+Since 1.5.77
+ * Reimplement FetchData and StoreData operations to make
+ use of rx_Writev and rx_Readv which is faster than than
+ multiple calls to rx_Write and rx_Read. Throughput
+ improvements of up to 20% are possible.
+
+ * Many improvements to the rx rpc stack:
+
+ - RTT measurements
+
+ - Fast recovery is not triggered by packet resend timeouts
+
+ - Socket errors are now detected and reported
+
+ - avoid repetitive memory allocations
+
+ - avoid calling gettimeofday() for every packet
+
+ - reduced dependency on the call->lock
+
+ - When a call receive is completed, ack all of the packets
+ immediately. Do not wait for the first response packet
+ to be sent.
+
+ - Do not hold the call->lock during rx_Write* and rx_Read*
+ operations when the call fields in use can only be accessed
+ by the application thread.
+
+ - Reduce the default window size from 128 back to 32 because
+ the current overhead from walking packet queues in the rx
+ listener thread significantly hampers the ability to
+ process incoming packets from the network.
+
+ - Only backoff the peer timeout once for a series of naks.
+
+ - Release builds are lean and mean. All debugging and
+ packet tracking code is disabled.
+
+ * Version number is logged to the Windows Application Event
+ Log as part of the start pending message.
+
+ * MSI installers now backup and restore configuration
+ data during upgrades.
+
+ * Rx pmtu discovery has been disabled by default. Use
+ HKLM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters
+ RxPMTUDiscovery "DWORD"
+ value to re-activate.
+
+ * cm_BkgDaemon event evaluation has been optimized to avoid
+ unnecessary overhead.
+
+ * If a volume is known to be readonly, then locally fail any
+ change request without sending it to the file server. This
+ avoids triggering the file server's abort threshold.
+
+ * Do not leak cm_volume_t objects from the volume LRU queue.
+
+ * Ensure that cm_NameI errors are acted upon promptly.
+ There are many cases in the SMB server where an error from cm_NameI()
+ was either ignored or not acted upon until several other operations
+ are performed that could result in the same error being repeated.
+ This is a mistake which did not have negative side effects until
+ additional checks for callback status were added recently.
+
+ At present, if a CM_ERROR_ACCESS error is returned and ignored,
+ subsequent attempts to operate on the same cm_scache_t will result
+ in additional queries to the file server that will also end in an
+ abort response. This can trigger the file server to delay responses
+ to the client.
+
+ * Fix fs mount point and symlink create operations which were
+ failing due to improper directory separator termination.
+
+ * RXAFS_GetVolumeStatus can return VNOVOL, VMOVED, etc. In
+ order to process them and update volume state a fid must
+ be passed to cm_Analyze(). Use the volume root fid.
+
+ * Negative caching for volume lookups that fail with either
+ VL_NOENT or VL_BADNAME. The expiration time is five minutes.
+ This prevents volume lookup storms.
+
+ * Provide each volume lookup its own two hour lifetime instead
+ of reseting all volume location information every two hours.
+ This prevents the first smb path evaluation after the volume
+ location data has been discarded from potentially causing an
+ smb client timeout.
+
+Since 1.5.76
+ * When the SYSTEM account is in use, the SMB connection is
+ not always established as S-1-5-18. Sometimes it uses an
+ anonymous, S-1-5-7, connection. In both cases the SMB
+ authentication name is the nul string. To better identify
+ when an SMB connection is local system, the smb_username_t
+ is now stored as a SID instead of a user name. When a SID
+ is used, a new flag bit is set SMB_USERNAMEFLAG_SID.
+
+ In smb_SetToken if AFS_PIOCTL_AFSLOGON is set and the user
+ connection is not SYSTEM, the RPC SID is checked. If RPC
+ SID is SYSTEM, that supercedes the SMB authentication.
+
+ * Replace STATUS_IO_TIMEOUT with RPC_NT_SERVER_TOO_BUSY for
+ CM_ERROR_ALLBUSY.
+
+ * Replace STATUS_PATH_NOT_FOUND with RPC_NT_SERVER_UNAVAILABLE
+ for CM_ERROR_ALLOFFLINE and CM_ERROR_ALLBUSY.
+
+ * Optimize behavior of buf_CleanAsyncLocked(). Avoid searching
+ for the cm_scache_t object by FID if it is already known.
+
+ * If the readonly file attribute is set (stored as a unix mode)
+ then a CreateFile operation should fail if the file is opened
+ for DELETE in combination with any other privilege.
+
+ * If the directory buffer contents are garbage we can crash
+ the service. Add some simple validation checks to ensure
+ that cm_dirEntry_t objects have the correct flag value and
+ that the name strings are not too long.
+
+ * If the bulkStat errorCode indicates that a particular object
+ is inaccessible due to a VIO error, we must update the server
+ status appropriately in order to permit failover.
+
+ * An RX_MSGSIZE error is returned by the new PMTU detection
+ code. It is critical that such an error result in a retry of
+ the operation that failed. Otherwise, the PMTU detection can't
+ work and the server will be marked down.
+ Secondly, it is important that such errors not leak to the
+ application layer. Map them to CM_ERROR_RETRY in all cases.
+
+ * Translate RX_RESTARTING to the same cache manager error code
+ for all RPC classes.
+
+ * When logging server volume instance errors to the windows
+ application event log, be sure to log the cell as well.
+ Translating from server ip address is non-trivial. Make it
+ easier for administrators triaging issues to plug the volume
+ and cell info into vos commands.
+
+ * Since unix mode bits are represented in octal in most cases
+ make sure we log them that way.
+
+ * The cm_enforceTrailingDot() function failed if there was a
+ trailing dot followed by white space.
+
+ * Rx: Do not send RX_MSGSIZE if the PMTU size did not change.
+
+Since 1.5.75
+ * A crash could occur if a single letter share name was
+ dynamically evaluated as matching a cell name. This was
+ due to a failure to treat the comparison of two nul
+ strings as identical.
+
+ * Docbook validation is performed by xmllint during builds.
+
+ * Volume package bugs in the file server can result in VOFFLINE
+ being returned to the client instead of VNOVOL or VMOVED. As
+ a result the Unix CM treats VOFFLINE the same as VMOVED and VNOVOL.
+ The Windows client has not. As a result, bugs in the file server
+ can cause the Windows client to lose if the volume has in fact
+ been moved to another server.
+
+ As part of this change, the volume location list is updated prior
+ to the volume status being applied to the server from which the
+ error was received.
+
+ * If the pages to be flushed are from a readonly or backup volume
+ they can't be dirty. In this case there is no need to stabilize
+ the pages before they are locked and recycled.
+ Stablilization is performed on the cm_scache_t object so do not
+ stabilize and unstablize for each cm_buf_t object.
+
+ * Over the years the processing of the Freelance callbacks have
+ added functionality that behaves much more like FetchStatus checks
+ to a file server. If the data version of the object has changed,
+ get the new data. Given that is the case, we can remove much of
+ the original refresh logic that is rather race prone. Say goodbye
+ to cm_fakeGettingCallback and cm_fakeDirCallback.
+
+ * When processing a pioctl path with either smb_ParseIoctlPath or
+ smb_ParseIoctlParent, cm_SyncOp(CM_SCACHESYNC_NEEDCALLBACK|GETSTATUS)
+ must be called on the cm_scache_t object to ensure that it is up
+ to date before we permit cm_Lookup or other operations to be performed
+ on it. Add the cm_SyncOp() call to smb_ParseIoctlPath and
+ smb_ParseIoctlParent to ensure it is done for all pioctl operations.
+
+ * The 32-bit tools installer was displaying client configuration wizard
+ pages. Since, the 32-bit tools share configuration with the AFS
+ service, the 32-bit tools installer should not be attempting to change
+ client configuration. Remove said wizard pages from the 32-bit tools
+ installer.
+
+ * cm_data.rootSCachep is a global pointer to the cm_scache_t that
+ represents the root.afs volume root directory. Throughout the
+ code this cm_scache_t was being used without ensuring that a
+ callback to the volume is in fact valid.
+
+ Under most circumstances this would not be a problem. However,
+ it is possible for a request to fail due to the lack of a callback
+ at a critical moment. Add a new function cm_rootScachep() that
+ attempts to ensure that a callback is present (if possible) prior
+ to use the cm_scache_t object.
+
+ * When the contents of the Freelance root directory changes the fake
+ directory buffers are updated and a fakeDirVersion is incremented.
+ The dataVersion of the cm_scache_t object is supposed to be updated
+ on the next access by performing a fake get callback request.
+ Unfortunately, this did not always occur because of a race. If another
+ Freelance object is updated first, the root directory object would
+ never successfully get a fake callback.
+
+ This patchset ensures that the generation of the fake directory
+ buffer content and the callback are obtained under the same set
+ of locks thereby removing the race.
+
+ * Enforce in afsd_service that tokens can be set for alternate
+ userids only if the SetToken pioctl is called from the
+ Local System account.
+
+Since 1.5.74
+ * Revise SMB QuerySecurityInfo Response for MS10-020
+
+ MS10-020 (http://support.microsoft.com/kb/980232) has caused
+ many problems for implementors of SMB 1.0 servers and applications
+ that call GetFileSecurity() without checking the return code to
+ determine if the call succeeded. The gist of the vulnerability
+ was that the SMB redirector would pass any buffer it received
+ to the application regardless of whether or not it was valid.
+ MS10-020 protects the applications by strictly validating the
+ SMB response data structure and the data in the security descriptor
+ that is returned.
+
+ The problem for SMB 1.0 server implementors is that there have
+ been at least three different protocol descriptions for
+ NT_TRANSACT_QUERY_SECURITY_DESC published over the last decade
+ and all of them are incomplete. Therefore, just about no one but
+ Microsoft has an SMB 1.0 server implementation that produces the
+ exact out that they are expecting to validate.
+
+ The end result is that in an attempt to protect applications from
+ crashing due to invalid input being passed in directly caused
+ dozens of applications to crash by not returning any security
+ descriptor data at all. Even when the applications didn't crash
+ they might not have been able to save their data. Cisco WAAS
+ and NetApp DataOnTap systems were most adversely affected and
+ they have had CIFS protocol licenses for many many years.
+
+ To fix OpenAFS here is what needed to be done:
+
+ 1. Instead of returning a security descriptor that gives ownership
+ to the NUL SID, give it to the Everyone SID and set the flag
+ that states that everyone has full access.
+
+ 2. Validate the input parameters. In particular, check to ensure
+ that the SMB file descriptor is valid and the file has not
+ been deleted.
+
+ 3. Enforce the maximum output data and parameter counts.
+
+ 4. Handle buffer overflow and buffertoosmall conditions
+ in the manner that Microsoft expects them to be handled.
+ In particular, note that the parameter data which is returned
+ in the SMB Data Region is not counted in the Data Count.
+ Even if MaxData is 0, we can still return parameters values
+ as long as MaxParm is large enough.
+
+ * Prevent use of AFSCache file contents if mapped to
+ a new address.
+
+ * The Windows version of "fs newcell" did not accept any parameters
+ and behaved quite differently from the Unix version. Instead of
+ permitting new cell information to be added, the Windows version
+ simply forced the existing cell information to be reacquired.
+
+ This update adds a new pioctl, VIOCNEWCELL2, to support the
+ implementation of a Unix-style "fs newcell". The functionality
+ added here differs from the Unix version in the following ways:
+
+ 1. "fs newcell" with no arguments is still accepted
+ in order to maintain compatibility with prior Windows
+ behavior.
+
+ 2. "fs newcell -cell <cell> -dns" instructs the cache manager
+ to add the new cell but obtain the vldb server info from
+ DNS.
+
+ 3. "fs newcell -cell <cell> ... -registry" instructs the cache
+ manager to add the new cell and also save the cell configuration
+ data in the registry for use the next time the service restarts.
+
+ 4. The -vlport and -fsport options are accepted although the
+ -fsport value is currently unsupported by the cache manager.
+
+ * New registry value "FreelanceImportCellServDB" instructs Freelance
+ to create a mount point for every cell name listed within the
+ CellServDB.
+
+ * Path MTU discovery for Rx is activated.
+
+ * Rx socket input buffer is converted to a circular buffer.
+
+ * Fix usage of cm_FreeServerList(). Do not set the server list
+ pointer to NULL after calling cm_FreeServerList(). Doing so
+ can result in a memory leak.
+
+ * Only enable Rx NAT pings on a single anonymous connection at a
+ time.
+
+ * Fix cm_IoctlSkipQueryOptions() buffer management. Prevents a
+ potential read beyond end of memory buffer.
+
+ * Reduce requested privileges when reading registry CellServDB
+ to the minimum required.
+
+ * Add support for RPC Pipe Service NetWkstaGetInfo levels
+ 101 and 102 which are called on Windows 7 and 2008-R2.
+
+ * Prevent integer overflow during quota percent used calculation
+ in Explorer Shell Extension (RT 126846)
+
+ * Generate a meaningful error if "fs listacls" or "fs setacls"
+ are executed on the Freelance root.afs volume.
+
+ * RXAFS_InlineBulkStat errors must be processed via cm_Analyze.
+ RXAFS_InlineBulkStatus does not return errors such as EACCES,
+ VNOVOL, VNOVNODE, VOFFLINE, VBUSY, VIO, VMOVED, etc. as an RPC return
+ code. Instead they are returned in the status info errorCode field
+ for each file.
+
+ Traditionally, the error associated with the first FID in the query
+ list has been returned to the caller of cm_TryBulkStatRPC().
+ However, the error has never been processed through cm_Analyze()
+ which means that the per-vnode processing for VNOVNODE and the volume
+ global processing for VMOVED, VNOVOL, etc. has never been performed.
+ As a result, failover to other .readonly volume instances cannot occur,
+ volume moves will not be handled, and files that have been deleted
+ are not detected.
+
+ This patchset makes the following changes:
+
+ 1. If an inline bulk operation has been performed and the inline
+ errorCode is a volume global error, then that error replaces
+ the RPC return code within the cm_Analyze() processing for
+ the RPC. This will affect whether or not a retry operation
+ is performed.
+
+ 2. The variable 'inlinebulk' is reset to 0 at the top of the
+ cm_Analyze() loop in case failover from an inlinebulk capable
+ file to an inlinebulk incapable file server takes place.
+
+ 3. The FID that is passed into cm_Analyze() is not a real fid.
+ Instead it consists of the cell and volume but vnode = 0.
+ This ensures that the error (if any) is not applied to the
+ directory object.
+
+ 4. If an inline bulk operation was performed, prior to performing
+ the cm_MergeStatus() operation a vnode a check is made to
+ determine if an error was returned for that vnode. If so,
+ cm_Analyze() is called with no connection, a fake cm_req_t,
+ the fid, and the error. This permits cm_Analyze() processing
+ to be performed on the file.
+
+ * Show configuration pages for all types of MSI installations
+
+ The OpenAFS MSI installer wizard used to not show any configuration
+ pages for "Typical" and "Complete" installations. Setting the
+ workstation cell and logon options during installation required
+ selecting the "Custom" option. Many users choose the "Typical" option
+ during installation, and thus would never see the configuration pages.
+ Therefore, for these users, the workstation cell was being set to the
+ default.
+
+ This patch makes the workstation cell and logon option configuration
+ pages visible to all types of installations (except silent
+ installations which show no UI).
+
+ * cm_LookupInternal creates Freelance mount points and symlinks
+ when queries cannot be found in the Freelance root.afs directory.
+ If the search name is a full cell name for which vldb information
+ can be obtained, then a mount point is added. If the search name
+ is a left-most substring or the full cell name with a dot appended
+ to it, then a symlink was created. This approach created a very
+ poluted Freelance name space.
+
+ This patchset makes the following changes:
+
+ 1. Do not create symlinks with a dot appended to the cellname
+
+ 2. Do not create symlinks where the left-most substring is not
+ a full dot separated component of the cellname.
+
+ 3. Permit lookups to succeed when we would have created a
+ symlink in the past without creating the symlink.
+
+ * BPlus tree lookups are much faster than searching through
+ the native directory format on Windows because the case sensitive
+ hash tables cannot be used successfully. Permit BPlus trees
+ to be used except when called with cm_BPlusDirFoo as the action
+ function because cm_BPlusDirFoo is used to build the BPlus trees
+ from the native directory format.
+
+ * Symlinks are ending up in the Freelance root.afs directory that
+ end with a dot. Make sure it cannot happen.
+
+ * cm_FreelanceAddMount and cm_FreelanceAddSymlink is supposed to
+ return the allocated FID of the entry that was added. However,
+ cm_NameI is called to perform the lookup without forcing an update
+ of the Freelance fake directory. As a result the entry may not be
+ found.
+
+ Force an update prior to calling cm_NameI() by using
+ cm_clearLocalMountPointChange() and cm_reInitLocalMountPoints()
+ if required.
+
+ * The Freelance fake root directory buffers were not zero-filled.
+ This results in random behavior that can cause the service to
+ terminate unexpectedly.
+
+ * The validation check for the response from the GetVolumeStatus
+ pioctl is incorrect. The response is not simply a VolumeStatus
+ structure but also several C strings appended to it.
+
+ * When flushing a file, we need to commit the file length changes
+ as well as the dirty buffers. Call cm_FSync instead of buf_CleanVnode
+ which is called by cm_FSync.
+
+ * Prevent rx_rpc_stats global lock from being a bottleneck in the
+ Rx library.
+
Since 1.5.73
* Avoid a race when updating cell vldb server lists
git://git.openafs.org / openafs.git / blobdiff