s3-vfs: rename open function to open_fn.
[kai/samba.git] / source3 / modules / vfs_smb_traffic_analyzer.c
1 /*
2  * traffic-analyzer VFS module. Measure the smb traffic users create
3  * on the net.
4  *
5  * Copyright (C) Holger Hetterich, 2008-2010
6  * Copyright (C) Jeremy Allison, 2008
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 3 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  */
21
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "../smbd/globals.h"
25 #include "../lib/crypto/crypto.h"
26 #include "vfs_smb_traffic_analyzer.h"
27 #include "../libcli/security/security.h"
28 #include "secrets.h"
29 #include "../librpc/gen_ndr/ndr_netlogon.h"
30 #include "auth.h"
31
32 /* abstraction for the send_over_network function */
33 enum sock_type {INTERNET_SOCKET = 0, UNIX_DOMAIN_SOCKET};
34
35 #define LOCAL_PATHNAME "/var/tmp/stadsocket"
36
37 static int vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
38
39 static enum sock_type smb_traffic_analyzer_connMode(vfs_handle_struct *handle)
40 {
41         connection_struct *conn = handle->conn;
42         const char *Mode;
43         Mode=lp_parm_const_string(SNUM(conn), "smb_traffic_analyzer","mode", \
44                         "internet_socket");
45         if (strstr(Mode,"unix_domain_socket")) {
46                 return UNIX_DOMAIN_SOCKET;
47         } else {
48                 return INTERNET_SOCKET;
49         }
50 }
51
52
53 /* Connect to an internet socket */
54 static int smb_traffic_analyzer_connect_inet_socket(vfs_handle_struct *handle,
55                                         const char *name, uint16_t port)
56 {
57         /* Create a streaming Socket */
58         int sockfd = -1;
59         struct addrinfo hints;
60         struct addrinfo *ailist = NULL;
61         struct addrinfo *res = NULL;
62         int ret;
63
64         ZERO_STRUCT(hints);
65         /* By default make sure it supports TCP. */
66         hints.ai_socktype = SOCK_STREAM;
67         hints.ai_flags = AI_ADDRCONFIG;
68
69         ret = getaddrinfo(name,
70                         NULL,
71                         &hints,
72                         &ailist);
73
74         if (ret) {
75                 DEBUG(3,("smb_traffic_analyzer_connect_inet_socket: "
76                         "getaddrinfo failed for name %s [%s]\n",
77                         name,
78                         gai_strerror(ret) ));
79                 return -1;
80         }
81
82         DEBUG(3,("smb_traffic_analyzer: Internet socket mode. Hostname: %s,"
83                 "Port: %i\n", name, port));
84
85         for (res = ailist; res; res = res->ai_next) {
86                 struct sockaddr_storage ss;
87                 NTSTATUS status;
88
89                 if (!res->ai_addr || res->ai_addrlen == 0) {
90                         continue;
91                 }
92
93                 ZERO_STRUCT(ss);
94                 memcpy(&ss, res->ai_addr, res->ai_addrlen);
95
96                 status = open_socket_out(&ss, port, 10000, &sockfd);
97                 if (NT_STATUS_IS_OK(status)) {
98                         break;
99                 }
100         }
101
102         if (ailist) {
103                 freeaddrinfo(ailist);
104         }
105
106         if (sockfd == -1) {
107                 DEBUG(1, ("smb_traffic_analyzer: unable to create "
108                         "socket, error is %s",
109                         strerror(errno)));
110                 return -1;
111         }
112
113         return sockfd;
114 }
115
116 /* Connect to a unix domain socket */
117 static int smb_traffic_analyzer_connect_unix_socket(vfs_handle_struct *handle,
118                                                 const char *name)
119 {
120         /* Create the socket to stad */
121         int len, sock;
122         struct sockaddr_un remote;
123
124         DEBUG(7, ("smb_traffic_analyzer_connect_unix_socket: "
125                         "Unix domain socket mode. Using %s\n",
126                         name ));
127
128         if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
129                 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
130                         "Couldn't create socket, "
131                         "make sure stad is running!\n"));
132                 return -1;
133         }
134         remote.sun_family = AF_UNIX;
135         strlcpy(remote.sun_path, name,
136                     sizeof(remote.sun_path));
137         len=strlen(remote.sun_path) + sizeof(remote.sun_family);
138         if (connect(sock, (struct sockaddr *)&remote, len) == -1 ) {
139                 DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
140                         "Could not connect to "
141                         "socket, make sure\nstad is running!\n"));
142                 close(sock);
143                 return -1;
144         }
145         return sock;
146 }
147
148 /* Private data allowing shared connection sockets. */
149 struct refcounted_sock {
150         struct refcounted_sock *next, *prev;
151         char *name;
152         uint16_t port;
153         int sock;
154         unsigned int ref_count;
155 };
156
157
158 /**
159  * Encryption of a data block with AES
160  * TALLOC_CTX *ctx      Talloc context to work on
161  * const char *akey     128bit key for the encryption
162  * const char *str      Data buffer to encrypt, \0 terminated
163  * int *len             Will be set to the length of the
164  *                      resulting data block
165  * The caller has to take care for the memory
166  * allocated on the context.
167  */
168 static char *smb_traffic_analyzer_encrypt( TALLOC_CTX *ctx,
169         const char *akey, const char *str, size_t *len)
170 {
171         int s1,s2,h,d;
172         AES_KEY key;
173         unsigned char filler[17]= "................";
174         char *output;
175         unsigned char crypted[18];
176         if (akey == NULL) return NULL;
177         samba_AES_set_encrypt_key((unsigned char *) akey, 128, &key);
178         s1 = strlen(str) / 16;
179         s2 = strlen(str) % 16;
180         for (h = 0; h < s2; h++) *(filler+h)=*(str+(s1*16)+h);
181         DEBUG(10, ("smb_traffic_analyzer_send_data_socket: created %s"
182                 " as filling block.\n", filler));
183         output = talloc_array(ctx, char, (s1*16)+17 );
184         d=0;
185         for (h = 0; h < s1; h++) {
186                 samba_AES_encrypt((unsigned char *) str+(16*h), crypted, &key);
187                 for (d = 0; d<16; d++) output[d+(16*h)]=crypted[d];
188         }
189         samba_AES_encrypt( (unsigned char *) str+(16*h), filler, &key );
190         for (d = 0;d < 16; d++) output[d+(16*h)]=*(filler+d);
191         *len = (s1*16)+16;
192         return output;  
193 }
194
195 /**
196  * Create a v2 header.
197  * TALLLOC_CTX *ctx             Talloc context to work on
198  * const char *state_flags      State flag string
199  * int len                      length of the data block
200  */
201 static char *smb_traffic_analyzer_create_header( TALLOC_CTX *ctx,
202         const char *state_flags, size_t data_len)
203 {
204         char *header = talloc_asprintf( ctx, "V2.%s%017u",
205                                         state_flags, (unsigned int) data_len);
206         DEBUG(10, ("smb_traffic_analyzer_send_data_socket: created Header:\n"));
207         dump_data(10, (uint8_t *)header, strlen(header));
208         return header;
209 }
210
211
212 /**
213  * Actually send header and data over the network
214  * char *header         Header data
215  * char *data           Data Block
216  * int dlength          Length of data block
217  * int socket
218  */
219 static void smb_traffic_analyzer_write_data( char *header, char *data,
220                         int dlength, int _socket)
221 {
222                 int len = strlen(header);
223                 if (write_data( _socket, header, len) != len) {
224                         DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
225                                                 "error sending the header"
226                                                 " over the socket!\n"));
227                 }
228                 DEBUG(10,("smb_traffic_analyzer_write_data: sending data:\n"));
229                 dump_data( 10, (uint8_t *)data, dlength);
230
231                 if (write_data( _socket, data, dlength) != dlength) {
232                         DEBUG(1, ("smb_traffic_analyzer_write_data: "
233                                 "error sending crypted data to socket!\n"));
234                 }
235 }
236
237
238 /*
239  * Anonymize a string if required.
240  * TALLOC_CTX *ctx                      The talloc context to work on
241  * const char *str                      The string to anonymize
242  * vfs_handle_struct *handle            The handle struct to work on
243  *
244  * Returns a newly allocated string, either the anonymized one,
245  * or a copy of const char *str. The caller has to take care for
246  * freeing the allocated memory.
247  */
248 static char *smb_traffic_analyzer_anonymize( TALLOC_CTX *ctx,
249                                         const char *str,
250                                         vfs_handle_struct *handle )
251 {
252         const char *total_anonymization;
253         const char *anon_prefix;
254         char *output;
255         total_anonymization=lp_parm_const_string(SNUM(handle->conn),
256                                         "smb_traffic_analyzer",
257                                         "total_anonymization", NULL);
258
259         anon_prefix=lp_parm_const_string(SNUM(handle->conn),
260                                         "smb_traffic_analyzer",
261                                         "anonymize_prefix", NULL );
262         if (anon_prefix != NULL) {
263                 if (total_anonymization != NULL) {
264                         output = talloc_asprintf(ctx, "%s",
265                                         anon_prefix);
266                 } else {
267                 output = talloc_asprintf(ctx, "%s%i", anon_prefix,
268                                                 str_checksum(str));
269                 }
270         } else {
271                 output = talloc_asprintf(ctx, "%s", str);
272         }
273
274         return output;
275 }
276
277
278 /**
279  * The marshalling function for protocol v2.
280  * TALLOC_CTX *ctx              Talloc context to work on
281  * struct tm *tm                tm struct for the timestamp
282  * int seconds                  milliseconds of the timestamp
283  * vfs_handle_struct *handle    vfs_handle_struct
284  * char *username               Name of the user
285  * int vfs_operation            VFS operation identifier
286  * int count                    Number of the common data blocks
287  * [...] variable args          data blocks taken from the individual
288  *                              VFS data structures
289  *
290  * Returns the complete data block to send. The caller has to
291  * take care for freeing the allocated buffer.
292  */
293 static char *smb_traffic_analyzer_create_string( TALLOC_CTX *ctx,
294         struct tm *tm, int seconds, vfs_handle_struct *handle, \
295         char *username, int vfs_operation, int count, ... )
296 {
297         
298         va_list ap;
299         char *arg = NULL;
300         int len;
301         char *common_data_count_str = NULL;
302         char *timestr = NULL;
303         char *sidstr = NULL;
304         char *usersid = NULL;
305         char *buf = NULL;
306         char *vfs_operation_str = NULL;
307         const char *service_name = lp_const_servicename(handle->conn->params->service);
308
309         /*
310          * first create the data that is transfered with any VFS op
311          * These are, in the following order:
312          *(0) number of data to come [6 in v2.0]
313          * 1.vfs_operation identifier
314          * 2.username
315          * 3.user-SID
316          * 4.affected share
317          * 5.domain
318          * 6.timestamp
319          * 7.IP Addresss of client
320          */
321
322         /*
323          * number of common data blocks to come,
324          * this is a #define in vfs_smb_traffic_anaylzer.h,
325          * it's length is known at compile time
326          */
327         common_data_count_str = talloc_strdup( ctx, SMBTA_COMMON_DATA_COUNT);
328         /* vfs operation identifier */
329         vfs_operation_str = talloc_asprintf( common_data_count_str, "%i",
330                                                         vfs_operation);
331         /*
332          * Handle anonymization. In protocol v2, we have to anonymize
333          * both the SID and the username. The name is already
334          * anonymized if needed, by the calling function.
335          */
336         usersid = dom_sid_string( common_data_count_str,
337                 &handle->conn->session_info->security_token->sids[0]);
338
339         sidstr = smb_traffic_analyzer_anonymize(
340                 common_data_count_str,
341                 usersid,
342                 handle);
343         
344         /* time stamp */
345         timestr = talloc_asprintf( common_data_count_str, \
346                 "%04d-%02d-%02d %02d:%02d:%02d.%03d", \
347                 tm->tm_year+1900, \
348                 tm->tm_mon+1, \
349                 tm->tm_mday, \
350                 tm->tm_hour, \
351                 tm->tm_min, \
352                 tm->tm_sec, \
353                 (int)seconds);
354         len = strlen( timestr );
355         /* create the string of common data */
356         buf = talloc_asprintf(ctx,
357                 "%s%04u%s%04u%s%04u%s%04u%s%04u%s%04u%s%04u%s",
358                 common_data_count_str,
359                 (unsigned int) strlen(vfs_operation_str),
360                 vfs_operation_str,
361                 (unsigned int) strlen(username),
362                 username,
363                 (unsigned int) strlen(sidstr),
364                 sidstr,
365                 (unsigned int) strlen(service_name),
366                 service_name,
367                 (unsigned int)
368                 strlen(handle->conn->session_info->info3->base.domain.string),
369                 handle->conn->session_info->info3->base.domain.string,
370                 (unsigned int) strlen(timestr),
371                 timestr,
372                 (unsigned int) strlen(handle->conn->sconn->client_id.addr),
373                 handle->conn->sconn->client_id.addr);
374
375         talloc_free(common_data_count_str);
376
377         /* data blocks depending on the VFS function */ 
378         va_start( ap, count );
379         while ( count-- ) {
380                 arg = va_arg( ap, char * );
381                 /*
382                  *  protocol v2 sends a four byte string
383                  * as a header to each block, including
384                  * the numbers of bytes to come in the
385                  * next string.
386                  */
387                 len = strlen( arg );
388                 buf = talloc_asprintf_append( buf, "%04u%s", len, arg);
389         }
390         va_end( ap );
391         return buf;
392 }
393
394 static void smb_traffic_analyzer_send_data(vfs_handle_struct *handle,
395                                         void *data,
396                                         enum vfs_id vfs_operation )
397 {
398         struct refcounted_sock *rf_sock = NULL;
399         struct timeval tv;
400         time_t tv_sec;
401         struct tm *tm = NULL;
402         int seconds;
403         char *str = NULL;
404         char *username = NULL;
405         char *header = NULL;
406         const char *protocol_version = NULL;
407         bool Write = false;
408         size_t len;
409         size_t size;
410         char *akey, *output;
411
412         /*
413          * The state flags are part of the header
414          * and are descripted in the protocol description
415          * in vfs_smb_traffic_analyzer.h. They begin at byte
416          * 03 of the header.
417          */
418         char state_flags[9] = "000000\0";
419
420         SMB_VFS_HANDLE_GET_DATA(handle, rf_sock, struct refcounted_sock, return);
421
422         if (rf_sock == NULL || rf_sock->sock == -1) {
423                 DEBUG(1, ("smb_traffic_analyzer_send_data: socket is "
424                         "closed\n"));
425                 return;
426         }
427
428         GetTimeOfDay(&tv);
429         tv_sec = tv.tv_sec;
430         tm = localtime(&tv_sec);
431         if (!tm) {
432                 return;
433         }
434         seconds=(float) (tv.tv_usec / 1000);
435
436         /*
437          * Check if anonymization is required, and if yes do this only for
438          * the username here, needed vor protocol version 1. In v2 we
439          * additionally anonymize the SID, which is done in it's marshalling
440          * function.
441          */
442         username = smb_traffic_analyzer_anonymize( talloc_tos(),
443                         handle->conn->session_info->sanitized_username,
444                         handle);
445
446         if (!username) {
447                 return;
448         }
449
450         protocol_version = lp_parm_const_string(SNUM(handle->conn),
451                                         "smb_traffic_analyzer",
452                                         "protocol_version", NULL );
453
454
455         if ( protocol_version == NULL || strcmp( protocol_version,"V1") == 0) {
456
457                 struct rw_data *s_data = (struct rw_data *) data;
458
459                 /*
460                  * in case of protocol v1, ignore any vfs operations
461                  * except read,pread,write,pwrite, and set the "Write"
462                  * bool accordingly, send data and return.
463                  */
464                 if ( vfs_operation > vfs_id_pwrite ) return;
465
466                 if ( vfs_operation <= vfs_id_pread ) Write=false;
467                         else Write=true;
468
469                 str = talloc_asprintf(talloc_tos(),
470                         "V1,%u,\"%s\",\"%s\",\"%c\",\"%s\",\"%s\","
471                         "\"%04d-%02d-%02d %02d:%02d:%02d.%03d\"\n",
472                         (unsigned int) s_data->len,
473                         username,
474                         handle->conn->session_info->info3->base.domain.string,
475                         Write ? 'W' : 'R',
476                         handle->conn->connectpath,
477                         s_data->filename,
478                         tm->tm_year+1900,
479                         tm->tm_mon+1,
480                         tm->tm_mday,
481                         tm->tm_hour,
482                         tm->tm_min,
483                         tm->tm_sec,
484                         (int)seconds);
485                 len = strlen(str);
486                 if (write_data(rf_sock->sock, str, len) != len) {
487                         DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
488                         "error sending V1 protocol data to socket!\n"));
489                 return;
490                 }
491
492         } else if ( strcmp( protocol_version, "V2") == 0) {
493
494                 switch( vfs_operation ) {
495                 case vfs_id_open: ;
496                         str = smb_traffic_analyzer_create_string( talloc_tos(),
497                                 tm, seconds, handle, username, vfs_id_open,
498                                 3, ((struct open_data *) data)->filename,
499                                 talloc_asprintf( talloc_tos(), "%u",
500                                 ((struct open_data *) data)->mode),
501                                 talloc_asprintf( talloc_tos(), "%u",
502                                 ((struct open_data *) data)->result));
503                         break;
504                 case vfs_id_close: ;
505                         str = smb_traffic_analyzer_create_string( talloc_tos(),
506                                 tm, seconds, handle, username, vfs_id_close,
507                                 2, ((struct close_data *) data)->filename,
508                                 talloc_asprintf( talloc_tos(), "%u",
509                                 ((struct close_data *) data)->result));
510                         break;
511                 case vfs_id_mkdir: ;
512                         str = smb_traffic_analyzer_create_string( talloc_tos(),
513                                 tm, seconds, handle, username, vfs_id_mkdir, \
514                                 3, ((struct mkdir_data *) data)->path, \
515                                 talloc_asprintf( talloc_tos(), "%u", \
516                                 ((struct mkdir_data *) data)->mode), \
517                                 talloc_asprintf( talloc_tos(), "%u", \
518                                 ((struct mkdir_data *) data)->result ));
519                         break;
520                 case vfs_id_rmdir: ;
521                         str = smb_traffic_analyzer_create_string( talloc_tos(),
522                                 tm, seconds, handle, username, vfs_id_rmdir,
523                                 2, ((struct rmdir_data *) data)->path, \
524                                 talloc_asprintf( talloc_tos(), "%u", \
525                                 ((struct rmdir_data *) data)->result ));
526                         break;
527                 case vfs_id_rename: ;
528                         str = smb_traffic_analyzer_create_string( talloc_tos(),
529                                 tm, seconds, handle, username, vfs_id_rename,
530                                 3, ((struct rename_data *) data)->src, \
531                                 ((struct rename_data *) data)->dst,
532                                 talloc_asprintf(talloc_tos(), "%u", \
533                                 ((struct rename_data *) data)->result));
534                         break;
535                 case vfs_id_chdir: ;
536                         str = smb_traffic_analyzer_create_string( talloc_tos(),
537                                 tm, seconds, handle, username, vfs_id_chdir,
538                                 2, ((struct chdir_data *) data)->path, \
539                                 talloc_asprintf(talloc_tos(), "%u", \
540                                 ((struct chdir_data *) data)->result));
541                         break;
542
543                 case vfs_id_write:
544                 case vfs_id_pwrite:
545                 case vfs_id_read:
546                 case vfs_id_pread: ;
547                         str = smb_traffic_analyzer_create_string( talloc_tos(),
548                                 tm, seconds, handle, username, vfs_operation,
549                                 2, ((struct rw_data *) data)->filename, \
550                                 talloc_asprintf(talloc_tos(), "%u", \
551                                 (unsigned int)
552                                         ((struct rw_data *) data)->len));
553                         break;
554                 default:
555                         DEBUG(1, ("smb_traffic_analyzer: error! "
556                                 "wrong VFS operation id detected!\n"));
557                         return;
558                 }
559
560         } else {
561                 DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
562                         "error, unknown protocol given!\n"));
563                 return;
564         }
565
566         if (!str) {
567                 DEBUG(1, ("smb_traffic_analyzer_send_data: "
568                         "unable to create string to send!\n"));
569                 return;
570         }
571
572
573         /*
574          * If configured, optain the key and run AES encryption
575          * over the data.
576          */
577         become_root();
578         akey = (char *) secrets_fetch("smb_traffic_analyzer_key", &size);
579         unbecome_root();
580         if ( akey != NULL ) {
581                 state_flags[2] = 'E';
582                 DEBUG(10, ("smb_traffic_analyzer_send_data_socket: a key was"
583                         " found, encrypting data!\n"));
584                 output = smb_traffic_analyzer_encrypt( talloc_tos(),
585                                                 akey, str, &len);
586                 SAFE_FREE(akey);
587                 header = smb_traffic_analyzer_create_header( talloc_tos(),
588                                                 state_flags, len);
589
590                 DEBUG(10, ("smb_traffic_analyzer_send_data_socket:"
591                         " header created for crypted data: %s\n", header));
592                 smb_traffic_analyzer_write_data(header, output, len,
593                                                         rf_sock->sock);
594                 return;
595
596         }
597
598         len = strlen(str);
599         header = smb_traffic_analyzer_create_header( talloc_tos(),
600                                 state_flags, len);
601         smb_traffic_analyzer_write_data(header, str, strlen(str),
602                                 rf_sock->sock);
603
604 }
605
606 static struct refcounted_sock *sock_list;
607
608 static void smb_traffic_analyzer_free_data(void **pptr)
609 {
610         struct refcounted_sock *rf_sock = *(struct refcounted_sock **)pptr;
611         if (rf_sock == NULL) {
612                 return;
613         }
614         rf_sock->ref_count--;
615         if (rf_sock->ref_count != 0) {
616                 return;
617         }
618         if (rf_sock->sock != -1) {
619                 close(rf_sock->sock);
620         }
621         DLIST_REMOVE(sock_list, rf_sock);
622         TALLOC_FREE(rf_sock);
623 }
624
625 static int smb_traffic_analyzer_connect(struct vfs_handle_struct *handle,
626                          const char *service,
627                          const char *user)
628 {
629         connection_struct *conn = handle->conn;
630         enum sock_type st = smb_traffic_analyzer_connMode(handle);
631         struct refcounted_sock *rf_sock = NULL;
632         const char *name = (st == UNIX_DOMAIN_SOCKET) ? LOCAL_PATHNAME :
633                                 lp_parm_const_string(SNUM(conn),
634                                         "smb_traffic_analyzer",
635                                 "host", "localhost");
636         uint16_t port = (st == UNIX_DOMAIN_SOCKET) ? 0 :
637                                 atoi( lp_parm_const_string(SNUM(conn),
638                                 "smb_traffic_analyzer", "port", "9430"));
639         int ret = SMB_VFS_NEXT_CONNECT(handle, service, user);
640
641         if (ret < 0) {
642                 return ret;
643         }
644
645         /* Are we already connected ? */
646         for (rf_sock = sock_list; rf_sock; rf_sock = rf_sock->next) {
647                 if (port == rf_sock->port &&
648                                 (strcmp(name, rf_sock->name) == 0)) {
649                         break;
650                 }
651         }
652
653         /* If we're connected already, just increase the
654          * reference count. */
655         if (rf_sock) {
656                 rf_sock->ref_count++;
657         } else {
658                 /* New connection. */
659                 rf_sock = TALLOC_ZERO_P(NULL, struct refcounted_sock);
660                 if (rf_sock == NULL) {
661                         SMB_VFS_NEXT_DISCONNECT(handle);
662                         errno = ENOMEM;
663                         return -1;
664                 }
665                 rf_sock->name = talloc_strdup(rf_sock, name);
666                 if (rf_sock->name == NULL) {
667                         SMB_VFS_NEXT_DISCONNECT(handle);
668                         TALLOC_FREE(rf_sock);
669                         errno = ENOMEM;
670                         return -1;
671                 }
672                 rf_sock->port = port;
673                 rf_sock->ref_count = 1;
674
675                 if (st == UNIX_DOMAIN_SOCKET) {
676                         rf_sock->sock = smb_traffic_analyzer_connect_unix_socket(handle,
677                                                         name);
678                 } else {
679
680                         rf_sock->sock = smb_traffic_analyzer_connect_inet_socket(handle,
681                                                         name,
682                                                         port);
683                 }
684                 if (rf_sock->sock == -1) {
685                         SMB_VFS_NEXT_DISCONNECT(handle);
686                         TALLOC_FREE(rf_sock);
687                         return -1;
688                 }
689                 DLIST_ADD(sock_list, rf_sock);
690         }
691
692         /* Store the private data. */
693         SMB_VFS_HANDLE_SET_DATA(handle, rf_sock, smb_traffic_analyzer_free_data,
694                                 struct refcounted_sock, return -1);
695         return 0;
696 }
697
698 /* VFS Functions */
699 static int smb_traffic_analyzer_chdir(vfs_handle_struct *handle, \
700                         const char *path)
701 {
702         struct chdir_data s_data;
703         s_data.result = SMB_VFS_NEXT_CHDIR(handle, path);
704         s_data.path = path;
705         DEBUG(10, ("smb_traffic_analyzer_chdir: CHDIR: %s\n", path));
706         smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_chdir);
707         return s_data.result;
708 }
709
710 static int smb_traffic_analyzer_rename(vfs_handle_struct *handle, \
711                 const struct smb_filename *smb_fname_src,
712                 const struct smb_filename *smb_fname_dst)
713 {
714         struct rename_data s_data;
715         s_data.result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, \
716                 smb_fname_dst);
717         s_data.src = smb_fname_src->base_name;
718         s_data.dst = smb_fname_dst->base_name;
719         DEBUG(10, ("smb_traffic_analyzer_rename: RENAME: %s / %s\n",
720                 smb_fname_src->base_name,
721                 smb_fname_dst->base_name));
722         smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_rename);
723         return s_data.result;
724 }
725
726 static int smb_traffic_analyzer_rmdir(vfs_handle_struct *handle, \
727                         const char *path)
728 {
729         struct rmdir_data s_data;
730         s_data.result = SMB_VFS_NEXT_RMDIR(handle, path);
731         s_data.path = path;
732         DEBUG(10, ("smb_traffic_analyzer_rmdir: RMDIR: %s\n", path));
733         smb_traffic_analyzer_send_data(handle, &s_data, vfs_id_rmdir);
734         return s_data.result;
735 }
736
737 static int smb_traffic_analyzer_mkdir(vfs_handle_struct *handle, \
738                         const char *path, mode_t mode)
739 {
740         struct mkdir_data s_data;
741         s_data.result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
742         s_data.path = path;
743         s_data.mode = mode;
744         DEBUG(10, ("smb_traffic_analyzer_mkdir: MKDIR: %s\n", path));
745         smb_traffic_analyzer_send_data(handle,
746                         &s_data,
747                         vfs_id_mkdir);
748         return s_data.result;
749 }
750
751 static ssize_t smb_traffic_analyzer_sendfile(vfs_handle_struct *handle,
752                                 int tofd,
753                                 files_struct *fromfsp,
754                                 const DATA_BLOB *hdr,
755                                 SMB_OFF_T offset,
756                                 size_t n)
757 {
758         struct rw_data s_data;
759         s_data.len = SMB_VFS_NEXT_SENDFILE(handle,
760                         tofd, fromfsp, hdr, offset, n);
761         s_data.filename = fromfsp->fsp_name->base_name;
762         DEBUG(10, ("smb_traffic_analyzer_sendfile: sendfile(r): %s\n",
763                 fsp_str_dbg(fromfsp)));
764         smb_traffic_analyzer_send_data(handle,
765                 &s_data,
766                 vfs_id_read);
767         return s_data.len;
768 }
769
770 static ssize_t smb_traffic_analyzer_recvfile(vfs_handle_struct *handle,
771                                 int fromfd,
772                                 files_struct *tofsp,
773                                 SMB_OFF_T offset,
774                                 size_t n)
775 {
776         struct rw_data s_data;
777         s_data.len = SMB_VFS_NEXT_RECVFILE(handle,
778                         fromfd, tofsp, offset, n);
779         s_data.filename = tofsp->fsp_name->base_name;
780         DEBUG(10, ("smb_traffic_analyzer_recvfile: recvfile(w): %s\n",
781                 fsp_str_dbg(tofsp)));
782         smb_traffic_analyzer_send_data(handle,
783                 &s_data,
784                 vfs_id_write);
785         return s_data.len;
786 }
787
788
789 static ssize_t smb_traffic_analyzer_read(vfs_handle_struct *handle, \
790                                 files_struct *fsp, void *data, size_t n)
791 {
792         struct rw_data s_data;
793
794         s_data.len = SMB_VFS_NEXT_READ(handle, fsp, data, n);
795         s_data.filename = fsp->fsp_name->base_name;
796         DEBUG(10, ("smb_traffic_analyzer_read: READ: %s\n", fsp_str_dbg(fsp)));
797
798         smb_traffic_analyzer_send_data(handle,
799                         &s_data,
800                         vfs_id_read);
801         return s_data.len;
802 }
803
804
805 static ssize_t smb_traffic_analyzer_pread(vfs_handle_struct *handle, \
806                 files_struct *fsp, void *data, size_t n, SMB_OFF_T offset)
807 {
808         struct rw_data s_data;
809
810         s_data.len = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
811         s_data.filename = fsp->fsp_name->base_name;
812         DEBUG(10, ("smb_traffic_analyzer_pread: PREAD: %s\n",
813                    fsp_str_dbg(fsp)));
814
815         smb_traffic_analyzer_send_data(handle,
816                         &s_data,
817                         vfs_id_pread);
818
819         return s_data.len;
820 }
821
822 static ssize_t smb_traffic_analyzer_write(vfs_handle_struct *handle, \
823                         files_struct *fsp, const void *data, size_t n)
824 {
825         struct rw_data s_data;
826
827         s_data.len = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
828         s_data.filename = fsp->fsp_name->base_name;
829         DEBUG(10, ("smb_traffic_analyzer_write: WRITE: %s\n",
830                    fsp_str_dbg(fsp)));
831
832         smb_traffic_analyzer_send_data(handle,
833                         &s_data,
834                         vfs_id_write);
835         return s_data.len;
836 }
837
838 static ssize_t smb_traffic_analyzer_pwrite(vfs_handle_struct *handle, \
839              files_struct *fsp, const void *data, size_t n, SMB_OFF_T offset)
840 {
841         struct rw_data s_data;
842
843         s_data.len = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
844         s_data.filename = fsp->fsp_name->base_name;
845         DEBUG(10, ("smb_traffic_analyzer_pwrite: PWRITE: %s\n", \
846                 fsp_str_dbg(fsp)));
847
848         smb_traffic_analyzer_send_data(handle,
849                         &s_data,
850                         vfs_id_pwrite);
851         return s_data.len;
852 }
853
854 static int smb_traffic_analyzer_open(vfs_handle_struct *handle, \
855         struct smb_filename *smb_fname, files_struct *fsp,\
856         int flags, mode_t mode)
857 {
858         struct open_data s_data;
859
860         s_data.result = SMB_VFS_NEXT_OPEN( handle, smb_fname, fsp,
861                         flags, mode);
862         DEBUG(10,("smb_traffic_analyzer_open: OPEN: %s\n",
863                 fsp_str_dbg(fsp)));
864         s_data.filename = fsp->fsp_name->base_name;
865         s_data.mode = mode;
866         smb_traffic_analyzer_send_data(handle,
867                         &s_data,
868                         vfs_id_open);
869         return s_data.result;
870 }
871
872 static int smb_traffic_analyzer_close(vfs_handle_struct *handle, \
873         files_struct *fsp)
874 {
875         struct close_data s_data;
876         s_data.result = SMB_VFS_NEXT_CLOSE(handle, fsp);
877         DEBUG(10,("smb_traffic_analyzer_close: CLOSE: %s\n",
878                 fsp_str_dbg(fsp)));
879         s_data.filename = fsp->fsp_name->base_name;
880         smb_traffic_analyzer_send_data(handle,
881                         &s_data,
882                         vfs_id_close);
883         return s_data.result;
884 }
885
886         
887 static struct vfs_fn_pointers vfs_smb_traffic_analyzer_fns = {
888         .connect_fn = smb_traffic_analyzer_connect,
889         .vfs_read = smb_traffic_analyzer_read,
890         .pread = smb_traffic_analyzer_pread,
891         .write = smb_traffic_analyzer_write,
892         .pwrite = smb_traffic_analyzer_pwrite,
893         .mkdir = smb_traffic_analyzer_mkdir,
894         .rename = smb_traffic_analyzer_rename,
895         .chdir = smb_traffic_analyzer_chdir,
896         .open_fn = smb_traffic_analyzer_open,
897         .rmdir = smb_traffic_analyzer_rmdir,
898         .close_fn = smb_traffic_analyzer_close,
899         .sendfile = smb_traffic_analyzer_sendfile,
900         .recvfile = smb_traffic_analyzer_recvfile
901 };
902
903 /* Module initialization */
904 NTSTATUS vfs_smb_traffic_analyzer_init(void)
905 {
906         NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
907                                         "smb_traffic_analyzer",
908                                         &vfs_smb_traffic_analyzer_fns);
909
910         if (!NT_STATUS_IS_OK(ret)) {
911                 return ret;
912         }
913
914         vfs_smb_traffic_analyzer_debug_level =
915                 debug_add_class("smb_traffic_analyzer");
916
917         if (vfs_smb_traffic_analyzer_debug_level == -1) {
918                 vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
919                 DEBUG(1, ("smb_traffic_analyzer_init: Couldn't register custom"
920                          "debugging class!\n"));
921         } else {
922                 DEBUG(3, ("smb_traffic_analyzer_init: Debug class number of"
923                         "'smb_traffic_analyzer': %d\n", \
924                         vfs_smb_traffic_analyzer_debug_level));
925         }
926
927         return ret;
928 }