Windows: Fail recursive path evaluation with access denied

Matching the behavior of the AFS SMB server, the afs redirector
should return STATUS_ACCESS_DENIED if File ID recursion is detected
in the Name Array for any given path.

Reviewed-on: http://gerrit.openafs.org/7018
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
(cherry picked from commit 4c5819e22852afe4e83bdcd05268864ac1953a8c)

Change-Id: Ib9c835e552e2aeb3bba402ca8d8ab537d507f91b
Reviewed-on: http://gerrit.openafs.org/7060
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Windows: Add per object per user EACCES caching

If a cache manager is told by a file server that the user does
not have permission to fetch status for an object, the cache
manager must avoid requesting a fetch status a second time for
that object for the same user.  Doing so risks triggering the
rx call abort throttling which can have a significant impact on
end user usability of the Explorer Shell and other applications.

The cache manager cannot make a decision on whether or not to
issue an RXAFS_FetchStatus RPC based upon the type of the object
because the type is unknown to the cache manager.  A file server
will succeed a FetchStatus request when the parent directory ACL
grants lookup permission if the object in question is the directory
or is a symlink/mountpoint.  Only file objects require read/write
permissions to obtain status information.

The rx call abort throttling is broken is many ways and must be
avoided.  Call aborts are tracked by call channel and occur whenever
ten call aborts are issued on the same call channel in a row
regardless of the amount of time that has elapsed.

The EACCES cache works by storing EACCES events by the FID and User
for which the event occurred, when it occurred and the FID of the
parent directory.  By definition, the parent FID of a volume root
directory is itself.

Entries are removed from the cache under the following circumstances:

 1. When the parent FID's callback expires or is replaced.

 2. When the parent FID's cm_scache object is recycled.

 3. When the user's tokens expire or are replaced.

Entries are not removed when the FID's cm_scache object is recycled.

This patchset also implements correct behavior if the VLF_DFSFILESET
flag is set on a volume.

Reviewed-on: http://gerrit.openafs.org/6996
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
(cherry picked from commit 7c5b8346b305911c981620fff70503008e9cf488)

Change-Id: Iaba693d2c3d8e4e8734dc600ade7f886211d9ebc
Reviewed-on: http://gerrit.openafs.org/7061
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Windows: do not call time() in a loop

When checking for ACL Entry expiration, obtain the current time
once per call to cm_FindACLCache() instead of once per ACL entry.

Reviewed-on: http://gerrit.openafs.org/7016
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
(cherry picked from commit 048b24ae2b8accb33bc92ab9fdc4cdda14bc425b)

Change-Id: I9954acea73cae20befa771ce430492c2396e8326
Reviewed-on: http://gerrit.openafs.org/7062
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>