aefea33d3054460f341bc7b1b57f78c640ba20e4
[kamenim/samba-autobuild/.git] / source3 / modules / vfs_time_audit.c
1 /*
2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
3  * facility.
4  *
5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 /*
22  * This module implements logging for time taken for all Samba VFS operations.
23  *
24  * vfs objects = time_audit
25  */
26
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "ntioctl.h"
31 #include "lib/util/tevent_unix.h"
32 #include "lib/util/tevent_ntstatus.h"
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_VFS
36
37 static double audit_timeout;
38
39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
40                                     const char *msg)
41 {
42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
43                   "(%.2f seconds) %s%s-- Validate that file and storage "
44                   "subsystems are operating normally\n", syscallname,
45                   elapsed, (msg != NULL) ? msg : "",
46                   (msg != NULL) ? " " : ""));
47 }
48
49 static void smb_time_audit_log(const char *syscallname, double elapsed)
50 {
51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
52 }
53
54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
55                                    const struct files_struct *fsp)
56 {
57         char *base_name = NULL;
58         char *connectpath = NULL;
59         char *msg = NULL;
60
61         if (fsp == NULL) {
62                 smb_time_audit_log(syscallname, elapsed);
63                 return;
64         }
65         if (fsp->conn)
66                 connectpath = fsp->conn->connectpath;
67         if (fsp->fsp_name)
68                 base_name = fsp->fsp_name->base_name;
69
70         if (connectpath != NULL && base_name != NULL) {
71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
72                                       connectpath, base_name);
73         } else if (connectpath != NULL && base_name == NULL) {
74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
75                                       "base_name = <NULL>",
76                                       connectpath);
77         } else if (connectpath == NULL && base_name != NULL) {
78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
79                                       "base_name = \"%s\"",
80                                       base_name);
81         } else { /* connectpath == NULL && base_name == NULL */
82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
83                                       "base_name = <NULL>");
84         }
85         smb_time_audit_log_msg(syscallname, elapsed, msg);
86         TALLOC_FREE(msg);
87 }
88
89 static void smb_time_audit_log_at(const char *syscallname,
90                                   double elapsed,
91                                   const struct files_struct *dir_fsp,
92                                   const struct smb_filename *smb_fname)
93 {
94         char *msg = NULL;
95
96         msg = talloc_asprintf(talloc_tos(),
97                               "filename = \"%s/%s/%s\"",
98                               dir_fsp->conn->connectpath,
99                               dir_fsp->fsp_name->base_name,
100                               smb_fname->base_name);
101
102         smb_time_audit_log_msg(syscallname, elapsed, msg);
103         TALLOC_FREE(msg);
104 }
105
106 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
107                                     const char *fname)
108 {
109         char cwd[PATH_MAX];
110         char *msg = NULL;
111
112         if (getcwd(cwd, sizeof(cwd)) == NULL) {
113                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
114         }
115         if (fname != NULL) {
116                 msg = talloc_asprintf(talloc_tos(),
117                                       "cwd = \"%s\", filename = \"%s\"",
118                                       cwd, fname);
119         } else {
120                 msg = talloc_asprintf(talloc_tos(),
121                                       "cwd = \"%s\", filename = <NULL>",
122                                       cwd);
123         }
124         smb_time_audit_log_msg(syscallname, elapsed, msg);
125         TALLOC_FREE(msg);
126 }
127
128 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
129                                        const struct smb_filename *smb_fname)
130 {
131         if (smb_fname != NULL) {
132                 smb_time_audit_log_fname(syscallname, elapsed,
133                                          smb_fname->base_name);
134         } else {
135                 smb_time_audit_log_fname(syscallname, elapsed,
136                                          "smb_fname = <NULL>");
137         }
138 }
139
140 static int smb_time_audit_connect(vfs_handle_struct *handle,
141                                   const char *svc, const char *user)
142 {
143         int result;
144         struct timespec ts1,ts2;
145         double timediff;
146
147         if (!handle) {
148                 return -1;
149         }
150
151         clock_gettime_mono(&ts1);
152         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
153         clock_gettime_mono(&ts2);
154         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
155         if (timediff > audit_timeout) {
156                 smb_time_audit_log_msg("connect", timediff, user);
157         }
158         return result;
159 }
160
161 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
162 {
163         struct timespec ts1,ts2;
164         double timediff;
165
166         clock_gettime_mono(&ts1);
167         SMB_VFS_NEXT_DISCONNECT(handle);
168         clock_gettime_mono(&ts2);
169         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
170
171         if (timediff > audit_timeout) {
172                 smb_time_audit_log("disconnect", timediff);
173         }
174 }
175
176 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
177                                         const struct smb_filename *smb_fname,
178                                         uint64_t *bsize,
179                                         uint64_t *dfree,
180                                         uint64_t *dsize)
181 {
182         uint64_t result;
183         struct timespec ts1,ts2;
184         double timediff;
185
186         clock_gettime_mono(&ts1);
187         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
188         clock_gettime_mono(&ts2);
189         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
190
191         /* Don't have a reasonable notion of failure here */
192         if (timediff > audit_timeout) {
193                 smb_time_audit_log_fname("disk_free",
194                                 timediff,
195                                 smb_fname->base_name);
196         }
197
198         return result;
199 }
200
201 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
202                                         const struct smb_filename *smb_fname,
203                                         enum SMB_QUOTA_TYPE qtype,
204                                         unid_t id,
205                                         SMB_DISK_QUOTA *qt)
206 {
207         int result;
208         struct timespec ts1,ts2;
209         double timediff;
210
211         clock_gettime_mono(&ts1);
212         result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
213         clock_gettime_mono(&ts2);
214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
215
216         if (timediff > audit_timeout) {
217                 smb_time_audit_log_fname("get_quota",
218                                 timediff,
219                                 smb_fname->base_name);
220         }
221         return result;
222 }
223
224 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
225                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
226                                     SMB_DISK_QUOTA *qt)
227 {
228         int result;
229         struct timespec ts1,ts2;
230         double timediff;
231
232         clock_gettime_mono(&ts1);
233         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
234         clock_gettime_mono(&ts2);
235         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
236
237         if (timediff > audit_timeout) {
238                 smb_time_audit_log("set_quota", timediff);
239         }
240
241         return result;
242 }
243
244 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
245                                                struct files_struct *fsp,
246                                                struct shadow_copy_data *shadow_copy_data,
247                                                bool labels)
248 {
249         int result;
250         struct timespec ts1,ts2;
251         double timediff;
252
253         clock_gettime_mono(&ts1);
254         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
255                                                    shadow_copy_data, labels);
256         clock_gettime_mono(&ts2);
257         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
258
259         if (timediff > audit_timeout) {
260                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
261         }
262
263         return result;
264 }
265
266 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
267                                   const struct smb_filename *smb_fname,
268                                   struct vfs_statvfs_struct *statbuf)
269 {
270         int result;
271         struct timespec ts1,ts2;
272         double timediff;
273
274         clock_gettime_mono(&ts1);
275         result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
276         clock_gettime_mono(&ts2);
277         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
278
279         if (timediff > audit_timeout) {
280                 smb_time_audit_log_fname("statvfs", timediff,
281                         smb_fname->base_name);
282         }
283
284         return result;
285 }
286
287 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
288                                                enum timestamp_set_resolution *p_ts_res)
289 {
290         uint32_t result;
291         struct timespec ts1,ts2;
292         double timediff;
293
294         clock_gettime_mono(&ts1);
295         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
296         clock_gettime_mono(&ts2);
297         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
298
299         if (timediff > audit_timeout) {
300                 smb_time_audit_log("fs_capabilities", timediff);
301         }
302
303         return result;
304 }
305
306 static NTSTATUS smb_time_audit_get_dfs_referrals(
307                         struct vfs_handle_struct *handle,
308                         struct dfs_GetDFSReferral *r)
309 {
310         NTSTATUS result;
311         struct timespec ts1,ts2;
312         double timediff;
313
314         clock_gettime_mono(&ts1);
315         result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
316         clock_gettime_mono(&ts2);
317         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
318
319         if (timediff > audit_timeout) {
320                 smb_time_audit_log("get_dfs_referrals", timediff);
321         }
322
323         return result;
324 }
325
326 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
327                                                TALLOC_CTX *mem_ctx,
328                                                const char *service_path,
329                                                char **base_volume)
330 {
331         NTSTATUS status;
332         struct timespec ts1,ts2;
333         double timediff;
334
335         clock_gettime_mono(&ts1);
336         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
337                                               base_volume);
338         clock_gettime_mono(&ts2);
339         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
340
341         if (timediff > audit_timeout) {
342                 smb_time_audit_log("snap_check_path", timediff);
343         }
344
345         return status;
346 }
347
348 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
349                                            TALLOC_CTX *mem_ctx,
350                                            const char *base_volume,
351                                            time_t *tstamp,
352                                            bool rw,
353                                            char **base_path,
354                                            char **snap_path)
355 {
356         NTSTATUS status;
357         struct timespec ts1,ts2;
358         double timediff;
359
360         clock_gettime_mono(&ts1);
361         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
362                                           rw, base_path, snap_path);
363         clock_gettime_mono(&ts2);
364         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
365
366         if (timediff > audit_timeout) {
367                 smb_time_audit_log("snap_create", timediff);
368         }
369
370         return status;
371 }
372
373 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
374                                            TALLOC_CTX *mem_ctx,
375                                            char *base_path,
376                                            char *snap_path)
377 {
378         NTSTATUS status;
379         struct timespec ts1,ts2;
380         double timediff;
381
382         clock_gettime_mono(&ts1);
383         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
384                                           snap_path);
385         clock_gettime_mono(&ts2);
386         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
387
388         if (timediff > audit_timeout) {
389                 smb_time_audit_log("snap_delete", timediff);
390         }
391
392         return status;
393 }
394
395 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
396                                    const struct smb_filename *smb_fname,
397                                    const char *mask, uint32_t attr)
398 {
399         DIR *result;
400         struct timespec ts1,ts2;
401         double timediff;
402
403         clock_gettime_mono(&ts1);
404         result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
405         clock_gettime_mono(&ts2);
406         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
407
408         if (timediff > audit_timeout) {
409                 smb_time_audit_log_smb_fname("opendir", timediff, smb_fname);
410         }
411
412         return result;
413 }
414
415 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
416                                               files_struct *fsp,
417                                               const char *mask, uint32_t attr)
418 {
419         DIR *result;
420         struct timespec ts1,ts2;
421         double timediff;
422
423         clock_gettime_mono(&ts1);
424         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
425         clock_gettime_mono(&ts2);
426         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
427
428         if (timediff > audit_timeout) {
429                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
430         }
431
432         return result;
433 }
434
435 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
436                                                  DIR *dirp,
437                                                  SMB_STRUCT_STAT *sbuf)
438 {
439         struct dirent *result;
440         struct timespec ts1,ts2;
441         double timediff;
442
443         clock_gettime_mono(&ts1);
444         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
445         clock_gettime_mono(&ts2);
446         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
447
448         if (timediff > audit_timeout) {
449                 smb_time_audit_log("readdir", timediff);
450         }
451
452         return result;
453 }
454
455 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
456                                    DIR *dirp, long offset)
457 {
458         struct timespec ts1,ts2;
459         double timediff;
460
461         clock_gettime_mono(&ts1);
462         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
463         clock_gettime_mono(&ts2);
464         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
465
466         if (timediff > audit_timeout) {
467                 smb_time_audit_log("seekdir", timediff);
468         }
469
470 }
471
472 static long smb_time_audit_telldir(vfs_handle_struct *handle,
473                                    DIR *dirp)
474 {
475         long result;
476         struct timespec ts1,ts2;
477         double timediff;
478
479         clock_gettime_mono(&ts1);
480         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
481         clock_gettime_mono(&ts2);
482         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
483
484         if (timediff > audit_timeout) {
485                 smb_time_audit_log("telldir", timediff);
486         }
487
488         return result;
489 }
490
491 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
492                                      DIR *dirp)
493 {
494         struct timespec ts1,ts2;
495         double timediff;
496
497         clock_gettime_mono(&ts1);
498         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
499         clock_gettime_mono(&ts2);
500         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
501
502         if (timediff > audit_timeout) {
503                 smb_time_audit_log("rewinddir", timediff);
504         }
505
506 }
507
508 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
509                                 const struct smb_filename *smb_fname,
510                                 mode_t mode)
511 {
512         int result;
513         struct timespec ts1,ts2;
514         double timediff;
515
516         clock_gettime_mono(&ts1);
517         result = SMB_VFS_NEXT_MKDIR(handle, smb_fname, mode);
518         clock_gettime_mono(&ts2);
519         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
520
521         if (timediff > audit_timeout) {
522                 smb_time_audit_log_smb_fname("mkdir",
523                         timediff,
524                         smb_fname);
525         }
526
527         return result;
528 }
529
530 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
531                                 const struct smb_filename *smb_fname)
532 {
533         int result;
534         struct timespec ts1,ts2;
535         double timediff;
536
537         clock_gettime_mono(&ts1);
538         result = SMB_VFS_NEXT_RMDIR(handle, smb_fname);
539         clock_gettime_mono(&ts2);
540         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
541
542         if (timediff > audit_timeout) {
543                 smb_time_audit_log_smb_fname("rmdir",
544                         timediff,
545                         smb_fname);
546         }
547
548         return result;
549 }
550
551 static int smb_time_audit_closedir(vfs_handle_struct *handle,
552                                    DIR *dirp)
553 {
554         int result;
555         struct timespec ts1,ts2;
556         double timediff;
557
558         clock_gettime_mono(&ts1);
559         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
560         clock_gettime_mono(&ts2);
561         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
562
563         if (timediff > audit_timeout) {
564                 smb_time_audit_log("closedir", timediff);
565         }
566
567         return result;
568 }
569
570 static int smb_time_audit_open(vfs_handle_struct *handle,
571                                struct smb_filename *fname,
572                                files_struct *fsp,
573                                int flags, mode_t mode)
574 {
575         int result;
576         struct timespec ts1,ts2;
577         double timediff;
578
579         clock_gettime_mono(&ts1);
580         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
581         clock_gettime_mono(&ts2);
582         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
583
584         if (timediff > audit_timeout) {
585                 smb_time_audit_log_fsp("open", timediff, fsp);
586         }
587
588         return result;
589 }
590
591 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
592                                            struct smb_request *req,
593                                            uint16_t root_dir_fid,
594                                            struct smb_filename *fname,
595                                            uint32_t access_mask,
596                                            uint32_t share_access,
597                                            uint32_t create_disposition,
598                                            uint32_t create_options,
599                                            uint32_t file_attributes,
600                                            uint32_t oplock_request,
601                                            struct smb2_lease *lease,
602                                            uint64_t allocation_size,
603                                            uint32_t private_flags,
604                                            struct security_descriptor *sd,
605                                            struct ea_list *ea_list,
606                                            files_struct **result_fsp,
607                                            int *pinfo,
608                                            const struct smb2_create_blobs *in_context_blobs,
609                                            struct smb2_create_blobs *out_context_blobs)
610 {
611         NTSTATUS result;
612         struct timespec ts1,ts2;
613         double timediff;
614
615         clock_gettime_mono(&ts1);
616         result = SMB_VFS_NEXT_CREATE_FILE(
617                 handle,                                 /* handle */
618                 req,                                    /* req */
619                 root_dir_fid,                           /* root_dir_fid */
620                 fname,                                  /* fname */
621                 access_mask,                            /* access_mask */
622                 share_access,                           /* share_access */
623                 create_disposition,                     /* create_disposition*/
624                 create_options,                         /* create_options */
625                 file_attributes,                        /* file_attributes */
626                 oplock_request,                         /* oplock_request */
627                 lease,                                  /* lease */
628                 allocation_size,                        /* allocation_size */
629                 private_flags,
630                 sd,                                     /* sd */
631                 ea_list,                                /* ea_list */
632                 result_fsp,                             /* result */
633                 pinfo,
634                 in_context_blobs, out_context_blobs);   /* create context */
635         clock_gettime_mono(&ts2);
636         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
637
638         if (timediff > audit_timeout) {
639                 /*
640                  * can't use result_fsp this time, may have
641                  * invalid content causing smbd crash
642                  */
643                 smb_time_audit_log_smb_fname("create_file", timediff,
644                                            fname);
645         }
646
647         return result;
648 }
649
650 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
651 {
652         int result;
653         struct timespec ts1,ts2;
654         double timediff;
655
656         clock_gettime_mono(&ts1);
657         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
658         clock_gettime_mono(&ts2);
659         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
660
661         if (timediff > audit_timeout) {
662                 smb_time_audit_log_fsp("close", timediff, fsp);
663         }
664
665         return result;
666 }
667
668 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
669                                     files_struct *fsp,
670                                     void *data, size_t n, off_t offset)
671 {
672         ssize_t result;
673         struct timespec ts1,ts2;
674         double timediff;
675
676         clock_gettime_mono(&ts1);
677         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
678         clock_gettime_mono(&ts2);
679         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
680
681         if (timediff > audit_timeout) {
682                 smb_time_audit_log_fsp("pread", timediff, fsp);
683         }
684
685         return result;
686 }
687
688 struct smb_time_audit_pread_state {
689         struct files_struct *fsp;
690         ssize_t ret;
691         struct vfs_aio_state vfs_aio_state;
692 };
693
694 static void smb_time_audit_pread_done(struct tevent_req *subreq);
695
696 static struct tevent_req *smb_time_audit_pread_send(
697         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
698         struct tevent_context *ev, struct files_struct *fsp,
699         void *data, size_t n, off_t offset)
700 {
701         struct tevent_req *req, *subreq;
702         struct smb_time_audit_pread_state *state;
703
704         req = tevent_req_create(mem_ctx, &state,
705                                 struct smb_time_audit_pread_state);
706         if (req == NULL) {
707                 return NULL;
708         }
709         state->fsp = fsp;
710
711         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
712                                          n, offset);
713         if (tevent_req_nomem(subreq, req)) {
714                 return tevent_req_post(req, ev);
715         }
716         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
717         return req;
718 }
719
720 static void smb_time_audit_pread_done(struct tevent_req *subreq)
721 {
722         struct tevent_req *req = tevent_req_callback_data(
723                 subreq, struct tevent_req);
724         struct smb_time_audit_pread_state *state = tevent_req_data(
725                 req, struct smb_time_audit_pread_state);
726
727         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
728         TALLOC_FREE(subreq);
729         tevent_req_done(req);
730 }
731
732 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
733                                          struct vfs_aio_state *vfs_aio_state)
734 {
735         struct smb_time_audit_pread_state *state = tevent_req_data(
736                 req, struct smb_time_audit_pread_state);
737         double timediff;
738
739         timediff = state->vfs_aio_state.duration * 1.0e-9;
740
741         if (timediff > audit_timeout) {
742                 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
743         }
744
745         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
746                 return -1;
747         }
748         *vfs_aio_state = state->vfs_aio_state;
749         return state->ret;
750 }
751
752 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
753                                      files_struct *fsp,
754                                      const void *data, size_t n,
755                                      off_t offset)
756 {
757         ssize_t result;
758         struct timespec ts1,ts2;
759         double timediff;
760
761         clock_gettime_mono(&ts1);
762         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
763         clock_gettime_mono(&ts2);
764         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
765
766         if (timediff > audit_timeout) {
767                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
768         }
769
770         return result;
771 }
772
773 struct smb_time_audit_pwrite_state {
774         struct files_struct *fsp;
775         ssize_t ret;
776         struct vfs_aio_state vfs_aio_state;
777 };
778
779 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
780
781 static struct tevent_req *smb_time_audit_pwrite_send(
782         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
783         struct tevent_context *ev, struct files_struct *fsp,
784         const void *data, size_t n, off_t offset)
785 {
786         struct tevent_req *req, *subreq;
787         struct smb_time_audit_pwrite_state *state;
788
789         req = tevent_req_create(mem_ctx, &state,
790                                 struct smb_time_audit_pwrite_state);
791         if (req == NULL) {
792                 return NULL;
793         }
794         state->fsp = fsp;
795
796         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
797                                          n, offset);
798         if (tevent_req_nomem(subreq, req)) {
799                 return tevent_req_post(req, ev);
800         }
801         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
802         return req;
803 }
804
805 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
806 {
807         struct tevent_req *req = tevent_req_callback_data(
808                 subreq, struct tevent_req);
809         struct smb_time_audit_pwrite_state *state = tevent_req_data(
810                 req, struct smb_time_audit_pwrite_state);
811
812         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
813         TALLOC_FREE(subreq);
814         tevent_req_done(req);
815 }
816
817 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
818                                           struct vfs_aio_state *vfs_aio_state)
819 {
820         struct smb_time_audit_pwrite_state *state = tevent_req_data(
821                 req, struct smb_time_audit_pwrite_state);
822         double timediff;
823
824         timediff = state->vfs_aio_state.duration * 1.0e-9;
825
826         if (timediff > audit_timeout) {
827                 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
828         }
829
830         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
831                 return -1;
832         }
833         *vfs_aio_state = state->vfs_aio_state;
834         return state->ret;
835 }
836
837 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
838                                       files_struct *fsp,
839                                       off_t offset, int whence)
840 {
841         off_t result;
842         struct timespec ts1,ts2;
843         double timediff;
844
845         clock_gettime_mono(&ts1);
846         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
847         clock_gettime_mono(&ts2);
848         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
849
850         if (timediff > audit_timeout) {
851                 smb_time_audit_log_fsp("lseek", timediff, fsp);
852         }
853
854         return result;
855 }
856
857 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
858                                        files_struct *fromfsp,
859                                        const DATA_BLOB *hdr, off_t offset,
860                                        size_t n)
861 {
862         ssize_t result;
863         struct timespec ts1,ts2;
864         double timediff;
865
866         clock_gettime_mono(&ts1);
867         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
868         clock_gettime_mono(&ts2);
869         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
870
871         if (timediff > audit_timeout) {
872                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
873         }
874
875         return result;
876 }
877
878 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
879                                        files_struct *tofsp,
880                                        off_t offset,
881                                        size_t n)
882 {
883         ssize_t result;
884         struct timespec ts1,ts2;
885         double timediff;
886
887         clock_gettime_mono(&ts1);
888         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
889         clock_gettime_mono(&ts2);
890         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
891
892         if (timediff > audit_timeout) {
893                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
894         }
895
896         return result;
897 }
898
899 static int smb_time_audit_rename(vfs_handle_struct *handle,
900                                  const struct smb_filename *oldname,
901                                  const struct smb_filename *newname)
902 {
903         int result;
904         struct timespec ts1,ts2;
905         double timediff;
906
907         clock_gettime_mono(&ts1);
908         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
909         clock_gettime_mono(&ts2);
910         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
911
912         if (timediff > audit_timeout) {
913                 smb_time_audit_log_smb_fname("rename", timediff, newname);
914         }
915
916         return result;
917 }
918
919 struct smb_time_audit_fsync_state {
920         struct files_struct *fsp;
921         int ret;
922         struct vfs_aio_state vfs_aio_state;
923 };
924
925 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
926
927 static struct tevent_req *smb_time_audit_fsync_send(
928         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
929         struct tevent_context *ev, struct files_struct *fsp)
930 {
931         struct tevent_req *req, *subreq;
932         struct smb_time_audit_fsync_state *state;
933
934         req = tevent_req_create(mem_ctx, &state,
935                                 struct smb_time_audit_fsync_state);
936         if (req == NULL) {
937                 return NULL;
938         }
939         state->fsp = fsp;
940
941         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
942         if (tevent_req_nomem(subreq, req)) {
943                 return tevent_req_post(req, ev);
944         }
945         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
946         return req;
947 }
948
949 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
950 {
951         struct tevent_req *req = tevent_req_callback_data(
952                 subreq, struct tevent_req);
953         struct smb_time_audit_fsync_state *state = tevent_req_data(
954                 req, struct smb_time_audit_fsync_state);
955
956         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
957         TALLOC_FREE(subreq);
958         tevent_req_done(req);
959 }
960
961 static int smb_time_audit_fsync_recv(struct tevent_req *req,
962                                      struct vfs_aio_state *vfs_aio_state)
963 {
964         struct smb_time_audit_fsync_state *state = tevent_req_data(
965                 req, struct smb_time_audit_fsync_state);
966         double timediff;
967
968         timediff = state->vfs_aio_state.duration * 1.0e-9;
969
970         if (timediff > audit_timeout) {
971                 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
972         }
973
974         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
975                 return -1;
976         }
977         *vfs_aio_state = state->vfs_aio_state;
978         return state->ret;
979 }
980
981 static int smb_time_audit_stat(vfs_handle_struct *handle,
982                                struct smb_filename *fname)
983 {
984         int result;
985         struct timespec ts1,ts2;
986         double timediff;
987
988         clock_gettime_mono(&ts1);
989         result = SMB_VFS_NEXT_STAT(handle, fname);
990         clock_gettime_mono(&ts2);
991         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
992
993         if (timediff > audit_timeout) {
994                 smb_time_audit_log_smb_fname("stat", timediff, fname);
995         }
996
997         return result;
998 }
999
1000 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1001                                 SMB_STRUCT_STAT *sbuf)
1002 {
1003         int result;
1004         struct timespec ts1,ts2;
1005         double timediff;
1006
1007         clock_gettime_mono(&ts1);
1008         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1009         clock_gettime_mono(&ts2);
1010         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1011
1012         if (timediff > audit_timeout) {
1013                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1014         }
1015
1016         return result;
1017 }
1018
1019 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1020                                 struct smb_filename *path)
1021 {
1022         int result;
1023         struct timespec ts1,ts2;
1024         double timediff;
1025
1026         clock_gettime_mono(&ts1);
1027         result = SMB_VFS_NEXT_LSTAT(handle, path);
1028         clock_gettime_mono(&ts2);
1029         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1030
1031         if (timediff > audit_timeout) {
1032                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1033         }
1034
1035         return result;
1036 }
1037
1038 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1039                                               files_struct *fsp,
1040                                               const SMB_STRUCT_STAT *sbuf)
1041 {
1042         uint64_t result;
1043         struct timespec ts1,ts2;
1044         double timediff;
1045
1046         clock_gettime_mono(&ts1);
1047         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1048         clock_gettime_mono(&ts2);
1049         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1050
1051         if (timediff > audit_timeout) {
1052                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1053         }
1054
1055         return result;
1056 }
1057
1058 static int smb_time_audit_unlink(vfs_handle_struct *handle,
1059                                  const struct smb_filename *path)
1060 {
1061         int result;
1062         struct timespec ts1,ts2;
1063         double timediff;
1064
1065         clock_gettime_mono(&ts1);
1066         result = SMB_VFS_NEXT_UNLINK(handle, path);
1067         clock_gettime_mono(&ts2);
1068         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1069
1070         if (timediff > audit_timeout) {
1071                 smb_time_audit_log_smb_fname("unlink", timediff, path);
1072         }
1073
1074         return result;
1075 }
1076
1077 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1078                         const struct smb_filename *smb_fname,
1079                         mode_t mode)
1080 {
1081         int result;
1082         struct timespec ts1,ts2;
1083         double timediff;
1084
1085         clock_gettime_mono(&ts1);
1086         result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1087         clock_gettime_mono(&ts2);
1088         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1089
1090         if (timediff > audit_timeout) {
1091                 smb_time_audit_log_fname("chmod",
1092                         timediff,
1093                         smb_fname->base_name);
1094         }
1095
1096         return result;
1097 }
1098
1099 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1100                                  mode_t mode)
1101 {
1102         int result;
1103         struct timespec ts1,ts2;
1104         double timediff;
1105
1106         clock_gettime_mono(&ts1);
1107         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1108         clock_gettime_mono(&ts2);
1109         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1110
1111         if (timediff > audit_timeout) {
1112                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1113         }
1114
1115         return result;
1116 }
1117
1118 static int smb_time_audit_chown(vfs_handle_struct *handle,
1119                         const struct smb_filename *smb_fname,
1120                         uid_t uid,
1121                         gid_t gid)
1122 {
1123         int result;
1124         struct timespec ts1,ts2;
1125         double timediff;
1126
1127         clock_gettime_mono(&ts1);
1128         result = SMB_VFS_NEXT_CHOWN(handle, smb_fname, uid, gid);
1129         clock_gettime_mono(&ts2);
1130         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1131
1132         if (timediff > audit_timeout) {
1133                 smb_time_audit_log_fname("chown",
1134                         timediff,
1135                         smb_fname->base_name);
1136         }
1137
1138         return result;
1139 }
1140
1141 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1142                                  uid_t uid, gid_t gid)
1143 {
1144         int result;
1145         struct timespec ts1,ts2;
1146         double timediff;
1147
1148         clock_gettime_mono(&ts1);
1149         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1150         clock_gettime_mono(&ts2);
1151         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1152
1153         if (timediff > audit_timeout) {
1154                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1155         }
1156
1157         return result;
1158 }
1159
1160 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1161                         const struct smb_filename *smb_fname,
1162                         uid_t uid,
1163                         gid_t gid)
1164 {
1165         int result;
1166         struct timespec ts1,ts2;
1167         double timediff;
1168
1169         clock_gettime_mono(&ts1);
1170         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1171         clock_gettime_mono(&ts2);
1172         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1173
1174         if (timediff > audit_timeout) {
1175                 smb_time_audit_log_fname("lchown",
1176                         timediff,
1177                         smb_fname->base_name);
1178         }
1179
1180         return result;
1181 }
1182
1183 static int smb_time_audit_chdir(vfs_handle_struct *handle,
1184                         const struct smb_filename *smb_fname)
1185 {
1186         int result;
1187         struct timespec ts1,ts2;
1188         double timediff;
1189
1190         clock_gettime_mono(&ts1);
1191         result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1192         clock_gettime_mono(&ts2);
1193         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1194
1195         if (timediff > audit_timeout) {
1196                 smb_time_audit_log_fname("chdir",
1197                         timediff,
1198                         smb_fname->base_name);
1199         }
1200
1201         return result;
1202 }
1203
1204 static struct smb_filename *smb_time_audit_getwd(vfs_handle_struct *handle,
1205                                         TALLOC_CTX *mem_ctx)
1206 {
1207         struct smb_filename *result;
1208         struct timespec ts1,ts2;
1209         double timediff;
1210
1211         clock_gettime_mono(&ts1);
1212         result = SMB_VFS_NEXT_GETWD(handle, mem_ctx);
1213         clock_gettime_mono(&ts2);
1214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1215
1216         if (timediff > audit_timeout) {
1217                 smb_time_audit_log("getwd", timediff);
1218         }
1219
1220         return result;
1221 }
1222
1223 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1224                                  const struct smb_filename *path,
1225                                  struct smb_file_time *ft)
1226 {
1227         int result;
1228         struct timespec ts1,ts2;
1229         double timediff;
1230
1231         clock_gettime_mono(&ts1);
1232         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1233         clock_gettime_mono(&ts2);
1234         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1235
1236         if (timediff > audit_timeout) {
1237                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1238         }
1239
1240         return result;
1241 }
1242
1243 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1244                                     files_struct *fsp,
1245                                     off_t len)
1246 {
1247         int result;
1248         struct timespec ts1,ts2;
1249         double timediff;
1250
1251         clock_gettime_mono(&ts1);
1252         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1253         clock_gettime_mono(&ts2);
1254         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1255
1256         if (timediff > audit_timeout) {
1257                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1258         }
1259
1260         return result;
1261 }
1262
1263 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1264                                     files_struct *fsp,
1265                                     uint32_t mode,
1266                                     off_t offset,
1267                                     off_t len)
1268 {
1269         int result;
1270         int saved_errno = 0;
1271         struct timespec ts1,ts2;
1272         double timediff;
1273
1274         clock_gettime_mono(&ts1);
1275         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1276         if (result == -1) {
1277                 saved_errno = errno;
1278         }
1279         clock_gettime_mono(&ts2);
1280         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1281
1282         if (timediff > audit_timeout) {
1283                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1284         }
1285         if (result == -1) {
1286                 errno = saved_errno;
1287         }
1288         return result;
1289 }
1290
1291 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1292                                 int op, off_t offset, off_t count,
1293                                 int type)
1294 {
1295         bool result;
1296         struct timespec ts1,ts2;
1297         double timediff;
1298
1299         clock_gettime_mono(&ts1);
1300         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1301         clock_gettime_mono(&ts2);
1302         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1303
1304         if (timediff > audit_timeout) {
1305                 smb_time_audit_log_fsp("lock", timediff, fsp);
1306         }
1307
1308         return result;
1309 }
1310
1311 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1312                                        struct files_struct *fsp,
1313                                        uint32_t share_mode, uint32_t access_mask)
1314 {
1315         int result;
1316         struct timespec ts1,ts2;
1317         double timediff;
1318
1319         clock_gettime_mono(&ts1);
1320         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
1321                                            access_mask);
1322         clock_gettime_mono(&ts2);
1323         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1324
1325         if (timediff > audit_timeout) {
1326                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1327         }
1328
1329         return result;
1330 }
1331
1332 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1333                                          files_struct *fsp,
1334                                          int leasetype)
1335 {
1336         int result;
1337         struct timespec ts1,ts2;
1338         double timediff;
1339
1340         clock_gettime_mono(&ts1);
1341         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1342         clock_gettime_mono(&ts2);
1343         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1344
1345         if (timediff > audit_timeout) {
1346                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1347         }
1348
1349         return result;
1350 }
1351
1352 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1353                                    files_struct *fsp,
1354                                    off_t *poffset, off_t *pcount,
1355                                    int *ptype, pid_t *ppid)
1356 {
1357         bool result;
1358         struct timespec ts1,ts2;
1359         double timediff;
1360
1361         clock_gettime_mono(&ts1);
1362         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1363                                       ppid);
1364         clock_gettime_mono(&ts2);
1365         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1366
1367         if (timediff > audit_timeout) {
1368                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1369         }
1370
1371         return result;
1372 }
1373
1374 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1375                                 const char *link_contents,
1376                                 const struct smb_filename *new_smb_fname)
1377 {
1378         int result;
1379         struct timespec ts1,ts2;
1380         double timediff;
1381
1382         clock_gettime_mono(&ts1);
1383         result = SMB_VFS_NEXT_SYMLINK(handle, link_contents, new_smb_fname);
1384         clock_gettime_mono(&ts2);
1385         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1386
1387         if (timediff > audit_timeout) {
1388                 smb_time_audit_log_fname("symlink", timediff,
1389                         new_smb_fname->base_name);
1390         }
1391
1392         return result;
1393 }
1394
1395 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1396                                 const struct smb_filename *smb_fname,
1397                                 char *buf,
1398                                 size_t bufsiz)
1399 {
1400         int result;
1401         struct timespec ts1,ts2;
1402         double timediff;
1403
1404         clock_gettime_mono(&ts1);
1405         result = SMB_VFS_NEXT_READLINK(handle, smb_fname,
1406                                 buf, bufsiz);
1407         clock_gettime_mono(&ts2);
1408         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1409
1410         if (timediff > audit_timeout) {
1411                 smb_time_audit_log_fname("readlink", timediff,
1412                                 smb_fname->base_name);
1413         }
1414
1415         return result;
1416 }
1417
1418 static int smb_time_audit_link(vfs_handle_struct *handle,
1419                                 const struct smb_filename *old_smb_fname,
1420                                 const struct smb_filename *new_smb_fname)
1421 {
1422         int result;
1423         struct timespec ts1,ts2;
1424         double timediff;
1425
1426         clock_gettime_mono(&ts1);
1427         result = SMB_VFS_NEXT_LINK(handle, old_smb_fname, new_smb_fname);
1428         clock_gettime_mono(&ts2);
1429         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1430
1431         if (timediff > audit_timeout) {
1432                 smb_time_audit_log_fname("link", timediff,
1433                         new_smb_fname->base_name);
1434         }
1435
1436         return result;
1437 }
1438
1439 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1440                                 const struct smb_filename *smb_fname,
1441                                 mode_t mode,
1442                                 SMB_DEV_T dev)
1443 {
1444         int result;
1445         struct timespec ts1,ts2;
1446         double timediff;
1447
1448         clock_gettime_mono(&ts1);
1449         result = SMB_VFS_NEXT_MKNOD(handle, smb_fname, mode, dev);
1450         clock_gettime_mono(&ts2);
1451         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1452
1453         if (timediff > audit_timeout) {
1454                 smb_time_audit_log_smb_fname("mknod", timediff, smb_fname);
1455         }
1456
1457         return result;
1458 }
1459
1460 static struct smb_filename *smb_time_audit_realpath(vfs_handle_struct *handle,
1461                                 TALLOC_CTX *ctx,
1462                                 const struct smb_filename *smb_fname)
1463 {
1464         struct smb_filename *result_fname;
1465         struct timespec ts1,ts2;
1466         double timediff;
1467
1468         clock_gettime_mono(&ts1);
1469         result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1470         clock_gettime_mono(&ts2);
1471         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1472
1473         if (timediff > audit_timeout) {
1474                 smb_time_audit_log_fname("realpath", timediff,
1475                                 smb_fname->base_name);
1476         }
1477
1478         return result_fname;
1479 }
1480
1481 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1482                                 const struct smb_filename *smb_fname,
1483                                 unsigned int flags)
1484 {
1485         int result;
1486         struct timespec ts1,ts2;
1487         double timediff;
1488
1489         clock_gettime_mono(&ts1);
1490         result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1491         clock_gettime_mono(&ts2);
1492         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1493
1494         if (timediff > audit_timeout) {
1495                 smb_time_audit_log_smb_fname("chflags", timediff, smb_fname);
1496         }
1497
1498         return result;
1499 }
1500
1501 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1502                                                     const SMB_STRUCT_STAT *sbuf)
1503 {
1504         struct file_id id_zero;
1505         struct file_id result;
1506         struct timespec ts1,ts2;
1507         double timediff;
1508
1509         ZERO_STRUCT(id_zero);
1510
1511         clock_gettime_mono(&ts1);
1512         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1513         clock_gettime_mono(&ts2);
1514         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1515
1516         if (timediff > audit_timeout) {
1517                 smb_time_audit_log("file_id_create", timediff);
1518         }
1519
1520         return result;
1521 }
1522
1523 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1524                                           struct files_struct *fsp,
1525                                           const struct smb_filename *smb_fname,
1526                                           TALLOC_CTX *mem_ctx,
1527                                           unsigned int *pnum_streams,
1528                                           struct stream_struct **pstreams)
1529 {
1530         NTSTATUS result;
1531         struct timespec ts1,ts2;
1532         double timediff;
1533
1534         clock_gettime_mono(&ts1);
1535         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1536                                          pnum_streams, pstreams);
1537         clock_gettime_mono(&ts2);
1538         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1539
1540         if (timediff > audit_timeout) {
1541                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1542         }
1543
1544         return result;
1545 }
1546
1547 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1548                                             const char *path,
1549                                             const char *name,
1550                                             TALLOC_CTX *mem_ctx,
1551                                             char **found_name)
1552 {
1553         int result;
1554         struct timespec ts1,ts2;
1555         double timediff;
1556
1557         clock_gettime_mono(&ts1);
1558         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1559                                                 found_name);
1560         clock_gettime_mono(&ts2);
1561         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1562
1563         if (timediff > audit_timeout) {
1564                 smb_time_audit_log_fname("get_real_filename", timediff, path);
1565         }
1566
1567         return result;
1568 }
1569
1570 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1571                                         const struct smb_filename *smb_fname)
1572 {
1573         const char *result;
1574         struct timespec ts1,ts2;
1575         double timediff;
1576
1577         clock_gettime_mono(&ts1);
1578         result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1579         clock_gettime_mono(&ts2);
1580         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1581
1582         if (timediff > audit_timeout) {
1583                 smb_time_audit_log_fname("connectpath", timediff,
1584                         smb_fname->base_name);
1585         }
1586
1587         return result;
1588 }
1589
1590 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1591                                                 struct byte_range_lock *br_lck,
1592                                                 struct lock_struct *plock,
1593                                                 bool blocking_lock)
1594 {
1595         NTSTATUS result;
1596         struct timespec ts1,ts2;
1597         double timediff;
1598
1599         clock_gettime_mono(&ts1);
1600         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1601                                                blocking_lock);
1602         clock_gettime_mono(&ts2);
1603         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1604
1605         if (timediff > audit_timeout) {
1606                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1607                                        brl_fsp(br_lck));
1608         }
1609
1610         return result;
1611 }
1612
1613 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1614                                               struct messaging_context *msg_ctx,
1615                                               struct byte_range_lock *br_lck,
1616                                               const struct lock_struct *plock)
1617 {
1618         bool result;
1619         struct timespec ts1,ts2;
1620         double timediff;
1621
1622         clock_gettime_mono(&ts1);
1623         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1624                                                  plock);
1625         clock_gettime_mono(&ts2);
1626         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1627
1628         if (timediff > audit_timeout) {
1629                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1630                                        brl_fsp(br_lck));
1631         }
1632
1633         return result;
1634 }
1635
1636 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1637                                               struct byte_range_lock *br_lck,
1638                                               struct lock_struct *plock)
1639 {
1640         bool result;
1641         struct timespec ts1,ts2;
1642         double timediff;
1643
1644         clock_gettime_mono(&ts1);
1645         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1646         clock_gettime_mono(&ts2);
1647         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1648
1649         if (timediff > audit_timeout) {
1650                 smb_time_audit_log_fsp("brl_cancel_windows", timediff,
1651                                        brl_fsp(br_lck));
1652         }
1653
1654         return result;
1655 }
1656
1657 static bool smb_time_audit_strict_lock_check(struct vfs_handle_struct *handle,
1658                                              struct files_struct *fsp,
1659                                              struct lock_struct *plock)
1660 {
1661         bool result;
1662         struct timespec ts1,ts2;
1663         double timediff;
1664
1665         clock_gettime_mono(&ts1);
1666         result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1667         clock_gettime_mono(&ts2);
1668         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1669
1670         if (timediff > audit_timeout) {
1671                 smb_time_audit_log_fsp("strict_lock_check", timediff, fsp);
1672         }
1673
1674         return result;
1675 }
1676
1677 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1678                                               const char *name,
1679                                               enum vfs_translate_direction direction,
1680                                               TALLOC_CTX *mem_ctx,
1681                                               char **mapped_name)
1682 {
1683         NTSTATUS result;
1684         struct timespec ts1,ts2;
1685         double timediff;
1686
1687         clock_gettime_mono(&ts1);
1688         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1689                                              mapped_name);
1690         clock_gettime_mono(&ts2);
1691         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1692
1693         if (timediff > audit_timeout) {
1694                 smb_time_audit_log_fname("translate_name", timediff, name);
1695         }
1696
1697         return result;
1698 }
1699
1700 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1701                                 struct files_struct *fsp,
1702                                 TALLOC_CTX *ctx,
1703                                 uint32_t function,
1704                                 uint16_t req_flags,
1705                                 const uint8_t *_in_data,
1706                                 uint32_t in_len,
1707                                 uint8_t **_out_data,
1708                                 uint32_t max_out_len,
1709                                 uint32_t *out_len)
1710 {
1711         NTSTATUS result;
1712         struct timespec ts1,ts2;
1713         double timediff;
1714
1715         clock_gettime_mono(&ts1);
1716         result = SMB_VFS_NEXT_FSCTL(handle,
1717                                 fsp,
1718                                 ctx,
1719                                 function,
1720                                 req_flags,
1721                                 _in_data,
1722                                 in_len,
1723                                 _out_data,
1724                                 max_out_len,
1725                                 out_len);
1726         clock_gettime_mono(&ts2);
1727         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1728
1729         if (timediff > audit_timeout) {
1730                 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1731         }
1732
1733         return result;
1734 }
1735
1736 static NTSTATUS smb_time_get_dos_attributes(struct vfs_handle_struct *handle,
1737                                         struct smb_filename *smb_fname,
1738                                         uint32_t *dosmode)
1739 {
1740         NTSTATUS result;
1741         struct timespec ts1,ts2;
1742         double timediff;
1743
1744         clock_gettime_mono(&ts1);
1745         result = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
1746                                 smb_fname,
1747                                 dosmode);
1748         clock_gettime_mono(&ts2);
1749         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1750
1751         if (timediff > audit_timeout) {
1752                 smb_time_audit_log_fname("get_dos_attributes",
1753                                 timediff,
1754                                 smb_fname->base_name);
1755         }
1756
1757         return result;
1758 }
1759
1760 struct smb_time_audit_get_dos_attributes_state {
1761         struct vfs_aio_state aio_state;
1762         files_struct *dir_fsp;
1763         const struct smb_filename *smb_fname;
1764         uint32_t dosmode;
1765 };
1766
1767 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq);
1768
1769 static struct tevent_req *smb_time_audit_get_dos_attributes_send(
1770                         TALLOC_CTX *mem_ctx,
1771                         const struct smb_vfs_ev_glue *evg,
1772                         struct vfs_handle_struct *handle,
1773                         files_struct *dir_fsp,
1774                         struct smb_filename *smb_fname)
1775 {
1776         struct tevent_context *ev = smb_vfs_ev_glue_ev_ctx(evg);
1777         struct tevent_req *req = NULL;
1778         struct smb_time_audit_get_dos_attributes_state *state = NULL;
1779         struct tevent_req *subreq = NULL;
1780
1781         req = tevent_req_create(mem_ctx, &state,
1782                                 struct smb_time_audit_get_dos_attributes_state);
1783         if (req == NULL) {
1784                 return NULL;
1785         }
1786         *state = (struct smb_time_audit_get_dos_attributes_state) {
1787                 .dir_fsp = dir_fsp,
1788                 .smb_fname = smb_fname,
1789         };
1790
1791         subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
1792                                                       evg,
1793                                                       handle,
1794                                                       dir_fsp,
1795                                                       smb_fname);
1796         if (tevent_req_nomem(subreq, req)) {
1797                 return tevent_req_post(req, ev);
1798         }
1799         tevent_req_set_callback(subreq,
1800                                 smb_time_audit_get_dos_attributes_done,
1801                                 req);
1802
1803         return req;
1804 }
1805
1806 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq)
1807 {
1808         struct tevent_req *req =
1809                 tevent_req_callback_data(subreq,
1810                 struct tevent_req);
1811         struct smb_time_audit_get_dos_attributes_state *state =
1812                 tevent_req_data(req,
1813                 struct smb_time_audit_get_dos_attributes_state);
1814         NTSTATUS status;
1815
1816         status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
1817                                                       &state->aio_state,
1818                                                       &state->dosmode);
1819         TALLOC_FREE(subreq);
1820         if (tevent_req_nterror(req, status)) {
1821                 return;
1822         }
1823
1824         tevent_req_done(req);
1825         return;
1826 }
1827
1828 static NTSTATUS smb_time_audit_get_dos_attributes_recv(struct tevent_req *req,
1829                                                 struct vfs_aio_state *aio_state,
1830                                                 uint32_t *dosmode)
1831 {
1832         struct smb_time_audit_get_dos_attributes_state *state =
1833                 tevent_req_data(req,
1834                 struct smb_time_audit_get_dos_attributes_state);
1835         NTSTATUS status;
1836         double timediff;
1837
1838         timediff = state->aio_state.duration * 1.0e-9;
1839
1840         if (timediff > audit_timeout) {
1841                 smb_time_audit_log_at("async get_dos_attributes",
1842                                       timediff,
1843                                       state->dir_fsp,
1844                                       state->smb_fname);
1845         }
1846
1847         if (tevent_req_is_nterror(req, &status)) {
1848                 tevent_req_received(req);
1849                 return status;
1850         }
1851
1852         *aio_state = state->aio_state;
1853         *dosmode = state->dosmode;
1854         tevent_req_received(req);
1855         return NT_STATUS_OK;
1856 }
1857
1858 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1859                                         struct files_struct *fsp,
1860                                         uint32_t *dosmode)
1861 {
1862         NTSTATUS result;
1863         struct timespec ts1,ts2;
1864         double timediff;
1865
1866         clock_gettime_mono(&ts1);
1867         result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1868                                 fsp,
1869                                 dosmode);
1870         clock_gettime_mono(&ts2);
1871         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1872
1873         if (timediff > audit_timeout) {
1874                 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1875         }
1876
1877         return result;
1878 }
1879
1880 static NTSTATUS smb_time_set_dos_attributes(struct vfs_handle_struct *handle,
1881                                         const struct smb_filename *smb_fname,
1882                                         uint32_t dosmode)
1883 {
1884         NTSTATUS result;
1885         struct timespec ts1,ts2;
1886         double timediff;
1887
1888         clock_gettime_mono(&ts1);
1889         result = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
1890                                 smb_fname,
1891                                 dosmode);
1892         clock_gettime_mono(&ts2);
1893         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1894
1895         if (timediff > audit_timeout) {
1896                 smb_time_audit_log_fname("set_dos_attributes",
1897                                 timediff,
1898                                 smb_fname->base_name);
1899         }
1900
1901         return result;
1902 }
1903
1904 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
1905                                         struct files_struct *fsp,
1906                                         uint32_t dosmode)
1907 {
1908         NTSTATUS result;
1909         struct timespec ts1,ts2;
1910         double timediff;
1911
1912         clock_gettime_mono(&ts1);
1913         result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
1914                                 fsp,
1915                                 dosmode);
1916         clock_gettime_mono(&ts2);
1917         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1918
1919         if (timediff > audit_timeout) {
1920                 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
1921         }
1922
1923         return result;
1924 }
1925
1926 struct time_audit_offload_read_state {
1927         struct vfs_handle_struct *handle;
1928         struct timespec ts_send;
1929         DATA_BLOB token_blob;
1930 };
1931
1932 static void smb_time_audit_offload_read_done(struct tevent_req *subreq);
1933
1934 static struct tevent_req *smb_time_audit_offload_read_send(
1935         TALLOC_CTX *mem_ctx,
1936         struct tevent_context *ev,
1937         struct vfs_handle_struct *handle,
1938         struct files_struct *fsp,
1939         uint32_t fsctl,
1940         uint32_t ttl,
1941         off_t offset,
1942         size_t to_copy)
1943 {
1944         struct tevent_req *req = NULL;
1945         struct tevent_req *subreq = NULL;
1946         struct time_audit_offload_read_state *state = NULL;
1947
1948         req = tevent_req_create(mem_ctx, &state,
1949                                 struct time_audit_offload_read_state);
1950         if (req == NULL) {
1951                 return NULL;
1952         }
1953         state->handle = handle;
1954         clock_gettime_mono(&state->ts_send);
1955
1956         subreq = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev,
1957                                                 handle, fsp,
1958                                                 fsctl, ttl,
1959                                                 offset, to_copy);
1960         if (tevent_req_nomem(subreq, req)) {
1961                 return tevent_req_post(req, ev);
1962         }
1963
1964         tevent_req_set_callback(subreq, smb_time_audit_offload_read_done, req);
1965         return req;
1966 }
1967
1968 static void smb_time_audit_offload_read_done(struct tevent_req *subreq)
1969 {
1970         struct tevent_req *req = tevent_req_callback_data(
1971                 subreq, struct tevent_req);
1972         struct time_audit_offload_read_state *state = tevent_req_data(
1973                 req, struct time_audit_offload_read_state);
1974         NTSTATUS status;
1975
1976         status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(subreq,
1977                                                 state->handle,
1978                                                 state,
1979                                                 &state->token_blob);
1980         TALLOC_FREE(subreq);
1981         if (tevent_req_nterror(req, status)) {
1982                 return;
1983         }
1984         tevent_req_done(req);
1985 }
1986
1987 static NTSTATUS smb_time_audit_offload_read_recv(
1988         struct tevent_req *req,
1989         struct vfs_handle_struct *handle,
1990         TALLOC_CTX *mem_ctx,
1991         DATA_BLOB *token_blob)
1992 {
1993         struct time_audit_offload_read_state *state = tevent_req_data(
1994                 req, struct time_audit_offload_read_state);
1995         struct timespec ts_recv;
1996         double timediff;
1997         NTSTATUS status;
1998
1999         clock_gettime_mono(&ts_recv);
2000         timediff = nsec_time_diff(&ts_recv, &state->ts_send) * 1.0e-9;
2001         if (timediff > audit_timeout) {
2002                 smb_time_audit_log("offload_read", timediff);
2003         }
2004
2005         if (tevent_req_is_nterror(req, &status)) {
2006                 tevent_req_received(req);
2007                 return status;
2008         }
2009
2010         token_blob->length = state->token_blob.length;
2011         token_blob->data = talloc_move(mem_ctx, &state->token_blob.data);
2012
2013         tevent_req_received(req);
2014         return NT_STATUS_OK;
2015 }
2016
2017 struct time_audit_offload_write_state {
2018         struct timespec ts_send;
2019         struct vfs_handle_struct *handle;
2020         off_t copied;
2021 };
2022 static void smb_time_audit_offload_write_done(struct tevent_req *subreq);
2023
2024 static struct tevent_req *smb_time_audit_offload_write_send(struct vfs_handle_struct *handle,
2025                                                          TALLOC_CTX *mem_ctx,
2026                                                          struct tevent_context *ev,
2027                                                          uint32_t fsctl,
2028                                                          DATA_BLOB *token,
2029                                                          off_t transfer_offset,
2030                                                          struct files_struct *dest_fsp,
2031                                                          off_t dest_off,
2032                                                          off_t num)
2033 {
2034         struct tevent_req *req;
2035         struct tevent_req *subreq;
2036         struct time_audit_offload_write_state *state;
2037
2038         req = tevent_req_create(mem_ctx, &state,
2039                                 struct time_audit_offload_write_state);
2040         if (req == NULL) {
2041                 return NULL;
2042         }
2043
2044         state->handle = handle;
2045         clock_gettime_mono(&state->ts_send);
2046         subreq = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, state, ev,
2047                                               fsctl, token, transfer_offset,
2048                                               dest_fsp, dest_off, num);
2049         if (tevent_req_nomem(subreq, req)) {
2050                 return tevent_req_post(req, ev);
2051         }
2052
2053         tevent_req_set_callback(subreq, smb_time_audit_offload_write_done, req);
2054         return req;
2055 }
2056
2057 static void smb_time_audit_offload_write_done(struct tevent_req *subreq)
2058 {
2059         struct tevent_req *req = tevent_req_callback_data(
2060                 subreq, struct tevent_req);
2061         struct time_audit_offload_write_state *state = tevent_req_data(
2062                 req, struct time_audit_offload_write_state);
2063         NTSTATUS status;
2064
2065         status = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(state->handle,
2066                                               subreq,
2067                                               &state->copied);
2068         TALLOC_FREE(subreq);
2069         if (tevent_req_nterror(req, status)) {
2070                 return;
2071         }
2072         tevent_req_done(req);
2073 }
2074
2075 static NTSTATUS smb_time_audit_offload_write_recv(struct vfs_handle_struct *handle,
2076                                                struct tevent_req *req,
2077                                                off_t *copied)
2078 {
2079         struct time_audit_offload_write_state *state = tevent_req_data(
2080                 req, struct time_audit_offload_write_state);
2081         struct timespec ts_recv;
2082         double timediff;
2083         NTSTATUS status;
2084
2085         clock_gettime_mono(&ts_recv);
2086         timediff = nsec_time_diff(&ts_recv, &state->ts_send)*1.0e-9;
2087         if (timediff > audit_timeout) {
2088                 smb_time_audit_log("offload_write", timediff);
2089         }
2090
2091         *copied = state->copied;
2092         if (tevent_req_is_nterror(req, &status)) {
2093                 tevent_req_received(req);
2094                 return status;
2095         }
2096
2097         tevent_req_received(req);
2098         return NT_STATUS_OK;
2099 }
2100
2101 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
2102                                                TALLOC_CTX *mem_ctx,
2103                                                struct files_struct *fsp,
2104                                                struct smb_filename *smb_fname,
2105                                                uint16_t *_compression_fmt)
2106 {
2107         NTSTATUS result;
2108         struct timespec ts1,ts2;
2109         double timediff;
2110
2111         clock_gettime_mono(&ts1);
2112         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2113                                               _compression_fmt);
2114         clock_gettime_mono(&ts2);
2115         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2116
2117         if (timediff > audit_timeout) {
2118                 if (fsp !=  NULL) {
2119                         smb_time_audit_log_fsp("get_compression",
2120                                                timediff, fsp);
2121                 } else {
2122                         smb_time_audit_log_smb_fname("get_compression",
2123                                                      timediff, smb_fname);
2124                 }
2125         }
2126
2127         return result;
2128 }
2129
2130 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
2131                                                TALLOC_CTX *mem_ctx,
2132                                                struct files_struct *fsp,
2133                                                uint16_t compression_fmt)
2134 {
2135         NTSTATUS result;
2136         struct timespec ts1,ts2;
2137         double timediff;
2138
2139         clock_gettime_mono(&ts1);
2140         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2141                                               compression_fmt);
2142         clock_gettime_mono(&ts2);
2143         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2144
2145         if (timediff > audit_timeout) {
2146                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2147         }
2148
2149         return result;
2150 }
2151
2152 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
2153                                             const struct smb_filename *fname,
2154                                             TALLOC_CTX *mem_ctx,
2155                                             struct readdir_attr_data **pattr_data)
2156 {
2157         NTSTATUS status;
2158         struct timespec ts1,ts2;
2159         double timediff;
2160
2161         clock_gettime_mono(&ts1);
2162         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2163         clock_gettime_mono(&ts2);
2164         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2165
2166         if (timediff > audit_timeout) {
2167                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
2168         }
2169
2170         return status;
2171 }
2172
2173 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2174                                            files_struct *fsp,
2175                                            uint32_t security_info,
2176                                            TALLOC_CTX *mem_ctx,
2177                                            struct security_descriptor **ppdesc)
2178 {
2179         NTSTATUS result;
2180         struct timespec ts1,ts2;
2181         double timediff;
2182
2183         clock_gettime_mono(&ts1);
2184         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2185                                           mem_ctx, ppdesc);
2186         clock_gettime_mono(&ts2);
2187         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2188
2189         if (timediff > audit_timeout) {
2190                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2191         }
2192
2193         return result;
2194 }
2195
2196 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
2197                                           const struct smb_filename *smb_fname,
2198                                           uint32_t security_info,
2199                                           TALLOC_CTX *mem_ctx,
2200                                           struct security_descriptor **ppdesc)
2201 {
2202         NTSTATUS result;
2203         struct timespec ts1,ts2;
2204         double timediff;
2205
2206         clock_gettime_mono(&ts1);
2207         result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2208                                          mem_ctx, ppdesc);
2209         clock_gettime_mono(&ts2);
2210         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2211
2212         if (timediff > audit_timeout) {
2213                 smb_time_audit_log_fname("get_nt_acl",
2214                         timediff,
2215                         smb_fname->base_name);
2216         }
2217
2218         return result;
2219 }
2220
2221 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2222                                            files_struct *fsp,
2223                                            uint32_t security_info_sent,
2224                                            const struct security_descriptor *psd)
2225 {
2226         NTSTATUS result;
2227         struct timespec ts1,ts2;
2228         double timediff;
2229
2230         clock_gettime_mono(&ts1);
2231         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2232                                           psd);
2233         clock_gettime_mono(&ts2);
2234         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2235
2236         if (timediff > audit_timeout) {
2237                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2238         }
2239
2240         return result;
2241 }
2242
2243 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2244                                 struct smb_filename *smb_fname,
2245                                 struct security_acl *sacl,
2246                                 uint32_t access_requested,
2247                                 uint32_t access_denied)
2248 {
2249         NTSTATUS result;
2250         struct timespec ts1,ts2;
2251         double timediff;
2252
2253         clock_gettime_mono(&ts1);
2254         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2255                                         smb_fname,
2256                                         sacl,
2257                                         access_requested,
2258                                         access_denied);
2259         clock_gettime_mono(&ts2);
2260         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2261
2262         if (timediff > audit_timeout) {
2263                 smb_time_audit_log_fname("audit_file",
2264                         timediff,
2265                         smb_fname->base_name);
2266         }
2267
2268         return result;
2269 }
2270
2271 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2272                                         const struct smb_filename *smb_fname,
2273                                         SMB_ACL_TYPE_T type,
2274                                         TALLOC_CTX *mem_ctx)
2275 {
2276         SMB_ACL_T result;
2277         struct timespec ts1,ts2;
2278         double timediff;
2279
2280         clock_gettime_mono(&ts1);
2281         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2282                                 type, mem_ctx);
2283         clock_gettime_mono(&ts2);
2284         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2285
2286         if (timediff > audit_timeout) {
2287                 smb_time_audit_log_fname("sys_acl_get_file", timediff,
2288                         smb_fname->base_name);
2289         }
2290
2291         return result;
2292 }
2293
2294 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2295                                                files_struct *fsp,
2296                                                TALLOC_CTX *mem_ctx)
2297 {
2298         SMB_ACL_T result;
2299         struct timespec ts1,ts2;
2300         double timediff;
2301
2302         clock_gettime_mono(&ts1);
2303         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2304         clock_gettime_mono(&ts2);
2305         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2306
2307         if (timediff > audit_timeout) {
2308                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2309         }
2310
2311         return result;
2312 }
2313
2314
2315 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2316                                 const struct smb_filename *smb_fname,
2317                                 TALLOC_CTX *mem_ctx,
2318                                 char **blob_description,
2319                                 DATA_BLOB *blob)
2320 {
2321         int result;
2322         struct timespec ts1,ts2;
2323         double timediff;
2324
2325         clock_gettime_mono(&ts1);
2326         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2327                                 mem_ctx, blob_description, blob);
2328         clock_gettime_mono(&ts2);
2329         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2330
2331         if (timediff > audit_timeout) {
2332                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2333         }
2334
2335         return result;
2336 }
2337
2338 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2339                                               files_struct *fsp,
2340                                               TALLOC_CTX *mem_ctx, 
2341                                               char **blob_description,
2342                                               DATA_BLOB *blob)
2343 {
2344         int result;
2345         struct timespec ts1,ts2;
2346         double timediff;
2347
2348         clock_gettime_mono(&ts1);
2349         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2350         clock_gettime_mono(&ts2);
2351         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2352
2353         if (timediff > audit_timeout) {
2354                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2355         }
2356
2357         return result;
2358 }
2359
2360 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2361                                            const struct smb_filename *smb_fname,
2362                                            SMB_ACL_TYPE_T acltype,
2363                                            SMB_ACL_T theacl)
2364 {
2365         int result;
2366         struct timespec ts1,ts2;
2367         double timediff;
2368
2369         clock_gettime_mono(&ts1);
2370         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2371                                                theacl);
2372         clock_gettime_mono(&ts2);
2373         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2374
2375         if (timediff > audit_timeout) {
2376                 smb_time_audit_log_fname("sys_acl_set_file", timediff,
2377                         smb_fname->base_name);
2378         }
2379
2380         return result;
2381 }
2382
2383 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2384                                          files_struct *fsp,
2385                                          SMB_ACL_T theacl)
2386 {
2387         int result;
2388         struct timespec ts1,ts2;
2389         double timediff;
2390
2391         clock_gettime_mono(&ts1);
2392         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2393         clock_gettime_mono(&ts2);
2394         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2395
2396         if (timediff > audit_timeout) {
2397                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2398         }
2399
2400         return result;
2401 }
2402
2403 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2404                                 const struct smb_filename *smb_fname)
2405 {
2406         int result;
2407         struct timespec ts1,ts2;
2408         double timediff;
2409
2410         clock_gettime_mono(&ts1);
2411         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2412         clock_gettime_mono(&ts2);
2413         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2414
2415         if (timediff > audit_timeout) {
2416                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff,
2417                         smb_fname->base_name);
2418         }
2419
2420         return result;
2421 }
2422
2423 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2424                                 const struct smb_filename *smb_fname,
2425                                 const char *name,
2426                                 void *value,
2427                                 size_t size)
2428 {
2429         ssize_t result;
2430         struct timespec ts1,ts2;
2431         double timediff;
2432
2433         clock_gettime_mono(&ts1);
2434         result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2435         clock_gettime_mono(&ts2);
2436         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2437
2438         if (timediff > audit_timeout) {
2439                 smb_time_audit_log_fname("getxattr", timediff,
2440                         smb_fname->base_name);
2441         }
2442
2443         return result;
2444 }
2445
2446 struct smb_time_audit_getxattrat_state {
2447         struct vfs_aio_state aio_state;
2448         files_struct *dir_fsp;
2449         const struct smb_filename *smb_fname;
2450         const char *xattr_name;
2451         ssize_t xattr_size;
2452         uint8_t *xattr_value;
2453 };
2454
2455 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq);
2456
2457 static struct tevent_req *smb_time_audit_getxattrat_send(
2458                         TALLOC_CTX *mem_ctx,
2459                         const struct smb_vfs_ev_glue *evg,
2460                         struct vfs_handle_struct *handle,
2461                         files_struct *dir_fsp,
2462                         const struct smb_filename *smb_fname,
2463                         const char *xattr_name,
2464                         size_t alloc_hint)
2465 {
2466         struct tevent_context *ev = smb_vfs_ev_glue_ev_ctx(evg);
2467         struct tevent_req *req = NULL;
2468         struct tevent_req *subreq = NULL;
2469         struct smb_time_audit_getxattrat_state *state = NULL;
2470
2471         req = tevent_req_create(mem_ctx, &state,
2472                                 struct smb_time_audit_getxattrat_state);
2473         if (req == NULL) {
2474                 return NULL;
2475         }
2476         *state = (struct smb_time_audit_getxattrat_state) {
2477                 .dir_fsp = dir_fsp,
2478                 .smb_fname = smb_fname,
2479                 .xattr_name = xattr_name,
2480         };
2481
2482         subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2483                                               evg,
2484                                               handle,
2485                                               dir_fsp,
2486                                               smb_fname,
2487                                               xattr_name,
2488                                               alloc_hint);
2489         if (tevent_req_nomem(subreq, req)) {
2490                 return tevent_req_post(req, ev);
2491         }
2492         tevent_req_set_callback(subreq, smb_time_audit_getxattrat_done, req);
2493
2494         return req;
2495 }
2496
2497 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq)
2498 {
2499         struct tevent_req *req = tevent_req_callback_data(
2500                 subreq, struct tevent_req);
2501         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2502                 req, struct smb_time_audit_getxattrat_state);
2503
2504         state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2505                                                          &state->aio_state,
2506                                                          state,
2507                                                          &state->xattr_value);
2508         TALLOC_FREE(subreq);
2509         if (state->xattr_size == -1) {
2510                 tevent_req_error(req, state->aio_state.error);
2511                 return;
2512         }
2513
2514         tevent_req_done(req);
2515 }
2516
2517 static ssize_t smb_time_audit_getxattrat_recv(struct tevent_req *req,
2518                                               struct vfs_aio_state *aio_state,
2519                                               TALLOC_CTX *mem_ctx,
2520                                               uint8_t **xattr_value)
2521 {
2522         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2523                 req, struct smb_time_audit_getxattrat_state);
2524         ssize_t xattr_size;
2525         double timediff;
2526
2527         timediff = state->aio_state.duration * 1.0e-9;
2528
2529         if (timediff > audit_timeout) {
2530                 smb_time_audit_log_at("async getxattrat",
2531                                       timediff,
2532                                       state->dir_fsp,
2533                                       state->smb_fname);
2534         }
2535
2536         if (tevent_req_is_unix_error(req, &aio_state->error)) {
2537                 tevent_req_received(req);
2538                 return -1;
2539         }
2540
2541         *aio_state = state->aio_state;
2542         xattr_size = state->xattr_size;
2543         if (xattr_value != NULL) {
2544                 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2545         }
2546
2547         tevent_req_received(req);
2548         return xattr_size;
2549 }
2550
2551 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2552                                         struct files_struct *fsp,
2553                                         const char *name, void *value,
2554                                         size_t size)
2555 {
2556         ssize_t result;
2557         struct timespec ts1,ts2;
2558         double timediff;
2559
2560         clock_gettime_mono(&ts1);
2561         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2562         clock_gettime_mono(&ts2);
2563         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2564
2565         if (timediff > audit_timeout) {
2566                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2567         }
2568
2569         return result;
2570 }
2571
2572 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2573                                         const struct smb_filename *smb_fname,
2574                                         char *list,
2575                                         size_t size)
2576 {
2577         ssize_t result;
2578         struct timespec ts1,ts2;
2579         double timediff;
2580
2581         clock_gettime_mono(&ts1);
2582         result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2583         clock_gettime_mono(&ts2);
2584         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2585
2586         if (timediff > audit_timeout) {
2587                 smb_time_audit_log_fname("listxattr", timediff,
2588                                 smb_fname->base_name);
2589         }
2590
2591         return result;
2592 }
2593
2594 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2595                                          struct files_struct *fsp, char *list,
2596                                          size_t size)
2597 {
2598         ssize_t result;
2599         struct timespec ts1,ts2;
2600         double timediff;
2601
2602         clock_gettime_mono(&ts1);
2603         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2604         clock_gettime_mono(&ts2);
2605         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2606
2607         if (timediff > audit_timeout) {
2608                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2609         }
2610
2611         return result;
2612 }
2613
2614 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2615                                 const struct smb_filename *smb_fname,
2616                                 const char *name)
2617 {
2618         int result;
2619         struct timespec ts1,ts2;
2620         double timediff;
2621
2622         clock_gettime_mono(&ts1);
2623         result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2624         clock_gettime_mono(&ts2);
2625         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2626
2627         if (timediff > audit_timeout) {
2628                 smb_time_audit_log_fname("removexattr", timediff,
2629                         smb_fname->base_name);
2630         }
2631
2632         return result;
2633 }
2634
2635 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2636                                        struct files_struct *fsp,
2637                                        const char *name)
2638 {
2639         int result;
2640         struct timespec ts1,ts2;
2641         double timediff;
2642
2643         clock_gettime_mono(&ts1);
2644         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2645         clock_gettime_mono(&ts2);
2646         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2647
2648         if (timediff > audit_timeout) {
2649                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2650         }
2651
2652         return result;
2653 }
2654
2655 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2656                                 const struct smb_filename *smb_fname,
2657                                 const char *name,
2658                                 const void *value,
2659                                 size_t size,
2660                                 int flags)
2661 {
2662         int result;
2663         struct timespec ts1,ts2;
2664         double timediff;
2665
2666         clock_gettime_mono(&ts1);
2667         result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2668                                        flags);
2669         clock_gettime_mono(&ts2);
2670         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2671
2672         if (timediff > audit_timeout) {
2673                 smb_time_audit_log_fname("setxattr", timediff,
2674                                 smb_fname->base_name);
2675         }
2676
2677         return result;
2678 }
2679
2680 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2681                                     struct files_struct *fsp, const char *name,
2682                                     const void *value, size_t size, int flags)
2683 {
2684         int result;
2685         struct timespec ts1,ts2;
2686         double timediff;
2687
2688         clock_gettime_mono(&ts1);
2689         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2690         clock_gettime_mono(&ts2);
2691         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2692
2693         if (timediff > audit_timeout) {
2694                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2695         }
2696
2697         return result;
2698 }
2699
2700 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2701                                      struct files_struct *fsp)
2702 {
2703         bool result;
2704         struct timespec ts1,ts2;
2705         double timediff;
2706
2707         clock_gettime_mono(&ts1);
2708         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2709         clock_gettime_mono(&ts2);
2710         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2711
2712         if (timediff > audit_timeout) {
2713                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2714         }
2715
2716         return result;
2717 }
2718
2719 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2720                                               struct files_struct *fsp,
2721                                               TALLOC_CTX *mem_ctx,
2722                                               DATA_BLOB *cookie)
2723 {
2724         NTSTATUS result;
2725         struct timespec ts1,ts2;
2726         double timediff;
2727
2728         clock_gettime_mono(&ts1);
2729         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2730         clock_gettime_mono(&ts2);
2731         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2732
2733         if (timediff > audit_timeout) {
2734                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2735         }
2736
2737         return result;
2738 }
2739
2740 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2741                                                   struct files_struct *fsp,
2742                                                   const DATA_BLOB old_cookie,
2743                                                   TALLOC_CTX *mem_ctx,
2744                                                   DATA_BLOB *new_cookie)
2745 {
2746         NTSTATUS result;
2747         struct timespec ts1,ts2;
2748         double timediff;
2749
2750         clock_gettime_mono(&ts1);
2751         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2752                                                  mem_ctx, new_cookie);
2753         clock_gettime_mono(&ts2);
2754         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2755
2756         if (timediff > audit_timeout) {
2757                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2758         }
2759
2760         return result;
2761 }
2762
2763 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2764                                                  struct smb_request *smb1req,
2765                                                  struct smbXsrv_open *op,
2766                                                  const DATA_BLOB old_cookie,
2767                                                  TALLOC_CTX *mem_ctx,
2768                                                  struct files_struct **fsp,
2769                                                  DATA_BLOB *new_cookie)
2770 {
2771         NTSTATUS result;
2772         struct timespec ts1,ts2;
2773         double timediff;
2774
2775         clock_gettime_mono(&ts1);
2776         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2777                                                 mem_ctx, fsp, new_cookie);
2778         clock_gettime_mono(&ts2);
2779         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2780
2781         if (timediff > audit_timeout) {
2782                 smb_time_audit_log("durable_reconnect", timediff);
2783         }
2784
2785         return result;
2786 }
2787
2788 /* VFS operations */
2789
2790 static struct vfs_fn_pointers vfs_time_audit_fns = {
2791         .connect_fn = smb_time_audit_connect,
2792         .disconnect_fn = smb_time_audit_disconnect,
2793         .disk_free_fn = smb_time_audit_disk_free,
2794         .get_quota_fn = smb_time_audit_get_quota,
2795         .set_quota_fn = smb_time_audit_set_quota,
2796         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2797         .statvfs_fn = smb_time_audit_statvfs,
2798         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2799         .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2800         .opendir_fn = smb_time_audit_opendir,
2801         .fdopendir_fn = smb_time_audit_fdopendir,
2802         .readdir_fn = smb_time_audit_readdir,
2803         .seekdir_fn = smb_time_audit_seekdir,
2804         .telldir_fn = smb_time_audit_telldir,
2805         .rewind_dir_fn = smb_time_audit_rewinddir,
2806         .mkdir_fn = smb_time_audit_mkdir,
2807         .rmdir_fn = smb_time_audit_rmdir,
2808         .closedir_fn = smb_time_audit_closedir,
2809         .open_fn = smb_time_audit_open,
2810         .create_file_fn = smb_time_audit_create_file,
2811         .close_fn = smb_time_audit_close,
2812         .pread_fn = smb_time_audit_pread,
2813         .pread_send_fn = smb_time_audit_pread_send,
2814         .pread_recv_fn = smb_time_audit_pread_recv,
2815         .pwrite_fn = smb_time_audit_pwrite,
2816         .pwrite_send_fn = smb_time_audit_pwrite_send,
2817         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2818         .lseek_fn = smb_time_audit_lseek,
2819         .sendfile_fn = smb_time_audit_sendfile,
2820         .recvfile_fn = smb_time_audit_recvfile,
2821         .rename_fn = smb_time_audit_rename,
2822         .fsync_send_fn = smb_time_audit_fsync_send,
2823         .fsync_recv_fn = smb_time_audit_fsync_recv,
2824         .stat_fn = smb_time_audit_stat,
2825         .fstat_fn = smb_time_audit_fstat,
2826         .lstat_fn = smb_time_audit_lstat,
2827         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2828         .unlink_fn = smb_time_audit_unlink,
2829         .chmod_fn = smb_time_audit_chmod,
2830         .fchmod_fn = smb_time_audit_fchmod,
2831         .chown_fn = smb_time_audit_chown,
2832         .fchown_fn = smb_time_audit_fchown,
2833         .lchown_fn = smb_time_audit_lchown,
2834         .chdir_fn = smb_time_audit_chdir,
2835         .getwd_fn = smb_time_audit_getwd,
2836         .ntimes_fn = smb_time_audit_ntimes,
2837         .ftruncate_fn = smb_time_audit_ftruncate,
2838         .fallocate_fn = smb_time_audit_fallocate,
2839         .lock_fn = smb_time_audit_lock,
2840         .kernel_flock_fn = smb_time_audit_kernel_flock,
2841         .linux_setlease_fn = smb_time_audit_linux_setlease,
2842         .getlock_fn = smb_time_audit_getlock,
2843         .symlink_fn = smb_time_audit_symlink,
2844         .readlink_fn = smb_time_audit_readlink,
2845         .link_fn = smb_time_audit_link,
2846         .mknod_fn = smb_time_audit_mknod,
2847         .realpath_fn = smb_time_audit_realpath,
2848         .chflags_fn = smb_time_audit_chflags,
2849         .file_id_create_fn = smb_time_audit_file_id_create,
2850         .offload_read_send_fn = smb_time_audit_offload_read_send,
2851         .offload_read_recv_fn = smb_time_audit_offload_read_recv,
2852         .offload_write_send_fn = smb_time_audit_offload_write_send,
2853         .offload_write_recv_fn = smb_time_audit_offload_write_recv,
2854         .get_compression_fn = smb_time_audit_get_compression,
2855         .set_compression_fn = smb_time_audit_set_compression,
2856         .snap_check_path_fn = smb_time_audit_snap_check_path,
2857         .snap_create_fn = smb_time_audit_snap_create,
2858         .snap_delete_fn = smb_time_audit_snap_delete,
2859         .streaminfo_fn = smb_time_audit_streaminfo,
2860         .get_real_filename_fn = smb_time_audit_get_real_filename,
2861         .connectpath_fn = smb_time_audit_connectpath,
2862         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2863         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2864         .brl_cancel_windows_fn = smb_time_audit_brl_cancel_windows,
2865         .strict_lock_check_fn = smb_time_audit_strict_lock_check,
2866         .translate_name_fn = smb_time_audit_translate_name,
2867         .fsctl_fn = smb_time_audit_fsctl,
2868         .get_dos_attributes_fn = smb_time_get_dos_attributes,
2869         .get_dos_attributes_send_fn = smb_time_audit_get_dos_attributes_send,
2870         .get_dos_attributes_recv_fn = smb_time_audit_get_dos_attributes_recv,
2871         .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2872         .set_dos_attributes_fn = smb_time_set_dos_attributes,
2873         .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2874         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2875         .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2876         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2877         .audit_file_fn = smb_time_audit_audit_file,
2878         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2879         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2880         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2881         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2882         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2883         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2884         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2885         .getxattr_fn = smb_time_audit_getxattr,
2886         .getxattrat_send_fn = smb_time_audit_getxattrat_send,
2887         .getxattrat_recv_fn = smb_time_audit_getxattrat_recv,
2888         .fgetxattr_fn = smb_time_audit_fgetxattr,
2889         .listxattr_fn = smb_time_audit_listxattr,
2890         .flistxattr_fn = smb_time_audit_flistxattr,
2891         .removexattr_fn = smb_time_audit_removexattr,
2892         .fremovexattr_fn = smb_time_audit_fremovexattr,
2893         .setxattr_fn = smb_time_audit_setxattr,
2894         .fsetxattr_fn = smb_time_audit_fsetxattr,
2895         .aio_force_fn = smb_time_audit_aio_force,
2896         .durable_cookie_fn = smb_time_audit_durable_cookie,
2897         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2898         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2899         .readdir_attr_fn = smb_time_audit_readdir_attr,
2900 };
2901
2902
2903 static_decl_vfs;
2904 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2905 {
2906         smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2907
2908         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2909                                             10000) / 1000.0;
2910         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2911                                 &vfs_time_audit_fns);
2912 }