Import Upstream version 1.8.5

[hcoop/debian/openafs.git] / doc / txt / winnotes / afs-changes-since-1.2.txt

Since 1.6.0002 (1.6.0b)

 * Correct an error in mount point string construction
   when the user provides a cell alias to "fs mkmount"
   instead of the full cell name.  Every mount point
   string must end in a trailing dot.

 * Major improvements to the Explorer Shell Extension.

 * Addition of the AFS Redirector drivers and service
   interface.

Since 1.6.0001 (1.6.0a)

 * Correct an error in CheckOfflineVolumeState processing

 * Permit NPLogonNotify() to exit immediately if the
   SetToken error is KTC_NOCM.

Since 1.6.0000 (1.6.0)

 * Avoid a cm_serverLock reference count leak.

Since 1.5.9907 (1.6pre7)

 * Add Shutdown message to the windows event log

 * Check Offline Volume status according to the specified policy
   not every time the daemon thread runs.

 * if the directory object cannot be found in the tree, return
   CM_ERROR_PATHNOTFOUND instead of crashing.

 * avoid memoryt leak of cm_GetSpace() allocations

 * improve afs/kfw error message output.  Include PT and KTC
   errors.  Impacts afslogon.dll, afscreds.exe and afssrvadm.exe

 * afslogon.dll NPNotifyLogon will now kick start the
   afsd_service if it is not already in a pending start or
   started state.

 * properly construct the userrealm in the afskfw library.
   do not include the '@' in the realm.

 * fix the generation of HTML reference manual pages from
   POD.

 * No longer send release lock RPCs to a file server for
   a deleted file.  Each attempt will fail with a VNOVNODE
   abort.  Multiple aborts can result in the file server
   throttling the client.

 * cm_BkgDaemon should not perform the job of cm_SyncOp
   which already properly serializes operations on the
   a file.

 * cm_BkgDaemon should not perform queued tasks on deleted
   objects. Doing so is a waste of resources.

 * Avoid rx nat pings prior to connection attachment.

 * After directory enumeration completes move the directory
   status object to the most recently used position to avoid
   it being recycled when the directory contains more objects
   that the status cache can hold.

 * Reduce memory fragmentation caused by lock order validation
   checks.

 * When a status object is deleted, move its object to the
   least recently used position in the queue to promote
   recycling when the reference count drops to zero.

 * Fix the osi_Log macros so they safe for use in if..else
   statements by wrapping in do..while(0).  Several logged
   messages were wrong as a result and there may have been
   other logic errors caused by mismatched if and else
   statements when braces were not used in the code.

 * Apply interlocked operations to all state and queue fields
   in the cm_call, cm_volume, cm_scache, and cm_buf objects
   in order to ensure that operations are atomic.  State flag
   bits were being lost on multi-processor systems under heavy
   load.

Since 1.5.9906 (1.6pre6)
 * add support for detection of NTFS symlinks to
   \\AFS using GetFileInformationByHandleEx which is
   available on Vista, Server 2008 and beyond.

 * improve thread safety of afs_shl_ext.dll

 * MS11-043 adds response validation for SMB_COM_NEGOTIATE
   messages received by the SMB Redirector.  OpenAFS failed
   to properly specify a Challenge and DomainName in the
   response when the security mode is SMB_AUTH_NONE (or share
   with password).  This patchset corrects smb_ReceiveNegotiate()
   so that it adheres to the protocol specification.

 * smb_T2SearchDirSingle() must not fail directory search requests
   for the _._AFS_IOCTL_._ file.  Although this file does not actually
   exist, it is successfully processed by CreateFile operations.
   Therefore, an explicit search for it should return a valid answer.

 * cm_SyncOp/cm_SyncOpDone is used to synchronize the RPC processing
   to ensure that calls which are in conflict cannot occur at the
   same time but also to ensure that the ordering of operations
   is consistent.  cm_MergeStatus() was in many cases executed after
   cm_SyncOpDone() removed the synchronization barrier which in turn
   permitted status information to be applied out of order.  Side
   effects could have included data loss due to client side file
   truncation.  More commonly two StoreData RPCs would have their
   status information applied out of order forcing the cache manager
   to invalidate all of the cached data for the file.

 * cm_NewServer() can result in a call to cm_UpdateVolumeLocation()
   if a server probe is performed.   In order to avoid recursive
   calls to cm_UpdateVolumeLocation() do not probe new servers from
   within cm_UpdateVolumeLocation().

 * Numerous Rx improvements.

 * Fix out of order lock acquisition in smb_ReceiveV3LockingX()
   which occurs if the lock acquisition fails.

Since 1.5.9905 (1.6pre5)
 * aklog supports dotted Kerberos v5 principal names.

 * afskfw library always attempts afs/cell@USER-REALM

 * afskfw library must test return code from
   krb5_cc_start_seq_get() or will trigger a null
   pointer exception when using Heimdal.

 * lock protected fields must be 32-bit in order
   to avoid memory overwrite races.

Since 1.5.9904 (1.6pre4)
 * Fix caching of non-existent volumes.  The test to
   trigger an immediate CM_ERROR_NOSUCHVOLUME in
   cm_UpdateVolumeLocation() was backwards.

 * Prevent the background daemon from checking the
   status of non-existent volumes.  cm_CheckOfflineVolumes()
   should skip volume groups with the CM_VOLUMEFLAG_NOEXIST
   flag set.

 * The afskfw library should return an error immediately
   if the krb5_32.dll library cannot be loaded.  Affects
   afslogon.dll and afscreds.exe.

 * No longer depend on leashw32.dll in afskfw library.

 * NPLogonNotify must provide the user password in all
   calls to KFW_AFS_get_cred().  It cannot count on a
   credential cache being preserved between calls.  Permits
   tokens to be acquired for all cells listed in the
   TheseCells registry value for a domain.

 * Improve the trace logging from NPLogonNotify().

 * Avoid a race when writing the cm_scache_t mountPointString
   when acquiring mount point or symlink target data via
   cm_GetData().  The race could result in bogus target
   data being cached.

 * Permit the use of des-cbc-md5 and des-cbc-md4 enctypes
   as DES keys in asetkey.exe.

Since 1.5.9903 (1.6pre3)
 * Fix automatic addition of Freelance cell mount points
   broken in 1.5.9902.

 * Avoid recursive offline volume checks which could cause
   a crash due to stack exhaustion.

Since 1.5.9902 (1.6pre2)
 * rx calls issued on a busy call channel are now specially
   handled and logged.  All calls are automatically retried.

 * The vos support for multi-homed servers was incorrectly
   implemented.  The changes have been reverted.

 * Avoid wasting cm_buf_t objects and associated data buffers
   for obtaining mountpoint and symlink target strings.  Instead
   read them directly into the cm_scache_t mountPointTarget
   buffer.

 * Optimize the evaluation of mountpoint and symlink targets
   by skipping the FetchStatus and a full round-trip if
   the cache manager does not have valid status information
   for the object.

 * Fix the abstraction of cm_FreelanceAddMount() by passing
   in volume names that do not include the trailing dot.

Since 1.5.78
 [there was no 1.6pre1 for Windows]

 * vos commands now manipulate servers by UUID and can
   recognize multi-homed servers.

 * afs_config will not longer set the Tray Icon State
   in the registry if the checkbox is not present in
   the dialog. [RT 128591]

 * Heimdal's roken utility library has been added
   as \Program Files\Common\afsroken.dll

 * When probing servers to determine if they are up or down
   no longer issue an RXAFS_GetTime RPC to servers that indicated
   that they do not understand the RXAFS_GetCapabilities RPC.
   Since they responded it is known that they are up.

 * AFS Explorer Shell Extension now works from folder
   backgrounds.  Overlays for mount points and symlinks
   are present in the dll, but are not registered at present
   by the installers.

 * Do not use RankServerInterval registry value as the value for
   PerformanceTuningInterval.

 * CellServDB updated to 13 Dec 2010 release from grand.central.org

 * Add "fs chmod" command and display current mode as part
   of "fs examine" output.

 * When the data version of a mountpoint or symlink changes,
   the target string in the cm_scache_t object must be cleared.
   Otherwise, the new target will not be queried.

 * "fs checkservers" now includes vldb servers in the output
   and only lists multi-homed servers once.  A multi-homed
   server that has at least one up interface is no longer
   considered to be down.

 * When asynchronously storing dirty data buffers to the
   file server ensure that (a) the cm_scache_t object and
   the cm_buf_t object are for the same File ID so that
   locking and signalling work properly; and (b) if the
   FID no longer exists on the file server, do not panic,
   just discard the buffer.

 * When processing VNOVOL, VMOVED and VOFFLINE errors perform
   server comparisons by UUID or address and not simply by
   cm_server_t pointer.  Otherwise, server failover may not
   succeed.

 * Do not preserve status information for cm_scache_t objects
   when the issuing server is multi-homed.

 * Giving up all callbacks when shutting down or suspending
   the machine is now significantly faster due to the use
   of an rx_multi implementation.  (This functionality is
   still off by default and must be activated by a registry
   value.)

 * Race conditions were possible when updating the state
   of the cm_volume_t flags and when moving the volumes
   within the least recently used list.

 * Ensure that the lanahelper library does not perform a
   NCBRESET of each lan adapter when enumerating the
   current network bindings.  Correcting this permits OpenAFS
   to work on Windows 7 when the network adapter settings
   change.

 * Fix creation of mount points and symlinks as \\AFS\xxxx


Since 1.5.77
 * Reimplement FetchData and StoreData operations to make
   use of rx_Writev and rx_Readv which is faster than than
   multiple calls to rx_Write and rx_Read.  Throughput
   improvements of up to 20% are possible.

 * Many improvements to the rx rpc stack:

   - RTT measurements

   - Fast recovery is not triggered by packet resend timeouts

   - Socket errors are now detected and reported

   - avoid repetitive memory allocations

   - avoid calling gettimeofday() for every packet

   - reduced dependency on the call->lock

   - When a call receive is completed, ack all of the packets
     immediately.  Do not wait for the first response packet
     to be sent.

   - Do not hold the call->lock during rx_Write* and rx_Read*
     operations when the call fields in use can only be accessed
     by the application thread.

   - Reduce the default window size from 128 back to 32 because
     the current overhead from walking packet queues in the rx
     listener thread significantly hampers the ability to
     process incoming packets from the network.

   - Only backoff the peer timeout once for a series of naks.

   - Release builds are lean and mean.  All debugging and
     packet tracking code is disabled.

 * Version number is logged to the Windows Application Event
   Log as part of the start pending message.

 * MSI installers now backup and restore configuration
   data during upgrades.

 * Rx pmtu discovery has been disabled by default.  Use
     HKLM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters
       RxPMTUDiscovery "DWORD"
   value to re-activate.

 * cm_BkgDaemon event evaluation has been optimized to avoid
   unnecessary overhead.

 * If a volume is known to be readonly, then locally fail any
   change request without sending it to the file server.  This
   avoids triggering the file server's abort threshold.

 * Do not leak cm_volume_t objects from the volume LRU queue.

 * Ensure that cm_NameI errors are acted upon promptly.
   There are many cases in the SMB server where an error from cm_NameI()
   was either ignored or not acted upon until several other operations
   are performed that could result in the same error being repeated.
   This is a mistake which did not have negative side effects until
   additional checks for callback status were added recently.

   At present, if a CM_ERROR_ACCESS error is returned and ignored,
   subsequent attempts to operate on the same cm_scache_t will result
   in additional queries to the file server that will also end in an
   abort response.  This can trigger the file server to delay responses
   to the client.

 * Fix fs mount point and symlink create operations which were
   failing due to improper directory separator termination.

 * RXAFS_GetVolumeStatus can return VNOVOL, VMOVED, etc.  In
   order to process them and update volume state a fid must
   be passed to cm_Analyze().  Use the volume root fid.

 * Negative caching for volume lookups that fail with either
   VL_NOENT or VL_BADNAME.  The expiration time is five minutes.
   This prevents volume lookup storms.

 * Provide each volume lookup its own two hour lifetime instead
   of reseting all volume location information every two hours.
   This prevents the first smb path evaluation after the volume
   location data has been discarded from potentially causing an
   smb client timeout.

Since 1.5.76
 * When the SYSTEM account is in use, the SMB connection is
   not always established as S-1-5-18.  Sometimes it uses an
   anonymous, S-1-5-7, connection.  In both cases the SMB
   authentication name is the nul string.  To better identify
   when an SMB connection is local system, the smb_username_t
   is now stored as a SID instead of a user name.  When a SID
   is used, a new flag bit is set SMB_USERNAMEFLAG_SID.

   In smb_SetToken if AFS_PIOCTL_AFSLOGON is set and the user
   connection is not SYSTEM, the RPC SID is checked.  If RPC
   SID is SYSTEM, that supercedes the SMB authentication.

 * Replace STATUS_IO_TIMEOUT with RPC_NT_SERVER_TOO_BUSY for
   CM_ERROR_ALLBUSY.

 * Replace STATUS_PATH_NOT_FOUND with RPC_NT_SERVER_UNAVAILABLE
   for CM_ERROR_ALLOFFLINE and CM_ERROR_ALLBUSY.

 * Optimize behavior of buf_CleanAsyncLocked().  Avoid searching
   for the cm_scache_t object by FID if it is already known.

 * If the readonly file attribute is set (stored as a unix mode)
   then a CreateFile operation should fail if the file is opened
   for DELETE in combination with any other privilege.

 * If the directory buffer contents are garbage we can crash
   the service.  Add some simple validation checks to ensure
   that cm_dirEntry_t objects have the correct flag value and
   that the name strings are not too long.

 * If the bulkStat errorCode indicates that a particular object
   is inaccessible due to a VIO error, we must update the server
   status appropriately in order to permit failover.

 * An RX_MSGSIZE error is returned by the new PMTU detection
   code.  It is critical that such an error result in a retry of
   the operation that failed.  Otherwise, the PMTU detection can't
   work and the server will be marked down.
   Secondly, it is important that such errors not leak to the
   application layer.  Map them to CM_ERROR_RETRY in all cases.

 * Translate RX_RESTARTING to the same cache manager error code
   for all RPC classes.

 * When logging server volume instance errors to the windows
   application event log, be sure to log the cell as well.
   Translating from server ip address is non-trivial.  Make it
   easier for administrators triaging issues to plug the volume
   and cell info into vos commands.

 * Since unix mode bits are represented in octal in most cases
   make sure we log them that way.

 * The cm_enforceTrailingDot() function failed if there was a
   trailing dot followed by white space.

 * Rx: Do not send RX_MSGSIZE if the PMTU size did not change.

Since 1.5.75
 * A crash could occur if a single letter share name was
   dynamically evaluated as matching a cell name.  This was
   due to a failure to treat the comparison of two nul
   strings as identical.

 * Docbook validation is performed by xmllint during builds.

 * Volume package bugs in the file server can result in VOFFLINE
   being returned to the client instead of VNOVOL or VMOVED.  As
   a result the Unix CM treats VOFFLINE the same as VMOVED and VNOVOL.
   The Windows client has not.  As a result, bugs in the file server
   can cause the Windows client to lose if the volume has in fact
   been moved to another server.

   As part of this change, the volume location list is updated prior
   to the volume status being applied to the server from which the
   error was received.

 * If the pages to be flushed are from a readonly or backup volume
   they can't be dirty.  In this case there is no need to stabilize
   the pages before they are locked and recycled.
   Stablilization is performed on the cm_scache_t object so do not
   stabilize and unstablize for each cm_buf_t object.

 * Over the years the processing of the Freelance callbacks have
   added functionality that behaves much more like FetchStatus checks
   to a file server.  If the data version of the object has changed,
   get the new data.  Given that is the case, we can remove much of
   the original refresh logic that is rather race prone.   Say goodbye
   to cm_fakeGettingCallback and cm_fakeDirCallback.

 * When processing a pioctl path with either smb_ParseIoctlPath or
   smb_ParseIoctlParent, cm_SyncOp(CM_SCACHESYNC_NEEDCALLBACK|GETSTATUS)
   must be called on the cm_scache_t object to ensure that it is up
   to date before we permit cm_Lookup or other operations to be performed
   on it.  Add the cm_SyncOp() call to smb_ParseIoctlPath and
   smb_ParseIoctlParent to ensure it is done for all pioctl operations.

 * The 32-bit tools installer was displaying client configuration wizard
   pages.  Since, the 32-bit tools share configuration with the AFS
   service, the 32-bit tools installer should not be attempting to change
   client configuration.  Remove said wizard pages from the 32-bit tools
   installer.

 * cm_data.rootSCachep is a global pointer to the cm_scache_t that
   represents the root.afs volume root directory.  Throughout the
   code this cm_scache_t was being used without ensuring that a
   callback to the volume is in fact valid.

   Under most circumstances this would not be a problem.  However,
   it is possible for a request to fail due to the lack of a callback
   at a critical moment.  Add a new function cm_rootScachep() that
   attempts to ensure that a callback is present (if possible) prior
   to use the cm_scache_t object.

 * When the contents of the Freelance root directory changes the fake
   directory buffers are updated and a fakeDirVersion is incremented.
   The dataVersion of the cm_scache_t object is supposed to be updated
   on the next access by performing a fake get callback request.
   Unfortunately, this did not always occur because of a race.  If another
   Freelance object is updated first, the root directory object would
   never successfully get a fake callback.

   This patchset ensures that the generation of the fake directory
   buffer content and the callback are obtained under the same set
   of locks thereby removing the race.

 * Enforce in afsd_service that tokens can be set for alternate
   userids only if the SetToken pioctl is called from the
   Local System account.

Since 1.5.74
 * Revise SMB QuerySecurityInfo Response for MS10-020

   MS10-020 (http://support.microsoft.com/kb/980232) has caused
   many problems for implementors of SMB 1.0 servers and applications
   that call GetFileSecurity() without checking the return code to
   determine if the call succeeded.  The gist of the vulnerability
   was that the SMB redirector would pass any buffer it received
   to the application regardless of whether or not it was valid.
   MS10-020 protects the applications by strictly validating the
   SMB response data structure and the data in the security descriptor
   that is returned.

   The problem for SMB 1.0 server implementors is that there have
   been at least three different protocol descriptions for
   NT_TRANSACT_QUERY_SECURITY_DESC published over the last decade
   and all of them are incomplete.  Therefore, just about no one but
   Microsoft has an SMB 1.0 server implementation that produces the
   exact out that they are expecting to validate.

   The end result is that in an attempt to protect applications from
   crashing due to invalid input being passed in directly caused
   dozens of applications to crash by not returning any security
   descriptor data at all.  Even when the applications didn't crash
   they might not have been able to save their data.  Cisco WAAS
   and NetApp DataOnTap systems were most adversely affected and
   they have had CIFS protocol licenses for many many years.

   To fix OpenAFS here is what needed to be done:

   1. Instead of returning a security descriptor that gives ownership
      to the NUL SID, give it to the Everyone SID and set the flag
      that states that everyone has full access.

   2. Validate the input parameters.  In particular, check to ensure
      that the SMB file descriptor is valid and the file has not
      been deleted.

   3. Enforce the maximum output data and parameter counts.

   4. Handle buffer overflow and buffertoosmall conditions
      in the manner that Microsoft expects them to be handled.
      In particular, note that the parameter data which is returned
      in the SMB Data Region is not counted in the Data Count.
      Even if MaxData is 0, we can still return parameters values
      as long as MaxParm is large enough.

 * Prevent use of AFSCache file contents if mapped to
   a new address.

 * The Windows version of "fs newcell" did not accept any parameters
   and behaved quite differently from the Unix version.  Instead of
   permitting new cell information to be added, the Windows version
   simply forced the existing cell information to be reacquired.

   This update adds a new pioctl, VIOCNEWCELL2, to support the
   implementation of a Unix-style "fs newcell".  The functionality
   added here differs from the Unix version in the following ways:

     1. "fs newcell" with no arguments is still accepted
        in order to maintain compatibility with prior Windows
        behavior.

     2. "fs newcell -cell <cell> -dns" instructs the cache manager
        to add the new cell but obtain the vldb server info from
        DNS.

     3. "fs newcell -cell <cell> ... -registry" instructs the cache
        manager to add the new cell and also save the cell configuration
        data in the registry for use the next time the service restarts.

     4. The -vlport and -fsport options are accepted although the
        -fsport value is currently unsupported by the cache manager.

 * New registry value "FreelanceImportCellServDB" instructs Freelance
   to create a mount point for every cell name listed within the
   CellServDB.

 * Path MTU discovery for Rx is activated.

 * Rx socket input buffer is converted to a circular buffer.

 * Fix usage of cm_FreeServerList().  Do not set the server list
   pointer to NULL after calling cm_FreeServerList().  Doing so
   can result in a memory leak.

 * Only enable Rx NAT pings on a single anonymous connection at a
   time.

 * Fix cm_IoctlSkipQueryOptions() buffer management.  Prevents a
   potential read beyond end of memory buffer.

 * Reduce requested privileges when reading registry CellServDB
   to the minimum required.

 * Add support for RPC Pipe Service NetWkstaGetInfo levels
   101 and 102 which are called on Windows 7 and 2008-R2.

 * Prevent integer overflow during quota percent used calculation
   in Explorer Shell Extension  (RT 126846)

 * Generate a meaningful error if "fs listacls" or "fs setacls"
   are executed on the Freelance root.afs volume.

 * RXAFS_InlineBulkStat errors must be processed via cm_Analyze.
   RXAFS_InlineBulkStatus does not return errors such as EACCES,
   VNOVOL, VNOVNODE, VOFFLINE, VBUSY, VIO, VMOVED, etc. as an RPC return
   code.  Instead they are returned in the status info errorCode field
   for each file.

   Traditionally, the error associated with the first FID in the query
   list has been returned to the caller of cm_TryBulkStatRPC().
   However, the error has never been processed through cm_Analyze()
   which means that the per-vnode processing for VNOVNODE and the volume
   global processing for VMOVED, VNOVOL, etc. has never been performed.
   As a result, failover to other .readonly volume instances cannot occur,
   volume moves will not be handled, and files that have been deleted
   are not detected.

   This patchset makes the following changes:

   1. If an inline bulk operation has been performed and the inline
      errorCode is a volume global error, then that error replaces
      the RPC return code within the cm_Analyze() processing for
      the RPC.  This will affect whether or not a retry operation
      is performed.

   2. The variable 'inlinebulk' is reset to 0 at the top of the
      cm_Analyze() loop in case failover from an inlinebulk capable
      file to an inlinebulk incapable file server takes place.

   3. The FID that is passed into cm_Analyze() is not a real fid.
      Instead it consists of the cell and volume but vnode = 0.
      This ensures that the error (if any) is not applied to the
      directory object.

   4. If an inline bulk operation was performed, prior to performing
      the cm_MergeStatus() operation a vnode a check is made to
      determine if an error was returned for that vnode.  If so,
      cm_Analyze() is called with no connection, a fake cm_req_t,
      the fid, and the error.  This permits cm_Analyze() processing
      to be performed on the file.  

 * Show configuration pages for all types of MSI installations

   The OpenAFS MSI installer wizard used to not show any configuration
   pages for "Typical" and "Complete" installations.  Setting the
   workstation cell and logon options during installation required
   selecting the "Custom" option.  Many users choose the "Typical" option
   during installation, and thus would never see the configuration pages.
   Therefore, for these users, the workstation cell was being set to the
   default.

   This patch makes the workstation cell and logon option configuration
   pages visible to all types of installations (except silent
   installations which show no UI).

 * cm_LookupInternal creates Freelance mount points and symlinks
   when queries cannot be found in the Freelance root.afs directory.
   If the search name is a full cell name for which vldb information
   can be obtained, then a mount point is added.  If the search name
   is a left-most substring or the full cell name with a dot appended
   to it, then a symlink was created.  This approach created a very
   poluted Freelance name space.

   This patchset makes the following changes:

    1. Do not create symlinks with a dot appended to the cellname

    2. Do not create symlinks where the left-most substring is not
       a full dot separated component of the cellname.

    3. Permit lookups to succeed when we would have created a
       symlink in the past without creating the symlink.

 * BPlus tree lookups are much faster than searching through
   the native directory format on Windows because the case sensitive
   hash tables cannot be used successfully.  Permit BPlus trees
   to be used except when called with cm_BPlusDirFoo as the action
   function because cm_BPlusDirFoo is used to build the BPlus trees
   from the native directory format.

 * Symlinks are ending up in the Freelance root.afs directory that
   end with a dot.  Make sure it cannot happen.

 * cm_FreelanceAddMount and cm_FreelanceAddSymlink is supposed to
   return the allocated FID of the entry that was added.  However,
   cm_NameI is called to perform the lookup without forcing an update
   of the Freelance fake directory.  As a result the entry may not be
   found.

   Force an update prior to calling cm_NameI() by using
   cm_clearLocalMountPointChange() and cm_reInitLocalMountPoints()
   if required.

 * The Freelance fake root directory buffers were not zero-filled.
   This results in random behavior that can cause the service to
   terminate unexpectedly.

 * The validation check for the response from the GetVolumeStatus
   pioctl is incorrect.  The response is not simply a VolumeStatus
   structure but also several C strings appended to it.

 * When flushing a file, we need to commit the file length changes
   as well as the dirty buffers.  Call cm_FSync instead of buf_CleanVnode
   which is called by cm_FSync.

 * Prevent rx_rpc_stats global lock from being a bottleneck in the
   Rx library.

Since 1.5.73

 * Avoid a race when updating cell vldb server lists
   that can result in a crash.

 * Avoid a deadlock when managing CM_SCACHESYNC_STOREDATA
   state operations for directory objects.

 * Add new Windows Application Event log messages for
   VBUSY, VRESTARTING, ALL_BUSY, ALL_OFFLINE, and ALL_DOWN.
   Include message throttling to prevent the same message
   from being logged repeatedly within a five second window.

 * Reduce lock contention by waiting for cm_buf_t I/O
   operations to complete before permitting cm_SetupStoreBIOD
   to analyze a buffer for inclusion in a BIOD.

 * Split the cm_buf_t flags field to separate the flags
   that are protected by the cm_buf_t mutex from those
   protected by the buf_globalLock.  This eliminates the need
   to hold both locks everytime the flags field is accessed.
   Both locks were not held in the past resulting in race
   conditions that could result in deadlocks.

 * Add "vos setaddrs" command.

 * Rx library lock contention avoidance between rx_NewCall and
   rx_EndCall.

 * Rx library races due to inconsistent use of rx_connection
   conn_data_lock to protect the flags field.

 * Rx library inconsistent use of RX_CALL_TQ_WAIT which could
   result in deadlocks.

 * Rx library must signal transmit queue waiters when flushing.
   Otherwise, deadlocks can occur.

 * In cm_UpdateVolumeLocation, avoid searching for a ".readonly"
   volume on a numeric volume name.

 * File buffer allocations whose offsets are beyond server EOF
   should be locally allocated and zero filled.  The file server
   should not be issued a FetchData rpc which is guaranteed to
   fail.

 * Enable integrated logon to work with Windows 7/2008 when
   user logons are performed with a non-Domain Kerberos principal.

 * Add Protection Error messages to aklog output.

Since 1.5.72

 * Prevent the Explorer Shell extension from crashing if
   symlink creation failed.  (126406)

 * A Rx level NAT ping has been implemented.
   Add NatPingInterval registry value to
     HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters
   to permit Nat Ping to be enabled.  The default value is 0 seconds.

 * When a re-initialization is taking place, be sure to reset
   cm_noLocalMountPoints to 0 in case someone deletes the "Freelance"
   registry key out from underneath the service.

 * Add krb5 error message translation to aklog, afscreds,
   afslogon.dll, the network identity manager afs provider
   and translate_et.

 * Mode bits aren't directly exposed by the Win32 API. We were leaving
   them to default to 0777 when creating new files and directories.
   This version introduces two configuration parameters;
   'UnixModeFileDefault' and 'UnixModeDirDefault' which are DWORD
   registry entries that are used to set the initial mode bits.
   If the values are set to 0, then the behavior is identical to what we
   had before.

 * Minidump files are now produced with a timestamp appended
   to the name.

 * An SMB request debugging monitor has been added.  When activated
   the monitor will automatically turn on trace logging if any SMB
   request has required longer than 60 seconds to complete and will
   then create a minidump every 60 seconds thereafter until the
   request completes.

Since 1.5.71

 * Restore use of DNS AFSDB and SRV records by kaserver clients.

Since 1.5.70

 * Avoid a potential Freelance deadlock during initial execution 
   of afsd_service.exe if the old ini file data has to be
   imported.

 * Three rx library corrections.  (1) Idle data connection
   processing could timeout if the send window filled and
   took longer than the idle data timeout period for the
   transmit window to re-open.  (2) The transmit queue
   could be emptied prematurely.  A required check for the
   queue being in use was forgotten.  (3) The function that
   is supposed to implement a wait for the transmit queue
   to cease being busy failed to wait.

Since 1.5.69
 * Restore use of DNS AFSDB and SRV records which were
   unintentionally disabled in 1.5.69

Since 1.5.68
 * Add a context menu to the NetIdMgr AFS Provider 
   notification icon.

 * Prevent an empty directory Btree from being created and
   marked as valid if cm_BPlusDirBuildTree fails.

 * cm_BPlusEnumAlloc should not fail if the enumeration
   contains zero entries.

 * In cm_BPlusXXX functions, return ENOMEM if malloc() fails.

 * Do not leak the cm_scache_t dirlock if cm_BPlusDirBuildTree
   fails.

 * fs examine should report owner and group ids as signed values.

 * Protect buffers in smb_WriteData from simultaneous writes.

 * Query network interface MTU values from the registry because
   the IP Helper GetAdapterAddresses() fails to report a manually
   configured MTU.

 * Improve performance by not dropping and reacquiring the rx_call
   lock in rx_WriteProc* and rx_ReadProc*.

 * When configuring the rx library, the network interface MTU
   must be applied to both the maximum send size as well as the
   maximum receive size as is done when rx_SetMaxMTU is called
   by the application.

There was no 1.5.67 release

Since 1.5.66
 * Convert afsauthent.dll to use the xdr_alloc and xdr_free
   routines from afsrpc.dll in place of malloc and free.
   This permits the two libraries to be built with different
   C runtime libraries without crashing.

 * Set the DOS Readonly attribute on a file/directory 
   whenever the unix mode combined with the mask 0200 
   is true.  Previously there was a discrepency between
   the mask used for testing for readonly behavior and
   that used for setting the attribute.

 * Disable AFSVolSync based .readonly "whole-volume callback"
   support because the all file servers prior to 1.5.67
   (and perhaps 1.4.12) do not properly assign a value to
   the AFSVolSync structure in bulk status RPC responses.

 * Improve the error output from aklog to output the value
   from krb5 error_message() if the afs_com_err output
   indicates an unknown value.

 * Hold a lock on the cm_scache_t object when the smb
   server is assigning a new clientModTime value.

 * Permit custom build version numbers to be set
   without modifying the src/config/NTMakefile.<platform>
   files.

 * Add support for binary code signing with cross-signed
   certificates and arbitrary versions of signtool.exe.

 * Convert VBUSY and VRESTARTING to CM_ERROR_ALLBUSY and
   do not permit them to be exposed to the smb redirector.

 * Convert STATUS_TIMEOUT responses to STATUS_IO_TIMEOUT
   to avoid confusion within the smb redirector.

 * Fix the byte order assigned to port numbers associated
   with AFSDB record lookups.  They must be network byte 
   order not host byte order.

 * Add dynamic server ranking based on RPC round trip
   time measurements.

Since 1.5.65
 * Official support for Windows 7 and Server 2008 R2

 * Improved Rx RTT computation following the lessons
   learned by TCP.

 * Prevent a file server bug (FetchData returning an
   invalid length instead of zero) from causing an
   "unexpected network error" when writing to files.

 * Promote DNS SRV records as superior to DNS AFSDB
   records.  Support arbitrary port numbers for vldb
   servers.

 * Add "fs listacl -cmd" support.

 * Add AFSVolSync based .readonly "whole-volume callback"
   support.  With this functionality, multiple objects from
   a .readonly volume can have their status validated by
   issuing a single RXAFS_FetchStatus RPC.

 * Remove drive mapping functionality and service start/stop
   from afscreds.exe.

 * Remove drive mapping functionality from afs_config.exe.

 * Adjust SMB error return codes to avoid returning 
   STATUS_TIMEOUT which results in the SMB redirector
   disconnecting.

 * Network Identity Manager OpenAFS Provider now provides its
   own "AFS lock" notification icon to report the status of
   "have tokens, have no tokens, service not started, service
   started but inaccessible".  Hovering over the icon lists the
   cells for which tokens exist (if any) and the OpenAFS version
   number.  Double-clicking executes the Network Identity Manager
   default action.

 * When merging the current status for an AFS object, ensure
   that the volume status for that object is set to 'vl_online'.

 * Permit cm_Analyze to request a retry even when the cm_req_t is
   flagged CM_REQ_NORETRY if the RPC failed due to RX_CALL_DEAD.
   The retry will force the use of a new connection.

 * Add digital signatures to resource only dlls as required by
   Windows 7.

 * Prevent pioctl calls from retrying indefinitely when a sharing
   violation error occurs.

 * Add {HKLM,HKCU}\SOFTWARE\OpenAFS\Client  DWORD  "ShowMountTab"
   to restore access to drive mapping functionality in afscreds.exe
   and afs_config.exe.

 * Permit Rx minimum peer timeout, maximum receive window size and
   maximum send window size to be configured via the registry.

 * The MSI installer now sets the ARPINSTALLLOCATION as required by
   Windows 7.

 * DNS lookups set the port numbers in network byte order within
   the cache manager.

 * Replace use of the 16-bit compatibility API WinExec with
   ShellExecuteEx in afs_config.exe and afscreds.exe.  WinExec
   is incompatible with Windows 7 / Server 2008 R2 UAC 
   functionality.

Since 1.5.64
 * Short circuit background volume checks if a shutdown
   or suspend request is received.

 * Avoid contacting the file server in order to allocate
   an empty buffer beyond the current length of the file.

 * When a request for streams on a directory or mount 
   point object is received, do not offer a default stream.
   This was affecting the saving of roaming profiles.

Since 1.5.63
 * Fix Windows 2000 compatibility.  Do not call rand_s() 
   even if it is compatible with the C run time library
   version.

 * Fix a data consistency error between the output of 
   NetWkstaGetInfo and NetServerGetInfo RPCs, specify the Lan 
   workstation group name "AFS", and report server name as 
   "AFS" instead of "\\AFS" when the caller asks for "\\AFS".

 * Enable executables to be run from \\AFS on Windows 7.  
   Return "Name not found" instead of "File not found" when 
   a directory or file name cannot be found.

 * Prevent cache manager from marking file server "down" when 
   the data returned in response to either RXAFS_FetchData64 
   or RXAFS_StoreData64 is invalid.

 * Add pioctl data validation to the AFS Explorer Shell extension.

Since 1.5.62
 * After 1.5.62 afslogon.dll would no longer crash but it 
   also would not load "domain" specific configurations.
   Fixed.

 * An uninitialized variable was present in the symlink
   recursion detection loop.

 * Reverse addition of unique per file GUID during 
   Create/Open responses. Inclusion of the GUID prevents 
   Cygwin applications (and others) from accessing //afs.

 * Treat "filename::$DATA" as a synonym for "filename".  
   This addresses the recent report of roaming profiles 
   failing to save back to the file server.

 * When given a choice between an error from rx_Write() 
   or RXAFS_EndStoreData(), use the rx_Write() error.  
   This ensures that over quota and access denied errors 
   are acted upon.

 * If an error occurs during RXAFS_StoreData operations, 
   apply that error to all of the buffers in the BIOD. 
   This ensures that failures will not be retried if they 
   will only fail again.

 * Do not perform a DNS lookup for a cellname if the 
   cellname prefix is _._AFS_IOCTL_._.  This will avoid 
   DNS lookups when the query is for 
   _._AFS_IOCTL_._.F7E5F580200909010061TTTTNT7TT.{10E39A49-4531-4496-A08E-842D4C440D20}.

 * Fix Freelance root.afs volume object callback processing.  
   Object synchronization and status merging bugs.

 * Fix Explorer Shell "invalid parameter" bug introduced 
   in 1.5.62.

 * Log RXKAD errors to the trace log.

 * Prevent simultaneous pioctl calls from multiple processes 
   from stepping on each other's data.

 * Prevent simultaneous pioctl calls from crashing the 
   afsd_service.

 * Add data validation to pioctl output processing in 
   ktc_GetToken and ktc_ListTokens.

 * Add data validation to pioctl output processing in 
   fs.exe and symlink.exe.

Since 1.5.61
 * IMPORTANT: New support for DCE RPC Services: SRVSVC and WKSSVC.
   No longer will browsing \\AFS produce truncated share names.

 * Registry specified server preferences did not result in
   the CM_SERVERFLAG_PREF_SET flag being applied to the
   cm_server_t object.  

 * Avoid unnecessary DNS lookups of share names as cells
   when it is known that the name cannot be a cell name.
   Any name that does not contain a dot is skipped.

 * When processing Dfs Referral requests, do not return an
   error if the server is down or busy; if the volume is
   offline; the cell vldb cannot be reached; etc.
   These paths are still \\AFS paths and so the client 
   should not be sent to search elsewhere for resolution.

 * CRITICAL: Prevent the cm_Daemon thread from terminating when
   the machine enters the suspend state.  IF the cm_Daemon thread
   dies, there is nothing to execute down server checks.

 * Prevent use of smb_StartedLock before initialization which
   can result in a panic in the lock package.

 * Improve error checking in afslogon.dll in order to prevent
   NULL pointer dereferences within GetLogonDomainOptions()
   if the Lsa operations fail.

 * Add support to the build system to automatically update
   a Microsoft Symbol Store.

 * Do not access the cm_conn_t after executing the cm_Analyze
   loops.  Doing so can result in an access to memory that has
   been freed.

 * CRITICAL: If a StoreData request offset is not aligned on the 
   buffer module blockSize, (offset % blockSize) bytes of dirty
   data will not be written to the file server.

 * CRITICAL: If a StoreData64 request is sent to a file server
   that does not support large files (>2GB) and the client is 
   unaware that the server has no large file support, the first 
   chunksize worth of data will not be written to the file server.
   This bug was introduced in 1.5.3.   It affects all IBM AFS file
   servers and all OpenAFS file servers older than 1.4.0.

Since 1.5.60
 * If a file server becomes inaccessible while the cache manager has 
   dirty buffers to write, the afsd_service buf_IncrSync thread can 
   attempt to use 100% of the cpu.

 * Fix the locking that protects the cm_cell_t lists 
   (all, name, id, free).

 * Remove cm_cell_t objects from the name and id hash tables before 
   placing them on the free list.

 * Fix "fs newcell" which was broken in 1.5.60.

 * Do not attempt to synchronize dirty buffers if the associated 
   volume is known to be unavailable.

 * Log to the Windows Event Log dirty buffers that cannot be written 
   during the shutdown process.

 * Modify behavior of a Freelance mountpoint target that does not 
   specify a cell.  Instead of assuming the target volume is in the 
   Freelance.Local cell, use the workstation "Cell" specified in the 
   registry. A mountpoint target of "#root.cell." will now mean the 
   root.cell volume in the workstation cell for the current session.  
   If the workstation cell changes from "athena.mit.edu" to 
   "andrew.cmu.edu", the referenced volume will also change without 
   requiring that the mount point targets be altered.

 * Avoid false infinite loop errors when validating the cm_cell_t 
   free list during startup.

 * Fix two more locations where xdr_free() should be used instead of 
   free() to permit a checked built of afsd_service.exe to work with 
   release builds of afsrpc.dll.

 * Add cm_FindServerByUuid().  Re-implement RXAFS_InitCallBackState3() 
   to permit the server Uuid to be used to lookup the server object 
   and from that determine the cell.  This permits callbacks that are 
   received from alternate addresses to be processed with a known server 
   object.  Previously a request from an unknown server would clear all 
   callbacks from all cells.

 * Fix a bug that prevented optimal performance when using a non-zero 
   value for 'daemonCheckVolCBInterval'.  As a reminder, when 
   "daemonCheckVolCBInterval" is set to a non-zero value, all .readonly 
   volume callbacks are automatically renewed 90 minutes before their 
   expiration.

 * Fix automatic ranking of vldb servers whose values are obtained from 
   the CellServDB file.

 * Add logging for RX CALL DEAD errors which are generated if the remote 
   host is unreachable.

 * Add failover for RX CALL TIMEOUT errors when the volume is readonly 
   or the call is to a vldb server.

 * Add registry based cell search functionality to NetIdMgr, 
   afs_config.exe, and klog.exe.

 * afsconf_GetCellInfo() has been modified to perform gethostbyname() 
   lookups on the host names in the CellServDB instead of using the 
   specified IP addresses.  This provides aklog, pts, vos, etc. the same 
   CellServDB behavior that the Windows Cache Manager uses.

 * Completely a behind the scenes change.  The snprintf() routines have 
   been completely rewritten.

 * When updating the stat cache entry callback of a .readonly object 
   from the volume group object, update the file server reference to 
   ensure it matches the most update to date callback.

 * Add proper support for processing callbacks from multi-homed file 
   servers.  Instead of comparing servers by cm_server_t pointer, 
   compare them by UUID when the UUID is known.

 * During a shutdown short circuit the offline volume check daemon 
   functionality.

 * Properly track link counts during cm_Link and cm_Unlink operations.

 * Return the error code of RXAFS_FetchData / RXAFS_StoreData in 
   preference to an error code reported by rx_EndCall.

 * Add "PerFileAccessCheck" registry value to permit testing against 
   experimental file servers that include per-file acl support.  This 
   value is intentionally undocumented.  It is not to be used by
   production environment deployments.

 * Log a warning to trace log if a volume group is marked as a DFS 
   File Set.  The Windows OpenAFS client does not include DFS support.

 * Fix a bug introduced in 1.5.60 that prevents the afs netidmgr 
   provider from obtaining tokens when referrals are in play.

 * Add "fs chown" and "fs chgrp" commands to permit the owner and 
   group of objects stored in AFS to be set from Windows.

 * Avoid performing background daemon operations when the machine is 
   going into suspend mode.

 * Perform offline volume checks in most recently used order.

 * Prevent crash when a data version for a cache object goes backwards.

 * fs setquota, fs setcachesize, vos setfields, and vos create now 
   accept human readable orders of magnitude. (K, M, G)

 * fs listquota fixed to permit large quota sizes to be displayed.

 * rx packet resend and data packets sent counts were incorrect.

 * Multi-thread safe library versions are now being generated and used.  
   mtafsubik.lib, mtafsutil.lib, mtafsvldb.lib, mtafsvol.lib.

 * Microsoft SMB Redirector (mrxsmb.sys) support for ExtendedSessTimeout
   values are now available on XP through Windows 7.  Add functionality
   to autodetect if such support is present on the machine.  If so,
   configure it if necessary and dynamically adjust the AFS Rx timeout
   values accordingly.

 * Correct another race condition in the Rx library that could result
   in an unexpected panic while freeing the Rx call iovq.

Since 1.5.59
 * A fix to the pioctl library to support drive substitution