,
1480                                 mode_t mode,
1481                                 SMB_DEV_T dev)
1482 {
1483         int result;
1484         struct timespec ts1,ts2;
1485         double timediff;
1486
1487         clock_gettime_mono(&ts1);
1488         result = SMB_VFS_NEXT_MKNOD(handle, smb_fname, mode, dev);
1489         clock_gettime_mono(&ts2);
1490         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1491
1492         if (timediff > audit_timeout) {
1493                 smb_time_audit_log_smb_fname("mknod", timediff, smb_fname);
1494         }
1495
1496         return result;
1497 }
1498
1499 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1500                                      const char *path)
1501 {
1502         char *result;
1503         struct timespec ts1,ts2;
1504         double timediff;
1505
1506         clock_gettime_mono(&ts1);
1507         result = SMB_VFS_NEXT_REALPATH(handle, path);
1508         clock_gettime_mono(&ts2);
1509         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1510
1511         if (timediff > audit_timeout) {
1512                 smb_time_audit_log_fname("realpath", timediff, path);
1513         }
1514
1515         return result;
1516 }
1517
1518 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1519                                 const struct smb_filename *smb_fname,
1520                                 unsigned int flags)
1521 {
1522         int result;
1523         struct timespec ts1,ts2;
1524         double timediff;
1525
1526         clock_gettime_mono(&ts1);
1527         result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1528         clock_gettime_mono(&ts2);
1529         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1530
1531         if (timediff > audit_timeout) {
1532                 smb_time_audit_log_smb_fname("chflags", timediff, smb_fname);
1533         }
1534
1535         return result;
1536 }
1537
1538 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1539                                                     const SMB_STRUCT_STAT *sbuf)
1540 {
1541         struct file_id id_zero;
1542         struct file_id result;
1543         struct timespec ts1,ts2;
1544         double timediff;
1545
1546         ZERO_STRUCT(id_zero);
1547
1548         clock_gettime_mono(&ts1);
1549         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1550         clock_gettime_mono(&ts2);
1551         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1552
1553         if (timediff > audit_timeout) {
1554                 smb_time_audit_log("file_id_create", timediff);
1555         }
1556
1557         return result;
1558 }
1559
1560 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1561                                           struct files_struct *fsp,
1562                                           const struct smb_filename *smb_fname,
1563                                           TALLOC_CTX *mem_ctx,
1564                                           unsigned int *pnum_streams,
1565                                           struct stream_struct **pstreams)
1566 {
1567         NTSTATUS result;
1568         struct timespec ts1,ts2;
1569         double timediff;
1570
1571         clock_gettime_mono(&ts1);
1572         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1573                                          pnum_streams, pstreams);
1574         clock_gettime_mono(&ts2);
1575         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1576
1577         if (timediff > audit_timeout) {
1578                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1579         }
1580
1581         return result;
1582 }
1583
1584 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1585                                             const char *path,
1586                                             const char *name,
1587                                             TALLOC_CTX *mem_ctx,
1588                                             char **found_name)
1589 {
1590         int result;
1591         struct timespec ts1,ts2;
1592         double timediff;
1593
1594         clock_gettime_mono(&ts1);
1595         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1596                                                 found_name);
1597         clock_gettime_mono(&ts2);
1598         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1599
1600         if (timediff > audit_timeout) {
1601                 smb_time_audit_log_fname("get_real_filename", timediff, path);
1602         }
1603
1604         return result;
1605 }
1606
1607 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1608                                               const char *fname)
1609 {
1610         const char *result;
1611         struct timespec ts1,ts2;
1612         double timediff;
1613
1614         clock_gettime_mono(&ts1);
1615         result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1616         clock_gettime_mono(&ts2);
1617         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1618
1619         if (timediff > audit_timeout) {
1620                 smb_time_audit_log_fname("connectpath", timediff, fname);
1621         }
1622
1623         return result;
1624 }
1625
1626 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1627                                                 struct byte_range_lock *br_lck,
1628                                                 struct lock_struct *plock,
1629                                                 bool blocking_lock)
1630 {
1631         NTSTATUS result;
1632         struct timespec ts1,ts2;
1633         double timediff;
1634
1635         clock_gettime_mono(&ts1);
1636         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1637                                                blocking_lock);
1638         clock_gettime_mono(&ts2);
1639         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1640
1641         if (timediff > audit_timeout) {
1642                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1643                                        brl_fsp(br_lck));
1644         }
1645
1646         return result;
1647 }
1648
1649 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1650                                               struct messaging_context *msg_ctx,
1651                                               struct byte_range_lock *br_lck,
1652                                               const struct lock_struct *plock)
1653 {
1654         bool result;
1655         struct timespec ts1,ts2;
1656         double timediff;
1657
1658         clock_gettime_mono(&ts1);
1659         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1660                                                  plock);
1661         clock_gettime_mono(&ts2);
1662         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1663
1664         if (timediff > audit_timeout) {
1665                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1666                                        brl_fsp(br_lck));
1667         }
1668
1669         return result;
1670 }
1671
1672 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1673                                               struct byte_range_lock *br_lck,
1674                                               struct lock_struct *plock)
1675 {
1676         bool result;
1677         struct timespec ts1,ts2;
1678         double timediff;
1679
1680         clock_gettime_mono(&ts1);
1681         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1682         clock_gettime_mono(&ts2);
1683         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1684
1685         if (timediff > audit_timeout) {
1686                 smb_time_audit_log_fsp("brl_cancel_windows", timediff,
1687                                        brl_fsp(br_lck));
1688         }
1689
1690         return result;
1691 }
1692
1693 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1694                                        struct files_struct *fsp,
1695                                        struct lock_struct *plock)
1696 {
1697         bool result;
1698         struct timespec ts1,ts2;
1699         double timediff;
1700
1701         clock_gettime_mono(&ts1);
1702         result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1703         clock_gettime_mono(&ts2);
1704         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1705
1706         if (timediff > audit_timeout) {
1707                 smb_time_audit_log_fsp("strict_lock", timediff, fsp);
1708         }
1709
1710         return result;
1711 }
1712
1713 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1714                                          struct files_struct *fsp,
1715                                          struct lock_struct *plock)
1716 {
1717         struct timespec ts1,ts2;
1718         double timediff;
1719
1720         clock_gettime_mono(&ts1);
1721         SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1722         clock_gettime_mono(&ts2);
1723         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1724
1725         if (timediff > audit_timeout) {
1726                 smb_time_audit_log_fsp("strict_unlock", timediff, fsp);
1727         }
1728 }
1729
1730 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1731                                               const char *name,
1732                                               enum vfs_translate_direction direction,
1733                                               TALLOC_CTX *mem_ctx,
1734                                               char **mapped_name)
1735 {
1736         NTSTATUS result;
1737         struct timespec ts1,ts2;
1738         double timediff;
1739
1740         clock_gettime_mono(&ts1);
1741         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1742                                              mapped_name);
1743         clock_gettime_mono(&ts2);
1744         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1745
1746         if (timediff > audit_timeout) {
1747                 smb_time_audit_log_fname("translate_name", timediff, name);
1748         }
1749
1750         return result;
1751 }
1752
1753 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1754                                 struct files_struct *fsp,
1755                                 TALLOC_CTX *ctx,
1756                                 uint32_t function,
1757                                 uint16_t req_flags,
1758                                 const uint8_t *_in_data,
1759                                 uint32_t in_len,
1760                                 uint8_t **_out_data,
1761                                 uint32_t max_out_len,
1762                                 uint32_t *out_len)
1763 {
1764         NTSTATUS result;
1765         struct timespec ts1,ts2;
1766         double timediff;
1767
1768         clock_gettime_mono(&ts1);
1769         result = SMB_VFS_NEXT_FSCTL(handle,
1770                                 fsp,
1771                                 ctx,
1772                                 function,
1773                                 req_flags,
1774                                 _in_data,
1775                                 in_len,
1776                                 _out_data,
1777                                 max_out_len,
1778                                 out_len);
1779         clock_gettime_mono(&ts2);
1780         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1781
1782         if (timediff > audit_timeout) {
1783                 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1784         }
1785
1786         return result;
1787 }
1788
1789 static NTSTATUS smb_time_get_dos_attributes(struct vfs_handle_struct *handle,
1790                                         struct smb_filename *smb_fname,
1791                                         uint32_t *dosmode)
1792 {
1793         NTSTATUS result;
1794         struct timespec ts1,ts2;
1795         double timediff;
1796
1797         clock_gettime_mono(&ts1);
1798         result = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
1799                                 smb_fname,
1800                                 dosmode);
1801         clock_gettime_mono(&ts2);
1802         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1803
1804         if (timediff > audit_timeout) {
1805                 smb_time_audit_log_fname("get_dos_attributes",
1806                                 timediff,
1807                                 smb_fname->base_name);
1808         }
1809
1810         return result;
1811 }
1812
1813 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1814                                         struct files_struct *fsp,
1815                                         uint32_t *dosmode)
1816 {
1817         NTSTATUS result;
1818         struct timespec ts1,ts2;
1819         double timediff;
1820
1821         clock_gettime_mono(&ts1);
1822         result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1823                                 fsp,
1824                                 dosmode);
1825         clock_gettime_mono(&ts2);
1826         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1827
1828         if (timediff > audit_timeout) {
1829                 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1830         }
1831
1832         return result;
1833 }
1834
1835 static NTSTATUS smb_time_set_dos_attributes(struct vfs_handle_struct *handle,
1836                                         const struct smb_filename *smb_fname,
1837                                         uint32_t dosmode)
1838 {
1839         NTSTATUS result;
1840         struct timespec ts1,ts2;
1841         double timediff;
1842
1843         clock_gettime_mono(&ts1);
1844         result = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
1845                                 smb_fname,
1846                                 dosmode);
1847         clock_gettime_mono(&ts2);
1848         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1849
1850         if (timediff > audit_timeout) {
1851                 smb_time_audit_log_fname("set_dos_attributes",
1852                                 timediff,
1853                                 smb_fname->base_name);
1854         }
1855
1856         return result;
1857 }
1858
1859 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
1860                                         struct files_struct *fsp,
1861                                         uint32_t dosmode)
1862 {
1863         NTSTATUS result;
1864         struct timespec ts1,ts2;
1865         double timediff;
1866
1867         clock_gettime_mono(&ts1);
1868         result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
1869                                 fsp,
1870                                 dosmode);
1871         clock_gettime_mono(&ts2);
1872         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1873
1874         if (timediff > audit_timeout) {
1875                 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
1876         }
1877
1878         return result;
1879 }
1880
1881 struct time_audit_cc_state {
1882         struct timespec ts_send;
1883         struct vfs_handle_struct *handle;
1884         off_t copied;
1885 };
1886 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq);
1887
1888 static struct tevent_req *smb_time_audit_copy_chunk_send(struct vfs_handle_struct *handle,
1889                                                          TALLOC_CTX *mem_ctx,
1890                                                          struct tevent_context *ev,
1891                                                          struct files_struct *src_fsp,
1892                                                          off_t src_off,
1893                                                          struct files_struct *dest_fsp,
1894                                                          off_t dest_off,
1895                                                          off_t num,
1896                                                          uint32_t flags)
1897 {
1898         struct tevent_req *req;
1899         struct tevent_req *subreq;
1900         struct time_audit_cc_state *cc_state;
1901
1902         req = tevent_req_create(mem_ctx, &cc_state, struct time_audit_cc_state);
1903         if (req == NULL) {
1904                 return NULL;
1905         }
1906
1907         cc_state->handle = handle;
1908         clock_gettime_mono(&cc_state->ts_send);
1909         subreq = SMB_VFS_NEXT_COPY_CHUNK_SEND(handle, cc_state, ev,
1910                                               src_fsp, src_off,
1911                                               dest_fsp, dest_off, num, flags);
1912         if (tevent_req_nomem(subreq, req)) {
1913                 return tevent_req_post(req, ev);
1914         }
1915
1916         tevent_req_set_callback(subreq, smb_time_audit_copy_chunk_done, req);
1917         return req;
1918 }
1919
1920 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq)
1921 {
1922         struct tevent_req *req = tevent_req_callback_data(
1923                 subreq, struct tevent_req);
1924         struct time_audit_cc_state *cc_state
1925                         = tevent_req_data(req, struct time_audit_cc_state);
1926         NTSTATUS status;
1927
1928         status = SMB_VFS_NEXT_COPY_CHUNK_RECV(cc_state->handle,
1929                                               subreq,
1930                                               &cc_state->copied);
1931         TALLOC_FREE(subreq);
1932         if (tevent_req_nterror(req, status)) {
1933                 return;
1934         }
1935         tevent_req_done(req);
1936 }
1937
1938 static NTSTATUS smb_time_audit_copy_chunk_recv(struct vfs_handle_struct *handle,
1939                                                struct tevent_req *req,
1940                                                off_t *copied)
1941 {
1942         struct time_audit_cc_state *cc_state
1943                         = tevent_req_data(req, struct time_audit_cc_state);
1944         struct timespec ts_recv;
1945         double timediff;
1946         NTSTATUS status;
1947
1948         clock_gettime_mono(&ts_recv);
1949         timediff = nsec_time_diff(&ts_recv, &cc_state->ts_send)*1.0e-9;
1950         if (timediff > audit_timeout) {
1951                 smb_time_audit_log("copy_chunk", timediff);
1952         }
1953
1954         *copied = cc_state->copied;
1955         if (tevent_req_is_nterror(req, &status)) {
1956                 tevent_req_received(req);
1957                 return status;
1958         }
1959
1960         tevent_req_received(req);
1961         return NT_STATUS_OK;
1962 }
1963
1964 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
1965                                                TALLOC_CTX *mem_ctx,
1966                                                struct files_struct *fsp,
1967                                                struct smb_filename *smb_fname,
1968                                                uint16_t *_compression_fmt)
1969 {
1970         NTSTATUS result;
1971         struct timespec ts1,ts2;
1972         double timediff;
1973
1974         clock_gettime_mono(&ts1);
1975         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1976                                               _compression_fmt);
1977         clock_gettime_mono(&ts2);
1978         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1979
1980         if (timediff > audit_timeout) {
1981                 if (fsp !=  NULL) {
1982                         smb_time_audit_log_fsp("get_compression",
1983                                                timediff, fsp);
1984                 } else {
1985                         smb_time_audit_log_smb_fname("get_compression",
1986                                                      timediff, smb_fname);
1987                 }
1988         }
1989
1990         return result;
1991 }
1992
1993 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
1994                                                TALLOC_CTX *mem_ctx,
1995                                                struct files_struct *fsp,
1996                                                uint16_t compression_fmt)
1997 {
1998         NTSTATUS result;
1999         struct timespec ts1,ts2;
2000         double timediff;
2001
2002         clock_gettime_mono(&ts1);
2003         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2004                                               compression_fmt);
2005         clock_gettime_mono(&ts2);
2006         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2007
2008         if (timediff > audit_timeout) {
2009                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2010         }
2011
2012         return result;
2013 }
2014
2015 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
2016                                             const struct smb_filename *fname,
2017                                             TALLOC_CTX *mem_ctx,
2018                                             struct readdir_attr_data **pattr_data)
2019 {
2020         NTSTATUS status;
2021         struct timespec ts1,ts2;
2022         double timediff;
2023
2024         clock_gettime_mono(&ts1);
2025         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2026         clock_gettime_mono(&ts2);
2027         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2028
2029         if (timediff > audit_timeout) {
2030                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
2031         }
2032
2033         return status;
2034 }
2035
2036 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2037                                            files_struct *fsp,
2038                                            uint32_t security_info,
2039                                            TALLOC_CTX *mem_ctx,
2040                                            struct security_descriptor **ppdesc)
2041 {
2042         NTSTATUS result;
2043         struct timespec ts1,ts2;
2044         double timediff;
2045
2046         clock_gettime_mono(&ts1);
2047         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2048                                           mem_ctx, ppdesc);
2049         clock_gettime_mono(&ts2);
2050         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2051
2052         if (timediff > audit_timeout) {
2053                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2054         }
2055
2056         return result;
2057 }
2058
2059 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
2060                                           const struct smb_filename *smb_fname,
2061                                           uint32_t security_info,
2062                                           TALLOC_CTX *mem_ctx,
2063                                           struct security_descriptor **ppdesc)
2064 {
2065         NTSTATUS result;
2066         struct timespec ts1,ts2;
2067         double timediff;
2068
2069         clock_gettime_mono(&ts1);
2070         result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2071                                          mem_ctx, ppdesc);
2072         clock_gettime_mono(&ts2);
2073         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2074
2075         if (timediff > audit_timeout) {
2076                 smb_time_audit_log_fname("get_nt_acl",
2077                         timediff,
2078                         smb_fname->base_name);
2079         }
2080
2081         return result;
2082 }
2083
2084 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2085                                            files_struct *fsp,
2086                                            uint32_t security_info_sent,
2087                                            const struct security_descriptor *psd)
2088 {
2089         NTSTATUS result;
2090         struct timespec ts1,ts2;
2091         double timediff;
2092
2093         clock_gettime_mono(&ts1);
2094         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2095                                           psd);
2096         clock_gettime_mono(&ts2);
2097         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2098
2099         if (timediff > audit_timeout) {
2100                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2101         }
2102
2103         return result;
2104 }
2105
2106 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2107                                 struct smb_filename *smb_fname,
2108                                 struct security_acl *sacl,
2109                                 uint32_t access_requested,
2110                                 uint32_t access_denied)
2111 {
2112         NTSTATUS result;
2113         struct timespec ts1,ts2;
2114         double timediff;
2115
2116         clock_gettime_mono(&ts1);
2117         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2118                                         smb_fname,
2119                                         sacl,
2120                                         access_requested,
2121                                         access_denied);
2122         clock_gettime_mono(&ts2);
2123         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2124
2125         if (timediff > audit_timeout) {
2126                 smb_time_audit_log_fname("audit_file",
2127                         timediff,
2128                         smb_fname->base_name);
2129         }
2130
2131         return result;
2132 }
2133
2134
2135
2136 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
2137                         const struct smb_filename *smb_fname,
2138                         mode_t mode)
2139 {
2140         int result;
2141         struct timespec ts1,ts2;
2142         double timediff;
2143
2144         clock_gettime_mono(&ts1);
2145         result = SMB_VFS_NEXT_CHMOD_ACL(handle, smb_fname, mode);
2146         clock_gettime_mono(&ts2);
2147         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2148
2149         if (timediff > audit_timeout) {
2150                 smb_time_audit_log_fname("chmod_acl",
2151                         timediff,
2152                         smb_fname->base_name);
2153         }
2154
2155         return result;
2156 }
2157
2158 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
2159                                      files_struct *fsp, mode_t mode)
2160 {
2161         int result;
2162         struct timespec ts1,ts2;
2163         double timediff;
2164
2165         clock_gettime_mono(&ts1);
2166         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
2167         clock_gettime_mono(&ts2);
2168         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2169
2170         if (timediff > audit_timeout) {
2171                 smb_time_audit_log_fsp("fchmod_acl", timediff, fsp);
2172         }
2173
2174         return result;
2175 }
2176
2177 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2178                                         const struct smb_filename *smb_fname,
2179                                         SMB_ACL_TYPE_T type,
2180                                         TALLOC_CTX *mem_ctx)
2181 {
2182         SMB_ACL_T result;
2183         struct timespec ts1,ts2;
2184         double timediff;
2185
2186         clock_gettime_mono(&ts1);
2187         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2188                                 type, mem_ctx);
2189         clock_gettime_mono(&ts2);
2190         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2191
2192         if (timediff > audit_timeout) {
2193                 smb_time_audit_log_fname("sys_acl_get_file", timediff,
2194                         smb_fname->base_name);
2195         }
2196
2197         return result;
2198 }
2199
2200 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2201                                                files_struct *fsp,
2202                                                TALLOC_CTX *mem_ctx)
2203 {
2204         SMB_ACL_T result;
2205         struct timespec ts1,ts2;
2206         double timediff;
2207
2208         clock_gettime_mono(&ts1);
2209         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2210         clock_gettime_mono(&ts2);
2211         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2212
2213         if (timediff > audit_timeout) {
2214                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2215         }
2216
2217         return result;
2218 }
2219
2220
2221 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2222                                 const struct smb_filename *smb_fname,
2223                                 TALLOC_CTX *mem_ctx,
2224                                 char **blob_description,
2225                                 DATA_BLOB *blob)
2226 {
2227         int result;
2228         struct timespec ts1,ts2;
2229         double timediff;
2230
2231         clock_gettime_mono(&ts1);
2232         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2233                                 mem_ctx, blob_description, blob);
2234         clock_gettime_mono(&ts2);
2235         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2236
2237         if (timediff > audit_timeout) {
2238                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2239         }
2240
2241         return result;
2242 }
2243
2244 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2245                                               files_struct *fsp,
2246                                               TALLOC_CTX *mem_ctx,
2247                                               char **blob_description,
2248                                               DATA_BLOB *blob)
2249 {
2250         int result;
2251         struct timespec ts1,ts2;
2252         double timediff;
2253
2254         clock_gettime_mono(&ts1);
2255         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2256         clock_gettime_mono(&ts2);
2257         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2258
2259         if (timediff > audit_timeout) {
2260                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2261         }
2262
2263         return result;
2264 }
2265
2266 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2267                                            const struct smb_filename *smb_fname,
2268                                            SMB_ACL_TYPE_T acltype,
2269                                            SMB_ACL_T theacl)
2270 {
2271         int result;
2272         struct timespec ts1,ts2;
2273         double timediff;
2274
2275         clock_gettime_mono(&ts1);
2276         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2277                                                theacl);
2278         clock_gettime_mono(&ts2);
2279         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2280
2281         if (timediff > audit_timeout) {
2282                 smb_time_audit_log_fname("sys_acl_set_file", timediff,
2283                         smb_fname->base_name);
2284         }
2285
2286         return result;
2287 }
2288
2289 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2290                                          files_struct *fsp,
2291                                          SMB_ACL_T theacl)
2292 {
2293         int result;
2294         struct timespec ts1,ts2;
2295         double timediff;
2296
2297         clock_gettime_mono(&ts1);
2298         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2299         clock_gettime_mono(&ts2);
2300         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2301
2302         if (timediff > audit_timeout) {
2303                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2304         }
2305
2306         return result;
2307 }
2308
2309 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2310                                 const struct smb_filename *smb_fname)
2311 {
2312         int result;
2313         struct timespec ts1,ts2;
2314         double timediff;
2315
2316         clock_gettime_mono(&ts1);
2317         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2318         clock_gettime_mono(&ts2);
2319         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2320
2321         if (timediff > audit_timeout) {
2322                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff,
2323                         smb_fname->base_name);
2324         }
2325
2326         return result;
2327 }
2328
2329 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2330                                 const struct smb_filename *smb_fname,
2331                                 const char *name,
2332                                 void *value,
2333                                 size_t size)
2334 {
2335         ssize_t result;
2336         struct timespec ts1,ts2;
2337         double timediff;
2338
2339         clock_gettime_mono(&ts1);
2340         result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2341         clock_gettime_mono(&ts2);
2342         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2343
2344         if (timediff > audit_timeout) {
2345                 smb_time_audit_log_fname("getxattr", timediff,
2346                         smb_fname->base_name);
2347         }
2348
2349         return result;
2350 }
2351
2352 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2353                                         struct files_struct *fsp,
2354                                         const char *name, void *value,
2355                                         size_t size)
2356 {
2357         ssize_t result;
2358         struct timespec ts1,ts2;
2359         double timediff;
2360
2361         clock_gettime_mono(&ts1);
2362         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2363         clock_gettime_mono(&ts2);
2364         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2365
2366         if (timediff > audit_timeout) {
2367                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2368         }
2369
2370         return result;
2371 }
2372
2373 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2374                                         const struct smb_filename *smb_fname,
2375                                         char *list,
2376                                         size_t size)
2377 {
2378         ssize_t result;
2379         struct timespec ts1,ts2;
2380         double timediff;
2381
2382         clock_gettime_mono(&ts1);
2383         result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2384         clock_gettime_mono(&ts2);
2385         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2386
2387         if (timediff > audit_timeout) {
2388                 smb_time_audit_log_fname("listxattr", timediff,
2389                                 smb_fname->base_name);
2390         }
2391
2392         return result;
2393 }
2394
2395 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2396                                          struct files_struct *fsp, char *list,
2397                                          size_t size)
2398 {
2399         ssize_t result;
2400         struct timespec ts1,ts2;
2401         double timediff;
2402
2403         clock_gettime_mono(&ts1);
2404         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2405         clock_gettime_mono(&ts2);
2406         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2407
2408         if (timediff > audit_timeout) {
2409                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2410         }
2411
2412         return result;
2413 }
2414
2415 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2416                                 const struct smb_filename *smb_fname,
2417                                 const char *name)
2418 {
2419         int result;
2420         struct timespec ts1,ts2;
2421         double timediff;
2422
2423         clock_gettime_mono(&ts1);
2424         result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2425         clock_gettime_mono(&ts2);
2426         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2427
2428         if (timediff > audit_timeout) {
2429                 smb_time_audit_log_fname("removexattr", timediff,
2430                         smb_fname->base_name);
2431         }
2432
2433         return result;
2434 }
2435
2436 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2437                                        struct files_struct *fsp,
2438                                        const char *name)
2439 {
2440         int result;
2441         struct timespec ts1,ts2;
2442         double timediff;
2443
2444         clock_gettime_mono(&ts1);
2445         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2446         clock_gettime_mono(&ts2);
2447         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2448
2449         if (timediff > audit_timeout) {
2450                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2451         }
2452
2453         return result;
2454 }
2455
2456 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2457                                 const struct smb_filename *smb_fname,
2458                                 const char *name,
2459                                 const void *value,
2460                                 size_t size,
2461                                 int flags)
2462 {
2463         int result;
2464         struct timespec ts1,ts2;
2465         double timediff;
2466
2467         clock_gettime_mono(&ts1);
2468         result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2469                                        flags);
2470         clock_gettime_mono(&ts2);
2471         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2472
2473         if (timediff > audit_timeout) {
2474                 smb_time_audit_log_fname("setxattr", timediff,
2475                                 smb_fname->base_name);
2476         }
2477
2478         return result;
2479 }
2480
2481 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2482                                     struct files_struct *fsp, const char *name,
2483                                     const void *value, size_t size, int flags)
2484 {
2485         int result;
2486         struct timespec ts1,ts2;
2487         double timediff;
2488
2489         clock_gettime_mono(&ts1);
2490         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2491         clock_gettime_mono(&ts2);
2492         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2493
2494         if (timediff > audit_timeout) {
2495                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2496         }
2497
2498         return result;
2499 }
2500
2501 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2502                                      struct files_struct *fsp)
2503 {
2504         bool result;
2505         struct timespec ts1,ts2;
2506         double timediff;
2507
2508         clock_gettime_mono(&ts1);
2509         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2510         clock_gettime_mono(&ts2);
2511         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2512
2513         if (timediff > audit_timeout) {
2514                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2515         }
2516
2517         return result;
2518 }
2519
2520 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2521                                               struct files_struct *fsp,
2522                                               TALLOC_CTX *mem_ctx,
2523                                               DATA_BLOB *cookie)
2524 {
2525         NTSTATUS result;
2526         struct timespec ts1,ts2;
2527         double timediff;
2528
2529         clock_gettime_mono(&ts1);
2530         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2531         clock_gettime_mono(&ts2);
2532         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2533
2534         if (timediff > audit_timeout) {
2535                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2536         }
2537
2538         return result;
2539 }
2540
2541 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2542                                                   struct files_struct *fsp,
2543                                                   const DATA_BLOB old_cookie,
2544                                                   TALLOC_CTX *mem_ctx,
2545                                                   DATA_BLOB *new_cookie)
2546 {
2547         NTSTATUS result;
2548         struct timespec ts1,ts2;
2549         double timediff;
2550
2551         clock_gettime_mono(&ts1);
2552         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2553                                                  mem_ctx, new_cookie);
2554         clock_gettime_mono(&ts2);
2555         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2556
2557         if (timediff > audit_timeout) {
2558                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2559         }
2560
2561         return result;
2562 }
2563
2564 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2565                                                  struct smb_request *smb1req,
2566                                                  struct smbXsrv_open *op,
2567                                                  const DATA_BLOB old_cookie,
2568                                                  TALLOC_CTX *mem_ctx,
2569                                                  struct files_struct **fsp,
2570                                                  DATA_BLOB *new_cookie)
2571 {
2572         NTSTATUS result;
2573         struct timespec ts1,ts2;
2574         double timediff;
2575
2576         clock_gettime_mono(&ts1);
2577         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2578                                                 mem_ctx, fsp, new_cookie);
2579         clock_gettime_mono(&ts2);
2580         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2581
2582         if (timediff > audit_timeout) {
2583                 smb_time_audit_log("durable_reconnect", timediff);
2584         }
2585
2586         return result;
2587 }
2588
2589 /* VFS operations */
2590
2591 static struct vfs_fn_pointers vfs_time_audit_fns = {
2592         .connect_fn = smb_time_audit_connect,
2593         .disconnect_fn = smb_time_audit_disconnect,
2594         .disk_free_fn = smb_time_audit_disk_free,
2595         .get_quota_fn = smb_time_audit_get_quota,
2596         .set_quota_fn = smb_time_audit_set_quota,
2597         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2598         .statvfs_fn = smb_time_audit_statvfs,
2599         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2600         .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2601         .opendir_fn = smb_time_audit_opendir,
2602         .fdopendir_fn = smb_time_audit_fdopendir,
2603         .readdir_fn = smb_time_audit_readdir,
2604         .seekdir_fn = smb_time_audit_seekdir,
2605         .telldir_fn = smb_time_audit_telldir,
2606         .rewind_dir_fn = smb_time_audit_rewinddir,
2607         .mkdir_fn = smb_time_audit_mkdir,
2608         .rmdir_fn = smb_time_audit_rmdir,
2609         .closedir_fn = smb_time_audit_closedir,
2610         .init_search_op_fn = smb_time_audit_init_search_op,
2611         .open_fn = smb_time_audit_open,
2612         .create_file_fn = smb_time_audit_create_file,
2613         .close_fn = smb_time_audit_close,
2614         .read_fn = smb_time_audit_read,
2615         .pread_fn = smb_time_audit_pread,
2616         .pread_send_fn = smb_time_audit_pread_send,
2617         .pread_recv_fn = smb_time_audit_pread_recv,
2618         .write_fn = smb_time_audit_write,
2619         .pwrite_fn = smb_time_audit_pwrite,
2620         .pwrite_send_fn = smb_time_audit_pwrite_send,
2621         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2622         .lseek_fn = smb_time_audit_lseek,
2623         .sendfile_fn = smb_time_audit_sendfile,
2624         .recvfile_fn = smb_time_audit_recvfile,
2625         .rename_fn = smb_time_audit_rename,
2626         .fsync_fn = smb_time_audit_fsync,
2627         .fsync_send_fn = smb_time_audit_fsync_send,
2628         .fsync_recv_fn = smb_time_audit_fsync_recv,
2629         .stat_fn = smb_time_audit_stat,
2630         .fstat_fn = smb_time_audit_fstat,
2631         .lstat_fn = smb_time_audit_lstat,
2632         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2633         .unlink_fn = smb_time_audit_unlink,
2634         .chmod_fn = smb_time_audit_chmod,
2635         .fchmod_fn = smb_time_audit_fchmod,
2636         .chown_fn = smb_time_audit_chown,
2637         .fchown_fn = smb_time_audit_fchown,
2638         .lchown_fn = smb_time_audit_lchown,
2639         .chdir_fn = smb_time_audit_chdir,
2640         .getwd_fn = smb_time_audit_getwd,
2641         .ntimes_fn = smb_time_audit_ntimes,
2642         .ftruncate_fn = smb_time_audit_ftruncate,
2643         .fallocate_fn = smb_time_audit_fallocate,
2644         .lock_fn = smb_time_audit_lock,
2645         .kernel_flock_fn = smb_time_audit_kernel_flock,
2646         .linux_setlease_fn = smb_time_audit_linux_setlease,
2647         .getlock_fn = smb_time_audit_getlock,
2648         .symlink_fn = smb_time_audit_symlink,
2649         .readlink_fn = smb_time_audit_readlink,
2650         .link_fn = smb_time_audit_link,
2651         .mknod_fn = smb_time_audit_mknod,
2652         .realpath_fn = smb_time_audit_realpath,
2653         .chflags_fn = smb_time_audit_chflags,
2654         .file_id_create_fn = smb_time_audit_file_id_create,
2655         .copy_chunk_send_fn = smb_time_audit_copy_chunk_send,
2656         .copy_chunk_recv_fn = smb_time_audit_copy_chunk_recv,
2657         .get_compression_fn = smb_time_audit_get_compression,
2658         .set_compression_fn = smb_time_audit_set_compression,
2659         .snap_check_path_fn = smb_time_audit_snap_check_path,
2660         .snap_create_fn = smb_time_audit_snap_create,
2661         .snap_delete_fn = smb_time_audit_snap_delete,
2662         .streaminfo_fn = smb_time_audit_streaminfo,
2663         .get_real_filename_fn = smb_time_audit_get_real_filename,
2664         .connectpath_fn = smb_time_audit_connectpath,
2665         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2666         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2667         .brl_cancel_windows_fn = smb_time_audit_brl_cancel_windows,
2668         .strict_lock_fn = smb_time_audit_strict_lock,
2669         .strict_unlock_fn = smb_time_audit_strict_unlock,
2670         .translate_name_fn = smb_time_audit_translate_name,
2671         .fsctl_fn = smb_time_audit_fsctl,
2672         .get_dos_attributes_fn = smb_time_get_dos_attributes,
2673         .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2674         .set_dos_attributes_fn = smb_time_set_dos_attributes,
2675         .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2676         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2677         .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2678         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2679         .audit_file_fn = smb_time_audit_audit_file,
2680         .chmod_acl_fn = smb_time_audit_chmod_acl,
2681         .fchmod_acl_fn = smb_time_audit_fchmod_acl,
2682         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2683         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2684         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2685         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2686         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2687         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2688         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2689         .getxattr_fn = smb_time_audit_getxattr,
2690         .fgetxattr_fn = smb_time_audit_fgetxattr,
2691         .listxattr_fn = smb_time_audit_listxattr,
2692         .flistxattr_fn = smb_time_audit_flistxattr,
2693         .removexattr_fn = smb_time_audit_removexattr,
2694         .fremovexattr_fn = smb_time_audit_fremovexattr,
2695         .setxattr_fn = smb_time_audit_setxattr,
2696         .fsetxattr_fn = smb_time_audit_fsetxattr,
2697         .aio_force_fn = smb_time_audit_aio_force,
2698         .durable_cookie_fn = smb_time_audit_durable_cookie,
2699         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2700         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2701         .readdir_attr_fn = smb_time_audit_readdir_attr,
2702 };
2703
2704
2705 NTSTATUS vfs_time_audit_init(TALLOC_CTX *);
2706 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2707 {
2708         smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2709
2710         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2711                                             10000) / 1000.0;
2712         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2713                                 &vfs_time_audit_fns);
2714 }