Squashed commit of the following:

commit f13fd991d99207f321c20642ef8c4d28c29c6703
Author: Dmitry Litvintsev <litvinse@fnal.gov>
Date:   Mon Jun 10 18:57:03 2013 -0500

    respect session read-only in SRM
    module: summary line

    what happened

    Ticket: 7842
    Patch: http://rb.dcache.org/r/5633/
    Acked-by: Al Rossi
    Target: trunk
    Require-book: no
    Require-notes: yes
    Bug: http://rt.dcache.org/Ticket/Display.html?id=7842
    Signed-off-by: Dmitry Litvintsev
    Request: 2.6

    RELEASE NOTES:
    SRM respects read-only session qualifier (as specified in storage-authzb or dcache.kpwd). That is
    if login record contains "read-only" qualifier SRM will refuse performing namespace modification
    functions with SRM_AUTHORIZATION_FAILURE error code
Ban all Diffie-Hellman ciphers in Java 1.7.0_6 and higher

Addresses an issue in SSL/TLS/GSI sessions that approximately one
out of 256 connections fail with an 'invalid padding' error. This
affects gridftp, webdav with https, httpd with https, SRM and gsidcap.
It should be noted that this significantly reduces the number of
available ciphers.

It appears that Diffie-Hellman is broken in Java 1.7.0_6 and higher. This
patch bans those ciphers if a broken version of Java is used.

The patch adds new configuration properties for configuring whether
certain cipher families are banned:

dcache.security.ciphers
webdav.security.ciphers
httpd.security.ciphers
gsidcap.security.ciphers
srm.security.ciphers
gridftp.security.ciphers

The latter are defined in terms of the first. The property names follow
the schema agreed upon at the 2013 developers workshop. The patch
introduces a new configuration property group called security. It is
intended for general security related properties like authentication,
authorization, cryptography, etc.

Target: trunk
Request: 2.6
Request: 2.2-sha2
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@gnal.gov>
Patch: http://rb.dcache.org/r/5616/
pool: Make xrootd max frame size configurable

Addresses the issue that the xrootdMoverMaxFrameSize property was
ignored by the xrootd mover.

Target: trunk
Request: 2.6
Require-notes: yes
Require-book: no
Acked-by: Dmitry Litvintsev <litvinse@fnal.gov>
Patch: http://rb.dcache.org/r/5622/
Squashed commit of the following:

commit f13fd991d99207f321c20642ef8c4d28c29c6703
Author: Dmitry Litvintsev <litvinse@fnal.gov>
Date:   Mon Jun 10 18:57:03 2013 -0500

    do not check gplazmaPolicy variable embedded gPlazma fragment
    module: do not check gplazmaPolicy variable embedded gPlazma fragment

    do not check gplazmaPolicy variable embedded gPlazma fragment

    Ticket:
    Acked-by: Tigran Mkrtchyan
    Patch: http://rb.dcache.org/r/5635/
    Target: trunk
    Require-book: no
    Require-notes: no
Inject configuration properties directly into spring cells

Addresses the issue that configuration properties had to be repeated
as cell arguments to make them available in spring. With this patch,
the cell environment is injected directly into the spring application
context, thus simplifying the batch files.

The patch updates all batch files instantiating UniversalSpringCell.

This change was discussed during the 2013 developers workshop.

A few properties have been altered:

- billing now uses 'poolmanager' rather than 'poolManager'. The
  'poolManager' property has been marked as forbidden.

- pnfsmanager's defaultPnfsServer properties has been marked
  obsolete. It only applied to PNFS and we no longer support PNFS.

Target: trunk
Require-notes: yes
Require-book: yes
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5623/
poolmanager: Make PSU collections thread safe and add accessors

The patch adds getters to the PSU to allow the 'bean properties' shell
commands to inspect the structure. Some entities were already exposed
through getters, others where not. Some entities were exposed through
non-getter methods.

While doing so, I discovered that many entities use non-thread safe
maps and sets internally. Even though the PSU uses a reader-writer
lock internally to protect updates, this isn't enough as we leak
references to the entities to the outside. Thus we can have concurrent
writes and reads on those collections. I replaced the collections
with thread safe equivalents.

I added setters and getters for many fields that were previously
accessed directly.

Target: trunk
Require-notes: yes
Require-book: no
Acked-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Patch: http://rb.dcache.org/r/5607/
Fix typo introduced in 99c801f7b8a3f9dbeea210464f253b87b2212cd6
webadmin: do not run billing service if database flag is off

module:  webadmin (billing)

The billing service which contacts the billing cell should not attempt to retrieve data if the billing database has been disabled.

The original code had planned to enable this through Spring profiles, and the property was already in place to do so, but in the shuffle between versions the actual spring <beans> stanza was not implemented.

However, after some testing it was discovered that profiles do not seem to play with Wicket Spring injection, and the @SpringBean(required=false) annotation does nothing to stop the Spring NoSuchBeanDefinition error.

We have therefore adopted a slightly different solution.  It turns out that it is only minimally invasive and fairly clean.

Patch: http://rb.dcache.org/r/5641
Target: master
Request: 2.6
Require-book: no
Require-notes: yes
Acked-by: Gerd

Testing:

Before the fix, with billingToDB=no but generatePlots=true, one would get

13 Jun 2013 16:59:59 (System) [] Uncaught exception in thread StandardBillingServiceRefresher
java.lang.reflect.UndeclaredThrowableException: null
        at com.sun.proxy.$Proxy9.getDcBytesHistogram(Unknown Source) ~[na:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.load(StandardBillingService.java:148) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.generatePlot(StandardBillingService.java:351) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.refresh(StandardBillingService.java:294) ~[classes/:na]
        at org.dcache.webadmin.controller.impl.StandardBillingService.run(StandardBillingService.java:307) ~[classes/:na]
        at java.lang.Thread.run(Thread.java:722) ~[na:1.7.0_19]
Caused by: diskCacheV111.util.TimeoutCacheException: Request to [>billing@local] timed out.
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:321) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:221) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.cells.CellStub.sendAndWait(CellStub.java:212) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]
        at org.dcache.services.billing.histograms.data.TimeFrameHistogramDataProxy.invoke(TimeFrameHistogramDataProxy.java:93) ~[dcache-core-2.7.0-SNAPSHOT.jar:2.7.0-SNAPSHOT]

With the patch applied, the following combinations were tried:

billingToDb=no, generatePlots=true:   the page is not rendered (as expected)
billingToDb=yes, generatePlots=false: the page is not rendered (as expected)
billingToDb=yes, generatePlots=true:  the page is rendered (as expected)

The TimeoutCacheException does not occur, thus producing no proxy error (since the client is turned off).

RELEASE NOTES:

Fixes a bug in the new billing setup where billingToDb=no, generatePlots=true does not turn off the billing client and a TimeoutCacheException is returned since there is no database-based request service on the BillingCell side.
webadmin: fix incorrect getter in StandardBillingService

module:  webadmin (billing)

The getPopupHeight() returns the width value.

The error is so minor and the patch so new (it has not been merged to 2.6 yet) that the fix requires no release notes.

Patch: http://rb.dcache.org/r/5646/
Target: master
Request: 2.6
Require-book: no
Require-notes: no
Acked-by: Gerd
spacemanager: unknown message have to be sent to Poolmanager

as SpaceManager works as a proxy, not all messages handled as
expected.

Ticket: 7844
Acked-by: Gerd Behrmann
Target: trunk, 2.6
Require-book: no
Require-notes: yes
Merge branch 'iss7844'

Acked-by: Gerd Behrmann