Ban elliptic-curve ciphers to prevent unsupported ciphers from being selected

Elliptic-Curve (EC) based ciphers offer advantages over RSA- and
DSA-based ciphers and are being introduced, albeit slowly.  OpenJDK (6 &
7) use external libraries, such as libnss3, to provide support for
various cipher-suites, including support for EC ciphers.  The libnss3
library provide only partial support for all of the EC-based ciphers.

Unfortuantely, the generic front-end believes all ciphers are supported.
So, if during an SSL/TLS negotiation, the client requests an EC cipher
that libnss3 doesn't support, the SSLEngine may choose that cipher.  The
result is an exception being thrown with the cryptic
'CKR_DOMAIN_PARAMS_INVALID' message.

Rather than trying to deploy work-arounds in the client or trying to
document how to disable EC-support in the server using JVM-related
configuration, this patch bans the EC ciphers programatically.

Patch: http://rb.dcache.org/r/5527/
Acked-by: Gerd Behrmann
Target: master
Request: 2.6
dcache: billing -- fix error in liquibase varchar changeset

module: dcache

The liquibase changeset 4.1.7 was discovered to contain an off-by-one error in the string used to test the condition for changing the varchar length in the billing tables (the actual length of the string was 256, not 257). As a result, 4.1.7. 4.1.8 and 4.1.9 never will run, and all billing installations created by liquibase (which hardcodes the default to 256) remained as such.

The reason for the requested change was that the path and errormessage attributes of certain tables can well exceed 256.

The new changesets correct the error.

Target: master
Patch: http://rb.dcache.org/r/5555
Require-book: no
Require-notes: yes
Request: 2.6
Acked-by: Dmitry

Testing done:  Ran changesets on both new and previously installed instances, observing correct attribute definitions in the table afterwards.

RELEASE	NOTES: 	Fixes string lengths in billing databse tables. Tables created automatically contained character columns limited to 256 which is too restrictive for path and errormessage columns in billinginfo, doorinfo and storageinfo tables. Additionaly, the length of pnfsid string was limited to 36.
A previous patch designed to address this issue failed to so.
gplazma: Rename dcache-gsi module to gplazma2-gsi

The gsi module used the dcache- prefix even though it is independent
of all dcache components. It is much more closely tied to the gPlazma 2
project (which is independent of dCache). Hence this patch renames the
module.

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5581/
webadmin: Rename module to dcache-webadmin

Webadmin is a dCache component (it relies heavily on dCache classes) and
the module should thus be called dcache-webadmin to follow the convention
used for other modules.

Target: trunk
Require-book: no
Require-notes: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5583/
packaging: Move DEB and RPM packaging to Maven and remove Ant configuration

Packaging was the only thing we still did (partially) through ant. Our
packaging is however mostly about putting the right files together and
calling the native packaging tools, and that we can do just as easily
from Maven.

This patch moves the RPM and DEB packaging to the fhs and srmclient
Maven modules. The packaging is triggered by activating the profiles
rpm and deb by using the -P option of Maven. The profiles are exclusive
and must not be activated at the same time. Like the old Ant targets,
the profiles allow the build number and local version strings to be
modified by overriding properties through the -D option of Maven.

Solaris packaging tools are moved to the FHS module too, I do however
not have a Solaris system for testing and thus I leave it to somebody
else to define the necessary Maven profile to invoke the packaging.

I removed all legacy packaging components and all Ant files. This
includes a couple of old spec files, including for dcap. Like for
the Solaris package, I hope somebody else can ressurect this within
Maven (or move the dcap client code out of the dCache repository and
into its own repo).

Finally, I moved the packaging related Maven modules into its
own top-level directory to separate them from the modules that
contain our source code.

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5589/
Fix incremetal compilation

The maven compiler plugin version 3.1 contains fixes to incremental
compilation. In addition to upgrading the plugin, the patch removes
an empty file in the cells module that triggers recompilation (since
it doesn't generate a class file and thus always appears as a change
in the source).

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Acked-by: Karsten Schwank <karsten.schwank@desy.de>
Patch: http://rb.dcache.org/r/5590/
logback-test-config: Synchronize logback version with dCache

This is the logback version used during tests.

Target: trunk
Require-book: no
Require-notes: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5592/
Use correct junit dependency

It used to be the case that junit contained the Hamcrest classes rather
than having a Maven dependency on the Hamcrest artifact. To avoid
conflicts, junit provided the junit-dep artifact.

Since junit 4.11, Hamcrest is now specified as a dependency and it
is no longer necessary to use junit-dep.

Target: trunk
Require-notes: no
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5593/
pool: Configure timeout for pool to pool transfer

Addresses the issue that a pool to pool transfer does not time out
if the underlying TCP connection "gets stuck".

Back when we used DCAP for pool to pool transfers, we configured TCP
keep alive to ensure that we eventually get a timeout if the TCP stacks
of the two operating systems disagree about the state of the TCP
connection. Ever since we switched to HTTP, this functionality was lost.

At NDGF we observed a situation in which a migration from one pool to
another got stuck because the TCP connection got into an inconsistent
state. The target pool saw the connection as established, while the
source pool no longer had a connection. The transfer forever stayed
in the DoorFinished state, as dCache expected that the TCP connection
would eventually be closed (since dCache knew it had been closed on the
source pool already).

We cannot get Sun's HTTP client to enable TCP keep alive, however we
can configure connect and read timeouts. Since we only ever need these
timeouts for the rare case when the OSes get confused, I don't see a
reason to make these values end user configurable. I have simply hard
coded some conservative timeout values.

Target: trunk
Request: 2.6
Request: 2.2
Require-notes: yes
Require-book: no
Acked-by: Paul Millar <paul.millar@desy.de>
Patch: http://rb.dcache.org/r/5556/