Fix buffer length validation in ktc_GetToken and knfs

The signed int tktLen is checked against a maximum size, then passed
as the unsigned size_t argument to memcpy.  So we need to make sure it
isn’t negative.

This doesn’t appear to be exploitable: tktLen comes from the kernel,
which should have previously validated the length within the SETTOK
pioctl.

This bug was found with STACK <http://css.csail.mit.edu/stack/>.

Change-Id: I781bd300cad3d725d3517e7f6ac9e6423c417087
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Reviewed-on: http://gerrit.openafs.org/11109
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Windows: RDR AFSSubtituteName invalid UNICODE_STRING

The 'ComponentName' parameter to AFSSubstituteName() is a UNICODE_STRING
pointer.  Its address should not be passed to AFSDbgTrace when used
in conjunction with a %wZ format.

Change-Id: I12ead951b1ae376e42da12b21e32f65e736375ab
Reviewed-on: http://gerrit.openafs.org/11090
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Windows: Adjust Last Write time handling for -1

The "what date/time gets changed when and by whom" in Windows is badly
defined, but all filesystems support the semantic that if a date is set
using a specific file object (or the timestamp is set to the magic number
-1)
then other changes provoked by that file object will be ignored.

AFS redirector timestamp handling does not support this behavior.
For the LastWrite timestamp (other timestamps are pretty much advisory and
maintained on a best effort basis) the timestamp would be updated by a
write operation even after -1 is set via the file handle.

This patchset implements the -1 behavior for LastWrite.  It also follows
the standard Windows practice of setting the LastWrite timestamp to be the
time of close of the handle that performed the write, not the time of the
write itself.

Finally, it should be noted that since RX*FS_StoreXXX operations update
the last write time on the server the client must restore the LastWrite
timestamp at handle close if -1 was specified.

Change-Id: Ica0c566fabb6b3046eb51f827402d622190daea8
Reviewed-on: http://gerrit.openafs.org/11110
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
libafs: fix lock leak during shutdown

afs_getattr returns EIO when afs is in the process of shutting
down.  Be sure to unlock the locks taken before returning.
The bozon lock leak has been present since IBM AFS.

Change-Id: Id3e330c458996abf1519de6364060cc0b8828e6a
Reviewed-on: http://gerrit.openafs.org/11096
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Windows: cm_Analyze retries vs CM_REQ_NORETRY (2)

Commit a1b5a1d42280753de13094006dcc130fede978a1 left out a critical
part of the patch.  The check for "retry < 2" when determining whether
retries should be skipped due to CM_REQ_NORETRY.

Change-Id: I9b750e2bab11d28813447b2ee92287b8dcfbbba3
Reviewed-on: http://gerrit.openafs.org/11131
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Linux: Prevent some fakestat data inconsistencies

When fakestat is enabled for a mount point, the parent vcache
entry is not the right place to find the DataVersion of
the target volume root directory.  This can lead to data
inconsistency since the revalidation checks rely on the parent's
DataVersion to determine if a file entry is still valid.  If the
file was replaced or deleted remotely, the only callback we
get is for the parent directory, and in that case the client
will think the file entry is still valid and give back stale
data to the user.

If fakestat is enabled and we have a mountpoint, always use
the parent vcache pointer returned by FakeStat before using it
to either store (in the lookup and create ops) or compare
(in the revalidate op) the DataVersion.

FIXES 131855

Change-Id: I03c05c1dab39e663b74635700e80ba70861b1c2e
Reviewed-on: http://gerrit.openafs.org/11118
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: D Brashear <shadow@your-file-system.com>
Windows: Fix uninitialized variables

VS2013 spotted two cases where we do not set up the
Iosb.Status when we catch an exception from Cc.
Fix them.

Change-Id: I93b8a48863f22fd1dc2d7dba4d9de18454f35fe0
Reviewed-on: http://gerrit.openafs.org/11140
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Tested-by: Jeffrey Altman <jaltman@your-file-system.com>
Windows: Restrict redir trace buffer to 10240KB

Define macro AFS_DBG_LOG_MAXLENGTH to 10240 and then use it to
enforce the 10MB trace buffer limit.

Change-Id: I98b759d9f51d24d402bfdc56570c0f0de93926a0
Reviewed-on: http://gerrit.openafs.org/11146
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Tested-by: Jeffrey Altman <jaltman@your-file-system.com>
doc: Clarify some BosConfig.new text

It is not always clear to users whether BosConfig.new is noticed
during an automatic restart, or if it requires stopping and starting
the bosserver. Slightly reword the relevant text and add a small note
that a "general restart" does cause BosConfig.new to be noticed, so
this is explicitly clear.

Change-Id: Iab3eaff176305b0b2991a6636e70204b5072b1b0
Reviewed-on: http://gerrit.openafs.org/11076
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
aklog: double get_credv5 in retry logic

Fix a bug where get_credv5() is called twice, even if the first one
succeeded, in the aklog retry logic.

(This bug uncovers another bug where get_credv5_akimpersonate
crashes in the krb5 libs when get_credv5 is called back to back.)

Change-Id: Ie6cac3b4522946c87c30ad3cd6939738234800bf
Reviewed-on: http://gerrit.openafs.org/11133
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
uss: add missing include

Fix a build error when configured with --enable-uss. The
added include defines the VolumeId which is needed by
the volser.h.

Change-Id: Ifbdaadf4de726ff1da54e93ba47124c5b5eb9cfb
Reviewed-on: http://gerrit.openafs.org/11084
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
RestrictedQuery feature

Make vlserver and volserver suppport a new command line parameter,
"-restricted_query admin".  When this is on, the query RPCs that
are not needed for normal cache manager operations are restricted
to administrators listed in UserList.  This is off by default.

Change-Id: I2a23a4e99cabd46b19ed491a6520773731a5994e
Reviewed-on: http://gerrit.openafs.org/10927
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: D Brashear <shadow@your-file-system.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
NetBSD: update kernel module glue for NetBSD 6.99.x

Change-Id: I4fe5ccb33ec823a6df3a73e94247a0a42b970e57
Reviewed-on: http://gerrit.openafs.org/11089
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
vos: vos release -force-reclone option

Add a new vos release option called -force-reclone to force the
reclone of the release clone and a release to all of the remote
sites, regardless of the state of the VLDB flags on the remote
sites, but does not force full volume dumps when distributing the
volume.

Provide an alias -f for -force for compatibility with the original
IBM vos, in case scripts were written to use the old '-f' option,
and for users with muscle memory.

Change-Id: I0ebebc5e8099299781e8da57579d91848bb2ad19
Reviewed-on: http://gerrit.openafs.org/9020
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
solaris: help fs_conv_sol26 build cleanly

handleit(), being static, should be declared before usage.

Change-Id: I5cf9767ed2fc552f7a22c7570d0a4d256a4111b1
Reviewed-on: http://gerrit.openafs.org/11134
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
afs: restructure afs_warn and afs_warnuser

Restructure afs_warn.c to provide an afs_vwarn and afs_vwarnuser
that accepts a va_list rather than a variadic parameter
specification.  afs_warn and afs_warnuser continue to be
variadic functions but now call afs_vwarn and afs_vwarnuser.
This is a preparatory change.  A subsequent update will
further exploit afs_vwarn and afs_vwarnuser.

Change-Id: I8e740c4db311582bda6422e6600f1503dfbd0f5a
Reviewed-on: http://gerrit.openafs.org/10942
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
afs: Define afs_warnall routine

In a Linux environment afs_warn and afs_warnuser both go to
the same spot, resulting in duplicated messages if both are
invoked back to back.  Define a new function afs_warnall
for use when identical messages are directed to both warn
and warnuser.  In a Linux environment it will do the right
thing and present only one copy of the message.

Change-Id: I1abdc63adc74fe5b08d3872d48698ec9dcc7a40c
Reviewed-on: http://gerrit.openafs.org/10943
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
afs: Suppress duplicate message on Linux

Update afs_util.c to call afs_warnall in places where afs_warn and
afs_warnuser are called back to back with identical parameters.

Change-Id: I529344dea12149d8f18ec38bb17418c703f7d26b
Reviewed-on: http://gerrit.openafs.org/11006
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
OpenBSD: Add support for OpenBSD 5.4

Add param header files and other config info to provide
support for OpenBSD 5.4.

Change-Id: I56d2e716bd7fa4dee699f8d190cb4b60bb0f67a8
Reviewed-on: http://gerrit.openafs.org/11130
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
Reviewed-by: D Brashear <shadow@your-file-system.com>
redhat: Use the right path to depmod

As of Fedora 17 and RHEL 7, depmod has moved from /sbin to /usr/sbin.
The full path to depmod is used in package scripts and as a dependency.
This hasn't caused problems in most cases because on an installed
system a link /sbin -> /usr/sbin is present and during ordinary package
installations yum/rpm correctly then figure out that /sbin/depmod is
actually provided. But in other situations, the dependency check is not
that clever and (incorrectly) fails.

Add a macro to the spec defining the full path to depmod, use the macro
rather than plain /sbin/depmod throughout the spec, and also pass it to
kmodtool when required to generate the kmod package scripts and
requirements.

FIXES 131860

Change-Id: I1f2e4f7100d244477c2cb9087d2f48bbcea27fdc
Reviewed-on: http://gerrit.openafs.org/11128
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: D Brashear <shadow@your-file-system.com>