source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_at(const char *syscallname,
  90                                   double elapsed,
  91                                   const struct files_struct *dir_fsp,
  92                                   const struct smb_filename *smb_fname)
  93 {
  94         char *msg = NULL;
  95
  96         msg = talloc_asprintf(talloc_tos(),
  97                               "filename = \"%s/%s/%s\"",
  98                               dir_fsp->conn->connectpath,
  99                               dir_fsp->fsp_name->base_name,
 100                               smb_fname->base_name);
 101
 102         smb_time_audit_log_msg(syscallname, elapsed, msg);
 103         TALLOC_FREE(msg);
 104 }
 105
 106 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
 107                                     const char *fname)
 108 {
 109         char cwd[PATH_MAX];
 110         char *msg = NULL;
 111
 112         if (getcwd(cwd, sizeof(cwd)) == NULL) {
 113                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
 114         }
 115         if (fname != NULL) {
 116                 msg = talloc_asprintf(talloc_tos(),
 117                                       "cwd = \"%s\", filename = \"%s\"",
 118                                       cwd, fname);
 119         } else {
 120                 msg = talloc_asprintf(talloc_tos(),
 121                                       "cwd = \"%s\", filename = <NULL>",
 122                                       cwd);
 123         }
 124         smb_time_audit_log_msg(syscallname, elapsed, msg);
 125         TALLOC_FREE(msg);
 126 }
 127
 128 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 129                                        const struct smb_filename *smb_fname)
 130 {
 131         if (smb_fname != NULL) {
 132                 smb_time_audit_log_fname(syscallname, elapsed,
 133                                          smb_fname->base_name);
 134         } else {
 135                 smb_time_audit_log_fname(syscallname, elapsed,
 136                                          "smb_fname = <NULL>");
 137         }
 138 }
 139
 140 static int smb_time_audit_connect(vfs_handle_struct *handle,
 141                                   const char *svc, const char *user)
 142 {
 143         int result;
 144         struct timespec ts1,ts2;
 145         double timediff;
 146
 147         if (!handle) {
 148                 return -1;
 149         }
 150
 151         clock_gettime_mono(&ts1);
 152         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 153         clock_gettime_mono(&ts2);
 154         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 155         if (timediff > audit_timeout) {
 156                 smb_time_audit_log_msg("connect", timediff, user);
 157         }
 158         return result;
 159 }
 160
 161 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 162 {
 163         struct timespec ts1,ts2;
 164         double timediff;
 165
 166         clock_gettime_mono(&ts1);
 167         SMB_VFS_NEXT_DISCONNECT(handle);
 168         clock_gettime_mono(&ts2);
 169         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 170
 171         if (timediff > audit_timeout) {
 172                 smb_time_audit_log("disconnect", timediff);
 173         }
 174 }
 175
 176 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 177                                         const struct smb_filename *smb_fname,
 178                                         uint64_t *bsize,
 179                                         uint64_t *dfree,
 180                                         uint64_t *dsize)
 181 {
 182         uint64_t result;
 183         struct timespec ts1,ts2;
 184         double timediff;
 185
 186         clock_gettime_mono(&ts1);
 187         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
 188         clock_gettime_mono(&ts2);
 189         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 190
 191         /* Don't have a reasonable notion of failure here */
 192         if (timediff > audit_timeout) {
 193                 smb_time_audit_log_fname("disk_free",
 194                                 timediff,
 195                                 smb_fname->base_name);
 196         }
 197
 198         return result;
 199 }
 200
 201 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 202                                         const struct smb_filename *smb_fname,
 203                                         enum SMB_QUOTA_TYPE qtype,
 204                                         unid_t id,
 205                                         SMB_DISK_QUOTA *qt)
 206 {
 207         int result;
 208         struct timespec ts1,ts2;
 209         double timediff;
 210
 211         clock_gettime_mono(&ts1);
 212         result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
 213         clock_gettime_mono(&ts2);
 214         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 215
 216         if (timediff > audit_timeout) {
 217                 smb_time_audit_log_fname("get_quota",
 218                                 timediff,
 219                                 smb_fname->base_name);
 220         }
 221         return result;
 222 }
 223
 224 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 225                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 226                                     SMB_DISK_QUOTA *qt)
 227 {
 228         int result;
 229         struct timespec ts1,ts2;
 230         double timediff;
 231
 232         clock_gettime_mono(&ts1);
 233         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 234         clock_gettime_mono(&ts2);
 235         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 236
 237         if (timediff > audit_timeout) {
 238                 smb_time_audit_log("set_quota", timediff);
 239         }
 240
 241         return result;
 242 }
 243
 244 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 245                                                struct files_struct *fsp,
 246                                                struct shadow_copy_data *shadow_copy_data,
 247                                                bool labels)
 248 {
 249         int result;
 250         struct timespec ts1,ts2;
 251         double timediff;
 252
 253         clock_gettime_mono(&ts1);
 254         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 255                                                    shadow_copy_data, labels);
 256         clock_gettime_mono(&ts2);
 257         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 258
 259         if (timediff > audit_timeout) {
 260                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 261         }
 262
 263         return result;
 264 }
 265
 266 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 267                                   const struct smb_filename *smb_fname,
 268                                   struct vfs_statvfs_struct *statbuf)
 269 {
 270         int result;
 271         struct timespec ts1,ts2;
 272         double timediff;
 273
 274         clock_gettime_mono(&ts1);
 275         result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
 276         clock_gettime_mono(&ts2);
 277         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 278
 279         if (timediff > audit_timeout) {
 280                 smb_time_audit_log_fname("statvfs", timediff,
 281                         smb_fname->base_name);
 282         }
 283
 284         return result;
 285 }
 286
 287 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 288                                                enum timestamp_set_resolution *p_ts_res)
 289 {
 290         uint32_t result;
 291         struct timespec ts1,ts2;
 292         double timediff;
 293
 294         clock_gettime_mono(&ts1);
 295         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 296         clock_gettime_mono(&ts2);
 297         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 298
 299         if (timediff > audit_timeout) {
 300                 smb_time_audit_log("fs_capabilities", timediff);
 301         }
 302
 303         return result;
 304 }
 305
 306 static NTSTATUS smb_time_audit_get_dfs_referrals(
 307                         struct vfs_handle_struct *handle,
 308                         struct dfs_GetDFSReferral *r)
 309 {
 310         NTSTATUS result;
 311         struct timespec ts1,ts2;
 312         double timediff;
 313
 314         clock_gettime_mono(&ts1);
 315         result = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
 316         clock_gettime_mono(&ts2);
 317         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 318
 319         if (timediff > audit_timeout) {
 320                 smb_time_audit_log("get_dfs_referrals", timediff);
 321         }
 322
 323         return result;
 324 }
 325
 326 static NTSTATUS smb_time_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
 327                         struct files_struct *dirfsp,
 328                         const struct smb_filename *smb_fname,
 329                         const struct referral *reflist,
 330                         size_t referral_count)
 331 {
 332         NTSTATUS result;
 333         struct timespec ts1,ts2;
 334         double timediff;
 335         struct smb_filename *full_fname = NULL;
 336
 337         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
 338                                                   dirfsp,
 339                                                   smb_fname);
 340         if (full_fname == NULL) {
 341                 return NT_STATUS_NO_MEMORY;
 342         }
 343
 344         clock_gettime_mono(&ts1);
 345         result = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
 346                         dirfsp,
 347                         smb_fname,
 348                         reflist,
 349                         referral_count);
 350         clock_gettime_mono(&ts2);
 351         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 352
 353         if (timediff > audit_timeout) {
 354                 smb_time_audit_log_smb_fname("create_dfs_pathat",
 355                         timediff,
 356                         full_fname);
 357         }
 358         TALLOC_FREE(full_fname);
 359         return result;
 360 }
 361
 362 static NTSTATUS smb_time_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
 363                         TALLOC_CTX *mem_ctx,
 364                         struct files_struct *dirfsp,
 365                         struct smb_filename *smb_fname,
 366                         struct referral **ppreflist,
 367                         size_t *preferral_count)
 368 {
 369         NTSTATUS result;
 370         struct timespec ts1,ts2;
 371         double timediff;
 372         struct smb_filename *full_fname = NULL;
 373
 374         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
 375                                                   dirfsp,
 376                                                   smb_fname);
 377         if (full_fname == NULL) {
 378                 return NT_STATUS_NO_MEMORY;
 379         }
 380
 381         clock_gettime_mono(&ts1);
 382         result = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
 383                         mem_ctx,
 384                         dirfsp,
 385                         smb_fname,
 386                         ppreflist,
 387                         preferral_count);
 388         clock_gettime_mono(&ts2);
 389         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 390
 391         if (timediff > audit_timeout) {
 392                 smb_time_audit_log_smb_fname("read_dfs_pathat",
 393                         timediff,
 394                         full_fname);
 395         }
 396
 397         TALLOC_FREE(full_fname);
 398         return result;
 399 }
 400
 401 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 402                                                TALLOC_CTX *mem_ctx,
 403                                                const char *service_path,
 404                                                char **base_volume)
 405 {
 406         NTSTATUS status;
 407         struct timespec ts1,ts2;
 408         double timediff;
 409
 410         clock_gettime_mono(&ts1);
 411         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 412                                               base_volume);
 413         clock_gettime_mono(&ts2);
 414         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 415
 416         if (timediff > audit_timeout) {
 417                 smb_time_audit_log("snap_check_path", timediff);
 418         }
 419
 420         return status;
 421 }
 422
 423 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 424                                            TALLOC_CTX *mem_ctx,
 425                                            const char *base_volume,
 426                                            time_t *tstamp,
 427                                            bool rw,
 428                                            char **base_path,
 429                                            char **snap_path)
 430 {
 431         NTSTATUS status;
 432         struct timespec ts1,ts2;
 433         double timediff;
 434
 435         clock_gettime_mono(&ts1);
 436         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 437                                           rw, base_path, snap_path);
 438         clock_gettime_mono(&ts2);
 439         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 440
 441         if (timediff > audit_timeout) {
 442                 smb_time_audit_log("snap_create", timediff);
 443         }
 444
 445         return status;
 446 }
 447
 448 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 449                                            TALLOC_CTX *mem_ctx,
 450                                            char *base_path,
 451                                            char *snap_path)
 452 {
 453         NTSTATUS status;
 454         struct timespec ts1,ts2;
 455         double timediff;
 456
 457         clock_gettime_mono(&ts1);
 458         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 459                                           snap_path);
 460         clock_gettime_mono(&ts2);
 461         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 462
 463         if (timediff > audit_timeout) {
 464                 smb_time_audit_log("snap_delete", timediff);
 465         }
 466
 467         return status;
 468 }
 469
 470 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 471                                               files_struct *fsp,
 472                                               const char *mask, uint32_t attr)
 473 {
 474         DIR *result;
 475         struct timespec ts1,ts2;
 476         double timediff;
 477
 478         clock_gettime_mono(&ts1);
 479         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 480         clock_gettime_mono(&ts2);
 481         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 482
 483         if (timediff > audit_timeout) {
 484                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 485         }
 486
 487         return result;
 488 }
 489
 490 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 491                                              struct files_struct *dirfsp,
 492                                              DIR *dirp)
 493 {
 494         struct dirent *result;
 495         struct timespec ts1,ts2;
 496         double timediff;
 497
 498         clock_gettime_mono(&ts1);
 499         result = SMB_VFS_NEXT_READDIR(handle, dirfsp, dirp);
 500         clock_gettime_mono(&ts2);
 501         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 502
 503         if (timediff > audit_timeout) {
 504                 smb_time_audit_log("readdir", timediff);
 505         }
 506
 507         return result;
 508 }
 509
 510 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 511                                      DIR *dirp)
 512 {
 513         struct timespec ts1,ts2;
 514         double timediff;
 515
 516         clock_gettime_mono(&ts1);
 517         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 518         clock_gettime_mono(&ts2);
 519         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 520
 521         if (timediff > audit_timeout) {
 522                 smb_time_audit_log("rewinddir", timediff);
 523         }
 524
 525 }
 526
 527 static int smb_time_audit_mkdirat(vfs_handle_struct *handle,
 528                                 struct files_struct *dirfsp,
 529                                 const struct smb_filename *smb_fname,
 530                                 mode_t mode)
 531 {
 532         struct smb_filename *full_fname = NULL;
 533         int result;
 534         struct timespec ts1,ts2;
 535         double timediff;
 536
 537         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
 538                                                   dirfsp,
 539                                                   smb_fname);
 540         if (full_fname == NULL) {
 541                 errno = ENOMEM;
 542                 return -1;
 543         }
 544
 545         clock_gettime_mono(&ts1);
 546         result = SMB_VFS_NEXT_MKDIRAT(handle,
 547                                 dirfsp,
 548                                 smb_fname,
 549                                 mode);
 550         clock_gettime_mono(&ts2);
 551         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 552
 553         if (timediff > audit_timeout) {
 554                 smb_time_audit_log_smb_fname("mkdirat",
 555                         timediff,
 556                         full_fname);
 557         }
 558
 559         TALLOC_FREE(full_fname);
 560
 561         return result;
 562 }
 563
 564 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 565                                    DIR *dirp)
 566 {
 567         int result;
 568         struct timespec ts1,ts2;
 569         double timediff;
 570
 571         clock_gettime_mono(&ts1);
 572         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 573         clock_gettime_mono(&ts2);
 574         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 575
 576         if (timediff > audit_timeout) {
 577                 smb_time_audit_log("closedir", timediff);
 578         }
 579
 580         return result;
 581 }
 582
 583 static int smb_time_audit_openat(vfs_handle_struct *handle,
 584                                  const struct files_struct *dirfsp,
 585                                  const struct smb_filename *smb_fname,
 586                                  struct files_struct *fsp,
 587                                  const struct vfs_open_how *how)
 588 {
 589         int result;
 590         struct timespec ts1,ts2;
 591         double timediff;
 592
 593         clock_gettime_mono(&ts1);
 594         result = SMB_VFS_NEXT_OPENAT(handle,
 595                                      dirfsp,
 596                                      smb_fname,
 597                                      fsp,
 598                                      how);
 599         clock_gettime_mono(&ts2);
 600         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 601
 602         if (timediff > audit_timeout) {
 603                 smb_time_audit_log_fsp("openat", timediff, fsp);
 604         }
 605
 606         return result;
 607 }
 608
 609 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 610                                            struct smb_request *req,
 611                                            struct files_struct *dirfsp,
 612                                            struct smb_filename *fname,
 613                                            uint32_t access_mask,
 614                                            uint32_t share_access,
 615                                            uint32_t create_disposition,
 616                                            uint32_t create_options,
 617                                            uint32_t file_attributes,
 618                                            uint32_t oplock_request,
 619                                            const struct smb2_lease *lease,
 620                                            uint64_t allocation_size,
 621                                            uint32_t private_flags,
 622                                            struct security_descriptor *sd,
 623                                            struct ea_list *ea_list,
 624                                            files_struct **result_fsp,
 625                                            int *pinfo,
 626                                            const struct smb2_create_blobs *in_context_blobs,
 627                                            struct smb2_create_blobs *out_context_blobs)
 628 {
 629         NTSTATUS result;
 630         struct timespec ts1,ts2;
 631         double timediff;
 632
 633         clock_gettime_mono(&ts1);
 634         result = SMB_VFS_NEXT_CREATE_FILE(
 635                 handle,                                 /* handle */
 636                 req,                                    /* req */
 637                 dirfsp,                                 /* dirfsp */
 638                 fname,                                  /* fname */
 639                 access_mask,                            /* access_mask */
 640                 share_access,                           /* share_access */
 641                 create_disposition,                     /* create_disposition*/
 642                 create_options,                         /* create_options */
 643                 file_attributes,                        /* file_attributes */
 644                 oplock_request,                         /* oplock_request */
 645                 lease,                                  /* lease */
 646                 allocation_size,                        /* allocation_size */
 647                 private_flags,
 648                 sd,                                     /* sd */
 649                 ea_list,                                /* ea_list */
 650                 result_fsp,                             /* result */
 651                 pinfo,
 652                 in_context_blobs, out_context_blobs);   /* create context */
 653         clock_gettime_mono(&ts2);
 654         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 655
 656         if (timediff > audit_timeout) {
 657                 /*
 658                  * can't use result_fsp this time, may have
 659                  * invalid content causing smbd crash
 660                  */
 661                 smb_time_audit_log_smb_fname("create_file", timediff,
 662                                            fname);
 663         }
 664
 665         return result;
 666 }
 667
 668 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 669 {
 670         int result;
 671         struct timespec ts1,ts2;
 672         double timediff;
 673
 674         clock_gettime_mono(&ts1);
 675         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 676         clock_gettime_mono(&ts2);
 677         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 678
 679         if (timediff > audit_timeout) {
 680                 smb_time_audit_log_fsp("close", timediff, fsp);
 681         }
 682
 683         return result;
 684 }
 685
 686 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 687                                     files_struct *fsp,
 688                                     void *data, size_t n, off_t offset)
 689 {
 690         ssize_t result;
 691         struct timespec ts1,ts2;
 692         double timediff;
 693
 694         clock_gettime_mono(&ts1);
 695         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 696         clock_gettime_mono(&ts2);
 697         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 698
 699         if (timediff > audit_timeout) {
 700                 smb_time_audit_log_fsp("pread", timediff, fsp);
 701         }
 702
 703         return result;
 704 }
 705
 706 struct smb_time_audit_pread_state {
 707         struct files_struct *fsp;
 708         ssize_t ret;
 709         struct vfs_aio_state vfs_aio_state;
 710 };
 711
 712 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 713
 714 static struct tevent_req *smb_time_audit_pread_send(
 715         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 716         struct tevent_context *ev, struct files_struct *fsp,
 717         void *data, size_t n, off_t offset)
 718 {
 719         struct tevent_req *req, *subreq;
 720         struct smb_time_audit_pread_state *state;
 721
 722         req = tevent_req_create(mem_ctx, &state,
 723                                 struct smb_time_audit_pread_state);
 724         if (req == NULL) {
 725                 return NULL;
 726         }
 727         state->fsp = fsp;
 728
 729         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 730                                          n, offset);
 731         if (tevent_req_nomem(subreq, req)) {
 732                 return tevent_req_post(req, ev);
 733         }
 734         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 735         return req;
 736 }
 737
 738 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 739 {
 740         struct tevent_req *req = tevent_req_callback_data(
 741                 subreq, struct tevent_req);
 742         struct smb_time_audit_pread_state *state = tevent_req_data(
 743                 req, struct smb_time_audit_pread_state);
 744
 745         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
 746         TALLOC_FREE(subreq);
 747         tevent_req_done(req);
 748 }
 749
 750 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req,
 751                                          struct vfs_aio_state *vfs_aio_state)
 752 {
 753         struct smb_time_audit_pread_state *state = tevent_req_data(
 754                 req, struct smb_time_audit_pread_state);
 755         double timediff;
 756
 757         timediff = state->vfs_aio_state.duration * 1.0e-9;
 758
 759         if (timediff > audit_timeout) {
 760                 smb_time_audit_log_fsp("async pread", timediff, state->fsp);
 761         }
 762
 763         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 764                 return -1;
 765         }
 766         *vfs_aio_state = state->vfs_aio_state;
 767         return state->ret;
 768 }
 769
 770 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 771                                      files_struct *fsp,
 772                                      const void *data, size_t n,
 773                                      off_t offset)
 774 {
 775         ssize_t result;
 776         struct timespec ts1,ts2;
 777         double timediff;
 778
 779         clock_gettime_mono(&ts1);
 780         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 781         clock_gettime_mono(&ts2);
 782         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 783
 784         if (timediff > audit_timeout) {
 785                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 786         }
 787
 788         return result;
 789 }
 790
 791 struct smb_time_audit_pwrite_state {
 792         struct files_struct *fsp;
 793         ssize_t ret;
 794         struct vfs_aio_state vfs_aio_state;
 795 };
 796
 797 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 798
 799 static struct tevent_req *smb_time_audit_pwrite_send(
 800         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 801         struct tevent_context *ev, struct files_struct *fsp,
 802         const void *data, size_t n, off_t offset)
 803 {
 804         struct tevent_req *req, *subreq;
 805         struct smb_time_audit_pwrite_state *state;
 806
 807         req = tevent_req_create(mem_ctx, &state,
 808                                 struct smb_time_audit_pwrite_state);
 809         if (req == NULL) {
 810                 return NULL;
 811         }
 812         state->fsp = fsp;
 813
 814         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 815                                          n, offset);
 816         if (tevent_req_nomem(subreq, req)) {
 817                 return tevent_req_post(req, ev);
 818         }
 819         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 820         return req;
 821 }
 822
 823 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 824 {
 825         struct tevent_req *req = tevent_req_callback_data(
 826                 subreq, struct tevent_req);
 827         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 828                 req, struct smb_time_audit_pwrite_state);
 829
 830         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
 831         TALLOC_FREE(subreq);
 832         tevent_req_done(req);
 833 }
 834
 835 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req,
 836                                           struct vfs_aio_state *vfs_aio_state)
 837 {
 838         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 839                 req, struct smb_time_audit_pwrite_state);
 840         double timediff;
 841
 842         timediff = state->vfs_aio_state.duration * 1.0e-9;
 843
 844         if (timediff > audit_timeout) {
 845                 smb_time_audit_log_fsp("async pwrite", timediff, state->fsp);
 846         }
 847
 848         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
 849                 return -1;
 850         }
 851         *vfs_aio_state = state->vfs_aio_state;
 852         return state->ret;
 853 }
 854
 855 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 856                                       files_struct *fsp,
 857                                       off_t offset, int whence)
 858 {
 859         off_t result;
 860         struct timespec ts1,ts2;
 861         double timediff;
 862
 863         clock_gettime_mono(&ts1);
 864         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 865         clock_gettime_mono(&ts2);
 866         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 867
 868         if (timediff > audit_timeout) {
 869                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 870         }
 871
 872         return result;
 873 }
 874
 875 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 876                                        files_struct *fromfsp,
 877                                        const DATA_BLOB *hdr, off_t offset,
 878                                        size_t n)
 879 {
 880         ssize_t result;
 881         struct timespec ts1,ts2;
 882         double timediff;
 883
 884         clock_gettime_mono(&ts1);
 885         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 886         clock_gettime_mono(&ts2);
 887         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 888
 889         if (timediff > audit_timeout) {
 890                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 891         }
 892
 893         return result;
 894 }
 895
 896 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 897                                        files_struct *tofsp,
 898                                        off_t offset,
 899                                        size_t n)
 900 {
 901         ssize_t result;
 902         struct timespec ts1,ts2;
 903         double timediff;
 904
 905         clock_gettime_mono(&ts1);
 906         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 907         clock_gettime_mono(&ts2);
 908         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 909
 910         if (timediff > audit_timeout) {
 911                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 912         }
 913
 914         return result;
 915 }
 916
 917 static int smb_time_audit_renameat(vfs_handle_struct *handle,
 918                                 files_struct *srcfsp,
 919                                 const struct smb_filename *oldname,
 920                                 files_struct *dstfsp,
 921                                 const struct smb_filename *newname,
 922                                 const struct vfs_rename_how *how)
 923 {
 924         int result;
 925         struct timespec ts1,ts2;
 926         double timediff;
 927         struct smb_filename *new_full_fname = NULL;
 928
 929         new_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
 930                                                   dstfsp,
 931                                                   newname);
 932         if (new_full_fname == NULL) {
 933                 errno = ENOMEM;
 934                 return -1;
 935         }
 936         clock_gettime_mono(&ts1);
 937         result = SMB_VFS_NEXT_RENAMEAT(handle,
 938                         srcfsp,
 939                         oldname,
 940                         dstfsp,
 941                         newname,
 942                         how);
 943         clock_gettime_mono(&ts2);
 944         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 945
 946         if (timediff > audit_timeout) {
 947                 smb_time_audit_log_smb_fname("renameat",
 948                                         timediff,
 949                                         new_full_fname);
 950         }
 951
 952         TALLOC_FREE(new_full_fname);
 953         return result;
 954 }
 955
 956 struct smb_time_audit_fsync_state {
 957         struct files_struct *fsp;
 958         int ret;
 959         struct vfs_aio_state vfs_aio_state;
 960 };
 961
 962 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 963
 964 static struct tevent_req *smb_time_audit_fsync_send(
 965         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 966         struct tevent_context *ev, struct files_struct *fsp)
 967 {
 968         struct tevent_req *req, *subreq;
 969         struct smb_time_audit_fsync_state *state;
 970
 971         req = tevent_req_create(mem_ctx, &state,
 972                                 struct smb_time_audit_fsync_state);
 973         if (req == NULL) {
 974                 return NULL;
 975         }
 976         state->fsp = fsp;
 977
 978         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 979         if (tevent_req_nomem(subreq, req)) {
 980                 return tevent_req_post(req, ev);
 981         }
 982         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 983         return req;
 984 }
 985
 986 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
 987 {
 988         struct tevent_req *req = tevent_req_callback_data(
 989                 subreq, struct tevent_req);
 990         struct smb_time_audit_fsync_state *state = tevent_req_data(
 991                 req, struct smb_time_audit_fsync_state);
 992
 993         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
 994         TALLOC_FREE(subreq);
 995         tevent_req_done(req);
 996 }
 997
 998 static int smb_time_audit_fsync_recv(struct tevent_req *req,
 999                                      struct vfs_aio_state *vfs_aio_state)
1000 {
1001         struct smb_time_audit_fsync_state *state = tevent_req_data(
1002                 req, struct smb_time_audit_fsync_state);
1003         double timediff;
1004
1005         timediff = state->vfs_aio_state.duration * 1.0e-9;
1006
1007         if (timediff > audit_timeout) {
1008                 smb_time_audit_log_fsp("async fsync", timediff, state->fsp);
1009         }
1010
1011         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1012                 return -1;
1013         }
1014         *vfs_aio_state = state->vfs_aio_state;
1015         return state->ret;
1016 }
1017
1018 static int smb_time_audit_stat(vfs_handle_struct *handle,
1019                                struct smb_filename *fname)
1020 {
1021         int result;
1022         struct timespec ts1,ts2;
1023         double timediff;
1024
1025         clock_gettime_mono(&ts1);
1026         result = SMB_VFS_NEXT_STAT(handle, fname);
1027         clock_gettime_mono(&ts2);
1028         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1029
1030         if (timediff > audit_timeout) {
1031                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1032         }
1033
1034         return result;
1035 }
1036
1037 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1038                                 SMB_STRUCT_STAT *sbuf)
1039 {
1040         int result;
1041         struct timespec ts1,ts2;
1042         double timediff;
1043
1044         clock_gettime_mono(&ts1);
1045         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1046         clock_gettime_mono(&ts2);
1047         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1048
1049         if (timediff > audit_timeout) {
1050                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1051         }
1052
1053         return result;
1054 }
1055
1056 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1057                                 struct smb_filename *path)
1058 {
1059         int result;
1060         struct timespec ts1,ts2;
1061         double timediff;
1062
1063         clock_gettime_mono(&ts1);
1064         result = SMB_VFS_NEXT_LSTAT(handle, path);
1065         clock_gettime_mono(&ts2);
1066         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1067
1068         if (timediff > audit_timeout) {
1069                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1070         }
1071
1072         return result;
1073 }
1074
1075 static int smb_time_audit_fstatat(
1076         struct vfs_handle_struct *handle,
1077         const struct files_struct *dirfsp,
1078         const struct smb_filename *smb_fname,
1079         SMB_STRUCT_STAT *sbuf,
1080         int flags)
1081 {
1082         int result;
1083         struct timespec ts1,ts2;
1084         double timediff;
1085
1086         clock_gettime_mono(&ts1);
1087         result = SMB_VFS_NEXT_FSTATAT(handle, dirfsp, smb_fname, sbuf, flags);
1088         clock_gettime_mono(&ts2);
1089         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1090
1091         if (timediff > audit_timeout) {
1092                 smb_time_audit_log_smb_fname("fstatat", timediff, smb_fname);
1093         }
1094
1095         return result;
1096 }
1097
1098 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1099                                               files_struct *fsp,
1100                                               const SMB_STRUCT_STAT *sbuf)
1101 {
1102         uint64_t result;
1103         struct timespec ts1,ts2;
1104         double timediff;
1105
1106         clock_gettime_mono(&ts1);
1107         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1108         clock_gettime_mono(&ts2);
1109         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1110
1111         if (timediff > audit_timeout) {
1112                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1113         }
1114
1115         return result;
1116 }
1117
1118 static int smb_time_audit_unlinkat(vfs_handle_struct *handle,
1119                         struct files_struct *dirfsp,
1120                         const struct smb_filename *path,
1121                         int flags)
1122 {
1123         struct smb_filename *full_fname = NULL;
1124         int result;
1125         struct timespec ts1,ts2;
1126         double timediff;
1127
1128         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1129                                                   dirfsp,
1130                                                   path);
1131         if (full_fname == NULL) {
1132                 return -1;
1133         }
1134
1135         clock_gettime_mono(&ts1);
1136         result = SMB_VFS_NEXT_UNLINKAT(handle,
1137                                 dirfsp,
1138                                 path,
1139                                 flags);
1140         clock_gettime_mono(&ts2);
1141         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1142
1143         if (timediff > audit_timeout) {
1144                 smb_time_audit_log_smb_fname("unlinkat", timediff, full_fname);
1145         }
1146
1147         TALLOC_FREE(full_fname);
1148         return result;
1149 }
1150
1151 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1152                                  mode_t mode)
1153 {
1154         int result;
1155         struct timespec ts1,ts2;
1156         double timediff;
1157
1158         clock_gettime_mono(&ts1);
1159         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1160         clock_gettime_mono(&ts2);
1161         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1162
1163         if (timediff > audit_timeout) {
1164                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1165         }
1166
1167         return result;
1168 }
1169
1170 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1171                                  uid_t uid, gid_t gid)
1172 {
1173         int result;
1174         struct timespec ts1,ts2;
1175         double timediff;
1176
1177         clock_gettime_mono(&ts1);
1178         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1179         clock_gettime_mono(&ts2);
1180         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1181
1182         if (timediff > audit_timeout) {
1183                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1184         }
1185
1186         return result;
1187 }
1188
1189 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1190                         const struct smb_filename *smb_fname,
1191                         uid_t uid,
1192                         gid_t gid)
1193 {
1194         int result;
1195         struct timespec ts1,ts2;
1196         double timediff;
1197
1198         clock_gettime_mono(&ts1);
1199         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1200         clock_gettime_mono(&ts2);
1201         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1202
1203         if (timediff > audit_timeout) {
1204                 smb_time_audit_log_fname("lchown",
1205                         timediff,
1206                         smb_fname->base_name);
1207         }
1208
1209         return result;
1210 }
1211
1212 static int smb_time_audit_chdir(vfs_handle_struct *handle,
1213                         const struct smb_filename *smb_fname)
1214 {
1215         int result;
1216         struct timespec ts1,ts2;
1217         double timediff;
1218
1219         clock_gettime_mono(&ts1);
1220         result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1221         clock_gettime_mono(&ts2);
1222         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1223
1224         if (timediff > audit_timeout) {
1225                 smb_time_audit_log_fname("chdir",
1226                         timediff,
1227                         smb_fname->base_name);
1228         }
1229
1230         return result;
1231 }
1232
1233 static struct smb_filename *smb_time_audit_getwd(vfs_handle_struct *handle,
1234                                         TALLOC_CTX *mem_ctx)
1235 {
1236         struct smb_filename *result;
1237         struct timespec ts1,ts2;
1238         double timediff;
1239
1240         clock_gettime_mono(&ts1);
1241         result = SMB_VFS_NEXT_GETWD(handle, mem_ctx);
1242         clock_gettime_mono(&ts2);
1243         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1244
1245         if (timediff > audit_timeout) {
1246                 smb_time_audit_log("getwd", timediff);
1247         }
1248
1249         return result;
1250 }
1251
1252 static int smb_time_audit_fntimes(vfs_handle_struct *handle,
1253                                   files_struct *fsp,
1254                                   struct smb_file_time *ft)
1255 {
1256         int result;
1257         struct timespec ts1,ts2;
1258         double timediff;
1259
1260         clock_gettime_mono(&ts1);
1261         result = SMB_VFS_NEXT_FNTIMES(handle, fsp, ft);
1262         clock_gettime_mono(&ts2);
1263         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
1264
1265         if (timediff > audit_timeout) {
1266                 smb_time_audit_log_fsp("fntimes", timediff, fsp);
1267         }
1268
1269         return result;
1270 }
1271
1272 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1273                                     files_struct *fsp,
1274                                     off_t len)
1275 {
1276         int result;
1277         struct timespec ts1,ts2;
1278         double timediff;
1279
1280         clock_gettime_mono(&ts1);
1281         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1282         clock_gettime_mono(&ts2);
1283         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1284
1285         if (timediff > audit_timeout) {
1286                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1287         }
1288
1289         return result;
1290 }
1291
1292 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1293                                     files_struct *fsp,
1294                                     uint32_t mode,
1295                                     off_t offset,
1296                                     off_t len)
1297 {
1298         int result;
1299         int saved_errno = 0;
1300         struct timespec ts1,ts2;
1301         double timediff;
1302
1303         clock_gettime_mono(&ts1);
1304         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1305         if (result == -1) {
1306                 saved_errno = errno;
1307         }
1308         clock_gettime_mono(&ts2);
1309         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1310
1311         if (timediff > audit_timeout) {
1312                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1313         }
1314         if (result == -1) {
1315                 errno = saved_errno;
1316         }
1317         return result;
1318 }
1319
1320 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1321                                 int op, off_t offset, off_t count,
1322                                 int type)
1323 {
1324         bool result;
1325         struct timespec ts1,ts2;
1326         double timediff;
1327
1328         clock_gettime_mono(&ts1);
1329         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1330         clock_gettime_mono(&ts2);
1331         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1332
1333         if (timediff > audit_timeout) {
1334                 smb_time_audit_log_fsp("lock", timediff, fsp);
1335         }
1336
1337         return result;
1338 }
1339
1340 static int smb_time_audit_filesystem_sharemode(struct vfs_handle_struct *handle,
1341                                                struct files_struct *fsp,
1342                                                uint32_t share_access,
1343                                                uint32_t access_mask)
1344 {
1345         int result;
1346         struct timespec ts1,ts2;
1347         double timediff;
1348
1349         clock_gettime_mono(&ts1);
1350         result = SMB_VFS_NEXT_FILESYSTEM_SHAREMODE(handle,
1351                                                    fsp,
1352                                                    share_access,
1353                                                    access_mask);
1354         clock_gettime_mono(&ts2);
1355         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1356
1357         if (timediff > audit_timeout) {
1358                 smb_time_audit_log_fsp("filesystem_sharemode", timediff, fsp);
1359         }
1360
1361         return result;
1362 }
1363
1364 static int smb_time_audit_fcntl(struct vfs_handle_struct *handle,
1365                                 struct files_struct *fsp,
1366                                 int cmd, va_list cmd_arg)
1367 {
1368         void *arg;
1369         va_list dup_cmd_arg;
1370         int result;
1371         struct timespec ts1,ts2;
1372         double timediff;
1373
1374         va_copy(dup_cmd_arg, cmd_arg);
1375         arg = va_arg(dup_cmd_arg, void *);
1376         clock_gettime_mono(&ts1);
1377         result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1378         clock_gettime_mono(&ts2);
1379         va_end(dup_cmd_arg);
1380
1381         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382         if (timediff > audit_timeout) {
1383                 smb_time_audit_log_fsp("fcntl", timediff, fsp);
1384         }
1385
1386         return result;
1387 }
1388
1389 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1390                                          files_struct *fsp,
1391                                          int leasetype)
1392 {
1393         int result;
1394         struct timespec ts1,ts2;
1395         double timediff;
1396
1397         clock_gettime_mono(&ts1);
1398         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1399         clock_gettime_mono(&ts2);
1400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1401
1402         if (timediff > audit_timeout) {
1403                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1404         }
1405
1406         return result;
1407 }
1408
1409 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1410                                    files_struct *fsp,
1411                                    off_t *poffset, off_t *pcount,
1412                                    int *ptype, pid_t *ppid)
1413 {
1414         bool result;
1415         struct timespec ts1,ts2;
1416         double timediff;
1417
1418         clock_gettime_mono(&ts1);
1419         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1420                                       ppid);
1421         clock_gettime_mono(&ts2);
1422         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1423
1424         if (timediff > audit_timeout) {
1425                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1426         }
1427
1428         return result;
1429 }
1430
1431 static int smb_time_audit_symlinkat(vfs_handle_struct *handle,
1432                                 const struct smb_filename *link_contents,
1433                                 struct files_struct *dirfsp,
1434                                 const struct smb_filename *new_smb_fname)
1435 {
1436         struct smb_filename *full_fname = NULL;
1437         int result;
1438         struct timespec ts1,ts2;
1439         double timediff;
1440
1441         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1442                                                 dirfsp,
1443                                                 new_smb_fname);
1444         if (full_fname == NULL) {
1445                 errno = ENOMEM;
1446                 return -1;
1447         }
1448
1449         clock_gettime_mono(&ts1);
1450         result = SMB_VFS_NEXT_SYMLINKAT(handle,
1451                                 link_contents,
1452                                 dirfsp,
1453                                 new_smb_fname);
1454         clock_gettime_mono(&ts2);
1455         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1456
1457         if (timediff > audit_timeout) {
1458                 smb_time_audit_log_fname("symlinkat", timediff,
1459                         full_fname->base_name);
1460         }
1461
1462         TALLOC_FREE(full_fname);
1463         return result;
1464 }
1465
1466 static int smb_time_audit_readlinkat(vfs_handle_struct *handle,
1467                                 const struct files_struct *dirfsp,
1468                                 const struct smb_filename *smb_fname,
1469                                 char *buf,
1470                                 size_t bufsiz)
1471 {
1472         struct smb_filename *full_fname = NULL;
1473         int result;
1474         struct timespec ts1,ts2;
1475         double timediff;
1476
1477         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1478                                                 dirfsp,
1479                                                 smb_fname);
1480         if (full_fname == NULL) {
1481                 errno = ENOMEM;
1482                 return -1;
1483         }
1484
1485         clock_gettime_mono(&ts1);
1486         result = SMB_VFS_NEXT_READLINKAT(handle,
1487                                 dirfsp,
1488                                 smb_fname,
1489                                 buf,
1490                                 bufsiz);
1491         clock_gettime_mono(&ts2);
1492         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1493
1494         if (timediff > audit_timeout) {
1495                 smb_time_audit_log_fname("readlinkat", timediff,
1496                                 full_fname->base_name);
1497         }
1498
1499         TALLOC_FREE(full_fname);
1500         return result;
1501 }
1502
1503 static int smb_time_audit_linkat(vfs_handle_struct *handle,
1504                                 files_struct *srcfsp,
1505                                 const struct smb_filename *old_smb_fname,
1506                                 files_struct *dstfsp,
1507                                 const struct smb_filename *new_smb_fname,
1508                                 int flags)
1509 {
1510         struct smb_filename *new_full_fname = NULL;
1511         int result;
1512         struct timespec ts1,ts2;
1513         double timediff;
1514
1515         new_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1516                                                   dstfsp,
1517                                                   new_smb_fname);
1518         if (new_full_fname == NULL) {
1519                 errno = ENOMEM;
1520                 return -1;
1521         }
1522
1523         clock_gettime_mono(&ts1);
1524         result = SMB_VFS_NEXT_LINKAT(handle,
1525                         srcfsp,
1526                         old_smb_fname,
1527                         dstfsp,
1528                         new_smb_fname,
1529                         flags);
1530         clock_gettime_mono(&ts2);
1531         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1532
1533         if (timediff > audit_timeout) {
1534                 smb_time_audit_log_fname("linkat", timediff,
1535                         new_full_fname->base_name);
1536         }
1537
1538         TALLOC_FREE(new_full_fname);
1539         return result;
1540 }
1541
1542 static int smb_time_audit_mknodat(vfs_handle_struct *handle,
1543                                 files_struct *dirfsp,
1544                                 const struct smb_filename *smb_fname,
1545                                 mode_t mode,
1546                                 SMB_DEV_T dev)
1547 {
1548         struct smb_filename *full_fname = NULL;
1549         int result;
1550         struct timespec ts1,ts2;
1551         double timediff;
1552
1553         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1554                                                   dirfsp,
1555                                                   smb_fname);
1556         if (full_fname == NULL) {
1557                 errno = ENOMEM;
1558                 return -1;
1559         }
1560
1561         clock_gettime_mono(&ts1);
1562         result = SMB_VFS_NEXT_MKNODAT(handle,
1563                                 dirfsp,
1564                                 smb_fname,
1565                                 mode,
1566                                 dev);
1567         clock_gettime_mono(&ts2);
1568         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1569
1570         if (timediff > audit_timeout) {
1571                 smb_time_audit_log_smb_fname("mknodat", timediff, full_fname);
1572         }
1573
1574         TALLOC_FREE(full_fname);
1575         return result;
1576 }
1577
1578 static struct smb_filename *smb_time_audit_realpath(vfs_handle_struct *handle,
1579                                 TALLOC_CTX *ctx,
1580                                 const struct smb_filename *smb_fname)
1581 {
1582         struct smb_filename *result_fname;
1583         struct timespec ts1,ts2;
1584         double timediff;
1585
1586         clock_gettime_mono(&ts1);
1587         result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1588         clock_gettime_mono(&ts2);
1589         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1590
1591         if (timediff > audit_timeout) {
1592                 smb_time_audit_log_fname("realpath", timediff,
1593                                 smb_fname->base_name);
1594         }
1595
1596         return result_fname;
1597 }
1598
1599 static int smb_time_audit_fchflags(vfs_handle_struct *handle,
1600                                 struct files_struct *fsp,
1601                                 unsigned int flags)
1602 {
1603         int result;
1604         struct timespec ts1,ts2;
1605         double timediff;
1606
1607         clock_gettime_mono(&ts1);
1608         result = SMB_VFS_NEXT_FCHFLAGS(handle, fsp, flags);
1609         clock_gettime_mono(&ts2);
1610         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1611
1612         if (timediff > audit_timeout) {
1613                 smb_time_audit_log_smb_fname("chflags",
1614                                              timediff,
1615                                              fsp->fsp_name);
1616         }
1617
1618         return result;
1619 }
1620
1621 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1622                                                     const SMB_STRUCT_STAT *sbuf)
1623 {
1624         struct file_id id_zero;
1625         struct file_id result;
1626         struct timespec ts1,ts2;
1627         double timediff;
1628
1629         ZERO_STRUCT(id_zero);
1630
1631         clock_gettime_mono(&ts1);
1632         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1633         clock_gettime_mono(&ts2);
1634         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1635
1636         if (timediff > audit_timeout) {
1637                 smb_time_audit_log("file_id_create", timediff);
1638         }
1639
1640         return result;
1641 }
1642
1643 static uint64_t smb_time_audit_fs_file_id(struct vfs_handle_struct *handle,
1644                                           const SMB_STRUCT_STAT *sbuf)
1645 {
1646         uint64_t result;
1647         struct timespec ts1,ts2;
1648         double timediff;
1649
1650         clock_gettime_mono(&ts1);
1651         result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
1652         clock_gettime_mono(&ts2);
1653         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1654
1655         if (timediff > audit_timeout) {
1656                 smb_time_audit_log("fs_file_id", timediff);
1657         }
1658
1659         return result;
1660 }
1661
1662 static NTSTATUS smb_time_audit_fstreaminfo(vfs_handle_struct *handle,
1663                                           struct files_struct *fsp,
1664                                           TALLOC_CTX *mem_ctx,
1665                                           unsigned int *pnum_streams,
1666                                           struct stream_struct **pstreams)
1667 {
1668         NTSTATUS result;
1669         struct timespec ts1,ts2;
1670         double timediff;
1671
1672         clock_gettime_mono(&ts1);
1673         result = SMB_VFS_NEXT_FSTREAMINFO(handle, fsp, mem_ctx,
1674                                          pnum_streams, pstreams);
1675         clock_gettime_mono(&ts2);
1676         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1677
1678         if (timediff > audit_timeout) {
1679                 smb_time_audit_log_fsp("fstreaminfo", timediff, fsp);
1680         }
1681
1682         return result;
1683 }
1684
1685 static NTSTATUS smb_time_audit_get_real_filename_at(
1686         struct vfs_handle_struct *handle,
1687         struct files_struct *dirfsp,
1688         const char *name,
1689         TALLOC_CTX *mem_ctx,
1690         char **found_name)
1691 {
1692         NTSTATUS result;
1693         struct timespec ts1,ts2;
1694         double timediff;
1695
1696         clock_gettime_mono(&ts1);
1697         result = SMB_VFS_NEXT_GET_REAL_FILENAME_AT(
1698                 handle, dirfsp, name, mem_ctx, found_name);
1699         clock_gettime_mono(&ts2);
1700         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1701
1702         if (timediff > audit_timeout) {
1703                 smb_time_audit_log_fname("get_real_filename_at",
1704                                          timediff,
1705                                          fsp_str_dbg(dirfsp));
1706         }
1707
1708         return result;
1709 }
1710
1711 static const char *smb_time_audit_connectpath(
1712         vfs_handle_struct *handle,
1713         const struct files_struct *dirfsp,
1714         const struct smb_filename *smb_fname)
1715 {
1716         const char *result;
1717         struct timespec ts1,ts2;
1718         double timediff;
1719
1720         clock_gettime_mono(&ts1);
1721         result = SMB_VFS_NEXT_CONNECTPATH(handle, dirfsp, smb_fname);
1722         clock_gettime_mono(&ts2);
1723         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1724
1725         if (timediff > audit_timeout) {
1726                 smb_time_audit_log_fname("connectpath", timediff,
1727                         smb_fname->base_name);
1728         }
1729
1730         return result;
1731 }
1732
1733 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1734                                                 struct byte_range_lock *br_lck,
1735                                                 struct lock_struct *plock)
1736 {
1737         NTSTATUS result;
1738         struct timespec ts1,ts2;
1739         double timediff;
1740
1741         clock_gettime_mono(&ts1);
1742         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
1743         clock_gettime_mono(&ts2);
1744         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1745
1746         if (timediff > audit_timeout) {
1747                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1748                                        brl_fsp(br_lck));
1749         }
1750
1751         return result;
1752 }
1753
1754 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1755                                               struct byte_range_lock *br_lck,
1756                                               const struct lock_struct *plock)
1757 {
1758         bool result;
1759         struct timespec ts1,ts2;
1760         double timediff;
1761
1762         clock_gettime_mono(&ts1);
1763         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
1764         clock_gettime_mono(&ts2);
1765         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1766
1767         if (timediff > audit_timeout) {
1768                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1769                                        brl_fsp(br_lck));
1770         }
1771
1772         return result;
1773 }
1774
1775 static bool smb_time_audit_strict_lock_check(struct vfs_handle_struct *handle,
1776                                              struct files_struct *fsp,
1777                                              struct lock_struct *plock)
1778 {
1779         bool result;
1780         struct timespec ts1,ts2;
1781         double timediff;
1782
1783         clock_gettime_mono(&ts1);
1784         result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1785         clock_gettime_mono(&ts2);
1786         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1787
1788         if (timediff > audit_timeout) {
1789                 smb_time_audit_log_fsp("strict_lock_check", timediff, fsp);
1790         }
1791
1792         return result;
1793 }
1794
1795 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1796                                               const char *name,
1797                                               enum vfs_translate_direction direction,
1798                                               TALLOC_CTX *mem_ctx,
1799                                               char **mapped_name)
1800 {
1801         NTSTATUS result;
1802         struct timespec ts1,ts2;
1803         double timediff;
1804
1805         clock_gettime_mono(&ts1);
1806         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1807                                              mapped_name);
1808         clock_gettime_mono(&ts2);
1809         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1810
1811         if (timediff > audit_timeout) {
1812                 smb_time_audit_log_fname("translate_name", timediff, name);
1813         }
1814
1815         return result;
1816 }
1817
1818 static NTSTATUS smb_time_audit_parent_pathname(struct vfs_handle_struct *handle,
1819                                                TALLOC_CTX *mem_ctx,
1820                                                const struct smb_filename *smb_fname_in,
1821                                                struct smb_filename **parent_dir_out,
1822                                                struct smb_filename **atname_out)
1823 {
1824         NTSTATUS result;
1825         struct timespec ts1,ts2;
1826         double timediff;
1827
1828         clock_gettime_mono(&ts1);
1829         result = SMB_VFS_NEXT_PARENT_PATHNAME(handle,
1830                                               mem_ctx,
1831                                               smb_fname_in,
1832                                               parent_dir_out,
1833                                               atname_out);
1834         clock_gettime_mono(&ts2);
1835         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1836
1837         if (timediff > audit_timeout) {
1838                 smb_time_audit_log_fname("parent_pathname",
1839                                          timediff,
1840                                          smb_fname_in->base_name);
1841         }
1842
1843         return result;
1844 }
1845
1846 static NTSTATUS smb_time_audit_fsctl(struct vfs_handle_struct *handle,
1847                                 struct files_struct *fsp,
1848                                 TALLOC_CTX *ctx,
1849                                 uint32_t function,
1850                                 uint16_t req_flags,
1851                                 const uint8_t *_in_data,
1852                                 uint32_t in_len,
1853                                 uint8_t **_out_data,
1854                                 uint32_t max_out_len,
1855                                 uint32_t *out_len)
1856 {
1857         NTSTATUS result;
1858         struct timespec ts1,ts2;
1859         double timediff;
1860
1861         clock_gettime_mono(&ts1);
1862         result = SMB_VFS_NEXT_FSCTL(handle,
1863                                 fsp,
1864                                 ctx,
1865                                 function,
1866                                 req_flags,
1867                                 _in_data,
1868                                 in_len,
1869                                 _out_data,
1870                                 max_out_len,
1871                                 out_len);
1872         clock_gettime_mono(&ts2);
1873         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1874
1875         if (timediff > audit_timeout) {
1876                 smb_time_audit_log_fsp("fsctl", timediff, fsp);
1877         }
1878
1879         return result;
1880 }
1881
1882 struct smb_time_audit_get_dos_attributes_state {
1883         struct vfs_aio_state aio_state;
1884         files_struct *dir_fsp;
1885         const struct smb_filename *smb_fname;
1886         uint32_t dosmode;
1887 };
1888
1889 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq);
1890
1891 static struct tevent_req *smb_time_audit_get_dos_attributes_send(
1892                         TALLOC_CTX *mem_ctx,
1893                         struct tevent_context *ev,
1894                         struct vfs_handle_struct *handle,
1895                         files_struct *dir_fsp,
1896                         struct smb_filename *smb_fname)
1897 {
1898         struct tevent_req *req = NULL;
1899         struct smb_time_audit_get_dos_attributes_state *state = NULL;
1900         struct tevent_req *subreq = NULL;
1901
1902         req = tevent_req_create(mem_ctx, &state,
1903                                 struct smb_time_audit_get_dos_attributes_state);
1904         if (req == NULL) {
1905                 return NULL;
1906         }
1907         *state = (struct smb_time_audit_get_dos_attributes_state) {
1908                 .dir_fsp = dir_fsp,
1909                 .smb_fname = smb_fname,
1910         };
1911
1912         subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
1913                                                       ev,
1914                                                       handle,
1915                                                       dir_fsp,
1916                                                       smb_fname);
1917         if (tevent_req_nomem(subreq, req)) {
1918                 return tevent_req_post(req, ev);
1919         }
1920         tevent_req_set_callback(subreq,
1921                                 smb_time_audit_get_dos_attributes_done,
1922                                 req);
1923
1924         return req;
1925 }
1926
1927 static void smb_time_audit_get_dos_attributes_done(struct tevent_req *subreq)
1928 {
1929         struct tevent_req *req =
1930                 tevent_req_callback_data(subreq,
1931                 struct tevent_req);
1932         struct smb_time_audit_get_dos_attributes_state *state =
1933                 tevent_req_data(req,
1934                 struct smb_time_audit_get_dos_attributes_state);
1935         NTSTATUS status;
1936
1937         status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
1938                                                       &state->aio_state,
1939                                                       &state->dosmode);
1940         TALLOC_FREE(subreq);
1941         if (tevent_req_nterror(req, status)) {
1942                 return;
1943         }
1944
1945         tevent_req_done(req);
1946         return;
1947 }
1948
1949 static NTSTATUS smb_time_audit_get_dos_attributes_recv(struct tevent_req *req,
1950                                                 struct vfs_aio_state *aio_state,
1951                                                 uint32_t *dosmode)
1952 {
1953         struct smb_time_audit_get_dos_attributes_state *state =
1954                 tevent_req_data(req,
1955                 struct smb_time_audit_get_dos_attributes_state);
1956         NTSTATUS status;
1957         double timediff;
1958
1959         timediff = state->aio_state.duration * 1.0e-9;
1960
1961         if (timediff > audit_timeout) {
1962                 smb_time_audit_log_at("async get_dos_attributes",
1963                                       timediff,
1964                                       state->dir_fsp,
1965                                       state->smb_fname);
1966         }
1967
1968         if (tevent_req_is_nterror(req, &status)) {
1969                 tevent_req_received(req);
1970                 return status;
1971         }
1972
1973         *aio_state = state->aio_state;
1974         *dosmode = state->dosmode;
1975         tevent_req_received(req);
1976         return NT_STATUS_OK;
1977 }
1978
1979 static NTSTATUS smb_time_fget_dos_attributes(struct vfs_handle_struct *handle,
1980                                         struct files_struct *fsp,
1981                                         uint32_t *dosmode)
1982 {
1983         NTSTATUS result;
1984         struct timespec ts1,ts2;
1985         double timediff;
1986
1987         clock_gettime_mono(&ts1);
1988         result = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
1989                                 fsp,
1990                                 dosmode);
1991         clock_gettime_mono(&ts2);
1992         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1993
1994         if (timediff > audit_timeout) {
1995                 smb_time_audit_log_fsp("fget_dos_attributes", timediff, fsp);
1996         }
1997
1998         return result;
1999 }
2000
2001 static NTSTATUS smb_time_fset_dos_attributes(struct vfs_handle_struct *handle,
2002                                         struct files_struct *fsp,
2003                                         uint32_t dosmode)
2004 {
2005         NTSTATUS result;
2006         struct timespec ts1,ts2;
2007         double timediff;
2008
2009         clock_gettime_mono(&ts1);
2010         result = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2011                                 fsp,
2012                                 dosmode);
2013         clock_gettime_mono(&ts2);
2014         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2015
2016         if (timediff > audit_timeout) {
2017                 smb_time_audit_log_fsp("fset_dos_attributes", timediff, fsp);
2018         }
2019
2020         return result;
2021 }
2022
2023 struct time_audit_offload_read_state {
2024         struct vfs_handle_struct *handle;
2025         struct timespec ts_send;
2026         uint32_t flags;
2027         uint64_t xferlen;
2028         DATA_BLOB token_blob;
2029 };
2030
2031 static void smb_time_audit_offload_read_done(struct tevent_req *subreq);
2032
2033 static struct tevent_req *smb_time_audit_offload_read_send(
2034         TALLOC_CTX *mem_ctx,
2035         struct tevent_context *ev,
2036         struct vfs_handle_struct *handle,
2037         struct files_struct *fsp,
2038         uint32_t fsctl,
2039         uint32_t ttl,
2040         off_t offset,
2041         size_t to_copy)
2042 {
2043         struct tevent_req *req = NULL;
2044         struct tevent_req *subreq = NULL;
2045         struct time_audit_offload_read_state *state = NULL;
2046
2047         req = tevent_req_create(mem_ctx, &state,
2048                                 struct time_audit_offload_read_state);
2049         if (req == NULL) {
2050                 return NULL;
2051         }
2052         state->handle = handle;
2053         clock_gettime_mono(&state->ts_send);
2054
2055         subreq = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev,
2056                                                 handle, fsp,
2057                                                 fsctl, ttl,
2058                                                 offset, to_copy);
2059         if (tevent_req_nomem(subreq, req)) {
2060                 return tevent_req_post(req, ev);
2061         }
2062
2063         tevent_req_set_callback(subreq, smb_time_audit_offload_read_done, req);
2064         return req;
2065 }
2066
2067 static void smb_time_audit_offload_read_done(struct tevent_req *subreq)
2068 {
2069         struct tevent_req *req = tevent_req_callback_data(
2070                 subreq, struct tevent_req);
2071         struct time_audit_offload_read_state *state = tevent_req_data(
2072                 req, struct time_audit_offload_read_state);
2073         NTSTATUS status;
2074
2075         status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(subreq,
2076                                                 state->handle,
2077                                                 state,
2078                                                 &state->flags,
2079                                                 &state->xferlen,
2080                                                 &state->token_blob);
2081         TALLOC_FREE(subreq);
2082         if (tevent_req_nterror(req, status)) {
2083                 return;
2084         }
2085         tevent_req_done(req);
2086 }
2087
2088 static NTSTATUS smb_time_audit_offload_read_recv(
2089         struct tevent_req *req,
2090         struct vfs_handle_struct *handle,
2091         TALLOC_CTX *mem_ctx,
2092         uint32_t *flags,
2093         uint64_t *xferlen,
2094         DATA_BLOB *token_blob)
2095 {
2096         struct time_audit_offload_read_state *state = tevent_req_data(
2097                 req, struct time_audit_offload_read_state);
2098         struct timespec ts_recv;
2099         double timediff;
2100         NTSTATUS status;
2101
2102         clock_gettime_mono(&ts_recv);
2103         timediff = nsec_time_diff(&ts_recv, &state->ts_send) * 1.0e-9;
2104         if (timediff > audit_timeout) {
2105                 smb_time_audit_log("offload_read", timediff);
2106         }
2107
2108         if (tevent_req_is_nterror(req, &status)) {
2109                 tevent_req_received(req);
2110                 return status;
2111         }
2112
2113         *flags = state->flags;
2114         *xferlen = state->xferlen;
2115         token_blob->length = state->token_blob.length;
2116         token_blob->data = talloc_move(mem_ctx, &state->token_blob.data);
2117
2118         tevent_req_received(req);
2119         return NT_STATUS_OK;
2120 }
2121
2122 struct time_audit_offload_write_state {
2123         struct timespec ts_send;
2124         struct vfs_handle_struct *handle;
2125         off_t copied;
2126 };
2127 static void smb_time_audit_offload_write_done(struct tevent_req *subreq);
2128
2129 static struct tevent_req *smb_time_audit_offload_write_send(struct vfs_handle_struct *handle,
2130                                                          TALLOC_CTX *mem_ctx,
2131                                                          struct tevent_context *ev,
2132                                                          uint32_t fsctl,
2133                                                          DATA_BLOB *token,
2134                                                          off_t transfer_offset,
2135                                                          struct files_struct *dest_fsp,
2136                                                          off_t dest_off,
2137                                                          off_t num)
2138 {
2139         struct tevent_req *req;
2140         struct tevent_req *subreq;
2141         struct time_audit_offload_write_state *state;
2142
2143         req = tevent_req_create(mem_ctx, &state,
2144                                 struct time_audit_offload_write_state);
2145         if (req == NULL) {
2146                 return NULL;
2147         }
2148
2149         state->handle = handle;
2150         clock_gettime_mono(&state->ts_send);
2151         subreq = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, state, ev,
2152                                               fsctl, token, transfer_offset,
2153                                               dest_fsp, dest_off, num);
2154         if (tevent_req_nomem(subreq, req)) {
2155                 return tevent_req_post(req, ev);
2156         }
2157
2158         tevent_req_set_callback(subreq, smb_time_audit_offload_write_done, req);
2159         return req;
2160 }
2161
2162 static void smb_time_audit_offload_write_done(struct tevent_req *subreq)
2163 {
2164         struct tevent_req *req = tevent_req_callback_data(
2165                 subreq, struct tevent_req);
2166         struct time_audit_offload_write_state *state = tevent_req_data(
2167                 req, struct time_audit_offload_write_state);
2168         NTSTATUS status;
2169
2170         status = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(state->handle,
2171                                               subreq,
2172                                               &state->copied);
2173         TALLOC_FREE(subreq);
2174         if (tevent_req_nterror(req, status)) {
2175                 return;
2176         }
2177         tevent_req_done(req);
2178 }
2179
2180 static NTSTATUS smb_time_audit_offload_write_recv(struct vfs_handle_struct *handle,
2181                                                struct tevent_req *req,
2182                                                off_t *copied)
2183 {
2184         struct time_audit_offload_write_state *state = tevent_req_data(
2185                 req, struct time_audit_offload_write_state);
2186         struct timespec ts_recv;
2187         double timediff;
2188         NTSTATUS status;
2189
2190         clock_gettime_mono(&ts_recv);
2191         timediff = nsec_time_diff(&ts_recv, &state->ts_send)*1.0e-9;
2192         if (timediff > audit_timeout) {
2193                 smb_time_audit_log("offload_write", timediff);
2194         }
2195
2196         *copied = state->copied;
2197         if (tevent_req_is_nterror(req, &status)) {
2198                 tevent_req_received(req);
2199                 return status;
2200         }
2201
2202         tevent_req_received(req);
2203         return NT_STATUS_OK;
2204 }
2205
2206 static NTSTATUS smb_time_audit_fget_compression(vfs_handle_struct *handle,
2207                                                TALLOC_CTX *mem_ctx,
2208                                                struct files_struct *fsp,
2209                                                uint16_t *_compression_fmt)
2210 {
2211         NTSTATUS result;
2212         struct timespec ts1,ts2;
2213         double timediff;
2214
2215         clock_gettime_mono(&ts1);
2216         result = SMB_VFS_NEXT_FGET_COMPRESSION(handle, mem_ctx, fsp,
2217                                               _compression_fmt);
2218         clock_gettime_mono(&ts2);
2219         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2220
2221         if (timediff > audit_timeout) {
2222                 smb_time_audit_log_fsp("get_compression",
2223                                        timediff, fsp);
2224         }
2225
2226         return result;
2227 }
2228
2229 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
2230                                                TALLOC_CTX *mem_ctx,
2231                                                struct files_struct *fsp,
2232                                                uint16_t compression_fmt)
2233 {
2234         NTSTATUS result;
2235         struct timespec ts1,ts2;
2236         double timediff;
2237
2238         clock_gettime_mono(&ts1);
2239         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2240                                               compression_fmt);
2241         clock_gettime_mono(&ts2);
2242         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2243
2244         if (timediff > audit_timeout) {
2245                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
2246         }
2247
2248         return result;
2249 }
2250
2251 static NTSTATUS smb_time_audit_freaddir_attr(struct vfs_handle_struct *handle,
2252                                         struct files_struct *fsp,
2253                                         TALLOC_CTX *mem_ctx,
2254                                         struct readdir_attr_data **pattr_data)
2255 {
2256         NTSTATUS status;
2257         struct timespec ts1, ts2;
2258         double timediff;
2259
2260         clock_gettime_mono(&ts1);
2261         status = SMB_VFS_NEXT_FREADDIR_ATTR(handle, fsp, mem_ctx, pattr_data);
2262         clock_gettime_mono(&ts2);
2263         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
2264
2265         if (timediff > audit_timeout) {
2266                 smb_time_audit_log_fsp("freaddir_attr", timediff, fsp);
2267         }
2268
2269         return status;
2270 }
2271
2272 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
2273                                            files_struct *fsp,
2274                                            uint32_t security_info,
2275                                            TALLOC_CTX *mem_ctx,
2276                                            struct security_descriptor **ppdesc)
2277 {
2278         NTSTATUS result;
2279         struct timespec ts1,ts2;
2280         double timediff;
2281
2282         clock_gettime_mono(&ts1);
2283         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2284                                           mem_ctx, ppdesc);
2285         clock_gettime_mono(&ts2);
2286         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2287
2288         if (timediff > audit_timeout) {
2289                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
2290         }
2291
2292         return result;
2293 }
2294
2295 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
2296                                            files_struct *fsp,
2297                                            uint32_t security_info_sent,
2298                                            const struct security_descriptor *psd)
2299 {
2300         NTSTATUS result;
2301         struct timespec ts1,ts2;
2302         double timediff;
2303
2304         clock_gettime_mono(&ts1);
2305         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
2306                                           psd);
2307         clock_gettime_mono(&ts2);
2308         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2309
2310         if (timediff > audit_timeout) {
2311                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
2312         }
2313
2314         return result;
2315 }
2316
2317 static NTSTATUS smb_time_audit_audit_file(struct vfs_handle_struct *handle,
2318                                 struct smb_filename *smb_fname,
2319                                 struct security_acl *sacl,
2320                                 uint32_t access_requested,
2321                                 uint32_t access_denied)
2322 {
2323         NTSTATUS result;
2324         struct timespec ts1,ts2;
2325         double timediff;
2326
2327         clock_gettime_mono(&ts1);
2328         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2329                                         smb_fname,
2330                                         sacl,
2331                                         access_requested,
2332                                         access_denied);
2333         clock_gettime_mono(&ts2);
2334         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2335
2336         if (timediff > audit_timeout) {
2337                 smb_time_audit_log_fname("audit_file",
2338                         timediff,
2339                         smb_fname->base_name);
2340         }
2341
2342         return result;
2343 }
2344
2345 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2346                                                files_struct *fsp,
2347                                                SMB_ACL_TYPE_T type,
2348                                                TALLOC_CTX *mem_ctx)
2349 {
2350         SMB_ACL_T result;
2351         struct timespec ts1,ts2;
2352         double timediff;
2353
2354         clock_gettime_mono(&ts1);
2355         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, type, mem_ctx);
2356         clock_gettime_mono(&ts2);
2357         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2358
2359         if (timediff > audit_timeout) {
2360                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2361         }
2362
2363         return result;
2364 }
2365
2366 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2367                                               files_struct *fsp,
2368                                               TALLOC_CTX *mem_ctx,
2369                                               char **blob_description,
2370                                               DATA_BLOB *blob)
2371 {
2372         int result;
2373         struct timespec ts1,ts2;
2374         double timediff;
2375
2376         clock_gettime_mono(&ts1);
2377         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2378         clock_gettime_mono(&ts2);
2379         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2380
2381         if (timediff > audit_timeout) {
2382                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2383         }
2384
2385         return result;
2386 }
2387
2388 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2389                                          files_struct *fsp,
2390                                          SMB_ACL_TYPE_T type,
2391                                          SMB_ACL_T theacl)
2392 {
2393         int result;
2394         struct timespec ts1,ts2;
2395         double timediff;
2396
2397         clock_gettime_mono(&ts1);
2398         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, type, theacl);
2399         clock_gettime_mono(&ts2);
2400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2401
2402         if (timediff > audit_timeout) {
2403                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2404         }
2405
2406         return result;
2407 }
2408
2409 static int smb_time_audit_sys_acl_delete_def_fd(vfs_handle_struct *handle,
2410                                 files_struct *fsp)
2411 {
2412         int result;
2413         struct timespec ts1,ts2;
2414         double timediff;
2415
2416         clock_gettime_mono(&ts1);
2417         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FD(handle, fsp);
2418         clock_gettime_mono(&ts2);
2419         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2420
2421         if (timediff > audit_timeout) {
2422                 smb_time_audit_log_fsp("sys_acl_delete_def_fd", timediff, fsp);
2423         }
2424
2425         return result;
2426 }
2427
2428 struct smb_time_audit_getxattrat_state {
2429         struct vfs_aio_state aio_state;
2430         files_struct *dir_fsp;
2431         const struct smb_filename *smb_fname;
2432         const char *xattr_name;
2433         ssize_t xattr_size;
2434         uint8_t *xattr_value;
2435 };
2436
2437 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq);
2438
2439 static struct tevent_req *smb_time_audit_getxattrat_send(
2440                         TALLOC_CTX *mem_ctx,
2441                         struct tevent_context *ev,
2442                         struct vfs_handle_struct *handle,
2443                         files_struct *dir_fsp,
2444                         const struct smb_filename *smb_fname,
2445                         const char *xattr_name,
2446                         size_t alloc_hint)
2447 {
2448         struct tevent_req *req = NULL;
2449         struct tevent_req *subreq = NULL;
2450         struct smb_time_audit_getxattrat_state *state = NULL;
2451
2452         req = tevent_req_create(mem_ctx, &state,
2453                                 struct smb_time_audit_getxattrat_state);
2454         if (req == NULL) {
2455                 return NULL;
2456         }
2457         *state = (struct smb_time_audit_getxattrat_state) {
2458                 .dir_fsp = dir_fsp,
2459                 .smb_fname = smb_fname,
2460                 .xattr_name = xattr_name,
2461         };
2462
2463         subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2464                                               ev,
2465                                               handle,
2466                                               dir_fsp,
2467                                               smb_fname,
2468                                               xattr_name,
2469                                               alloc_hint);
2470         if (tevent_req_nomem(subreq, req)) {
2471                 return tevent_req_post(req, ev);
2472         }
2473         tevent_req_set_callback(subreq, smb_time_audit_getxattrat_done, req);
2474
2475         return req;
2476 }
2477
2478 static void smb_time_audit_getxattrat_done(struct tevent_req *subreq)
2479 {
2480         struct tevent_req *req = tevent_req_callback_data(
2481                 subreq, struct tevent_req);
2482         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2483                 req, struct smb_time_audit_getxattrat_state);
2484
2485         state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2486                                                          &state->aio_state,
2487                                                          state,
2488                                                          &state->xattr_value);
2489         TALLOC_FREE(subreq);
2490         if (state->xattr_size == -1) {
2491                 tevent_req_error(req, state->aio_state.error);
2492                 return;
2493         }
2494
2495         tevent_req_done(req);
2496 }
2497
2498 static ssize_t smb_time_audit_getxattrat_recv(struct tevent_req *req,
2499                                               struct vfs_aio_state *aio_state,
2500                                               TALLOC_CTX *mem_ctx,
2501                                               uint8_t **xattr_value)
2502 {
2503         struct smb_time_audit_getxattrat_state *state = tevent_req_data(
2504                 req, struct smb_time_audit_getxattrat_state);
2505         ssize_t xattr_size;
2506         double timediff;
2507
2508         timediff = state->aio_state.duration * 1.0e-9;
2509
2510         if (timediff > audit_timeout) {
2511                 smb_time_audit_log_at("async getxattrat",
2512                                       timediff,
2513                                       state->dir_fsp,
2514                                       state->smb_fname);
2515         }
2516
2517         if (tevent_req_is_unix_error(req, &aio_state->error)) {
2518                 tevent_req_received(req);
2519                 return -1;
2520         }
2521
2522         *aio_state = state->aio_state;
2523         xattr_size = state->xattr_size;
2524         if (xattr_value != NULL) {
2525                 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2526         }
2527
2528         tevent_req_received(req);
2529         return xattr_size;
2530 }
2531
2532 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2533                                         struct files_struct *fsp,
2534                                         const char *name, void *value,
2535                                         size_t size)
2536 {
2537         ssize_t result;
2538         struct timespec ts1,ts2;
2539         double timediff;
2540
2541         clock_gettime_mono(&ts1);
2542         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2543         clock_gettime_mono(&ts2);
2544         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2545
2546         if (timediff > audit_timeout) {
2547                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2548         }
2549
2550         return result;
2551 }
2552
2553 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2554                                          struct files_struct *fsp, char *list,
2555                                          size_t size)
2556 {
2557         ssize_t result;
2558         struct timespec ts1,ts2;
2559         double timediff;
2560
2561         clock_gettime_mono(&ts1);
2562         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2563         clock_gettime_mono(&ts2);
2564         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2565
2566         if (timediff > audit_timeout) {
2567                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2568         }
2569
2570         return result;
2571 }
2572
2573 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2574                                        struct files_struct *fsp,
2575                                        const char *name)
2576 {
2577         int result;
2578         struct timespec ts1,ts2;
2579         double timediff;
2580
2581         clock_gettime_mono(&ts1);
2582         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2583         clock_gettime_mono(&ts2);
2584         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2585
2586         if (timediff > audit_timeout) {
2587                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2588         }
2589
2590         return result;
2591 }
2592
2593 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2594                                     struct files_struct *fsp, const char *name,
2595                                     const void *value, size_t size, int flags)
2596 {
2597         int result;
2598         struct timespec ts1,ts2;
2599         double timediff;
2600
2601         clock_gettime_mono(&ts1);
2602         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2603         clock_gettime_mono(&ts2);
2604         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2605
2606         if (timediff > audit_timeout) {
2607                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2608         }
2609
2610         return result;
2611 }
2612
2613 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2614                                      struct files_struct *fsp)
2615 {
2616         bool result;
2617         struct timespec ts1,ts2;
2618         double timediff;
2619
2620         clock_gettime_mono(&ts1);
2621         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2622         clock_gettime_mono(&ts2);
2623         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2624
2625         if (timediff > audit_timeout) {
2626                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2627         }
2628
2629         return result;
2630 }
2631
2632 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2633                                               struct files_struct *fsp,
2634                                               TALLOC_CTX *mem_ctx,
2635                                               DATA_BLOB *cookie)
2636 {
2637         NTSTATUS result;
2638         struct timespec ts1,ts2;
2639         double timediff;
2640
2641         clock_gettime_mono(&ts1);
2642         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2643         clock_gettime_mono(&ts2);
2644         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2645
2646         if (timediff > audit_timeout) {
2647                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2648         }
2649
2650         return result;
2651 }
2652
2653 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2654                                                   struct files_struct *fsp,
2655                                                   const DATA_BLOB old_cookie,
2656                                                   TALLOC_CTX *mem_ctx,
2657                                                   DATA_BLOB *new_cookie)
2658 {
2659         NTSTATUS result;
2660         struct timespec ts1,ts2;
2661         double timediff;
2662
2663         clock_gettime_mono(&ts1);
2664         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2665                                                  mem_ctx, new_cookie);
2666         clock_gettime_mono(&ts2);
2667         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2668
2669         if (timediff > audit_timeout) {
2670                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2671         }
2672
2673         return result;
2674 }
2675
2676 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2677                                                  struct smb_request *smb1req,
2678                                                  struct smbXsrv_open *op,
2679                                                  const DATA_BLOB old_cookie,
2680                                                  TALLOC_CTX *mem_ctx,
2681                                                  struct files_struct **fsp,
2682                                                  DATA_BLOB *new_cookie)
2683 {
2684         NTSTATUS result;
2685         struct timespec ts1,ts2;
2686         double timediff;
2687
2688         clock_gettime_mono(&ts1);
2689         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2690                                                 mem_ctx, fsp, new_cookie);
2691         clock_gettime_mono(&ts2);
2692         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2693
2694         if (timediff > audit_timeout) {
2695                 smb_time_audit_log("durable_reconnect", timediff);
2696         }
2697
2698         return result;
2699 }
2700
2701 /* VFS operations */
2702
2703 static struct vfs_fn_pointers vfs_time_audit_fns = {
2704         .connect_fn = smb_time_audit_connect,
2705         .disconnect_fn = smb_time_audit_disconnect,
2706         .disk_free_fn = smb_time_audit_disk_free,
2707         .get_quota_fn = smb_time_audit_get_quota,
2708         .set_quota_fn = smb_time_audit_set_quota,
2709         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2710         .statvfs_fn = smb_time_audit_statvfs,
2711         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2712         .get_dfs_referrals_fn = smb_time_audit_get_dfs_referrals,
2713         .create_dfs_pathat_fn = smb_time_audit_create_dfs_pathat,
2714         .read_dfs_pathat_fn = smb_time_audit_read_dfs_pathat,
2715         .fdopendir_fn = smb_time_audit_fdopendir,
2716         .readdir_fn = smb_time_audit_readdir,
2717         .rewind_dir_fn = smb_time_audit_rewinddir,
2718         .mkdirat_fn = smb_time_audit_mkdirat,
2719         .closedir_fn = smb_time_audit_closedir,
2720         .openat_fn = smb_time_audit_openat,
2721         .create_file_fn = smb_time_audit_create_file,
2722         .close_fn = smb_time_audit_close,
2723         .pread_fn = smb_time_audit_pread,
2724         .pread_send_fn = smb_time_audit_pread_send,
2725         .pread_recv_fn = smb_time_audit_pread_recv,
2726         .pwrite_fn = smb_time_audit_pwrite,
2727         .pwrite_send_fn = smb_time_audit_pwrite_send,
2728         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2729         .lseek_fn = smb_time_audit_lseek,
2730         .sendfile_fn = smb_time_audit_sendfile,
2731         .recvfile_fn = smb_time_audit_recvfile,
2732         .renameat_fn = smb_time_audit_renameat,
2733         .fsync_send_fn = smb_time_audit_fsync_send,
2734         .fsync_recv_fn = smb_time_audit_fsync_recv,
2735         .stat_fn = smb_time_audit_stat,
2736         .fstat_fn = smb_time_audit_fstat,
2737         .lstat_fn = smb_time_audit_lstat,
2738         .fstatat_fn = smb_time_audit_fstatat,
2739         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2740         .unlinkat_fn = smb_time_audit_unlinkat,
2741         .fchmod_fn = smb_time_audit_fchmod,
2742         .fchown_fn = smb_time_audit_fchown,
2743         .lchown_fn = smb_time_audit_lchown,
2744         .chdir_fn = smb_time_audit_chdir,
2745         .getwd_fn = smb_time_audit_getwd,
2746         .fntimes_fn = smb_time_audit_fntimes,
2747         .ftruncate_fn = smb_time_audit_ftruncate,
2748         .fallocate_fn = smb_time_audit_fallocate,
2749         .lock_fn = smb_time_audit_lock,
2750         .filesystem_sharemode_fn = smb_time_audit_filesystem_sharemode,
2751         .fcntl_fn = smb_time_audit_fcntl,
2752         .linux_setlease_fn = smb_time_audit_linux_setlease,
2753         .getlock_fn = smb_time_audit_getlock,
2754         .symlinkat_fn = smb_time_audit_symlinkat,
2755         .readlinkat_fn = smb_time_audit_readlinkat,
2756         .linkat_fn = smb_time_audit_linkat,
2757         .mknodat_fn = smb_time_audit_mknodat,
2758         .realpath_fn = smb_time_audit_realpath,
2759         .fchflags_fn = smb_time_audit_fchflags,
2760         .file_id_create_fn = smb_time_audit_file_id_create,
2761         .fs_file_id_fn = smb_time_audit_fs_file_id,
2762         .offload_read_send_fn = smb_time_audit_offload_read_send,
2763         .offload_read_recv_fn = smb_time_audit_offload_read_recv,
2764         .offload_write_send_fn = smb_time_audit_offload_write_send,
2765         .offload_write_recv_fn = smb_time_audit_offload_write_recv,
2766         .fget_compression_fn = smb_time_audit_fget_compression,
2767         .set_compression_fn = smb_time_audit_set_compression,
2768         .snap_check_path_fn = smb_time_audit_snap_check_path,
2769         .snap_create_fn = smb_time_audit_snap_create,
2770         .snap_delete_fn = smb_time_audit_snap_delete,
2771         .fstreaminfo_fn = smb_time_audit_fstreaminfo,
2772         .get_real_filename_at_fn = smb_time_audit_get_real_filename_at,
2773         .connectpath_fn = smb_time_audit_connectpath,
2774         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2775         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2776         .strict_lock_check_fn = smb_time_audit_strict_lock_check,
2777         .translate_name_fn = smb_time_audit_translate_name,
2778         .parent_pathname_fn = smb_time_audit_parent_pathname,
2779         .fsctl_fn = smb_time_audit_fsctl,
2780         .get_dos_attributes_send_fn = smb_time_audit_get_dos_attributes_send,
2781         .get_dos_attributes_recv_fn = smb_time_audit_get_dos_attributes_recv,
2782         .fget_dos_attributes_fn = smb_time_fget_dos_attributes,
2783         .fset_dos_attributes_fn = smb_time_fset_dos_attributes,
2784         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2785         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2786         .audit_file_fn = smb_time_audit_audit_file,
2787         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2788         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2789         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2790         .sys_acl_delete_def_fd_fn = smb_time_audit_sys_acl_delete_def_fd,
2791         .getxattrat_send_fn = smb_time_audit_getxattrat_send,
2792         .getxattrat_recv_fn = smb_time_audit_getxattrat_recv,
2793         .fgetxattr_fn = smb_time_audit_fgetxattr,
2794         .flistxattr_fn = smb_time_audit_flistxattr,
2795         .fremovexattr_fn = smb_time_audit_fremovexattr,
2796         .fsetxattr_fn = smb_time_audit_fsetxattr,
2797         .aio_force_fn = smb_time_audit_aio_force,
2798         .durable_cookie_fn = smb_time_audit_durable_cookie,
2799         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2800         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2801         .freaddir_attr_fn = smb_time_audit_freaddir_attr,
2802 };
2803
2804
2805 static_decl_vfs;
2806 NTSTATUS vfs_time_audit_init(TALLOC_CTX *ctx)
2807 {
2808         smb_vfs_assert_all_fns(&vfs_time_audit_fns, "time_audit");
2809
2810         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2811                                             10000) / 1000.0;
2812         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2813                                 &vfs_time_audit_fns);
2814 }