Ban elliptic-curve ciphers to prevent unsupported ciphers from being selected

Elliptic-Curve (EC) based ciphers offer advantages over RSA- and
DSA-based ciphers and are being introduced, albeit slowly.  OpenJDK (6 &
7) use external libraries, such as libnss3, to provide support for
various cipher-suites, including support for EC ciphers.  The libnss3
library provide only partial support for all of the EC-based ciphers.

Unfortuantely, the generic front-end believes all ciphers are supported.
So, if during an SSL/TLS negotiation, the client requests an EC cipher
that libnss3 doesn't support, the SSLEngine may choose that cipher.  The
result is an exception being thrown with the cryptic
'CKR_DOMAIN_PARAMS_INVALID' message.

Rather than trying to deploy work-arounds in the client or trying to
document how to disable EC-support in the server using JVM-related
configuration, this patch bans the EC ciphers programatically.

Patch: http://rb.dcache.org/r/5527/
Acked-by: Gerd Behrmann
Target: master
Request: 2.6

Conflicts:
	modules/dcache-ftp/src/main/java/diskCacheV111/doors/GsiFtpDoorV1.java
	modules/javatunnel/src/main/java/javatunnel/GsiTunnel.java
webdav: Fix interpretation of client cert properties

Addresses a problem that causes the interpretation of the
webdavWantClientAuth and webdavNeedClientAuth properties to
be reversed.

JGlobus 2 seems to have a different interpretation of these
flags. The relevant JGlobus code is:

	 if (this.requireClientAuth.booleanValue() == Boolean.TRUE) {
             this.sslEngine.setNeedClientAuth(this.requireClientAuth.booleanValue());
	 } else
             this.sslEngine.setWantClientAuth(!this.acceptNoClientCerts.booleanValue());

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
An earlier patch added support for banning ciphers through the JGlobus
library.  The same problem exists for the connectors supplied with
Jetty, which are used in the WebDAV/HTTP door and the webadmin.

This patch adds support for banning problematic ciphers for
these services.

Target: master
Request: 2.6
Signed-off-by: Paul Millar
Upgrade to JGlobus 2.0.7-SNAPSHOT.
system-test: add ability to autogenerate host credentials

The system-test module creates a self-contained dCache instance.  It
does, however, require a host certificate, which currently is stored
in git.  The certificate was signed by a throw-away CA.

The host certificate stored in git makes use of the Globus
non-standard "host-certificate" extension ("CN=host/<name>").  This,
together with the lack of any subjectAltName extension means that only
Globus software will accept the host certificate.

Also, since the process for generating the certificate wasn't
documented, when the certificate runs out, generating a new
certificate may take some effort to create.

This patch adds support in the populate script for generating a
suitable host-certificate using OpenSSL.  The script
hostCredentials can generate a CA credentials, generates the host
credentials and installs the CA certificate, CA signing_policy and
host credentials, throwing away the CA private key.

By default, the host certificate has various DNS subjectAltName,
but if the --only-localhost option is specified then only
DNS:localhost is uesd.

The --install option will install the generated CA files in
~/.globus/certificates, so trusting the throwaway CA.

Target: master
Patch: https://rb.dcache.org/r/5529/
Acked-by: Gerd Behrmann

This patch adds support for generating the required host-certificate
using OpenSSL.  The process is triggered by running an extra script.
The script may also be used to install the trusted CA.
(cherry picked from commit 4e234a0f093c9b8b822aafe0c2aaf4886a964419)
Ban all Diffie-Hellman ciphers in Java 1.7.0_6 and higher

Addresses an issue in SSL/TLS/GSI sessions that approximately one
out of 256 connections fail with an 'invalid padding' error. This
affects gridftp, webdav with https, httpd with https, SRM and gsidcap.
It should be noted that this significantly reduces the number of
available ciphers.

It appears that Diffie-Hellman is broken in Java 1.7.0_6 and higher. This
patch bans those ciphers if a broken version of Java is used.

The patch adds new configuration properties for configuring whether
certain cipher families are banned:

dcache.security.ciphers
webdav.security.ciphers
httpd.security.ciphers
gsidcap.security.ciphers
srm.security.ciphers
gridftp.security.ciphers

The latter are defined in terms of the first. The property names follow
the schema agreed upon at the 2013 developers workshop. The patch
introduces a new configuration property group called security. It is
intended for general security related properties like authentication,
authorization, cryptography, etc.

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@gnal.gov>
Patch: http://rb.dcache.org/r/5616/