Release notes for Model 204 version 8.0

Overview

These release notes contain installation and features information for the Rocket Model 204 version 8.0 release. Before beginning your installation, please read through this information about product installation and changes.

New in this release

The table below cites some highlights of Model 204 version 8.0. For a full list of features, refer to the Table of Contents.

Category	Feature
Data access	Imagine Transparency allows files in an Imagine database to be accessed from Model 204 as if they were native files, using the new IMAGINET Janus port type. The new SOUL Imagine class lets applications drive Imagine Transparency broker requests directly.
Security	Janus SSL ports now support TLS 1.3 (RFC 8446) for both client and server connections, including client certificate authentication and post-handshake authentication. The new SSH Janus port type provides a built-in SSH server with trusted public-key login.
Performance	The SOUL compression functions now exploit IBM z15 DFLTCC hardware for deflate and inflate operations.
New commands	New commands including DISPLAY DSNAMES, DISPLAY IMAGINESYNC, and IMAGINE; new JANUS subcommands for Imagine Transparency and SSH; and changed output from VIEW FILEORG and VIEW CURLOC. See New and changed commands.

Imagine Transparency support

A new facility called Imagine Transparency is now available to allow files in an Imagine database to be accessed from Model 204 as if they were native files. Applications can issue ordinary SOUL FIND, FOR EACH RECORD, and update statements against a Transparency file, and Model 204 transparently retrieves and updates the underlying records through an Imagine broker.

A new port type, IMAGINET, is now available. It allows Model 204 files to be stored on an Imagine server rather than in operating system files. A new option on the ALLOCATE command indicates that a file is to be accessed via the IMAGINET port rather than from operating system files.

The following related features support Imagine Transparency:

• The IMAGINE command controls Transparency operations, including IMAGINE EXTRACT (extract records into an Imagine file) and IMAGINE SYNC (synchronize an Imagine file with its underlying database).
• The DISPLAY IMAGINESYNC command displays the status of outstanding Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.
• The RELEASE statement has a new RELEASE IMAGINE RECORDS form that releases the records held for the current Transparency transaction. An optional COMMIT or BACKOUT keyword commits or backs out the associated Imagine transaction, and an optional CLEARLISTS keyword also clears associated $lists and StringLists.
• The new SOUL Imagine class lets applications interact with the Imagine Transparency broker for the current transaction. It is a collection of shared methods (there is no Imagine object), including Call, which runs Imagine code on the broker and accepts StringList and DollarList parameters and an optional apsySuffix named parameter, along with methods that return the broker version, DBS name, and APSY suffix. See the List of Imagine methods.
• A single IMAGINET port can route to multiple Imagine database servers (DBS), selected by an APSY suffix character. The suffix-to-DBS mappings are managed with the new JANUS ADDSUFFIX, JANUS DELETESUFFIX, JANUS DISPLAYSUFFIX, and JANUS SUFFIXSTAT commands, and the active suffix and DBS name are available to SOUL through the Imagine class.

SOUL (User Language) enhancements

Imagine class

The new Imagine class lets SOUL applications interact with the Imagine Transparency broker for the current transaction. See Imagine Transparency support for details.

BrokerCallError class

The new BrokerCallError class represents an error returned by an Imagine Transparency broker call, such as a call made with the Call method of the Imagine class.

Record retrieval by RecordId

The Record class can now create and retrieve a record directly from a recordId:

• The new NewFromRecordId constructor creates a Record object from a recordId, optionally in a named file.
• The new ImagineFile function returns the Imagine file associated with a Record object.

See the List of Record methods for the complete set of Record methods.

$LISTFINDI_MULT functions

The new $LISTFINDI_MULT, $LISTFINDI_MULT_SUB, and $LISTFINDI_MULT_UP $functions locate, or build a subset of, the items in an $list that match up to eight image-item values. $LISTFINDI_MULT_UP searches the $list in the backward (up) direction.

Janus product enhancements

TLS 1.3 support

Janus SSL ports now support TLS 1.3 (RFC 8446) for both client and server connections. TLS 1.3 provides improved security and performance over TLS 1.2, including a simplified handshake with fewer round trips, and the removal of legacy features such as renegotiation.

The following TLS 1.3 cipher suites are supported:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384

Key exchange is performed using X25519 (Curve25519 Elliptic Curve Diffie-Hellman, per RFC 7748). Certificate authentication uses RSA-PSS signatures.

Key derivation uses the HKDF-based key schedule defined in RFC 8446, replacing the PRF-based approach of earlier TLS versions.

TLS 1.3 is enabled by default on ports that allow TLS 1.2. To restrict a port to earlier protocol versions, use the existing SSLVERSION parameter on the JANUS DEFINE command.

Client-side TLS 1.3 and post-handshake authentication

Janus client connections (for example, clients built with the $SOCK functions or the equivalent Socket class methods, and Janus Web Server outbound HTTPS requests) now negotiate and complete a full TLS 1.3 handshake as the client, including X25519 key exchange, the HKDF-based key schedule, and RSA-PSS certificate verification of the server.

Client certificate authentication is supported both during the initial handshake and after it completes. When a TLS 1.3 server sends a post-handshake CertificateRequest (RFC 8446 Section 4.6.2) — for example, when a server application requests a client certificate on a connection that did not originally require one — the Janus client automatically responds with its Certificate, CertificateVerify, and Finished messages, allowing the authenticated request to proceed without interrupting the connection.

No application changes are required. Post-handshake authentication is used automatically when a server requests it and a client certificate is available for the port.

Janus SSH server

A new SSH Janus port type provides a built-in SSH (Secure Shell) server, allowing users to connect to a Model 204 Online from a standard SSH client over an encrypted connection. An SSH port is defined with the JANUS DEFINE command; for example:

JANUS DEFINE SSHPORT 5996 SSH 10 SSL PROFILE SSH.PKEY

In addition to password authentication, SSH ports support trusted public-key login, in which a user is authenticated by an SSH public key that has been registered with the port. The following commands manage trusted keys (see Janus SSH for full details):

Command	Description
JANUS TRUST portname userid base64key	Registers a trusted SSH public key for userid on the named SSH port.
JANUS DELTRUST portname userid	Removes the trusted key for userid on the named port.
JANUS DISPLAYTRUST [portname]	Displays the trusted keys registered on a port (or on all ports).
JANUS DISTOFU [portname]	Displays keys that were auto-registered by trust-on-first-use (TOFU).
JANUS SSHKEY	Displays the SSH public key of the current user.

Trust-on-first-use (TOFU) can be enabled on an SSH port with the TOFU option on the JANUS DEFINE command. When enabled, a user's public key is automatically registered on first connection, up to a specified maximum number of keys.

TCP keep-alive on Janus ports

The TCP keep-alive interval for a Janus port can now be set with the TCPKEEPALIVE parameter on the JANUS DEFINE command.

Security enhancements

SUBSYSMGMT and DICTADMIN without preauthorization

System managers can now use the SUBSYSMGMT and DICTADMIN subsystems without being separately preauthorized for them.

Performance enhancements

Hardware-accelerated deflate/inflate compression

The SOUL compression functions (Deflate, Inflate, Gzip, Gunzip, Zip, and Unzip) now exploit the IBM z15 (and above) DFLTCC (Deflate Conversion Call) hardware instruction when available. This provides significant performance improvement for compression and decompression of longstrings without any application code changes.

Hardware acceleration is used automatically when the processor supports it. On processors without DFLTCC support, the existing software implementation continues to be used transparently.

The DFLTCC instruction handles both the deflate (compress) and inflate (expand) operations natively in hardware, including CRC-32 computation, providing throughput improvements that scale with data size.

New and changed commands

New commands

DISPLAY DSNAMES [pattern] displays the data set names allocated to the run, including Model 204 database files and in-memory files, optionally restricted to those matching pattern.

DISPLAY IMAGINESYNC displays the status of outstanding Imagine Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.

IMAGINE controls Imagine Transparency operations, such as IMAGINE EXTRACT and IMAGINE SYNC.

The new PUSHPARM command saves the current value of a resettable user, system, or file parameter—optionally while setting a new value, as in PUSHPARM MCPU 1000—so that the previous value can later be restored with the new POPPARM command. PUSHPARMQ is a quiet form that does not display the new value, PUSHPARMS saves all user parameters, and POPPARMS restores them. Only one PUSHPARM may be issued per INCLUDE level. These commands complement the existing PUSHUTABLE and POPUTABLE commands.

The new MINUTABLE and MINUGLOBAL commands establish minimum values for parameters that are set with the UTABLE or PUSHUTABLE commands. MINUTABLE sets user minimums and MINUGLOBAL sets system minimums; a requested value below the applicable minimum is raised to it, and when both apply, the larger minimum is used.

Changed commands

VIEW FILEORG is not a new command, but its output has changed: the displayed file organization now indicates whether the current file is an in-memory file or an Imagine Transparency file.

VIEW CURLOC is likewise not a new command, but its output now shows (IMAGINE) when the current file is an Imagine Transparency file. Local files, including in-memory files, continue to display (LOCAL).

SWITCH STREAM TCPLOG is a new operand of the existing SWITCH command. It switches the TCPLOG output stream, where TCPLOG is the DDNAME specified by the DEFINE JANUS TCPLOG command. The SWITCH command can also now perform a CCAJRNL RESET while inside a checkpoint extended quiesce when both CCAJRNL and CCAJLOG are active, so that disabled members of a parallel stream can be reactivated without affecting subsequent recovery or regeneration.

The VIEW command no longer truncates the USERID, ACCOUNT, and RECSECID values at seven characters.

The UTABLE command accepts a new > suffix on a value, meaning "this value or more". For example, UTABLE LVTBL 1000> raises LVTBL to 1000 only if it is currently smaller, and otherwise leaves it unchanged.

The MONITOR SUBTRAN command now supports up to 9,999,999 records, and the MONITOR SIZE display now includes the volume serial and data set name (VOLSER\DSN).

The DEFINE DATASET command supports a new form, DEFINE DATASET x FROM y, which defines data set x from a data set y that is defined in the JCL.

Several statistics displays and the file last-updated time reported by message M204.1203 now include fractional seconds.

New JANUS commands

Several new JANUS subcommands support Imagine Transparency and the Janus SSH server:

• JANUS ADDSUFFIX, JANUS DELETESUFFIX, JANUS DISPLAYSUFFIX, and JANUS SUFFIXSTAT manage the suffix-to-DBS mappings that let a single IMAGINET port serve multiple Imagine database servers.
• JANUS TRUST, JANUS DELTRUST, JANUS DISPLAYTRUST, JANUS DISTOFU, and JANUS SSHKEY manage trusted public-key login on SSH ports.

New and changed parameters

RESRQST

The new RESRQST parameter sets the maximum number of active resident requests. In addition, the VIEW RESCURR and VIEW RESHIGH displays now report the number of bytes and pages in use.

ECMAXCPU

The new ECMAXCPU parameter limits the CPU time, in seconds, that a single External Call Facility (ECF) call may consume. The default of 0 means no limit; a call that exceeds the limit is cancelled with a retryable user 99 ABEND. ECMAXCPU is set on the User 0 parameter line and can be reset by a system manager.

EVALOPT

Two new EVALOPT option bits cancel a request (with message M204.2985) when a value is truncated during evaluation: X'80' cancels on string-to-numeric truncation, and X'40' cancels on numeric-to-numeric truncation.

COMPOPT

The COMPOPT parameter has a new value, 16, that allows a procedure containing updates to a read-only file to compile successfully. If the update is attempted at evaluation time, the request is cancelled with message M204.3056 (or M204.1036 for a security violation).

MAXBG

The MAXBG parameter can now be reset by a system manager.

TEMPPAGE

Resetting the TEMPPAGE parameter can now expand CCATEMP: if the new value is larger than the current size, additional space is allocated; a value equal to or smaller than the current size is rejected.

Discontinued features

The SHAPE capability, a single-customer feature that is no longer used, has been removed.