chimera: update tags mtime on re-write

keep nfs client cache happy

Acked-by: Dmitry Litvintsev
Patch: http://rb.dcache.org/r/5617/
Target: trunk, 2.6, 2.2
Require-book: no
Require-notes: no
webdav: Fix interpretation of client cert properties

Addresses a problem that causes the interpretation of the
webdavWantClientAuth and webdavNeedClientAuth properties to
be reversed.

JGlobus 2 seems to have a different interpretation of these
flags. The relevant JGlobus code is:

	 if (this.requireClientAuth.booleanValue() == Boolean.TRUE) {
             this.sslEngine.setNeedClientAuth(this.requireClientAuth.booleanValue());
	 } else
             this.sslEngine.setWantClientAuth(!this.acceptNoClientCerts.booleanValue());

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5615/
Add support for banning problematic ciphers for Jetty SSL connectors

An earlier patch added support for banning ciphers through the JGlobus
library.  The same problem exists for the connectors supplied with
Jetty, which are used in the WebDAV/HTTP door and the webadmin.

This patch adds support for banning problematic ciphers for
these services.

Target: master
Request: 2.6
Signed-off-by: Paul Millar <paul.millar@desy.de>
Acked-by: Gerd Behrmann <behrmann@nordu.net>
Patch: http://rb.dcache.org/r/5614/
Require-notes: yes
Require-book: no
scripts: fix invalid path in dcache-pool-meta-preupgrade

Acked-by: Gerd Behrmann
Target: trunk, 2.6
Require-book: no
Require-notes: no
chimera:  fix corruption of directory mode on tag update

in case up create/update of a directory tag, the directory mode was
corrupted as  setInodeAttributes was used.

This is a simple fix before the complete set/get attribute rewrite.

Acked-by: Gerd Behrmann
Target: trunk, 2.6
Require-book: no
Require-notes: yes
pool: Improve resilience against broken SI files

Addresses an issue in which corrupt SI files could cause pool
startup to fail. Eg. NPE or OOM during deserialization would
cause the pool to fail and it would not even log the file
triggering the problem. Such exceptions would typically be
caused by corrupt length fields or similar invalid data in
the SI file.

Also improved the exception chaining and logging in this part
of the pool.

The problem was reported on the user-forum list.

Target: trunk
Request: 2.6
Request: 2.2
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5609/
ftp: Remove duplicate session ID in NDC

Addresses the issue that the session ID is stored twice in the diagnostic
context of log messages generated by the FTP door.

The NDC is already initialized with the session ID in Tranfer#initSession.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@fnal.gov>
Patch: http://rb.dcache.org/r/5610/
billing: restructure to use service-oriented architecture

Combines four patches.

5415: Modify billing DAO to support p2p attribute and new request API (2)

module: core billing db/dao

Part 2.

This patch builds on http://rb.dcache.org/r/5413 to address the following:

A.  Previous versions of the billing plot generation relied on the placement of the generating cell (billing) on the same file partition as the web server.  This has made the billing plots unusable at DESY.

B.  In the current billing data tables there is no way to track migration/pool-to-pool operations as distinct from door-initiated uploads and downloads.

In support of these,

- An interface for timestamped data objects (ITimestamped) has been moved out of the billing package in core and placed in common; a second interface, IHistogramData, replaces IPlotData.  Plotting and histogram data are thus conceptually separated.

- The DAO objects have undergone small redesigning and extensions for p2p operations

- General cleanup and adjustment of main DAO implementation class

- Liquibase changelog to modify the tables

- Standalone migration script for updating data with p2p attribute values.

-----------------------------------------------------------------------------

5416: Add billing request API, handlers, and histogram implementation (3)

module: billing database and cell

Part 3.

This patch refactors the billing functionality so that it now is service-oriented.  In order to do so, we have added a general API layer for remote requests to the billing cell, providing one concrete implementation, that for histogram data.  The billing package in core has been restructured so that the histogram abstraction is distinct from the plot abstraction (such that plot generation can take place elsewhere, on the calling end).

New interfaces and data objects have been provided which allow for the wire transmission of an implementation-neutral data wrapper for histogram data; a service interface supporting this transfer is also implemented, with the client using the synchronous cell endpoint sendAndWait call to talk to the service, which in turn takes the request and interprets it via introspection in order invoke a method on the IBillingInfoAccess interface and return the query result to the caller.

The histogram request semantics are now the layer at which the specific JDO queries are articulated.

As stated, this implementation is actually based on a more general API for BillingRequests and their handlers, so that additional handlers could be added in the future.  The handlers are mapped by the BillingDatabase to the return type of the request object they are responsible for.

-----------------------------------------------------------------------------

5417: Refactor Jaida plot modules based on new request API (4)

module: billing plots

Part 4.

The billing package in core has been restructured so that the histogram abstraction is distinct from the plot abstraction.  This patch refactors plotting against the new APIs.  It is still implemented using JAIDA.  While it still resides in the dcache core module, it is actually used by the webadmin service.

We have also modified what is and what is not exposed in terms of plot configuration.  Aside from the choices for style and scale, property configuration is internal.  plotPropertiesFile path is no longer used.

The plot generation interfaces, along with the underlying JAIDA implementation, have be extended to produce the new p2p plots.

The plots generated currently use connected data points and a log scale; however, DESY has plots which use an bar/outline style. We would like to allow the installation or the user to display the plots using a few simple options; hence, we have added options and default properties for them:

The plot style can be CONNECTED, OUTLINE or FILLED.  If OUTLINE, the first histogram appears as a filled bar and all others overlaid are outlines only.  FILLED, on the other hand, overlays histograms opaquely over each other.  The default can be set via the property billing.plot.default-style.  Scale can be "lin" (linear) or "log" (logarithmic); default property set via billing.plot.default-scale.  (These options are actually made available via user-facing choices on the new billing plots page; see the final patch in this series).

-----------------------------------------------------------------------------

5578: Changes to webadmin to accommodate new billing SOA; no plot rendering options (5)
module: webadmin billing

Part 5.  Changes to webadmin in connection with the reworked billing infrastructure.

Version of 5418 in which the plot rendering options are not exposed to the user.

Conversion to implementation-specific histograms and plots (in the current case, using the org.freehep packages) now takes place on the receiving end of the call.  The JAIDA-based classes are included in the core module, but are now utilized inside of the webadmin container.

This is accomplished by adding a service abstraction and implementation to the controller package of webadmin; this service is used by the billing page.

Refresh can be achieved (a) by forcing it with the refresh button, (b) leaving the window open Ajax auto-refresh is added to the form, run once every refresh interval) and/or (c), a daemon thread in the service which runs at the refresh interval.

Property configuration is internal.  plotPropertiesFile path is no longer used.

The plot style can be CONNECTED, OUTLINE or FILLED.  If OUTLINE, the first histogram appears as a filled bar and all others overlaid are outlines only.  FILLED, on the other hand, overlays histograms opaquely over each other.  The default can be set via the property billing.plot.default-style.  Scale can be "lin" (linear) or "log" (logarithmic); default property set via billing.plot.default-scale.  Once the default is selected, this is the form in which the service serves up the plots to everyone.

-----------------------------------------------------------------------------

Testing:

For the redesign, a fully redeployed RPM was tested with the billing cell running both inside and outside the httpd domain.  Tests for the following conditions:

    - reload with no plots
    - reload with unexpired plots
    - reload with expired plots
    - force refresh

were run in Firefox, Safari and Chrome.

Also tested were the default settings for the style and scaling, and switching between those options.

For p2p, multiple migrations done from pool to pool through admin interface and logs/database/plots checked for consistency.

-----------------------------------------------------------------------------

Patch: http://rb.dcache.org/r/5415
Patch: http://rb.dcache.org/r/5416
Patch: http://rb.dcache.org/r/5417
Patch: http://rb.dcache.org/r/5578
Acked-by: Gerd
Target: master
Require-book: yes
Require-notes: yes
Request: 2.6

RELEASE NOTES:
BOOK:
Draw attention to the possibility of adding a clause in the accounting logs (format for mover messages): '[p2p=true/false]'.  The database schema for the billinginfo table has been modified to include this boolean 'p2p' indicating a pool-to-pool transfer.  An sql script for migrating old data (an optional procedure to make the billing table consistent which will require several hours of downtime) is included (/usr/share/dcache/migration/migrate_to_billing_with_p2p.sql).

The billing cell now is independent of the domain where the plots are rendered (the webadmin service); there is no longer a requirement to run billing on the same file partition as the httpd domain.  note that "billingToDb" needs to be visible only to the billing service, and "generatePlots" only to the httpd service.  Note that plotPropertiesFile is obsolete and no longer used. There several new properties for controlling plot types.

webadmin.billing-plot.refresh-threshold=5

webadmin.billing-plot.height=800

webadmin.billing-plot.width=1200

(one-of?CONNECTED|OUTLINE|FILLED)webadmin.billing-plot.default-style=CONNECTED

(one-of?lin|log)webadmin.billing-plot.default-scale=log
nfs: allow protocol family name be configurable

The protocol family name used by LoginBroker and published
as supported transfer protocol by SRM.

Target: trunk, 2.2, 2.6
Ticket: #7233, #7874
Require-notes: yes
Require-book: yes

Acked-by: Paul Millar
Acked-By: Gerd Behrmann
Patch: http://rb.dcache.org/r/5020
Squashed commit of the following:

commit f13fd991d99207f321c20642ef8c4d28c29c6703
Author: Dmitry Litvintsev <litvinse@fnal.gov>
Date:   Mon Jun 10 18:57:03 2013 -0500

    respect session read-only in SRM
    module: summary line

    what happened

    Ticket: 7842
    Patch: http://rb.dcache.org/r/5633/
    Acked-by: Al Rossi
    Target: trunk
    Require-book: no
    Require-notes: yes
    Bug: http://rt.dcache.org/Ticket/Display.html?id=7842
    Signed-off-by: Dmitry Litvintsev
    Request: 2.6

    RELEASE NOTES:
    SRM respects read-only session qualifier (as specified in storage-authzb or dcache.kpwd). That is
    if login record contains "read-only" qualifier SRM will refuse performing namespace modification
    functions with SRM_AUTHORIZATION_FAILURE error code
Ban all Diffie-Hellman ciphers in Java 1.7.0_6 and higher

Addresses an issue in SSL/TLS/GSI sessions that approximately one
out of 256 connections fail with an 'invalid padding' error. This
affects gridftp, webdav with https, httpd with https, SRM and gsidcap.
It should be noted that this significantly reduces the number of
available ciphers.

It appears that Diffie-Hellman is broken in Java 1.7.0_6 and higher. This
patch bans those ciphers if a broken version of Java is used.

The patch adds new configuration properties for configuring whether
certain cipher families are banned:

dcache.security.ciphers
webdav.security.ciphers
httpd.security.ciphers
gsidcap.security.ciphers
srm.security.ciphers
gridftp.security.ciphers

The latter are defined in terms of the first. The property names follow
the schema agreed upon at the 2013 developers workshop. The patch
introduces a new configuration property group called security. It is
intended for general security related properties like authentication,
authorization, cryptography, etc.

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@gnal.gov>
Patch: http://rb.dcache.org/r/5616/
pool: Make xrootd max frame size configurable

Addresses the issue that the xrootdMoverMaxFrameSize property was
ignored by the xrootd mover.

Target: trunk
Request: 2.6
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@fnal.gov>
Patch: http://rb.dcache.org/r/5622/
Squashed commit of the following:

commit f13fd991d99207f321c20642ef8c4d28c29c6703
Author: Dmitry Litvintsev <litvinse@fnal.gov>
Date:   Mon Jun 10 18:57:03 2013 -0500

    do not check gplazmaPolicy variable embedded gPlazma fragment
    module: do not check gplazmaPolicy variable embedded gPlazma fragment

    do not check gplazmaPolicy variable embedded gPlazma fragment

    Ticket:
    Acked-by: Tigran Mkrtchyan
    Patch: http://rb.dcache.org/r/5635/
    Target: trunk
    Require-book: no
    Require-notes: no
Inject configuration properties directly into spring cells

Addresses the issue that configuration properties had to be repeated
as cell arguments to make them available in spring. With this patch,
the cell environment is injected directly into the spring application
context, thus simplifying the batch files.

The patch updates all batch files instantiating UniversalSpringCell.

This change was discussed during the 2013 developers workshop.

A few properties have been altered:

- billing now uses 'poolmanager' rather than 'poolManager'. The
  'poolManager' property has been marked as forbidden.

- pnfsmanager's defaultPnfsServer properties has been marked
  obsolete. It only applied to PNFS and we no longer support PNFS.

Target: trunk
Require-notes: yes
Require-book: yes
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5623/
poolmanager: Make PSU collections thread safe and add accessors

The patch adds getters to the PSU to allow the 'bean properties' shell
commands to inspect the structure. Some entities were already exposed
through getters, others where not. Some entities were exposed through
non-getter methods.

While doing so, I discovered that many entities use non-thread safe
maps and sets internally. Even though the PSU uses a reader-writer
lock internally to protect updates, this isn't enough as we leak
references to the entities to the outside. Thus we can have concurrent
writes and reads on those collections. I replaced the collections
with thread safe equivalents.

I added setters and getters for many fields that were previously
accessed directly.

Target: trunk
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5607/
Fix typo introduced in 99c801f7b8a3f9dbeea210464f253b87b2212cd6
webadmin: do not run billing service if database flag is off

module:  webadmin (billing)

The billing service which contacts the billing cell should not attempt to retrieve data if the billing database has been disabled.

The original code had planned to enable this through Spring profiles, and the property was already in place to do so, but in the shuffle between versions the actual spring <beans> stanza was not implemented.

However, after some testing it was discovered that profiles do not seem to play with Wicket Spring injection, and the @SpringBean(required=false) annotation does nothing to stop the Spring NoSuchBeanDefinition error.

We have therefore adopted a slightly different solution.  It turns out that it is only minimally invasive and fairly clean.

Patch: http://rb.dcache.org/r/5641
Target: master
Request: 2.6
Require-book: no
Require-notes: yes
Acked-by: Gerd

Testing:

Before the fix, with billingToDB=no but generatePlots=true, one would get

13 Jun 2013 16:59:59 (System) [] Uncaught exception in thread StandardBillingServiceRefresher
java.lang.reflect.UndeclaredThrowableException: null
        at com.sun.proxy.$Proxy9.getDcBytesHistogram(Unknown Source) ~[na:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.load(StandardBillingService.java:148) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.generatePlot(StandardBillingService.java:351) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.refresh(StandardBillingService.java:294) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.run(StandardBillingService.java:307) ~[classes/:na]
        at java.lang.Thread.run(Thread.java:722) ~[na:1.7.0_19]
Caused by: diskCacheV111.util.TimeoutCacheException: Request to [>billing@local] timed out.
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:321) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:221) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:212) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.services.billing.histograms.data.TimeFrameHistogramDataProxy.invoke(TimeFrameHistogramDataProxy.java:93) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]

With the patch applied, the following combinations were tried:

billingToDb=no, generatePlots=true:   the page is not rendered (as expected)
billingToDb=yes, generatePlots=false: the page is not rendered (as expected)
billingToDb=yes, generatePlots=true:  the page is rendered (as expected)

The TimeoutCacheException does not occur, thus producing no proxy error (since the client is turned off).

RELEASE NOTES:

Fixes a bug in the new billing setup where billingToDb=no, generatePlots=true does not turn off the billing client and a TimeoutCacheException is returned since there is no database-based request service on the BillingCell side.
webadmin: fix incorrect getter in StandardBillingService

module:  webadmin (billing)

The getPopupHeight() returns the width value.

The error is so minor and the patch so new (it has not been merged to 2.6 yet) that the fix requires no release notes.

Patch: http://rb.dcache.org/r/5646/
Target: master
Request: 2.6
Require-book: no
Require-notes: no
Acked-by: Gerd
spacemanager: unknown message have to be sent to Poolmanager

as SpaceManager works as a proxy, not all messages handled as
expected.

Ticket: 7844
Acked-by: Gerd Behrmann
Target: trunk, 2.6
Require-book: no
Require-notes: yes
libs: update jpnfs to 0.5.1

with following bug fixes and improvements:

- support for old file handles, which will allow to update nfs server without
  remount of existing clients (important for backtort to 2.2).

- reject mount from clients which do not have any export entries.
- respect root user if no_root_squash option is specified in exports file

  [3eb23ef] vfs: fix no_root_squash exports
  [5c12e5d] vfs: support old file handles
  [694da2f] vfs: construct new file handles from old one
  [513d265] test: add unit test for FileHandle and FileHandleBuilder
  [56d803b] nfsv4: consult export file on getRootInode()

Acked-by: Gerd Behrmann
Target: trunk, 2.6
Require-book: no
Require-notes: yes