* If you ran the isi auth ads modify command with the --reset-schannel option
  to reset the secure channel to the primary domain, the following error
  appeared where [provider-name] was the name of the specified Active
  Directory authentication provider: 

  Failed to reset schannel for [provider-name]': LW_ERROR_NOT_HANDLED

* Because OneFS did not respond correctly to a specific Local Security
  Authority (LSA) request made by Mac OS 10 clients running Mac OS 10.6
  through 10.10, the ACLs and POSIX owner applied to an affected share could
  not be viewed from Mac OS 10 clients running those versions.

* If an SMB client disconnected from a node unexpectedly (for example, if the
  client machine was shut down improperly), a race condition could have been
  encountered. This was more likely to occur in environments where many SMB
  clients were simultaneously sending and receiving requests to and from
  the cluster. If this condition occurred, the lwio process restarted, SMB
  clients connected to the affected node were disconnected, and the following
  lines appeared in the /var/log/messages file: 

  /lib/libc.so.7:thr_kill+0xc
  /usr/likewise/lib/liblwiocommon.so.0:LwIoAssertionFailed+0xa4
  /usr/likewise/lib/libiomgr.so.0:IopIrpCompleteInternal+0x5c7
  /usr/likewise/lib/libiomgr.so.0:IopIrpDispatch+0x1c8
  /usr/likewise/lib/libiomgr.so.0:IopCompleteZctReadWriteFile
  +0x222
  /usr/likewise/lib/libiomgr.so.0:IoCompleteZctReadFile+0x2f
  /usr/likewise/lib/lwio-driver/srv.so:SrvCompleteZctRead_SMB_V2
  +0x52
  /usr/likewise/lib/lwio-driver/srv.so:SrvProcessRead_SMB_V2
  +0x456
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecute_SMB_V2
  +0xa61
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecute2
  +0xab
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecuteWorkItemCallback2
  +0x28
  /usr/likewise/lib/liblwbase.so.0:WorkThread+0x256
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine+0xee
  /lib/libthr.so.3:_pthread_getprio+0x15d 

* An issue sometimes occurred that prevented OneFS from retrieving SPN 
  keys from the cluster's machine password configuration file, pstore.gc.
  If this issue occurred, authentication requests failed with an "Access
  Denied" error, and continued to fail until the lwio process restarted.   

* If specific users who were members of multiple Active Directory (AD)
  security and distribution groups attempted to log in to the cluster,
  and those users' primary AD groups were not contained within the list of
  user groups, a signed/unsigned integer mismatch error could occur that
  sometimes caused the lsass process to restart. If the lsass process restarted
  as a result of this issue, users could not log in to the cluster, and the
  following lines appeared in the /var/log/messages file:

  /usr/likewise/lib/lsa-provider/ad_open.so:ADLdap_GetObjectGroupMembership
  +0x20b2
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_PacMembershipFilterWithLdap
  +0x7d5
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_CacheGroupMembershipFromPac
  +0x10c8
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_OnlineCheckUserPassword
  +0xf77
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_OnlineAuthenticateUserPam
  +0x3c7
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_AuthenticateUserPam
  +0x30c
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvAuthenticateUserPam
  +0x57e
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvIpcAuthenticateUserPam
  +0x3

* If the lwio process was handling an SMB 2 Create request while a related
  SMB session or connection was being closed, a race condition could have
  occurred. If this condition occurred, some SMB process threads stopped
  responding and new SMB client connections to the affected node could not
  be established until the lwio process on the node was restarted.

* If an SMB 2 client sent a compound request to the cluster, OneFS did not send
  the correct response and, as a result, the client was disconnected from the
  cluster.

* Although an LDAP or NIS file provider was configured with a list of unfindable
  users through the --unfindable-users option of the isi auth create or isi
  auth modify command, a user's groups were still queried for through the LDAP
  or NIS provider.

* When users attempted to access a file under an audited SMB share and the
  access failed, the audit events were not recorded in the audit log.  

* PowerPC-based clients running Mac OS 10.5 and earlier were unable to connect
  to SMB shares on clusters running OneFS 7.1 or later.

* If different nodes in a cluster were connected to different network subnets
  and if those subnets were assigned to different Active Directory sites, the
  site configuration information on the cluster was repeatedly updated.
  Because updates to the site configuration information require a refresh of
  the lsass service, this behavior caused authentication services to become
  slow or unresponsive.

* If a machine password was changed by a node while the lwreg process on another
  node was refreshing that node's lsass configuration, the lsass process on the
  second node could have cached both the old and new machine passwords. If this
  occurred, the lsass process unexpectedly restarted and clients connected to
  the affected node could not be authenticated. In addition, lines similar to
  the following appeared in the /var/log/messages file: 
  
  /lib/libc.so.7:thr_kill+0xc
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaPcachepEnsurePasswordInfoAndLock
  +0x9b6
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaPcacheGetMachineAccountInfoA
  +0x28
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_MachineCredentialsCacheInitialize
  +0x38
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_Activate+0x9d5
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaAdProviderStateCreate+0xb22
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_RefreshConfigurationCallback
  +0x792
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvRefreshConfiguration+0x432
  /usr/likewise/lib/lw-svcm/lsass.so:LsaSvcmRefresh+0x209
  /usr/likewise/lib/liblwbase.so.0:RefreshWorkItem+0x24
  /usr/likewise/lib/liblwbase.so.0:WorkThread+0x256
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine+0xec
  /lib/libthr.so.3:_pthread_getprio+0x15d


* Because OneFS sent an incorrect response to a NetBIOS session request, the
  request to connect was closed and the NetBIOS client could not connect to the
  cluster. When the session request was closed, lines similar to the following
  appeared in the packet capture:
  
  10.4.0.35     10.4.0.100      NBS     138 Session request
  10.4.0.100    10.4.0.35	TCP	66  netbios-ssn > 51660 [FIN, ACK]
  10.4.0.35     10.4.0.100	TCP	66  51660 > netbios-ssn [FIN, ACK]
  10.4.0.100    10.4.0.35	TCP	66  netbios-ssn > 51660 [ACK]
 
* If an Active Directory machine account password was changed by a node in a
  cluster, but the new password had not yet been replicated to all domain
  controllers in the Active Directory domain, errors similar to the following
  appeared in the /var/log/lsassd.log files stored on other nodes in the
  cluster, where [machine account] is the name of the machine and its domain:

  Recurring: Error on machine account [machine account]: The password is
  incorrect for the given username
  
  This issue would usually resolve itself when the password replication in the
  Active Directory domain had completed.

* NetBIOS requests sent over SMB 2 were not properly handled. As a
  result, the lwio process failed and lines similar to the following
  appeared in the /var/log/messages file:

  /lib/libc.so.7:thr_kill 0xc
  /usr/likewise/lib/liblwbase_nothr.so.0:__LwRtlAssertFailed 0x5a
  /usr/lib/libisi_ntoken.so.1 0x23d673:0x808490673
  /usr/lib/libisi_ntoken.so.1 0x243b4e:0x808496b4e
  /usr/lib/libisi_ntoken.so.1 0x2453c5:0x8084983c5
  /usr/lib/libisi_ntoken.so.1 0x2e450f:0x80853750f
  /usr/likewise/lib/liblwbase.so.0:EventThread 0x333
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine 0xec
  /lib/libthr.so.3:_pthread_getprio 0x15d
  
* In environments where Kerberos authentication was used to authenticate
  SMB clients to the cluster, a memory leak in the lwio process caused the
  amount of memory allocated to the process to steadily increase until the
  amount exceeded the maximum amount of allocated memory allowed, 4 GB.
  If the amount of memory allocated to the process exceeded the maximum
  amount allowed, the lwio process restarted and SMB clients connected to
  the affected node were disconnected.
  
* Intermittently, incoming SMB sessions were successfully authenticated and
  received the correct username but were mapped to the wrong SID. As a result,
  audit logs associated the incorrect SID with the affected user and the
  affected user was denied access to their files. In order to correct the 
  problem, the lsass process had to be restarted on all nodes in the cluster.

* OneFS permitted the use of forward slashes in path names
  and, in OneFS, forward slashes within an SMB request were
  silently converted to backslashes. This behavior did not
  comply with the SMB protocol, which specifies that such a
  request should fail and return the following error:
  OBJECT_NAME_INVALID
  Note
  OneFS 7.1.0.6 and later versions of OneFS comply with the
  SMB protocol. If an SMB request that contains a forward slash
  is received, an OBJECT_NAME_INVALID error is returned.
 
* Under rare circumstances, if a subprocess of the lwio process
  opened a new file handle on an existing lease at the same
  time that another subprocess was breaking the lease, the
  lwio process unexpectedly restarted. If the lwio process
  restarted, SMB clients that were connected to the affected
  node were disconnected.


* In some cases, while the lwio process was shutting down
  (because it was manually or automatically restarted), the lwio
  SRV component waited indefinitely for a file object to be freed
  and did not shut down. As a result, the lwio process could not
  restart and SMB clients could not connect to the affected
  node.

* The notify FD needs to be unregistered from the task before 
  we close it.

* Updates the SMB 1 maximum buffer size so that it can be configured
  to meet the requirements of Kazeon applications. To configure the
  SMB 1 maximum buffer size:
  1. Open an SSH connection on any node in the cluster and log on
  using the root account.
  2. Run the following command from the command line where
  [max_buffer] is the desired maximum buffer size:
  isi_gconfig
  registry.Services.lwio.Parameters.Drivers.srv.MaxBufferSizeSMB1= 
  [max_buffer]
  Note
  For optimal interoperability with Kazeon, the maximum buffer size
  should be set to 16644.

* Because OneFS relied on a function that could handle file
  descriptors with a maximum value of 1024, the lsass process
  unexpectedly restarted if it attempted to process file
  descriptors assigned a value higher than 1024. As a result,
  SMB users could not be authenticated for the few seconds it
  took for the lsass process to restart.

* Adds a setting to the OneFS registry that enables you to configure the
  maximum amount of memory that can be allocated to the lsass
  process. Without this setting, the maximum amount of memory that
  can be allocated to the lsass process is set to a default of 512 MB. If
  the system approaches that limit, LDAP connections are closed, and
  the following lines appear in the lsassd.log file:
  Error code 40286 occurred during attempt 0 of a ldap
  search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap
  search. Retrying.
  Error code 40286 occurred during attempt 2 of a ldap
  search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap
  search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap
  search. Retrying.
  Work with EMC Isilon Support to determine whether you need to
  configure the amount of memory allocated to the lsass process. The
  memory limit must be at least 512 MB, and no more than 1024 MB. If
  the memory limit is set outside that range, the system will restore the
  default value of 512 MB.

* If OneFS received a request from an SMB client whose
  Kerberos service ticket could not be decrypted, OneFS
  returned a STATUS_LOGON_FAILURE response to the SMB
  client that sent the request. If this response was sent, the
  affected SMB client might have experienced issues accessing
  files or applications that were stored on the cluster.
  Note
  In OneFS 7.1.0.6 and later, if OneFS receives a request from
  an SMB client whose Kerberos service ticket cannot be
  decrypted, a STATUS_MORE_PROCESSING_REQUIRED
  response is returned. This response prompts the affected
  SMB client to search for a secondary cluster. If the search for
  a secondary cluster fails, the affected SMB client could still
  experience issues accessing files or applications on the
  cluster.

* In the OneFS web administration interface, if you created a
  user mapping rule that contained incorrect syntax that
  included quote marks, the updated Access Zone could not be
  saved and the following error appeared:
  Your access zone edit was not saved
  Error #1: Rules parsing failed at ' ': syntax
  error, unexpected QUOTED, expecting BINARY_OP or
  UNARY_OP
  In addition, future attempts to create mapping rules
  sometimes also failed.

* If Microsoft Security Bulletin MS15-027 was installed on a Microsoft Active
  Directory server that authenticated SMB clients that were accessing an Isilon
  cluster, and if the server used the NTLMSSP challenge-response protocol, the
  SMB clients could not be authenticated. As a result, SMB clients could not
  access data on the cluster.
  
  For more information, see the following article on the EMC Online Support
  site:
  https://support.emc.com/kb/199379.
