SRM: log client disconnecting at debug level

Currently, if a client disconnects during the SSL/GSI handshake then
the EOFException is logged as just EOFException.  This is both
non-obvious and unnecessary as dCache is behaving correctly.

This patch updates the message to be meaningful and reduces the
log-level to debug.
SRM: don't talk to SpaceManager when disabled

There is a configuration value describing whether or not space-manager
is enabled.  Currently, SRM sends messages to space-manager even when
space-manager is disabled.  Because of this, sites are required to run
space-manager, even when it is disabled.

This patch alters the SRM so that if space-manager is disabled then not
communication with space-manager is attempted.  Under this circumstance,
SRM will report any space-token information for srmLs operations and
space-specific operations will fail with a friendly error message.
Remove deprecated code.

Breaks compatibility with components older than dCache 2.6.

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5531/
system-test: downgrade missing trust from an error to a warning

Currently, the system-test module checks whether the environment is
properly configured to run secure clients against the system-test.
If this test fails then the system-test build fails.

There are (at least) a couple of reasons why failing the build is
wrong:

  1.  there are situations where building the system-test should not
      dependend on being able to successfully test dCache via
      system-test (e.g., "mvn release")

  2.  the user may use a client that is configured to use the
      trust-store provided within system-test.  Therefore, missing
      trust in the default locations isn't always a problem.

This patch downgrades the test failing from an error to a warning.  The
patch also rewords the message to try to avoid some confusion
experienced by users.

Patch: https://rb.dcache.org/r/5533/
Acked-by; Tigran Mkrtchyan
Target: master
Fix NPE when a class providing a SOAP service returns nothing
gsidcap: fix regression introduced by 969903b5

The patch entitled "a step towards configurable cell names for gPlazma
and billing", committed master@969903b5 added support in various doors
for configuring the gPlazma and billing cell names.

Unfortunately, the part touching the gsidcap door was broken as the
resulting code attempts to create the LoginStrategy before the gPlazma
CellStub is defined.  This results in an NPE any time a client attempts
to connect to dCache.

This patch fixes that issue by creating the LoginStrategy after the
required gPlazma CellStub is defined.

Patch: http://rb.dcache.org/r/5537/
Acked-by: Gerd Behrmann
Target: master
Update patch based on Gerd's comments
system-test: add ability to autogenerate host credentials

The system-test module creates a self-contained dCache instance.  It
does, however, require a host certificate, which currently is stored
in git.  The certificate was signed by a throw-away CA.

The host certificate stored in git makes use of the Globus
non-standard "host-certificate" extension ("CN=host/<name>").  This,
together with the lack of any subjectAltName extension means that only
Globus software will accept the host certificate.

Also, since the process for generating the certificate wasn't
documented, when the certificate runs out, generating a new
certificate may take some effort to create.

This patch adds support in the populate script for generating a
suitable host-certificate using OpenSSL.  The script
hostCredentials can generate a CA credentials, generates the host
credentials and installs the CA certificate, CA signing_policy and
host credentials, throwing away the CA private key.

By default, the host certificate has various DNS subjectAltName,
but if the --only-localhost option is specified then only
DNS:localhost is uesd.

The --install option will install the generated CA files in
~/.globus/certificates, so trusting the throwaway CA.

Target: master
Patch: https://rb.dcache.org/r/5529/
Acked-by: Gerd Behrmann

This patch adds support for generating the required host-certificate
using OpenSSL.  The process is triggered by running an extra script.
The script may also be used to install the trusted CA.
axis: fix NPE when the class providing a SOAP service has void method

The LoggingRPCProvider wraps the standard Axis method-based dispatch
and adds better logging of what's happening.

If the method being invoked (corresponding to some SOAP method) is
declared void or the method returns a null value then the
LoggingRPCProvider suffers an NPE.

This patch fixes this problem.  It also distinguishes between a void
method and a method returning null.

Note #1. None of the SRM operations trigger this problem as all such
methods return something (a class following a *Response naming scheme)

Note #2. Axis allows a method to have multiple OUT values by passing
value-handle objects as arguments to methods.  A future version of
LoggingRPCProvider should detect such methods and log such multi-OUT
values.

Target: master
Request: 2.6
Patch: http://rb.dcache.org/r/5538/
Acked-by: Gerd Behrmann
SRM: log client disconnecting at debug level

It is possible for the client to "give up" on a connection during the
SSL/GSI handshake exchange.  For example, this can happen if the
client doesn't trust the server's certificate.

When this happens, an EOFException is logged; for example:

30 Apr 2013 19:31:59 (SRM-zitpcx6184) [] java.io.EOFException

This message is both unintelligible and unnecessary, as dCache is
behaving correctly under the circumstances.

This patch updates the message to be meaningful, including the
client's IP address and port number in the diagnostic context. It also
reduces the log-level to debug.

Target: master
Request: 2.6
Patch: http://rb.dcache.org/r/5534/
Acked-by: Gerd Behrmann
Switch values of sanatised variable to 'true' or 'false'
SRM: don't talk to SpaceManager when disabled

A recent patch (committed master@2ba5c9 and 2.2@d069ff) fixed an NPE.
The submitter mentioned concerns that this would "break something",
which turned out to be correct.  After the patch, SRM verbose ls
(and space-related operations) no longer function correctly if
space-manager is disabled.  This is because SRM verbose-ls always
sends a request to space-manager and, after the patch, space-manager
gives an error-response when running but configured to be disabled.

This patch alters the SRM so that if configuration shows that
space-manager is disabled then no communication with space-manager
is attempted.  SRM verbose ls will list all files are in no
space-reservations and the space-related operations will fail with
a friendly error message.

A side-effect of this patch is that the 'spacemanager' service is
no longer needed when space-manager is disabled.

Target: master
Request: 2.6
Request: 2.2
Patch: http://rb.dcache.org/r/5526/
Acked-by: Gerd Behrmann
gplazma2-xacml: fix regression on network address sort

module:  gplazma2-xacml

svn trunk@18137 altered NetworkUtils to use an immutable list for local addresses.  The XACML plugin needs to sort these according to external/internal.  This sort was failing and causing failure to load the plugin (undiscovered until now).

Patch copies the immutable list and then sorts.

Redeployed and authenticated using XACML.

Target: master
Patch: http://rb.dcache.org/r/5539
Require-notes: no
Require-book: no
Acked-by: Paul
Request 2.6
Parameterize log levels and log formats

The log levels and log formats are now customizable through
dcache.conf.

New configuration properties:

dcache.log.level.file
dcache.log.level.pinboard
dcache.log.level.remote
dcache.log.level.events
dcache.log.format.file
dcache.log.format.pinboard

Target: master
Require-notes: yes
Require-book: yes
Acked-by: Albert Rossi <arossi@fnal.gov>
Patch: http://rb.dcache.org/r/5530/
Remove version number handling for SVN

Since we no longer use SVN, we can simplify our Maven
project by not supporting SVN revision numbers.

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5532/
ftp: Log CertPath in case CertPath validation fails

Addresses the issue that if authentication fails with a certificate
chain validation error, the error message contains absolutely no
information about the certificate that triggered the failure.

Requires https://github.com/gbehrmann/JGlobus/tree/feature/certpathvalidationexception_includes_certpath

Target: trunk
Request: 2.6
Request: 2.5
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5543/
ftp: Log stack trace on authentication failure

A recent patch removed logging of stack trace during GSI/Kerberos
authentication failure. Although it is correct not to log a stack
trace for such a failure (it is not a bug), having a stack trace
while debugging JGlobus 2 is convenient. This patch adds logging
of the stack trace at trace level.

Target: trunk
Request: 2.6
Require-notes: no
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5547/
wevdav,xrootd,nfs: Fix blocking reverse DNS lookup

Addresses an issue in these doors that could cause the door to
become unresponsive.

Our monitoring services periodically poll our doors to get a list
of active transfers. The door did a reverse DNS lookup on the client
IP and this lookup could block the door.

Target: trunk
Request: 2.6
Request: 2.5
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5546/
don't use /opt/ paths in dcachesrm-gplazma.policy

There's still a place in the template file, where /opt is used, namely the
default for the kpwdPath property.

* Change the default value for the kpwdPath to "/etc/dcache/dcache.kpwd".

Actually I'd personally suggest introducing a new subdirectory like
/etc/dcache/access_control/
where access control related files should go into. This may include things like
grid-vorolemap, grid-mapfile, storage-authzdb or dcache.kpwd.
/etc/grid-security doesn't seem the right place for them, as they are not
necessarily grid-related.
But that could be done in another patch.

Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name>
use example.org in some more places

example.org is already used in most places as default domain name.

* Use example.org instead of real (not reserved) domain names in some more
  places.

Using example.org is already much better than using real domain names as it was
done in the past, but still it has some negative effects.
If a dCache instance really uses them, the example.org server will get
“attacked”.
Or it could be even a security problem, when someone manages to actually run a
services on example.org, which dCache tries to use then (and potentially
trusts).

The best way IMHO would be to mark all options where an example value is given
with some flag, that they _must_ be overridden.
Another alternative, that should work in practise is using a domain like
“example.invalid” as this should already be sorted out by the local nameservers.
And ”invalid” is a specially reserved (top level) domain.

Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name>