source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
  90                                     const char *fname)
  91 {
  92         char cwd[PATH_MAX];
  93         char *msg = NULL;
  94
  95         if (getcwd(cwd, sizeof(cwd)) == NULL) {
  96                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
  97         }
  98         if (fname != NULL) {
  99                 msg = talloc_asprintf(talloc_tos(),
 100                                       "cwd = \"%s\", filename = \"%s\"",
 101                                       cwd, fname);
 102         } else {
 103                 msg = talloc_asprintf(talloc_tos(),
 104                                       "cwd = \"%s\", filename = <NULL>",
 105                                       cwd);
 106         }
 107         smb_time_audit_log_msg(syscallname, elapsed, msg);
 108         TALLOC_FREE(msg);
 109 }
 110
 111 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 112                                        const struct smb_filename *smb_fname)
 113 {
 114         if (smb_fname != NULL) {
 115                 smb_time_audit_log_fname(syscallname, elapsed,
 116                                          smb_fname->base_name);
 117         } else {
 118                 smb_time_audit_log_fname(syscallname, elapsed,
 119                                          "smb_fname = <NULL>");
 120         }
 121 }
 122
 123 static int smb_time_audit_connect(vfs_handle_struct *handle,
 124                                   const char *svc, const char *user)
 125 {
 126         int result;
 127         struct timespec ts1,ts2;
 128         double timediff;
 129
 130         if (!handle) {
 131                 return -1;
 132         }
 133
 134         clock_gettime_mono(&ts1);
 135         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 136         clock_gettime_mono(&ts2);
 137         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 138         if (timediff > audit_timeout) {
 139                 smb_time_audit_log_msg("connect", timediff, user);
 140         }
 141         return result;
 142 }
 143
 144 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 145 {
 146         struct timespec ts1,ts2;
 147         double timediff;
 148
 149         clock_gettime_mono(&ts1);
 150         SMB_VFS_NEXT_DISCONNECT(handle);
 151         clock_gettime_mono(&ts2);
 152         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 153
 154         if (timediff > audit_timeout) {
 155                 smb_time_audit_log("disconnect", timediff);
 156         }
 157 }
 158
 159 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 160                                          const char *path, uint64_t *bsize,
 161                                          uint64_t *dfree, uint64_t *dsize)
 162 {
 163         uint64_t result;
 164         struct timespec ts1,ts2;
 165         double timediff;
 166
 167         clock_gettime_mono(&ts1);
 168         result = SMB_VFS_NEXT_DISK_FREE(handle, path, bsize, dfree, dsize);
 169         clock_gettime_mono(&ts2);
 170         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 171
 172         /* Don't have a reasonable notion of failure here */
 173         if (timediff > audit_timeout) {
 174                 smb_time_audit_log_fname("disk_free", timediff, path);
 175         }
 176
 177         return result;
 178 }
 179
 180 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 181                                     const char *path, enum SMB_QUOTA_TYPE qtype,
 182                                     unid_t id, SMB_DISK_QUOTA *qt)
 183 {
 184         int result;
 185         struct timespec ts1,ts2;
 186         double timediff;
 187
 188         clock_gettime_mono(&ts1);
 189         result = SMB_VFS_NEXT_GET_QUOTA(handle, path, qtype, id, qt);
 190         clock_gettime_mono(&ts2);
 191         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 192
 193         if (timediff > audit_timeout) {
 194                 smb_time_audit_log("get_quota", timediff);
 195         }
 196         return result;
 197 }
 198
 199 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 200                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 201                                     SMB_DISK_QUOTA *qt)
 202 {
 203         int result;
 204         struct timespec ts1,ts2;
 205         double timediff;
 206
 207         clock_gettime_mono(&ts1);
 208         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 209         clock_gettime_mono(&ts2);
 210         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 211
 212         if (timediff > audit_timeout) {
 213                 smb_time_audit_log("set_quota", timediff);
 214         }
 215
 216         return result;
 217 }
 218
 219 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 220                                                struct files_struct *fsp,
 221                                                struct shadow_copy_data *shadow_copy_data,
 222                                                bool labels)
 223 {
 224         int result;
 225         struct timespec ts1,ts2;
 226         double timediff;
 227
 228         clock_gettime_mono(&ts1);
 229         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 230                                                    shadow_copy_data, labels);
 231         clock_gettime_mono(&ts2);
 232         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 233
 234         if (timediff > audit_timeout) {
 235                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 236         }
 237
 238         return result;
 239 }
 240
 241 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 242                                   const char *path,
 243                                   struct vfs_statvfs_struct *statbuf)
 244 {
 245         int result;
 246         struct timespec ts1,ts2;
 247         double timediff;
 248
 249         clock_gettime_mono(&ts1);
 250         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
 251         clock_gettime_mono(&ts2);
 252         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 253
 254         if (timediff > audit_timeout) {
 255                 smb_time_audit_log_fname("statvfs", timediff, path);
 256         }
 257
 258         return result;
 259 }
 260
 261 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 262                                                enum timestamp_set_resolution *p_ts_res)
 263 {
 264         uint32_t result;
 265         struct timespec ts1,ts2;
 266         double timediff;
 267
 268         clock_gettime_mono(&ts1);
 269         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 270         clock_gettime_mono(&ts2);
 271         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 272
 273         if (timediff > audit_timeout) {
 274                 smb_time_audit_log("fs_capabilities", timediff);
 275         }
 276
 277         return result;
 278 }
 279
 280 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 281                                                TALLOC_CTX *mem_ctx,
 282                                                const char *service_path,
 283                                                char **base_volume)
 284 {
 285         NTSTATUS status;
 286         struct timespec ts1,ts2;
 287         double timediff;
 288
 289         clock_gettime_mono(&ts1);
 290         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 291                                               base_volume);
 292         clock_gettime_mono(&ts2);
 293         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 294
 295         if (timediff > audit_timeout) {
 296                 smb_time_audit_log("snap_check_path", timediff);
 297         }
 298
 299         return status;
 300 }
 301
 302 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 303                                            TALLOC_CTX *mem_ctx,
 304                                            const char *base_volume,
 305                                            time_t *tstamp,
 306                                            bool rw,
 307                                            char **base_path,
 308                                            char **snap_path)
 309 {
 310         NTSTATUS status;
 311         struct timespec ts1,ts2;
 312         double timediff;
 313
 314         clock_gettime_mono(&ts1);
 315         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 316                                           rw, base_path, snap_path);
 317         clock_gettime_mono(&ts2);
 318         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 319
 320         if (timediff > audit_timeout) {
 321                 smb_time_audit_log("snap_create", timediff);
 322         }
 323
 324         return status;
 325 }
 326
 327 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 328                                            TALLOC_CTX *mem_ctx,
 329                                            char *base_path,
 330                                            char *snap_path)
 331 {
 332         NTSTATUS status;
 333         struct timespec ts1,ts2;
 334         double timediff;
 335
 336         clock_gettime_mono(&ts1);
 337         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 338                                           snap_path);
 339         clock_gettime_mono(&ts2);
 340         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 341
 342         if (timediff > audit_timeout) {
 343                 smb_time_audit_log("snap_delete", timediff);
 344         }
 345
 346         return status;
 347 }
 348
 349 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
 350                                    const char *fname,
 351                                    const char *mask, uint32_t attr)
 352 {
 353         DIR *result;
 354         struct timespec ts1,ts2;
 355         double timediff;
 356
 357         clock_gettime_mono(&ts1);
 358         result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 359         clock_gettime_mono(&ts2);
 360         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 361
 362         if (timediff > audit_timeout) {
 363                 smb_time_audit_log_fname("opendir", timediff, fname);
 364         }
 365
 366         return result;
 367 }
 368
 369 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 370                                               files_struct *fsp,
 371                                               const char *mask, uint32_t attr)
 372 {
 373         DIR *result;
 374         struct timespec ts1,ts2;
 375         double timediff;
 376
 377         clock_gettime_mono(&ts1);
 378         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 379         clock_gettime_mono(&ts2);
 380         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 381
 382         if (timediff > audit_timeout) {
 383                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 384         }
 385
 386         return result;
 387 }
 388
 389 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 390                                                  DIR *dirp,
 391                                                  SMB_STRUCT_STAT *sbuf)
 392 {
 393         struct dirent *result;
 394         struct timespec ts1,ts2;
 395         double timediff;
 396
 397         clock_gettime_mono(&ts1);
 398         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 399         clock_gettime_mono(&ts2);
 400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 401
 402         if (timediff > audit_timeout) {
 403                 smb_time_audit_log("readdir", timediff);
 404         }
 405
 406         return result;
 407 }
 408
 409 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 410                                    DIR *dirp, long offset)
 411 {
 412         struct timespec ts1,ts2;
 413         double timediff;
 414
 415         clock_gettime_mono(&ts1);
 416         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 417         clock_gettime_mono(&ts2);
 418         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 419
 420         if (timediff > audit_timeout) {
 421                 smb_time_audit_log("seekdir", timediff);
 422         }
 423
 424 }
 425
 426 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 427                                    DIR *dirp)
 428 {
 429         long result;
 430         struct timespec ts1,ts2;
 431         double timediff;
 432
 433         clock_gettime_mono(&ts1);
 434         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 435         clock_gettime_mono(&ts2);
 436         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 437
 438         if (timediff > audit_timeout) {
 439                 smb_time_audit_log("telldir", timediff);
 440         }
 441
 442         return result;
 443 }
 444
 445 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 446                                      DIR *dirp)
 447 {
 448         struct timespec ts1,ts2;
 449         double timediff;
 450
 451         clock_gettime_mono(&ts1);
 452         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 453         clock_gettime_mono(&ts2);
 454         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 455
 456         if (timediff > audit_timeout) {
 457                 smb_time_audit_log("rewinddir", timediff);
 458         }
 459
 460 }
 461
 462 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
 463                                 const char *path, mode_t mode)
 464 {
 465         int result;
 466         struct timespec ts1,ts2;
 467         double timediff;
 468
 469         clock_gettime_mono(&ts1);
 470         result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
 471         clock_gettime_mono(&ts2);
 472         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 473
 474         if (timediff > audit_timeout) {
 475                 smb_time_audit_log_fname("mkdir", timediff, path);
 476         }
 477
 478         return result;
 479 }
 480
 481 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
 482                                 const char *path)
 483 {
 484         int result;
 485         struct timespec ts1,ts2;
 486         double timediff;
 487
 488         clock_gettime_mono(&ts1);
 489         result = SMB_VFS_NEXT_RMDIR(handle, path);
 490         clock_gettime_mono(&ts2);
 491         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 492
 493         if (timediff > audit_timeout) {
 494                 smb_time_audit_log_fname("rmdir", timediff, path);
 495         }
 496
 497         return result;
 498 }
 499
 500 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 501                                    DIR *dirp)
 502 {
 503         int result;
 504         struct timespec ts1,ts2;
 505         double timediff;
 506
 507         clock_gettime_mono(&ts1);
 508         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 509         clock_gettime_mono(&ts2);
 510         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 511
 512         if (timediff > audit_timeout) {
 513                 smb_time_audit_log("closedir", timediff);
 514         }
 515
 516         return result;
 517 }
 518
 519 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
 520                                           DIR *dirp)
 521 {
 522         struct timespec ts1,ts2;
 523         double timediff;
 524
 525         clock_gettime_mono(&ts1);
 526         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
 527         clock_gettime_mono(&ts2);
 528         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 529
 530         if (timediff > audit_timeout) {
 531                 smb_time_audit_log("init_search_op", timediff);
 532         }
 533 }
 534
 535 static int smb_time_audit_open(vfs_handle_struct *handle,
 536                                struct smb_filename *fname,
 537                                files_struct *fsp,
 538                                int flags, mode_t mode)
 539 {
 540         int result;
 541         struct timespec ts1,ts2;
 542         double timediff;
 543
 544         clock_gettime_mono(&ts1);
 545         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
 546         clock_gettime_mono(&ts2);
 547         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 548
 549         if (timediff > audit_timeout) {
 550                 smb_time_audit_log_fsp("open", timediff, fsp);
 551         }
 552
 553         return result;
 554 }
 555
 556 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 557                                            struct smb_request *req,
 558                                            uint16_t root_dir_fid,
 559                                            struct smb_filename *fname,
 560                                            uint32_t access_mask,
 561                                            uint32_t share_access,
 562                                            uint32_t create_disposition,
 563                                            uint32_t create_options,
 564                                            uint32_t file_attributes,
 565                                            uint32_t oplock_request,
 566                                            struct smb2_lease *lease,
 567                                            uint64_t allocation_size,
 568                                            uint32_t private_flags,
 569                                            struct security_descriptor *sd,
 570                                            struct ea_list *ea_list,
 571                                            files_struct **result_fsp,
 572                                            int *pinfo,
 573                                            const struct smb2_create_blobs *in_context_blobs,
 574                                            struct smb2_create_blobs *out_context_blobs)
 575 {
 576         NTSTATUS result;
 577         struct timespec ts1,ts2;
 578         double timediff;
 579
 580         clock_gettime_mono(&ts1);
 581         result = SMB_VFS_NEXT_CREATE_FILE(
 582                 handle,                                 /* handle */
 583                 req,                                    /* req */
 584                 root_dir_fid,                           /* root_dir_fid */
 585                 fname,                                  /* fname */
 586                 access_mask,                            /* access_mask */
 587                 share_access,                           /* share_access */
 588                 create_disposition,                     /* create_disposition*/
 589                 create_options,                         /* create_options */
 590                 file_attributes,                        /* file_attributes */
 591                 oplock_request,                         /* oplock_request */
 592                 lease,                                  /* lease */
 593                 allocation_size,                        /* allocation_size */
 594                 private_flags,
 595                 sd,                                     /* sd */
 596                 ea_list,                                /* ea_list */
 597                 result_fsp,                             /* result */
 598                 pinfo,
 599                 in_context_blobs, out_context_blobs);   /* create context */
 600         clock_gettime_mono(&ts2);
 601         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 602
 603         if (timediff > audit_timeout) {
 604                 /*
 605                  * can't use result_fsp this time, may have
 606                  * invalid content causing smbd crash
 607                  */
 608                 smb_time_audit_log_smb_fname("create_file", timediff,
 609                                            fname);
 610         }
 611
 612         return result;
 613 }
 614
 615 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 616 {
 617         int result;
 618         struct timespec ts1,ts2;
 619         double timediff;
 620
 621         clock_gettime_mono(&ts1);
 622         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 623         clock_gettime_mono(&ts2);
 624         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 625
 626         if (timediff > audit_timeout) {
 627                 smb_time_audit_log_fsp("close", timediff, fsp);
 628         }
 629
 630         return result;
 631 }
 632
 633 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
 634                                    files_struct *fsp, void *data, size_t n)
 635 {
 636         ssize_t result;
 637         struct timespec ts1,ts2;
 638         double timediff;
 639
 640         clock_gettime_mono(&ts1);
 641         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
 642         clock_gettime_mono(&ts2);
 643         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 644
 645         if (timediff > audit_timeout) {
 646                 smb_time_audit_log_fsp("read", timediff, fsp);
 647         }
 648
 649         return result;
 650 }
 651
 652 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 653                                     files_struct *fsp,
 654                                     void *data, size_t n, off_t offset)
 655 {
 656         ssize_t result;
 657         struct timespec ts1,ts2;
 658         double timediff;
 659
 660         clock_gettime_mono(&ts1);
 661         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 662         clock_gettime_mono(&ts2);
 663         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 664
 665         if (timediff > audit_timeout) {
 666                 smb_time_audit_log_fsp("pread", timediff, fsp);
 667         }
 668
 669         return result;
 670 }
 671
 672 struct smb_time_audit_pread_state {
 673         struct files_struct *fsp;
 674         struct timespec ts1;
 675         ssize_t ret;
 676         int err;
 677 };
 678
 679 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 680
 681 static struct tevent_req *smb_time_audit_pread_send(
 682         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 683         struct tevent_context *ev, struct files_struct *fsp,
 684         void *data, size_t n, off_t offset)
 685 {
 686         struct tevent_req *req, *subreq;
 687         struct smb_time_audit_pread_state *state;
 688
 689         req = tevent_req_create(mem_ctx, &state,
 690                                 struct smb_time_audit_pread_state);
 691         if (req == NULL) {
 692                 return NULL;
 693         }
 694         clock_gettime_mono(&state->ts1);
 695         state->fsp = fsp;
 696
 697         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 698                                          n, offset);
 699         if (tevent_req_nomem(subreq, req)) {
 700                 return tevent_req_post(req, ev);
 701         }
 702         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 703         return req;
 704 }
 705
 706 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 707 {
 708         struct tevent_req *req = tevent_req_callback_data(
 709                 subreq, struct tevent_req);
 710         struct smb_time_audit_pread_state *state = tevent_req_data(
 711                 req, struct smb_time_audit_pread_state);
 712
 713         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->err);
 714         TALLOC_FREE(subreq);
 715         tevent_req_done(req);
 716 }
 717
 718 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req, int *err)
 719 {
 720         struct smb_time_audit_pread_state *state = tevent_req_data(
 721                 req, struct smb_time_audit_pread_state);
 722         struct timespec ts2;
 723         double timediff;
 724
 725         clock_gettime_mono(&ts2);
 726         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
 727
 728         if (timediff > audit_timeout) {
 729                 smb_time_audit_log_fsp("pread", timediff, state->fsp);
 730         }
 731
 732         if (tevent_req_is_unix_error(req, err)) {
 733                 return -1;
 734         }
 735         *err = state->err;
 736         return state->ret;
 737 }
 738
 739 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
 740                                     files_struct *fsp,
 741                                     const void *data, size_t n)
 742 {
 743         ssize_t result;
 744         struct timespec ts1,ts2;
 745         double timediff;
 746
 747         clock_gettime_mono(&ts1);
 748         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
 749         clock_gettime_mono(&ts2);
 750         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 751
 752         if (timediff > audit_timeout) {
 753                 smb_time_audit_log_fsp("write", timediff, fsp);
 754         }
 755
 756         return result;
 757 }
 758
 759 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 760                                      files_struct *fsp,
 761                                      const void *data, size_t n,
 762                                      off_t offset)
 763 {
 764         ssize_t result;
 765         struct timespec ts1,ts2;
 766         double timediff;
 767
 768         clock_gettime_mono(&ts1);
 769         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 770         clock_gettime_mono(&ts2);
 771         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 772
 773         if (timediff > audit_timeout) {
 774                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 775         }
 776
 777         return result;
 778 }
 779
 780 struct smb_time_audit_pwrite_state {
 781         struct files_struct *fsp;
 782         struct timespec ts1;
 783         ssize_t ret;
 784         int err;
 785 };
 786
 787 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 788
 789 static struct tevent_req *smb_time_audit_pwrite_send(
 790         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 791         struct tevent_context *ev, struct files_struct *fsp,
 792         const void *data, size_t n, off_t offset)
 793 {
 794         struct tevent_req *req, *subreq;
 795         struct smb_time_audit_pwrite_state *state;
 796
 797         req = tevent_req_create(mem_ctx, &state,
 798                                 struct smb_time_audit_pwrite_state);
 799         if (req == NULL) {
 800                 return NULL;
 801         }
 802         clock_gettime_mono(&state->ts1);
 803         state->fsp = fsp;
 804
 805         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 806                                          n, offset);
 807         if (tevent_req_nomem(subreq, req)) {
 808                 return tevent_req_post(req, ev);
 809         }
 810         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 811         return req;
 812 }
 813
 814 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 815 {
 816         struct tevent_req *req = tevent_req_callback_data(
 817                 subreq, struct tevent_req);
 818         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 819                 req, struct smb_time_audit_pwrite_state);
 820
 821         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->err);
 822         TALLOC_FREE(subreq);
 823         tevent_req_done(req);
 824 }
 825
 826 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req, int *err)
 827 {
 828         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 829                 req, struct smb_time_audit_pwrite_state);
 830         struct timespec ts2;
 831         double timediff;
 832
 833         clock_gettime_mono(&ts2);
 834         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
 835
 836         if (timediff > audit_timeout) {
 837                 smb_time_audit_log_fsp("pwrite", timediff, state->fsp);
 838         }
 839
 840         if (tevent_req_is_unix_error(req, err)) {
 841                 return -1;
 842         }
 843         *err = state->err;
 844         return state->ret;
 845 }
 846
 847 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 848                                       files_struct *fsp,
 849                                       off_t offset, int whence)
 850 {
 851         off_t result;
 852         struct timespec ts1,ts2;
 853         double timediff;
 854
 855         clock_gettime_mono(&ts1);
 856         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 857         clock_gettime_mono(&ts2);
 858         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 859
 860         if (timediff > audit_timeout) {
 861                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 862         }
 863
 864         return result;
 865 }
 866
 867 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 868                                        files_struct *fromfsp,
 869                                        const DATA_BLOB *hdr, off_t offset,
 870                                        size_t n)
 871 {
 872         ssize_t result;
 873         struct timespec ts1,ts2;
 874         double timediff;
 875
 876         clock_gettime_mono(&ts1);
 877         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 878         clock_gettime_mono(&ts2);
 879         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 880
 881         if (timediff > audit_timeout) {
 882                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 883         }
 884
 885         return result;
 886 }
 887
 888 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 889                                        files_struct *tofsp,
 890                                        off_t offset,
 891                                        size_t n)
 892 {
 893         ssize_t result;
 894         struct timespec ts1,ts2;
 895         double timediff;
 896
 897         clock_gettime_mono(&ts1);
 898         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 899         clock_gettime_mono(&ts2);
 900         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 901
 902         if (timediff > audit_timeout) {
 903                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 904         }
 905
 906         return result;
 907 }
 908
 909 static int smb_time_audit_rename(vfs_handle_struct *handle,
 910                                  const struct smb_filename *oldname,
 911                                  const struct smb_filename *newname)
 912 {
 913         int result;
 914         struct timespec ts1,ts2;
 915         double timediff;
 916
 917         clock_gettime_mono(&ts1);
 918         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
 919         clock_gettime_mono(&ts2);
 920         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 921
 922         if (timediff > audit_timeout) {
 923                 smb_time_audit_log_smb_fname("rename", timediff, newname);
 924         }
 925
 926         return result;
 927 }
 928
 929 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
 930 {
 931         int result;
 932         struct timespec ts1,ts2;
 933         double timediff;
 934
 935         clock_gettime_mono(&ts1);
 936         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
 937         clock_gettime_mono(&ts2);
 938         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 939
 940         if (timediff > audit_timeout) {
 941                 smb_time_audit_log_fsp("fsync", timediff, fsp);
 942         }
 943
 944         return result;
 945 }
 946
 947 struct smb_time_audit_fsync_state {
 948         struct files_struct *fsp;
 949         struct timespec ts1;
 950         int ret;
 951         int err;
 952 };
 953
 954 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 955
 956 static struct tevent_req *smb_time_audit_fsync_send(
 957         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 958         struct tevent_context *ev, struct files_struct *fsp)
 959 {
 960         struct tevent_req *req, *subreq;
 961         struct smb_time_audit_fsync_state *state;
 962
 963         req = tevent_req_create(mem_ctx, &state,
 964                                 struct smb_time_audit_fsync_state);
 965         if (req == NULL) {
 966                 return NULL;
 967         }
 968         clock_gettime_mono(&state->ts1);
 969         state->fsp = fsp;
 970
 971         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 972         if (tevent_req_nomem(subreq, req)) {
 973                 return tevent_req_post(req, ev);
 974         }
 975         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 976         return req;
 977 }
 978
 979 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
 980 {
 981         struct tevent_req *req = tevent_req_callback_data(
 982                 subreq, struct tevent_req);
 983         struct smb_time_audit_fsync_state *state = tevent_req_data(
 984                 req, struct smb_time_audit_fsync_state);
 985
 986         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->err);
 987         TALLOC_FREE(subreq);
 988         tevent_req_done(req);
 989 }
 990
 991 static int smb_time_audit_fsync_recv(struct tevent_req *req, int *err)
 992 {
 993         struct smb_time_audit_fsync_state *state = tevent_req_data(
 994                 req, struct smb_time_audit_fsync_state);
 995         struct timespec ts2;
 996         double timediff;
 997
 998         clock_gettime_mono(&ts2);
 999         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
1000
1001         if (timediff > audit_timeout) {
1002                 smb_time_audit_log_fsp("fsync", timediff, state->fsp);
1003         }
1004
1005         if (tevent_req_is_unix_error(req, err)) {
1006                 return -1;
1007         }
1008         *err = state->err;
1009         return state->ret;
1010 }
1011
1012 static int smb_time_audit_stat(vfs_handle_struct *handle,
1013                                struct smb_filename *fname)
1014 {
1015         int result;
1016         struct timespec ts1,ts2;
1017         double timediff;
1018
1019         clock_gettime_mono(&ts1);
1020         result = SMB_VFS_NEXT_STAT(handle, fname);
1021         clock_gettime_mono(&ts2);
1022         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1023
1024         if (timediff > audit_timeout) {
1025                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1026         }
1027
1028         return result;
1029 }
1030
1031 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1032                                 SMB_STRUCT_STAT *sbuf)
1033 {
1034         int result;
1035         struct timespec ts1,ts2;
1036         double timediff;
1037
1038         clock_gettime_mono(&ts1);
1039         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1040         clock_gettime_mono(&ts2);
1041         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1042
1043         if (timediff > audit_timeout) {
1044                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1045         }
1046
1047         return result;
1048 }
1049
1050 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1051                                 struct smb_filename *path)
1052 {
1053         int result;
1054         struct timespec ts1,ts2;
1055         double timediff;
1056
1057         clock_gettime_mono(&ts1);
1058         result = SMB_VFS_NEXT_LSTAT(handle, path);
1059         clock_gettime_mono(&ts2);
1060         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1061
1062         if (timediff > audit_timeout) {
1063                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1064         }
1065
1066         return result;
1067 }
1068
1069 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1070                                               files_struct *fsp,
1071                                               const SMB_STRUCT_STAT *sbuf)
1072 {
1073         uint64_t result;
1074         struct timespec ts1,ts2;
1075         double timediff;
1076
1077         clock_gettime_mono(&ts1);
1078         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1079         clock_gettime_mono(&ts2);
1080         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1081
1082         if (timediff > audit_timeout) {
1083                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1084         }
1085
1086         return result;
1087 }
1088
1089 static int smb_time_audit_unlink(vfs_handle_struct *handle,
1090                                  const struct smb_filename *path)
1091 {
1092         int result;
1093         struct timespec ts1,ts2;
1094         double timediff;
1095
1096         clock_gettime_mono(&ts1);
1097         result = SMB_VFS_NEXT_UNLINK(handle, path);
1098         clock_gettime_mono(&ts2);
1099         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1100
1101         if (timediff > audit_timeout) {
1102                 smb_time_audit_log_smb_fname("unlink", timediff, path);
1103         }
1104
1105         return result;
1106 }
1107
1108 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1109                                 const char *path, mode_t mode)
1110 {
1111         int result;
1112         struct timespec ts1,ts2;
1113         double timediff;
1114
1115         clock_gettime_mono(&ts1);
1116         result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1117         clock_gettime_mono(&ts2);
1118         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1119
1120         if (timediff > audit_timeout) {
1121                 smb_time_audit_log_fname("chmod", timediff, path);
1122         }
1123
1124         return result;
1125 }
1126
1127 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1128                                  mode_t mode)
1129 {
1130         int result;
1131         struct timespec ts1,ts2;
1132         double timediff;
1133
1134         clock_gettime_mono(&ts1);
1135         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1136         clock_gettime_mono(&ts2);
1137         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1138
1139         if (timediff > audit_timeout) {
1140                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1141         }
1142
1143         return result;
1144 }
1145
1146 static int smb_time_audit_chown(vfs_handle_struct *handle,
1147                                 const char *path, uid_t uid, gid_t gid)
1148 {
1149         int result;
1150         struct timespec ts1,ts2;
1151         double timediff;
1152
1153         clock_gettime_mono(&ts1);
1154         result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1155         clock_gettime_mono(&ts2);
1156         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1157
1158         if (timediff > audit_timeout) {
1159                 smb_time_audit_log_fname("chown", timediff, path);
1160         }
1161
1162         return result;
1163 }
1164
1165 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1166                                  uid_t uid, gid_t gid)
1167 {
1168         int result;
1169         struct timespec ts1,ts2;
1170         double timediff;
1171
1172         clock_gettime_mono(&ts1);
1173         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1174         clock_gettime_mono(&ts2);
1175         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1176
1177         if (timediff > audit_timeout) {
1178                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1179         }
1180
1181         return result;
1182 }
1183
1184 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1185                                  const char *path, uid_t uid, gid_t gid)
1186 {
1187         int result;
1188         struct timespec ts1,ts2;
1189         double timediff;
1190
1191         clock_gettime_mono(&ts1);
1192         result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1193         clock_gettime_mono(&ts2);
1194         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1195
1196         if (timediff > audit_timeout) {
1197                 smb_time_audit_log_fname("lchown", timediff, path);
1198         }
1199
1200         return result;
1201 }
1202
1203 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
1204 {
1205         int result;
1206         struct timespec ts1,ts2;
1207         double timediff;
1208
1209         clock_gettime_mono(&ts1);
1210         result = SMB_VFS_NEXT_CHDIR(handle, path);
1211         clock_gettime_mono(&ts2);
1212         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1213
1214         if (timediff > audit_timeout) {
1215                 smb_time_audit_log_fname("chdir", timediff, path);
1216         }
1217
1218         return result;
1219 }
1220
1221 static char *smb_time_audit_getwd(vfs_handle_struct *handle)
1222 {
1223         char *result;
1224         struct timespec ts1,ts2;
1225         double timediff;
1226
1227         clock_gettime_mono(&ts1);
1228         result = SMB_VFS_NEXT_GETWD(handle);
1229         clock_gettime_mono(&ts2);
1230         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1231
1232         if (timediff > audit_timeout) {
1233                 smb_time_audit_log("getwd", timediff);
1234         }
1235
1236         return result;
1237 }
1238
1239 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1240                                  const struct smb_filename *path,
1241                                  struct smb_file_time *ft)
1242 {
1243         int result;
1244         struct timespec ts1,ts2;
1245         double timediff;
1246
1247         clock_gettime_mono(&ts1);
1248         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1249         clock_gettime_mono(&ts2);
1250         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1251
1252         if (timediff > audit_timeout) {
1253                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1254         }
1255
1256         return result;
1257 }
1258
1259 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1260                                     files_struct *fsp,
1261                                     off_t len)
1262 {
1263         int result;
1264         struct timespec ts1,ts2;
1265         double timediff;
1266
1267         clock_gettime_mono(&ts1);
1268         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1269         clock_gettime_mono(&ts2);
1270         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1271
1272         if (timediff > audit_timeout) {
1273                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1274         }
1275
1276         return result;
1277 }
1278
1279 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1280                                     files_struct *fsp,
1281                                     uint32_t mode,
1282                                     off_t offset,
1283                                     off_t len)
1284 {
1285         int result;
1286         int saved_errno = 0;
1287         struct timespec ts1,ts2;
1288         double timediff;
1289
1290         clock_gettime_mono(&ts1);
1291         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1292         if (result == -1) {
1293                 saved_errno = errno;
1294         }
1295         clock_gettime_mono(&ts2);
1296         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1297
1298         if (timediff > audit_timeout) {
1299                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1300         }
1301         if (result == -1) {
1302                 errno = saved_errno;
1303         }
1304         return result;
1305 }
1306
1307 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1308                                 int op, off_t offset, off_t count,
1309                                 int type)
1310 {
1311         bool result;
1312         struct timespec ts1,ts2;
1313         double timediff;
1314
1315         clock_gettime_mono(&ts1);
1316         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1317         clock_gettime_mono(&ts2);
1318         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1319
1320         if (timediff > audit_timeout) {
1321                 smb_time_audit_log_fsp("lock", timediff, fsp);
1322         }
1323
1324         return result;
1325 }
1326
1327 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1328                                        struct files_struct *fsp,
1329                                        uint32_t share_mode, uint32_t access_mask)
1330 {
1331         int result;
1332         struct timespec ts1,ts2;
1333         double timediff;
1334
1335         clock_gettime_mono(&ts1);
1336         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
1337                                            access_mask);
1338         clock_gettime_mono(&ts2);
1339         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1340
1341         if (timediff > audit_timeout) {
1342                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1343         }
1344
1345         return result;
1346 }
1347
1348 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1349                                          files_struct *fsp,
1350                                          int leasetype)
1351 {
1352         int result;
1353         struct timespec ts1,ts2;
1354         double timediff;
1355
1356         clock_gettime_mono(&ts1);
1357         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1358         clock_gettime_mono(&ts2);
1359         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1360
1361         if (timediff > audit_timeout) {
1362                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1363         }
1364
1365         return result;
1366 }
1367
1368 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1369                                    files_struct *fsp,
1370                                    off_t *poffset, off_t *pcount,
1371                                    int *ptype, pid_t *ppid)
1372 {
1373         bool result;
1374         struct timespec ts1,ts2;
1375         double timediff;
1376
1377         clock_gettime_mono(&ts1);
1378         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1379                                       ppid);
1380         clock_gettime_mono(&ts2);
1381         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382
1383         if (timediff > audit_timeout) {
1384                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1385         }
1386
1387         return result;
1388 }
1389
1390 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1391                                   const char *oldpath, const char *newpath)
1392 {
1393         int result;
1394         struct timespec ts1,ts2;
1395         double timediff;
1396
1397         clock_gettime_mono(&ts1);
1398         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1399         clock_gettime_mono(&ts2);
1400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1401
1402         if (timediff > audit_timeout) {
1403                 smb_time_audit_log_fname("symlink", timediff, newpath);
1404         }
1405
1406         return result;
1407 }
1408
1409 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1410                           const char *path, char *buf, size_t bufsiz)
1411 {
1412         int result;
1413         struct timespec ts1,ts2;
1414         double timediff;
1415
1416         clock_gettime_mono(&ts1);
1417         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1418         clock_gettime_mono(&ts2);
1419         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1420
1421         if (timediff > audit_timeout) {
1422                 smb_time_audit_log_fname("readlink", timediff, path);
1423         }
1424
1425         return result;
1426 }
1427
1428 static int smb_time_audit_link(vfs_handle_struct *handle,
1429                                const char *oldpath, const char *newpath)
1430 {
1431         int result;
1432         struct timespec ts1,ts2;
1433         double timediff;
1434
1435         clock_gettime_mono(&ts1);
1436         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1437         clock_gettime_mono(&ts2);
1438         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1439
1440         if (timediff > audit_timeout) {
1441                 smb_time_audit_log_fname("link", timediff, newpath);
1442         }
1443
1444         return result;
1445 }
1446
1447 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1448                                 const char *pathname, mode_t mode,
1449                                 SMB_DEV_T dev)
1450 {
1451         int result;
1452         struct timespec ts1,ts2;
1453         double timediff;
1454
1455         clock_gettime_mono(&ts1);
1456         result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1457         clock_gettime_mono(&ts2);
1458         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1459
1460         if (timediff > audit_timeout) {
1461                 smb_time_audit_log_fname("mknod", timediff, pathname);
1462         }
1463
1464         return result;
1465 }
1466
1467 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1468                                      const char *path)
1469 {
1470         char *result;
1471         struct timespec ts1,ts2;
1472         double timediff;
1473
1474         clock_gettime_mono(&ts1);
1475         result = SMB_VFS_NEXT_REALPATH(handle, path);
1476         clock_gettime_mono(&ts2);
1477         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1478
1479         if (timediff > audit_timeout) {
1480                 smb_time_audit_log_fname("realpath", timediff, path);
1481         }
1482
1483         return result;
1484 }
1485
1486 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1487                                   const char *path, unsigned int flags)
1488 {
1489         int result;
1490         struct timespec ts1,ts2;
1491         double timediff;
1492
1493         clock_gettime_mono(&ts1);
1494         result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1495         clock_gettime_mono(&ts2);
1496         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1497
1498         if (timediff > audit_timeout) {
1499                 smb_time_audit_log_fname("chflags", timediff, path);
1500         }
1501
1502         return result;
1503 }
1504
1505 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1506                                                     const SMB_STRUCT_STAT *sbuf)
1507 {
1508         struct file_id id_zero;
1509         struct file_id result;
1510         struct timespec ts1,ts2;
1511         double timediff;
1512
1513         ZERO_STRUCT(id_zero);
1514
1515         clock_gettime_mono(&ts1);
1516         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1517         clock_gettime_mono(&ts2);
1518         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1519
1520         if (timediff > audit_timeout) {
1521                 smb_time_audit_log("file_id_create", timediff);
1522         }
1523
1524         return result;
1525 }
1526
1527 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1528                                           struct files_struct *fsp,
1529                                           const char *fname,
1530                                           TALLOC_CTX *mem_ctx,
1531                                           unsigned int *pnum_streams,
1532                                           struct stream_struct **pstreams)
1533 {
1534         NTSTATUS result;
1535         struct timespec ts1,ts2;
1536         double timediff;
1537
1538         clock_gettime_mono(&ts1);
1539         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1540                                          pnum_streams, pstreams);
1541         clock_gettime_mono(&ts2);
1542         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1543
1544         if (timediff > audit_timeout) {
1545                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1546         }
1547
1548         return result;
1549 }
1550
1551 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1552                                             const char *path,
1553                                             const char *name,
1554                                             TALLOC_CTX *mem_ctx,
1555                                             char **found_name)
1556 {
1557         int result;
1558         struct timespec ts1,ts2;
1559         double timediff;
1560
1561         clock_gettime_mono(&ts1);
1562         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1563                                                 found_name);
1564         clock_gettime_mono(&ts2);
1565         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1566
1567         if (timediff > audit_timeout) {
1568                 smb_time_audit_log_fname("get_real_filename", timediff, path);
1569         }
1570
1571         return result;
1572 }
1573
1574 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1575                                               const char *fname)
1576 {
1577         const char *result;
1578         struct timespec ts1,ts2;
1579         double timediff;
1580
1581         clock_gettime_mono(&ts1);
1582         result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1583         clock_gettime_mono(&ts2);
1584         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1585
1586         if (timediff > audit_timeout) {
1587                 smb_time_audit_log_fname("connectpath", timediff, fname);
1588         }
1589
1590         return result;
1591 }
1592
1593 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1594                                                 struct byte_range_lock *br_lck,
1595                                                 struct lock_struct *plock,
1596                                                 bool blocking_lock)
1597 {
1598         NTSTATUS result;
1599         struct timespec ts1,ts2;
1600         double timediff;
1601
1602         clock_gettime_mono(&ts1);
1603         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1604                                                blocking_lock);
1605         clock_gettime_mono(&ts2);
1606         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1607
1608         if (timediff > audit_timeout) {
1609                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1610                                        brl_fsp(br_lck));
1611         }
1612
1613         return result;
1614 }
1615
1616 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1617                                               struct messaging_context *msg_ctx,
1618                                               struct byte_range_lock *br_lck,
1619                                               const struct lock_struct *plock)
1620 {
1621         bool result;
1622         struct timespec ts1,ts2;
1623         double timediff;
1624
1625         clock_gettime_mono(&ts1);
1626         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1627                                                  plock);
1628         clock_gettime_mono(&ts2);
1629         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1630
1631         if (timediff > audit_timeout) {
1632                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1633                                        brl_fsp(br_lck));
1634         }
1635
1636         return result;
1637 }
1638
1639 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1640                                               struct byte_range_lock *br_lck,
1641                                               struct lock_struct *plock)
1642 {
1643         bool result;
1644         struct timespec ts1,ts2;
1645         double timediff;
1646
1647         clock_gettime_mono(&ts1);
1648         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1649         clock_gettime_mono(&ts2);
1650         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1651
1652         if (timediff > audit_timeout) {
1653                 smb_time_audit_log_fsp("brl_cancel_windows", timediff,
1654                                        brl_fsp(br_lck));
1655         }
1656
1657         return result;
1658 }
1659
1660 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1661                                        struct files_struct *fsp,
1662                                        struct lock_struct *plock)
1663 {
1664         bool result;
1665         struct timespec ts1,ts2;
1666         double timediff;
1667
1668         clock_gettime_mono(&ts1);
1669         result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1670         clock_gettime_mono(&ts2);
1671         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1672
1673         if (timediff > audit_timeout) {
1674                 smb_time_audit_log_fsp("strict_lock", timediff, fsp);
1675         }
1676
1677         return result;
1678 }
1679
1680 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1681                                          struct files_struct *fsp,
1682                                          struct lock_struct *plock)
1683 {
1684         struct timespec ts1,ts2;
1685         double timediff;
1686
1687         clock_gettime_mono(&ts1);
1688         SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1689         clock_gettime_mono(&ts2);
1690         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1691
1692         if (timediff > audit_timeout) {
1693                 smb_time_audit_log_fsp("strict_unlock", timediff, fsp);
1694         }
1695 }
1696
1697 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1698                                               const char *name,
1699                                               enum vfs_translate_direction direction,
1700                                               TALLOC_CTX *mem_ctx,
1701                                               char **mapped_name)
1702 {
1703         NTSTATUS result;
1704         struct timespec ts1,ts2;
1705         double timediff;
1706
1707         clock_gettime_mono(&ts1);
1708         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1709                                              mapped_name);
1710         clock_gettime_mono(&ts2);
1711         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1712
1713         if (timediff > audit_timeout) {
1714                 smb_time_audit_log_fname("translate_name", timediff, name);
1715         }
1716
1717         return result;
1718 }
1719
1720 struct time_audit_cc_state {
1721         struct timespec ts_send;
1722         struct vfs_handle_struct *handle;
1723         off_t copied;
1724 };
1725 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq);
1726
1727 static struct tevent_req *smb_time_audit_copy_chunk_send(struct vfs_handle_struct *handle,
1728                                                          TALLOC_CTX *mem_ctx,
1729                                                          struct tevent_context *ev,
1730                                                          struct files_struct *src_fsp,
1731                                                          off_t src_off,
1732                                                          struct files_struct *dest_fsp,
1733                                                          off_t dest_off,
1734                                                          off_t num)
1735 {
1736         struct tevent_req *req;
1737         struct tevent_req *subreq;
1738         struct time_audit_cc_state *cc_state;
1739
1740         req = tevent_req_create(mem_ctx, &cc_state, struct time_audit_cc_state);
1741         if (req == NULL) {
1742                 return NULL;
1743         }
1744
1745         cc_state->handle = handle;
1746         clock_gettime_mono(&cc_state->ts_send);
1747         subreq = SMB_VFS_NEXT_COPY_CHUNK_SEND(handle, cc_state, ev,
1748                                               src_fsp, src_off,
1749                                               dest_fsp, dest_off, num);
1750         if (tevent_req_nomem(subreq, req)) {
1751                 return tevent_req_post(req, ev);
1752         }
1753
1754         tevent_req_set_callback(subreq, smb_time_audit_copy_chunk_done, req);
1755         return req;
1756 }
1757
1758 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq)
1759 {
1760         struct tevent_req *req = tevent_req_callback_data(
1761                 subreq, struct tevent_req);
1762         struct time_audit_cc_state *cc_state
1763                         = tevent_req_data(req, struct time_audit_cc_state);
1764         NTSTATUS status;
1765
1766         status = SMB_VFS_NEXT_COPY_CHUNK_RECV(cc_state->handle,
1767                                               subreq,
1768                                               &cc_state->copied);
1769         TALLOC_FREE(subreq);
1770         if (tevent_req_nterror(req, status)) {
1771                 return;
1772         }
1773         tevent_req_done(req);
1774 }
1775
1776 static NTSTATUS smb_time_audit_copy_chunk_recv(struct vfs_handle_struct *handle,
1777                                                struct tevent_req *req,
1778                                                off_t *copied)
1779 {
1780         struct time_audit_cc_state *cc_state
1781                         = tevent_req_data(req, struct time_audit_cc_state);
1782         struct timespec ts_recv;
1783         double timediff;
1784         NTSTATUS status;
1785
1786         clock_gettime_mono(&ts_recv);
1787         timediff = nsec_time_diff(&ts_recv, &cc_state->ts_send)*1.0e-9;
1788         if (timediff > audit_timeout) {
1789                 smb_time_audit_log("copy_chunk", timediff);
1790         }
1791
1792         *copied = cc_state->copied;
1793         if (tevent_req_is_nterror(req, &status)) {
1794                 tevent_req_received(req);
1795                 return status;
1796         }
1797
1798         tevent_req_received(req);
1799         return NT_STATUS_OK;
1800 }
1801
1802 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
1803                                                TALLOC_CTX *mem_ctx,
1804                                                struct files_struct *fsp,
1805                                                struct smb_filename *smb_fname,
1806                                                uint16_t *_compression_fmt)
1807 {
1808         NTSTATUS result;
1809         struct timespec ts1,ts2;
1810         double timediff;
1811
1812         clock_gettime_mono(&ts1);
1813         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1814                                               _compression_fmt);
1815         clock_gettime_mono(&ts2);
1816         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1817
1818         if (timediff > audit_timeout) {
1819                 if (fsp !=  NULL) {
1820                         smb_time_audit_log_fsp("get_compression",
1821                                                timediff, fsp);
1822                 } else {
1823                         smb_time_audit_log_smb_fname("get_compression",
1824                                                      timediff, smb_fname);
1825                 }
1826         }
1827
1828         return result;
1829 }
1830
1831 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
1832                                                TALLOC_CTX *mem_ctx,
1833                                                struct files_struct *fsp,
1834                                                uint16_t compression_fmt)
1835 {
1836         NTSTATUS result;
1837         struct timespec ts1,ts2;
1838         double timediff;
1839
1840         clock_gettime_mono(&ts1);
1841         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
1842                                               compression_fmt);
1843         clock_gettime_mono(&ts2);
1844         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1845
1846         if (timediff > audit_timeout) {
1847                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
1848         }
1849
1850         return result;
1851 }
1852
1853 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
1854                                             const struct smb_filename *fname,
1855                                             TALLOC_CTX *mem_ctx,
1856                                             struct readdir_attr_data **pattr_data)
1857 {
1858         NTSTATUS status;
1859         struct timespec ts1,ts2;
1860         double timediff;
1861
1862         clock_gettime_mono(&ts1);
1863         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
1864         clock_gettime_mono(&ts2);
1865         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1866
1867         if (timediff > audit_timeout) {
1868                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
1869         }
1870
1871         return status;
1872 }
1873
1874 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
1875                                            files_struct *fsp,
1876                                            uint32_t security_info,
1877                                            TALLOC_CTX *mem_ctx,
1878                                            struct security_descriptor **ppdesc)
1879 {
1880         NTSTATUS result;
1881         struct timespec ts1,ts2;
1882         double timediff;
1883
1884         clock_gettime_mono(&ts1);
1885         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
1886                                           mem_ctx, ppdesc);
1887         clock_gettime_mono(&ts2);
1888         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1889
1890         if (timediff > audit_timeout) {
1891                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
1892         }
1893
1894         return result;
1895 }
1896
1897 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
1898                                           const char *name,
1899                                           uint32_t security_info,
1900                                           TALLOC_CTX *mem_ctx,
1901                                           struct security_descriptor **ppdesc)
1902 {
1903         NTSTATUS result;
1904         struct timespec ts1,ts2;
1905         double timediff;
1906
1907         clock_gettime_mono(&ts1);
1908         result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
1909                                          mem_ctx, ppdesc);
1910         clock_gettime_mono(&ts2);
1911         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1912
1913         if (timediff > audit_timeout) {
1914                 smb_time_audit_log_fname("get_nt_acl", timediff, name);
1915         }
1916
1917         return result;
1918 }
1919
1920 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
1921                                            files_struct *fsp,
1922                                            uint32_t security_info_sent,
1923                                            const struct security_descriptor *psd)
1924 {
1925         NTSTATUS result;
1926         struct timespec ts1,ts2;
1927         double timediff;
1928
1929         clock_gettime_mono(&ts1);
1930         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
1931                                           psd);
1932         clock_gettime_mono(&ts2);
1933         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1934
1935         if (timediff > audit_timeout) {
1936                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
1937         }
1938
1939         return result;
1940 }
1941
1942 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
1943                                     const char *path, mode_t mode)
1944 {
1945         int result;
1946         struct timespec ts1,ts2;
1947         double timediff;
1948
1949         clock_gettime_mono(&ts1);
1950         result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1951         clock_gettime_mono(&ts2);
1952         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1953
1954         if (timediff > audit_timeout) {
1955                 smb_time_audit_log_fname("chmod_acl", timediff, path);
1956         }
1957
1958         return result;
1959 }
1960
1961 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
1962                                      files_struct *fsp, mode_t mode)
1963 {
1964         int result;
1965         struct timespec ts1,ts2;
1966         double timediff;
1967
1968         clock_gettime_mono(&ts1);
1969         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1970         clock_gettime_mono(&ts2);
1971         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1972
1973         if (timediff > audit_timeout) {
1974                 smb_time_audit_log_fsp("fchmod_acl", timediff, fsp);
1975         }
1976
1977         return result;
1978 }
1979
1980 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
1981                                                  const char *path_p,
1982                                                  SMB_ACL_TYPE_T type,
1983                                                  TALLOC_CTX *mem_ctx)
1984 {
1985         SMB_ACL_T result;
1986         struct timespec ts1,ts2;
1987         double timediff;
1988
1989         clock_gettime_mono(&ts1);
1990         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
1991         clock_gettime_mono(&ts2);
1992         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1993
1994         if (timediff > audit_timeout) {
1995                 smb_time_audit_log_fname("sys_acl_get_file", timediff, path_p);
1996         }
1997
1998         return result;
1999 }
2000
2001 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2002                                                files_struct *fsp,
2003                                                TALLOC_CTX *mem_ctx)
2004 {
2005         SMB_ACL_T result;
2006         struct timespec ts1,ts2;
2007         double timediff;
2008
2009         clock_gettime_mono(&ts1);
2010         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2011         clock_gettime_mono(&ts2);
2012         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2013
2014         if (timediff > audit_timeout) {
2015                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2016         }
2017
2018         return result;
2019 }
2020
2021
2022 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2023                                                 const char *path_p,
2024                                                 TALLOC_CTX *mem_ctx,
2025                                                 char **blob_description,
2026                                                 DATA_BLOB *blob)
2027 {
2028         int result;
2029         struct timespec ts1,ts2;
2030         double timediff;
2031
2032         clock_gettime_mono(&ts1);
2033         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, path_p, mem_ctx, blob_description, blob);
2034         clock_gettime_mono(&ts2);
2035         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2036
2037         if (timediff > audit_timeout) {
2038                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2039         }
2040
2041         return result;
2042 }
2043
2044 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2045                                               files_struct *fsp,
2046                                               TALLOC_CTX *mem_ctx,
2047                                               char **blob_description,
2048                                               DATA_BLOB *blob)
2049 {
2050         int result;
2051         struct timespec ts1,ts2;
2052         double timediff;
2053
2054         clock_gettime_mono(&ts1);
2055         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2056         clock_gettime_mono(&ts2);
2057         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2058
2059         if (timediff > audit_timeout) {
2060                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2061         }
2062
2063         return result;
2064 }
2065
2066 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2067                                            const char *name,
2068                                            SMB_ACL_TYPE_T acltype,
2069                                            SMB_ACL_T theacl)
2070 {
2071         int result;
2072         struct timespec ts1,ts2;
2073         double timediff;
2074
2075         clock_gettime_mono(&ts1);
2076         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
2077                                                theacl);
2078         clock_gettime_mono(&ts2);
2079         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2080
2081         if (timediff > audit_timeout) {
2082                 smb_time_audit_log_fname("sys_acl_set_file", timediff, name);
2083         }
2084
2085         return result;
2086 }
2087
2088 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2089                                          files_struct *fsp,
2090                                          SMB_ACL_T theacl)
2091 {
2092         int result;
2093         struct timespec ts1,ts2;
2094         double timediff;
2095
2096         clock_gettime_mono(&ts1);
2097         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2098         clock_gettime_mono(&ts2);
2099         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2100
2101         if (timediff > audit_timeout) {
2102                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2103         }
2104
2105         return result;
2106 }
2107
2108 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2109                                                   const char *path)
2110 {
2111         int result;
2112         struct timespec ts1,ts2;
2113         double timediff;
2114
2115         clock_gettime_mono(&ts1);
2116         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2117         clock_gettime_mono(&ts2);
2118         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2119
2120         if (timediff > audit_timeout) {
2121                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff, path);
2122         }
2123
2124         return result;
2125 }
2126
2127 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2128                                        const char *path, const char *name,
2129                                        void *value, size_t size)
2130 {
2131         ssize_t result;
2132         struct timespec ts1,ts2;
2133         double timediff;
2134
2135         clock_gettime_mono(&ts1);
2136         result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2137         clock_gettime_mono(&ts2);
2138         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2139
2140         if (timediff > audit_timeout) {
2141                 smb_time_audit_log_fname("getxattr", timediff, path);
2142         }
2143
2144         return result;
2145 }
2146
2147 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2148                                         struct files_struct *fsp,
2149                                         const char *name, void *value,
2150                                         size_t size)
2151 {
2152         ssize_t result;
2153         struct timespec ts1,ts2;
2154         double timediff;
2155
2156         clock_gettime_mono(&ts1);
2157         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2158         clock_gettime_mono(&ts2);
2159         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2160
2161         if (timediff > audit_timeout) {
2162                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2163         }
2164
2165         return result;
2166 }
2167
2168 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2169                                         const char *path, char *list,
2170                                         size_t size)
2171 {
2172         ssize_t result;
2173         struct timespec ts1,ts2;
2174         double timediff;
2175
2176         clock_gettime_mono(&ts1);
2177         result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2178         clock_gettime_mono(&ts2);
2179         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2180
2181         if (timediff > audit_timeout) {
2182                 smb_time_audit_log_fname("listxattr", timediff, path);
2183         }
2184
2185         return result;
2186 }
2187
2188 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2189                                          struct files_struct *fsp, char *list,
2190                                          size_t size)
2191 {
2192         ssize_t result;
2193         struct timespec ts1,ts2;
2194         double timediff;
2195
2196         clock_gettime_mono(&ts1);
2197         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2198         clock_gettime_mono(&ts2);
2199         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2200
2201         if (timediff > audit_timeout) {
2202                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2203         }
2204
2205         return result;
2206 }
2207
2208 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2209                                       const char *path, const char *name)
2210 {
2211         int result;
2212         struct timespec ts1,ts2;
2213         double timediff;
2214
2215         clock_gettime_mono(&ts1);
2216         result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2217         clock_gettime_mono(&ts2);
2218         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2219
2220         if (timediff > audit_timeout) {
2221                 smb_time_audit_log_fname("removexattr", timediff, path);
2222         }
2223
2224         return result;
2225 }
2226
2227 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2228                                        struct files_struct *fsp,
2229                                        const char *name)
2230 {
2231         int result;
2232         struct timespec ts1,ts2;
2233         double timediff;
2234
2235         clock_gettime_mono(&ts1);
2236         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2237         clock_gettime_mono(&ts2);
2238         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2239
2240         if (timediff > audit_timeout) {
2241                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2242         }
2243
2244         return result;
2245 }
2246
2247 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2248                                    const char *path, const char *name,
2249                                    const void *value, size_t size,
2250                                    int flags)
2251 {
2252         int result;
2253         struct timespec ts1,ts2;
2254         double timediff;
2255
2256         clock_gettime_mono(&ts1);
2257         result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2258                                        flags);
2259         clock_gettime_mono(&ts2);
2260         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2261
2262         if (timediff > audit_timeout) {
2263                 smb_time_audit_log_fname("setxattr", timediff, path);
2264         }
2265
2266         return result;
2267 }
2268
2269 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2270                                     struct files_struct *fsp, const char *name,
2271                                     const void *value, size_t size, int flags)
2272 {
2273         int result;
2274         struct timespec ts1,ts2;
2275         double timediff;
2276
2277         clock_gettime_mono(&ts1);
2278         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2279         clock_gettime_mono(&ts2);
2280         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2281
2282         if (timediff > audit_timeout) {
2283                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2284         }
2285
2286         return result;
2287 }
2288
2289 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2290                                      struct files_struct *fsp)
2291 {
2292         bool result;
2293         struct timespec ts1,ts2;
2294         double timediff;
2295
2296         clock_gettime_mono(&ts1);
2297         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2298         clock_gettime_mono(&ts2);
2299         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2300
2301         if (timediff > audit_timeout) {
2302                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2303         }
2304
2305         return result;
2306 }
2307
2308 static bool smb_time_audit_is_offline(struct vfs_handle_struct *handle,
2309                                       const struct smb_filename *fname,
2310                                       SMB_STRUCT_STAT *sbuf)
2311 {
2312         bool result;
2313         struct timespec ts1,ts2;
2314         double timediff;
2315
2316         clock_gettime_mono(&ts1);
2317         result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
2318         clock_gettime_mono(&ts2);
2319         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2320
2321         if (timediff > audit_timeout) {
2322                 smb_time_audit_log_smb_fname("is_offline", timediff, fname);
2323         }
2324
2325         return result;
2326 }
2327
2328 static int smb_time_audit_set_offline(struct vfs_handle_struct *handle,
2329                                       const struct smb_filename *fname)
2330 {
2331         int result;
2332         struct timespec ts1,ts2;
2333         double timediff;
2334
2335         clock_gettime_mono(&ts1);
2336         result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2337         clock_gettime_mono(&ts2);
2338         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2339
2340         if (timediff > audit_timeout) {
2341                 smb_time_audit_log_smb_fname("set_offline", timediff, fname);
2342         }
2343
2344         return result;
2345 }
2346
2347 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2348                                               struct files_struct *fsp,
2349                                               TALLOC_CTX *mem_ctx,
2350                                               DATA_BLOB *cookie)
2351 {
2352         NTSTATUS result;
2353         struct timespec ts1,ts2;
2354         double timediff;
2355
2356         clock_gettime_mono(&ts1);
2357         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2358         clock_gettime_mono(&ts2);
2359         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2360
2361         if (timediff > audit_timeout) {
2362                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2363         }
2364
2365         return result;
2366 }
2367
2368 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2369                                                   struct files_struct *fsp,
2370                                                   const DATA_BLOB old_cookie,
2371                                                   TALLOC_CTX *mem_ctx,
2372                                                   DATA_BLOB *new_cookie)
2373 {
2374         NTSTATUS result;
2375         struct timespec ts1,ts2;
2376         double timediff;
2377
2378         clock_gettime_mono(&ts1);
2379         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2380                                                  mem_ctx, new_cookie);
2381         clock_gettime_mono(&ts2);
2382         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2383
2384         if (timediff > audit_timeout) {
2385                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2386         }
2387
2388         return result;
2389 }
2390
2391 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2392                                                  struct smb_request *smb1req,
2393                                                  struct smbXsrv_open *op,
2394                                                  const DATA_BLOB old_cookie,
2395                                                  TALLOC_CTX *mem_ctx,
2396                                                  struct files_struct **fsp,
2397                                                  DATA_BLOB *new_cookie)
2398 {
2399         NTSTATUS result;
2400         struct timespec ts1,ts2;
2401         double timediff;
2402
2403         clock_gettime_mono(&ts1);
2404         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2405                                                 mem_ctx, fsp, new_cookie);
2406         clock_gettime_mono(&ts2);
2407         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2408
2409         if (timediff > audit_timeout) {
2410                 smb_time_audit_log("durable_reconnect", timediff);
2411         }
2412
2413         return result;
2414 }
2415
2416 /* VFS operations */
2417
2418 static struct vfs_fn_pointers vfs_time_audit_fns = {
2419         .connect_fn = smb_time_audit_connect,
2420         .disconnect_fn = smb_time_audit_disconnect,
2421         .disk_free_fn = smb_time_audit_disk_free,
2422         .get_quota_fn = smb_time_audit_get_quota,
2423         .set_quota_fn = smb_time_audit_set_quota,
2424         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2425         .statvfs_fn = smb_time_audit_statvfs,
2426         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2427         .snap_check_path_fn = smb_time_audit_snap_check_path,
2428         .snap_create_fn = smb_time_audit_snap_create,
2429         .snap_delete_fn = smb_time_audit_snap_delete,
2430         .opendir_fn = smb_time_audit_opendir,
2431         .fdopendir_fn = smb_time_audit_fdopendir,
2432         .readdir_fn = smb_time_audit_readdir,
2433         .seekdir_fn = smb_time_audit_seekdir,
2434         .telldir_fn = smb_time_audit_telldir,
2435         .rewind_dir_fn = smb_time_audit_rewinddir,
2436         .mkdir_fn = smb_time_audit_mkdir,
2437         .rmdir_fn = smb_time_audit_rmdir,
2438         .closedir_fn = smb_time_audit_closedir,
2439         .init_search_op_fn = smb_time_audit_init_search_op,
2440         .open_fn = smb_time_audit_open,
2441         .create_file_fn = smb_time_audit_create_file,
2442         .close_fn = smb_time_audit_close,
2443         .read_fn = smb_time_audit_read,
2444         .pread_fn = smb_time_audit_pread,
2445         .pread_send_fn = smb_time_audit_pread_send,
2446         .pread_recv_fn = smb_time_audit_pread_recv,
2447         .write_fn = smb_time_audit_write,
2448         .pwrite_fn = smb_time_audit_pwrite,
2449         .pwrite_send_fn = smb_time_audit_pwrite_send,
2450         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2451         .lseek_fn = smb_time_audit_lseek,
2452         .sendfile_fn = smb_time_audit_sendfile,
2453         .recvfile_fn = smb_time_audit_recvfile,
2454         .rename_fn = smb_time_audit_rename,
2455         .fsync_fn = smb_time_audit_fsync,
2456         .fsync_send_fn = smb_time_audit_fsync_send,
2457         .fsync_recv_fn = smb_time_audit_fsync_recv,
2458         .stat_fn = smb_time_audit_stat,
2459         .fstat_fn = smb_time_audit_fstat,
2460         .lstat_fn = smb_time_audit_lstat,
2461         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2462         .unlink_fn = smb_time_audit_unlink,
2463         .chmod_fn = smb_time_audit_chmod,
2464         .fchmod_fn = smb_time_audit_fchmod,
2465         .chown_fn = smb_time_audit_chown,
2466         .fchown_fn = smb_time_audit_fchown,
2467         .lchown_fn = smb_time_audit_lchown,
2468         .chdir_fn = smb_time_audit_chdir,
2469         .getwd_fn = smb_time_audit_getwd,
2470         .ntimes_fn = smb_time_audit_ntimes,
2471         .ftruncate_fn = smb_time_audit_ftruncate,
2472         .fallocate_fn = smb_time_audit_fallocate,
2473         .lock_fn = smb_time_audit_lock,
2474         .kernel_flock_fn = smb_time_audit_kernel_flock,
2475         .linux_setlease_fn = smb_time_audit_linux_setlease,
2476         .getlock_fn = smb_time_audit_getlock,
2477         .symlink_fn = smb_time_audit_symlink,
2478         .readlink_fn = smb_time_audit_readlink,
2479         .link_fn = smb_time_audit_link,
2480         .mknod_fn = smb_time_audit_mknod,
2481         .realpath_fn = smb_time_audit_realpath,
2482         .chflags_fn = smb_time_audit_chflags,
2483         .file_id_create_fn = smb_time_audit_file_id_create,
2484         .streaminfo_fn = smb_time_audit_streaminfo,
2485         .get_real_filename_fn = smb_time_audit_get_real_filename,
2486         .connectpath_fn = smb_time_audit_connectpath,
2487         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2488         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2489         .brl_cancel_windows_fn = smb_time_audit_brl_cancel_windows,
2490         .strict_lock_fn = smb_time_audit_strict_lock,
2491         .strict_unlock_fn = smb_time_audit_strict_unlock,
2492         .translate_name_fn = smb_time_audit_translate_name,
2493         .copy_chunk_send_fn = smb_time_audit_copy_chunk_send,
2494         .copy_chunk_recv_fn = smb_time_audit_copy_chunk_recv,
2495         .get_compression_fn = smb_time_audit_get_compression,
2496         .set_compression_fn = smb_time_audit_set_compression,
2497         .readdir_attr_fn = smb_time_audit_readdir_attr,
2498         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2499         .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2500         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2501         .chmod_acl_fn = smb_time_audit_chmod_acl,
2502         .fchmod_acl_fn = smb_time_audit_fchmod_acl,
2503         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2504         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2505         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2506         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2507         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2508         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2509         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2510         .getxattr_fn = smb_time_audit_getxattr,
2511         .fgetxattr_fn = smb_time_audit_fgetxattr,
2512         .listxattr_fn = smb_time_audit_listxattr,
2513         .flistxattr_fn = smb_time_audit_flistxattr,
2514         .removexattr_fn = smb_time_audit_removexattr,
2515         .fremovexattr_fn = smb_time_audit_fremovexattr,
2516         .setxattr_fn = smb_time_audit_setxattr,
2517         .fsetxattr_fn = smb_time_audit_fsetxattr,
2518         .aio_force_fn = smb_time_audit_aio_force,
2519         .is_offline_fn = smb_time_audit_is_offline,
2520         .set_offline_fn = smb_time_audit_set_offline,
2521         .durable_cookie_fn = smb_time_audit_durable_cookie,
2522         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2523         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2524 };
2525
2526
2527 NTSTATUS vfs_time_audit_init(void);
2528 NTSTATUS vfs_time_audit_init(void)
2529 {
2530         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2531                                             10000) / 1000.0;
2532         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2533                                 &vfs_time_audit_fns);
2534 }