|
1 # |
|
2 # This patch is to provide a SFTP DTrace provider which offers an administrator |
|
3 # some observability of SFTP data transfer. This was developed in-house. |
|
4 # Because this is Solaris-specific and not suitable for upstream, we will not |
|
5 # contribute the changes to the upstream community. |
|
6 # |
|
7 diff -pur old/Makefile.in new/Makefile.in |
|
8 --- old/Makefile.in |
|
9 +++ new/Makefile.in |
|
10 @@ -85,6 +85,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ |
|
11 atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o misc.o utf8.o \ |
|
12 monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \ |
|
13 msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ |
|
14 + sftp_provider.o \ |
|
15 ssh-pkcs11.o smult_curve25519_ref.o \ |
|
16 poly1305.o chacha.o cipher-chachapoly.o \ |
|
17 ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \ |
|
18 @@ -107,7 +108,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw |
|
19 monitor_mm.o monitor.o monitor_wrap.o auth-krb5.o \ |
|
20 auth2-gss.o gss-serv.o gss-serv-krb5.o \ |
|
21 loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ |
|
22 - sftp-server.o sftp-common.o \ |
|
23 + sftp-server.o sftp-common.o sftp_provider.o \ |
|
24 sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ |
|
25 sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \ |
|
26 sandbox-solaris.o |
|
27 @@ -187,8 +188,8 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) |
|
28 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o |
|
29 $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) |
|
30 |
|
31 -sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o |
|
32 - $(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) |
|
33 +sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o sftp_provider.o |
|
34 + $(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o sftp_provider.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) |
|
35 |
|
36 sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o |
|
37 $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) |
|
38 @@ -225,9 +226,18 @@ umac128.o: umac.c |
|
39 -Dumac_update=umac128_update -Dumac_final=umac128_final \ |
|
40 -Dumac_delete=umac128_delete -Dumac_ctx=umac128_ctx |
|
41 |
|
42 +# dtrace sftp |
|
43 +sftp_provider.h: $(srcdir)/sftp_provider.d |
|
44 + /usr/sbin/dtrace -xnolibs -h -s $(srcdir)/sftp_provider.d \ |
|
45 + -o $(srcdir)/sftp_provider.h |
|
46 + |
|
47 +sftp_provider.o: sftp_provider.d sftp_provider.h sftp-server.o |
|
48 + /usr/sbin/dtrace -G -32 -xnolibs -s $(srcdir)/sftp_provider.d \ |
|
49 + sftp-server.o -o sftp_provider.o |
|
50 + |
|
51 clean: regressclean |
|
52 rm -f *.o *.a $(TARGETS) logintest config.cache config.log |
|
53 - rm -f *.out core survey |
|
54 + rm -f *.out core survey sftp_provider.h |
|
55 rm -f regress/unittests/test_helper/*.a |
|
56 rm -f regress/unittests/test_helper/*.o |
|
57 rm -f regress/unittests/sshbuf/*.o |
|
58 diff -pur old/sftp-server.c new/sftp-server.c |
|
59 --- old/sftp-server.c |
|
60 +++ new/sftp-server.c |
|
61 @@ -51,6 +51,9 @@ |
|
62 |
|
63 #include "sftp.h" |
|
64 #include "sftp-common.h" |
|
65 +#ifdef DTRACE_SFTP |
|
66 +#include "sftp_provider_impl.h" |
|
67 +#endif |
|
68 |
|
69 /* Our verbosity */ |
|
70 static LogLevel log_level = SYSLOG_LEVEL_ERROR; |
|
71 @@ -737,14 +740,17 @@ process_read(u_int32_t id) |
|
72 u_int32_t len; |
|
73 int r, handle, fd, ret, status = SSH2_FX_FAILURE; |
|
74 u_int64_t off; |
|
75 + char *fpath; |
|
76 |
|
77 if ((r = get_handle(iqueue, &handle)) != 0 || |
|
78 (r = sshbuf_get_u64(iqueue, &off)) != 0 || |
|
79 (r = sshbuf_get_u32(iqueue, &len)) != 0) |
|
80 fatal("%s: buffer error: %s", __func__, ssh_err(r)); |
|
81 |
|
82 - debug("request %u: read \"%s\" (handle %d) off %llu len %d", |
|
83 - id, handle_to_name(handle), handle, (unsigned long long)off, len); |
|
84 + fpath = handle_to_name(handle); |
|
85 + |
|
86 + debug("request %u: read \"%s\" (handle %d) off %llu len %d", |
|
87 + id, fpath, handle, (unsigned long long)off, len); |
|
88 if (len > sizeof buf) { |
|
89 len = sizeof buf; |
|
90 debug2("read change len %d", len); |
|
91 @@ -755,7 +761,13 @@ process_read(u_int32_t id) |
|
92 error("process_read: seek failed"); |
|
93 status = errno_to_portable(errno); |
|
94 } else { |
|
95 +#ifdef DTRACE_SFTP |
|
96 + SFTP_TRANSFER_START_OP("read", fd, fpath, len); |
|
97 +#endif |
|
98 ret = read(fd, buf, len); |
|
99 +#ifdef DTRACE_SFTP |
|
100 + SFTP_TRANSFER_DONE_OP("read", fd, fpath, ret); |
|
101 +#endif |
|
102 if (ret < 0) { |
|
103 status = errno_to_portable(errno); |
|
104 } else if (ret == 0) { |
|
105 @@ -778,14 +790,16 @@ process_write(u_int32_t id) |
|
106 size_t len; |
|
107 int r, handle, fd, ret, status; |
|
108 u_char *data; |
|
109 + char *fpath; |
|
110 |
|
111 if ((r = get_handle(iqueue, &handle)) != 0 || |
|
112 (r = sshbuf_get_u64(iqueue, &off)) != 0 || |
|
113 (r = sshbuf_get_string(iqueue, &data, &len)) != 0) |
|
114 fatal("%s: buffer error: %s", __func__, ssh_err(r)); |
|
115 |
|
116 + fpath = handle_to_name(handle); |
|
117 debug("request %u: write \"%s\" (handle %d) off %llu len %zu", |
|
118 - id, handle_to_name(handle), handle, (unsigned long long)off, len); |
|
119 + id, fpath, handle, (unsigned long long)off, len); |
|
120 fd = handle_to_fd(handle); |
|
121 |
|
122 if (fd < 0) |
|
123 @@ -797,7 +811,14 @@ process_write(u_int32_t id) |
|
124 error("process_write: seek failed"); |
|
125 } else { |
|
126 /* XXX ATOMICIO ? */ |
|
127 +#ifdef DTRACE_SFTP |
|
128 + SFTP_TRANSFER_START_OP("write", fd, fpath, len); |
|
129 +#endif |
|
130 ret = write(fd, data, len); |
|
131 +#ifdef DTRACE_SFTP |
|
132 + SFTP_TRANSFER_DONE_OP("write", fd, fpath, ret); |
|
133 +#endif |
|
134 + |
|
135 if (ret < 0) { |
|
136 error("process_write: write failed"); |
|
137 status = errno_to_portable(errno); |