<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">OBSOLETE Patch-ID# 110179-07
Keywords: PC Netlink
Synopsis: Obsoleted by: 110179-08 PC Netlink 1.2 bug fixes
Date: Jun/27/2001

Solaris Release: 2.6 7 8

SunOS Release: 5.6 5.7 5.8

Unbundled Product: PC Netlink

Unbundled Release: 1.2

Xref: 

Topic: 

Relevant Architectures: sparc
NOTE: sun4u

BugId's fixed with this patch: 4317724 4336622 4340358 4344004 4360584 4365016 4369953 4372352 4372362 4376719 4379181 4390801 4391148 4392263 4395436 4395930 4397013 4439032 4453122 4457143 4461714 4466383

Changes incorporated in this version: 4466383 4461714

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/opt/lanman/bin/net
/opt/lanman/lib/libasulang.so.1
/opt/lanman/lib/libasusec.so.1
/opt/lanman/lib/liblmx.so.1
/opt/lanman/lib/libmsrpc.so.1
/opt/lanman/lib/librpcapi.so.1
/opt/lanman/lib/libsam.so.1
/opt/lanman/lib/libtask.so.1
/opt/lanman/lib/lmx.ctrl
/opt/lanman/lib/lmx.srv
/opt/lanman/lib/service/lmx.browser
/opt/lanman/lib/service/lmx.wins
/opt/lanman/msgfiles/locale/en/net.hlp
/opt/lanman/sbin/acladm
/opt/lanman/sbin/rmacl
/opt/lanman/sbin/sam2passwd

Problem Description:

########## New in this patch ##########
 
4461714 W2k Clients mapping non-existent shares cause performance problem
 
    W2k Clients may erroneously try to remap a non-existent share
    forever.  If a W2k client has a share mapped, and that share is
    deleted while the client has it mapped, attempts by the client
    to access the share will cause the client to relentlessly try
    to create a new session to that share as fast as possible, 
    eventually overwhelming the lmx.srv process with new sessions
    because old ones are never deleted by the client.  
 
    With this patch, sessions are limited to 100 per client with
    a new Registry parameter: AdvancedServer/Parameters/MaxUIDsPerVC.
    MaxUIDsPerVC defaults to 100.  There is not normally a registry
    entry for this parameter, and if the user wishes to adjust this
    value, he must create the registry parameter.  The minimum value
    for MaxUIDsPerVC is 2, the maximum is 32,768 and the default
    is 100.
 
    CurrentControlSet\Services\AdvancedServer\Parameters\MaxUIDsPerVC
 
4466383 PCNL doesn't delay 3 secs when returning certain failure responses
 
    There are certain kinds of failures which cause clients to repeatedly
    send the same failing request to the PCNL server.  With a large client
    population, the volume of failing requests can waste a great deal of
    server time, causing performance degradation.  This fix inserts a
    3 second delay before returning certain failing responses: 
    STATUS_LOGON_FAILURE, STATUS_ACCOUNT_LOCKOUT or STATUS_ACCOUNT_DISABLED.
    The delay throttles the level of failing activity any client may 
    impose on the server.
 
########## Carried forward from 110179-06 ##########
 
NOTE: The following bug requires no code change, but there is an
      *** ADMINISTRATIVE PROCEDURE REQUIRED *** to correct it.
      Running samcheck -r will fix the builtin groups. Any accounts
      created before patch 110179-01 was applied which contain 8-bit
      chars will need to be recreated manually.
 
4439032 administrative access to groups with 8-bit chars not possible
 
    This problem occurred in 1.2 when a fix for 4360963 (case mapping of
    8-bit chars) was applied with patch 1. If PCNL is installed on top of
    German Solaris, the builtin group names are spelled in German. Fixing
    the case mapping broke the names as previously spelled. The fix is to
    run samcheck -r which re-creates the "well-known" accounts.
 
4448969 $IPC acl corruption prevents logins
 
    This error was introduced in patch 110179-04.
 
    The error was that when the index hash tables were rebuilt,
    (normally when the size is increased), the index pointing to some 
    entries was lost. The entries are still present in the database, but
    become inaccessible to lookup. Because the data for the acl is still
    present, acladm -C can repair it.
 
    When the $IPC acl became invisible, the result was that logins got an
    error. This was the most visible but not the only possible consequence
    of various acls disappearing. It is not possible to describe all potential
    consequences but in general the symptom would be access denied errors.
 
    This corruption is limited to the acl database does NOT effect any other
    databases such as Sam or Registry.
 
    The bug which caused this has been found and is fixed in this patch.
 
4453122 p3/s4 PCNetlink 1.2: ACl corrupted
 
    This is a duplicate of 4448969 above.
 
4425039 t2find with specific filename returns invalid shortname
 
    Patch 110179-05 introduced an error in generating the shortname
    when there is a single file lookup using t2find. Wild card and
    full dir listings were still correct but when a specific file
    name was provided the shortname was garbage.
 
4433079 on win98, dir command will fail to find a file without extension
 
    Filenames with no extension were not found by "dir file"
    in the dos box on win98.
 
4453930 long filenames displayed as short names in MS project
 
    In MS Project running on win9x, long filenames would be displayed as
    short (compressed) names. The compressed names still worked. In a
    dos box on win9x, "dir longfilename.txt" returned the name in upper
    case when the real filename was lowercase or mixed case. This has 
    been corrected.
 
4401046 lmx.srv process dies unexpectedly without core
 
    This can occur when an enumeration of printers is done and one
    of the registry entries for the printers is not complete.
    The printer enumeration could be a background operation based
    on the state of a Windows client Explorer.
 
4419446 name mapping problems with certain 16-bit application
 
    The information associated with a shortname was not returned correctly
    for an SMB used by some older applications, resulting in an application
    error. This has been corrected.
 
4334975 Member Server can't authenticate with LMCompatibilityLevel=4
 
    When LMCompatibilityLevel=4, PCNL is required to use NT style
    password and never old-style Lan Manager password.  PCNL did
    not align the bytes  of the NT style password in an out-going
    session packet and could not connect to an NT server at
    LMCompatibilityLevel=4.  Therefor, a PCNL member server could
    not connect to an NT PDC for authentication.
 
4422555 NetUserInfo32() with level 21 will core
 
    The NetUserInfo32() internal service routine will core if the
    info level is 21.  This only affects customers who write
    programs based on PCNL service libraries.
 
 
4435066 Client-based "net admin" command hangs with RPC timeout error
 
    The IBM utility programs which run on WinNT and IBM OS/2 hang
    when a "net admin &lt;command&gt;" is directed to an PCNL server.
    The error reported is RPC timeout.
 
4457143 Folder creation on Automounted share fails
 
    When using NFS mounted shares (usually home directories), with
    restricted UNIX permissions, such as 700, then directory and
    file create operations would report errors, but would, in fact,
    get created.  However, file delete operations would report "file
    not found" errors, and the file or directory would not be deleted.
 
########## Carried forward from 110179-05 ##########
 
4395930  Netlink 1.2 very slow on writes
 
    The reported problem was that file writes (client to server) were
    5x slower than reads. This has been corrected. However, it should
    be noted that performance will still vary considerably depending on
    many factors including network environment, what client is involved,
    and what write protocol the client chooses to use.
 
PLEASE NOTE that the increase of the MaxMessageSize registry parameter
    as described below produced improvements at least as great as any
    of the code optimizations included in this patch.
 
    Performance of file operations in large directories has als been
    substantially improved by optimizing directory search times.
 
PLEASE NOTE that the corresponding netbios patch T110178-03 is necessary
     to provide the complete set of changes. The patch will work without
     out it (not broken), but one of the major performance improvements
     for the SMBwriteBraw will have no effect.
 
 
******** Tuning for Better File Copy Performance *****************
 
There are 2 registry parameter changes that can be changed to improve
performance on file copies, independent of the changes in this patch.
 
    1. under SYSTEM/CurrentControlSet/Services/AdvancedServer/Parameters
       there is a parameter MaxMessageSize.
       The default is 4160. Set it to 32768 (8000 hex).
       This can be done by
 
regconfig SYSTEM/CurrentControlSet/Services/AdvancedServer/Parameters MaxMessageSize REG_DWORD 32768
 
    2. IF none of your applications use the truncated 8.3 shortnames,
       where names longer than 8.3 are converted to something like
 
		prefix~1.typ
 
       then the use of these names can be turned off. This should improve
       directory search time, especially in directories containing large
       numbers of files. With the default setting, these names must be
       created and returned for every non-8.3 name, every time a directory
       listing is requested, or a wildcard search done, which would include
       every file copy operation. That's every file in the dir if you 
       copy a the contents of a dir.
 
       The use of shortnames can be turned of by changing the value of
       the registry parameter NameSpaceMapping under
       SYSTEM/CurrentControlSet/Services/AdvancedServer/FileServiceParameters
 
       The default value is 3, which means, use shortnames and NT names.
       For NT names only, set the parameter to 2.
       This can be done by
 
regconfig SYSTEM/CurrentControlSet/Services/AdvancedServer/FileServiceParameters NameSpaceMapping REG_DWORD 2
 
    Force NO File Acl
    -----------------
 
    There are new modes of ACL behavior implemented in patch 04 which do
    not create explicit ACLs on files. (All changes for patch 4 are included
    in this test patch).  This dramatically reduces the growth of the ACL
    database, and speeds up all file access operations.  Please see the
    technical note on the ForceFileAcl parameter further on in this file
    for a description of this feature to determine if it is appropriate
    for your site. Patch 4 also includes performance improvements in the
    acl blob database itself, see the description for bugid 4379181.
 
***************************************************************
 
########## Carried forward from 110179-04 ##########
 
4365016: browser may fail to start in backup role
 
   The lmx.browser would inappropriately exit when it lost a browser
   election under certain conditions.
 
 
4360584  DeadLock between lmx.browser, lmx.ctrl ...
 
   During certain browser load conditions with WINS configured,
   the browser will hang while communicating with lmx.ctrl.  The
   result was no browsing and too many lmx.srv processes.
 
 
4397013 PCNL WINS server uses physical node IP in cluster
 
   PCNL wins services used the physical node IP address in it's WINS
   database instead of the cluster logical IP. Using the MS Wins
   manager application showed only physical node IPs instead of the
   cluster logical IP.
 
	CRITICAL NOTE:
	---------------------------------------------------
	| On clustered systems, this fix requires NETBIOS |
	| patch 110178-02.                                | 
	---------------------------------------------------
 
 
4391148 PCNL 1.2 hangs in Japanese local on Sol 2.6
 
    Solaris 2.6 eucJP conversion gives errors when patch 106131-01 is
    applied.  These errors triggered a bug in PCNL ja local.  The PCNL
    error is fixed, but the customer is required to install 106131-02
    for the ja locale.
 
4395436 Read from share fails from MSDOS boot floppy
 
    SMB protocol levels which use the 'core smb' open routine would see
    a returned file size of zero.  The user-visible results would vary,
    because not all programs cared about the file size returned from
    the open call.  The simplest example is that a LANMAN boot floppy
    could copy files from a PCNL share, but could not 'type' the file
    from the MSDOS command line.  Also, the 'GHOST (c)' disk imaging
    product would fail.
 
4392263 acladm -U (on a member server) removes ACE 's of known users
 
	To be supplied.
 
4390801 LEXMARK printer driver loader fails 
 
    LEXMARK provides a client-side utility program which downloads
    collection of printer driver modules to the PCNL server.  This
    utility program provides the convenience of downloading perhaps
    hundreds of printer drivers all at once.
 
    This utility program would fail with a spooler related error and
    fail to load any driver modules.
 
4336622 net user command does not support /domain switch.
 
    Previously, the "net user" command did not support the /DOMAIN
    switch.  Support for the /DOMAIN switch has been added.
 
         Ex:
         net user /domain:Adomain
 
    now provides the proper response.
 
4344004 net user /USERNAME option does not work
 
    This is an additional option for managing user names.  This option
    allows the administrator to rename an existing user without
    deleting the user then recreating the user under the new user
    name.
 
 
         Ex:
             net user don /username:donna
 
    now provides the proper response.
 
4379181 Poor acl blob performance under write
 
    This fix contains Acl blob performance enhancements to make
    modifying the ACL blob faster for a single process.  These avoid
    large copies or writes.
 
4317724 Logon fails when RestrictAnonymous is enabled
 
    Under certain conditions with restrictions on password policies,
    users were unable to logon to change their passwords when the
    password had expired.
 
4376719 PCNL does not record logoff events
 
    PCNL did not properly record logoff events and did not provide
    meaningful information in the logoff event.  The admin could not
    identify who was logging off.
 
4369953 Enumeration of shares shows phantom users        
 
    Using the "net share &lt;sharename&gt;" command would list users who were
    not using that share.
 
4372352 Need a way to delete file acls
 
    A new option to acladm has been provided which will delete ACLs on
    all ordinary files. The option comes in 2 variants to accommodate
    sites which need explicit ACLs where the owner is different from
    the owner of the parent dir.
 
acladm -X
    will delete all ACLs on ordinary files except where the owner is
    different from the owner of the parent.
 
acladm -XX
    will delete ALL ACLs on ordinary files.  In both cases ACLs on
    directories and non-file objects (i.e shares) are preserved.
 
    For better understanding of the use of this option, see the
    Technical Note on ForceFileAcl, below.
 
 
4372362 Need an option to prevent creation of file acls
 
    Due to the problems caused by large acl databases, there should be
    a way to prevent the creation of acls on files for those customers
    willing to accept the limits of inherited acls.
 
    Currently there is a registry parameter ForceFileAcl which can be
    used to force creation of a real acl on every file. When this is
    off (the default), there are some cases where file acls are not
    created. There should be new values for this parameter which will
    cause NO file acls to be created.
 
    This Technical Notes on the ForceFileACL registry parameter, below.
 
 
########## Carried forward from 110179-03 ##########
 
4384158 P2/S3 Unable to create files with patch 110179-02 - Users are mapped
4384901 P2/S3 Renaming a folder does copy instead of move with patch 110179-02
 
    Both of these bugs were inadvertent consequences of a previous change.
    The mapping of the DOS Read-Only attribute was changed from unix
    permissions of 555 to 755, on directories only. NT ignores the
    read-only attribute on directories but PCNL was enforcing it, which
    caused both of these bugs. Owners now have the right to create and
    delete files in their home directories if they have unix perms 755.
    Note that the read-only attribute on files is still unix perms 444,
    and is enforced.
 
4340358 P4/S3 cascade: changes group on unix files
 
    PCNL represents the DOS attributes Archive, System, and Hidden in
    group id's of the general form DOS----. We have found that NT clients
    routinely reset these attributes in many cases where it would not
    appear to be necessary, for example, when a text file is modified.
    This fix checks to see that a change is really being made when the
    attributes are set, and does not apply the DOS group unless one of
    the attributes stored that way is really changing. Unix groups should
    now be preserved in these cases, unless a real attribute change is made.
 
 
###### Carried forward from 110179-02 ######
 
4373578 Installation of patch 110179-01 appears to break cascade 1.2
 
    The fix for 4364383 in 110179-01 (consuming all of a cpu) introduced
    an error which can cause lmx.srv to coredump. When lmx.srv processes
    keep dying it can cause a variety of other error conditions.
 
    Any customer who took the first patch for the cpu consumption fix
    should install this patch. However, the error in question depends
    on timing and may or may not be causing a problem if you have patch
    110179-01.
 
4376090 lmx.srv core dump running stress tests
 
    While testing the fix for 4364383 another bug was encountered
    which is also fixed in this patch.
 
###### Carried forward from 110179-01 ######
 
4364383 lmx.srv consumes all available CPU cycles
 
    It was possible for an lmx.srv process to go into a tight loop,
    consuming all of 1 cpu. See the bug report for a representative
    pstack indicating the presence of this problem. This bug is
    specific to 1.2.
 
4311513 unable to copy from read-only filesystem to pcnl share if quotas
        enabled
 
    This bug was fixed in 1.1 but the fix did not make it into 1.2 before
    code freeze.
 
    When the registry parameter UnixQuotas is set to 1 to enable enforcement
    of unix file system quotes on pcnl clients, attempts to copy a read-
    only folder resulted in an empty folder. NT preserves the read-only
    attribute on copy, unlike unix. The contents of the folder will now
    be created and all will be read-only if the source of the copy was.
 
4356718 unable to access long file name from DOS prompt if
        UniqueSuffixLength=0
 
    Setting UniqueSuffixLength=0 is a new option in 1.2 which results in
    all DOS short names having the form prefix~1.ext, but files with an
    extension were not visible.
 
4360963 filenames with umlauts are not visible with mixed locale categories
 
    Filenames with umlauts worked only if the "LC_ALL" variable was set,
    which is not the default case for 8-bit English, among others. The
    locale is now handled properly in these cases. This bug is specific
    to 1.2.
 
4363424 File locking owned by incorrect user
 
    The case of multiple user contexts on a single session was not
    always tracked correctly. This made it seem that there were several
    users with the same file open, and could result in the real user
    being locked out. This was seen with clients coming in to PCNL via
    Citrix MetaFrame, but could occur in other cases if there are
    multiple users on a single connection to PCNL.
 
4365814 sam2passwd should be extended to support domain extractions
 
    An option was added to sam2passwd to accept a domainname. This allows
    it to collect domain accounts when running on a member server. See
    the revised man page included in this patch for details.
 
 
 
 Technical Note on ForceFileACL Registry Parameter
 --------------------------------------------------
 
 There are 2 new options implemented for this RFE that can be used to
 improve performance at the expense of strict conformance to NT ACL
 semantics. Use of these options implies acceptance of non-standard
 behavior in regard to ACLs.
 
 To understand whether use of these options is appropriate, it is
 necessary have some understanding of the implications for ACL
 behavior.
 
 In NT there is an ACL on every file and directory, as well as some
 other kinds of objects in the system.  These ACLs are maintained as
 part of the file system.
 
 PCNL currently stores ACLs in a database.  One consequence of this is
 that when the size of the database becomes large, performance can
 deteriorate.  This is a function of the number of files in PCNL
 shares, the number of users, and typical activity on the system.
 
 As an optimization, the system provides the concept of "virtual ACLs"
 which inherit their characteristics from the parent directory,
 combined with information about the owner if the NT user account is
 mapped to a unix user account. To the extent that no specific changes
 are made to the ACL on an individual file, this virtual ACL will be
 the same as an "explicit" ACL stored in the database. They system
 makes the substitution on the fly, and it is transparent to the user.
 If the user modifies the ACL on a file, then an explicit ACL is
 created so that the change can be accurately represented. This,
 combined with the ingrained habit of many users (and administrators)
 to use the check box which propagates the change to subdirectories,
 tends to result in growth of the database over time. For some customer
 sites this has been a significant issue.
 
 In PCNL there has always been a choice between strict NT conformance
 (an explicit ACL on every file) and a conservative approach to the
 optimization described above, which results in behavior that closely
 approximates NT behavior. This is controlled by the registry parameter
 ForceFileAcl.
 
 The default value is 0, which means the system will not create an
 explicit ACL on a file when it will be the same as the virtual ACL
 which will be inherited from the parent dir. This provides a
 performance improvement over always creating an ACL, with a very close
 approximation of NT ACL semantics.
 
 When ForceFileAcl is 1, an explicit ACL will always be created for
 every file. This provides exact conformance to NT semantics, at some
 cost in performance.
 
 New options implemented in this patch:
 
 ForceFileAcl 2: No ACL will be created unless the owner is different from
 		the owner of the parent dir.
 
 ForceFileAcl 3: No ACL will be created for an ordinary file for any reason.
 
 These options essentially provide ACLs at the directory level but not
 at the level of an individual file. File ACLs will be created on the
 fly based on the ACL on the parent directory and the unix owner if mapped.
 
 In both cases, if the owner of the file is different from the owner of the
 parent, and the owner is mapped to a unix account, the unix ownership will
 be maintained so that the owner will be represented correctly. Customers
 who do not have mapped unix accounts should use option 2 if file ownership
 is significant for administrative or policy reasons.
 
 These options are intended for customers who have a problem with ACL
 performance. Fewer ACLs will be created, keeping the size of the database
 down. In addition, there will be much less write access to the database,
 substantially reducing contention for write locks on the database among
 tasks supporting different clients. While the resulting change in performance
 has not yet been measured, and is very dependent on the characteristics of
 a particular site, it appears to be significant.
 
 In both cases 2 and 3 this change only prevents the creation of new ACLs,
 it will not remove any that are already present. The new acladm -X or -XX
 option can be used to do this. See description below.
 
 It is strongly recommended to run the corresponding acladm command to
 delete existing ACLs when one of these new options for ForceFileAcl
 is chosen. It should significantly reduce the size of the ACL database.
 Then the use of the new option should keep the ACL database from growing,
 or with option 2, it should grow much more slowly.
 
 IMPORTANT NOTE:
 
 It is important to understand that attempts to modify an ACL where we will
 not create one will get a success status, but since there is no ACL, the
 change will not really be made. If the NT account is mapped to a unix account,
 the unix ownership will be changed accordingly, but no real ACL is maintained.
 
 For true NT compatibility these options should not be used. This behavior is
 intended only for sites that choose to have this behavior to obtain the
 resulting shrinkage of the ACL database and improved performance obtained by
 avoiding the need to create and update the ACLs, in exchange for the
 discrepancy between this behavior and a true NT ACL implementation.
 
 How to change ForceFileAcl
 
 This is a registry parameter which can be changed with the regconfig
 command supplied with PCNL, or the NT registry editing program regedt32.
 The path for the parameter is
 
 SYSTEM/CurrentControlSet/Services/AdvancedServer/FileServiceParameters/ForceFileAcl
 
 Please note that any non-0 value other than 1, 2 or 3 is not valid.
 In practice, unrecognized values will effectively be treated the same
 as 1, which is to say always force the creation of an ACL.
 
 -------------
 
 New acladm option to delete file ACLs.
 
 A new option to acladm has been provided which will delete ACLs on all
 ordinary files. The option comes in 2 variants to accommodate sites which
 need explicit ACLs where the owner is different from the owner of the
 parent dir.
 
 acladm -X will delete all ACLs on ordinary files except where the owner
 	  is different from the owner of the parent.
 
 acladm -XX will delete ALL ACLs on ordinary files.
 
 In both cases ACLs on directories and non-file objects (i.e shares)
 are preserved.
 
 For better understanding of the use of this option, see the note above on
 ACLs and  performance tradeoffs.
 
 
 End Technical Note
 ------------------

Patch Installation Instructions:
--------------------------------
Refer to the Install.info file for instructions on using the
generic 'installpatch' and 'backoutpatch' scripts provided with
each patch.  Any other special or non-generic installation
instructions should be described below as special instructions.

Special Install Instructions:
-----------------------------
 
NOTE: This patch must be installed using the version of installpatch that
shipped w/ this patch.  It should not be installed via the patchadd utility.
Also, the system that this patch is applied to should be rebooted after patch
installation. This will ensure proper functioning of the applied patch binaries.

README -- Last modified date:  Tuesday, August 14, 2001

</pre></body></html>