Release notes for Model 204 version 8.0

Overview

These release notes contain installation and features information for the Rocket Model 204 version 8.0 release. Before beginning your installation, please read through this information about product installation and changes.

New in this release

The table below cites some highlights of Model 204 version 8.0. For a full list of features, refer to the Table of Contents.

Category	Feature
Data access	Imagine Transparency allows files in an Imagine database to be accessed from Model 204 as if they were native files, using the new IMAGINET Janus port type.
Security	Janus SSL ports now support TLS 1.3 (RFC 8446) for both client and server connections, including client certificate authentication and post-handshake authentication. The new SSH Janus port type provides a built-in SSH server with trusted public-key login.
Performance	The SOUL compression functions now exploit IBM z15 DFLTCC hardware for deflate and inflate operations.
New commands	The DISPLAY DSNAMES, VIEW FILEORG, DISPLAY IMAGINESYNC, IMAGINE, and SWITCH STREAM TCPLOG commands. See New and changed commands.

Imagine Transparency support

A new facility called Imagine Transparency is now available to allow files in an Imagine database to be accessed from Model 204 as if they were native files. Applications can issue ordinary SOUL FIND, FOR EACH RECORD, and update statements against a Transparency file, and Model 204 transparently retrieves and updates the underlying records through an Imagine broker.

A new port type, IMAGINET, is now available. It allows Model 204 files to be stored on an Imagine server rather than in operating system files. A new option on the ALLOCATE command indicates that a file is to be accessed via the IMAGINET port rather than from operating system files.

The following related features support Imagine Transparency:

• The IMAGINE command controls Transparency operations, including IMAGINE EXTRACT (extract records into an Imagine file) and IMAGINE SYNC (synchronize an Imagine file with its underlying database).
• The DISPLAY IMAGINESYNC command displays the status of outstanding Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.
• The RELEASE IMAGINE RECORDS statement releases records that are held for Transparency processing; an optional CLEARLISTS operand also clears associated $lists and StringLists.
• The SOUL Imagine:Call method invokes an Imagine broker request from an application, and accepts StringList and DollarList parameters and an optional apsySuffix named parameter.

Janus product enhancements

TLS 1.3 support

Janus SSL ports now support TLS 1.3 (RFC 8446) for both client and server connections. TLS 1.3 provides improved security and performance over TLS 1.2, including a simplified handshake with fewer round trips, and the removal of legacy features such as renegotiation.

The following TLS 1.3 cipher suites are supported:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384

Key exchange is performed using X25519 (Curve25519 Elliptic Curve Diffie-Hellman, per RFC 7748). Certificate authentication uses RSA-PSS signatures.

Key derivation uses the HKDF-based key schedule defined in RFC 8446, replacing the PRF-based approach of earlier TLS versions.

TLS 1.3 is enabled by default on ports that allow TLS 1.2. To restrict a port to earlier protocol versions, use the existing SSLVERSION parameter on the JANUS DEFINE command.

Client-side TLS 1.3 and post-handshake authentication

Janus client connections (for example, clients built with the $SOCK functions or the equivalent Socket class methods, and Janus Web Server outbound HTTPS requests) now negotiate and complete a full TLS 1.3 handshake as the client, including X25519 key exchange, the HKDF-based key schedule, and RSA-PSS certificate verification of the server.

Client certificate authentication is supported both during the initial handshake and after it completes. When a TLS 1.3 server sends a post-handshake CertificateRequest (RFC 8446 Section 4.6.2) — for example, when a server application requests a client certificate on a connection that did not originally require one — the Janus client automatically responds with its Certificate, CertificateVerify, and Finished messages, allowing the authenticated request to proceed without interrupting the connection.

No application changes are required. Post-handshake authentication is used automatically when a server requests it and a client certificate is available for the port.

Janus SSH server

A new SSH Janus port type provides a built-in SSH (Secure Shell) server, allowing users to connect to a Model 204 Online from a standard SSH client over an encrypted connection. An SSH port is defined with the JANUS DEFINE command; for example:

JANUS DEFINE SSHPORT 5996 SSH 10 SSL PROFILE SSH.PKEY

In addition to password authentication, SSH ports support trusted public-key login, in which a user is authenticated by an SSH public key that has been registered with the port. The following commands manage trusted keys (see Janus SSH for full details):

Command	Description
JANUS TRUST portname userid base64key	Registers a trusted SSH public key for userid on the named SSH port.
JANUS DELTRUST portname userid	Removes the trusted key for userid on the named port.
JANUS DISPLAYTRUST [portname]	Displays the trusted keys registered on a port (or on all ports).
JANUS DISTOFU [portname]	Displays keys that were auto-registered by trust-on-first-use (TOFU).
JANUS SSHKEY	Displays the SSH public key of the current user.

Trust-on-first-use (TOFU) can be enabled on an SSH port with the TOFU option on the JANUS DEFINE command. When enabled, a user's public key is automatically registered on first connection, up to a specified maximum number of keys.

Performance enhancements

Hardware-accelerated deflate/inflate compression

The SOUL compression functions (Deflate, Inflate, Gzip, Gunzip, Zip, and Unzip) now exploit the IBM z15 (and above) DFLTCC (Deflate Conversion Call) hardware instruction when available. This provides significant performance improvement for compression and decompression of longstrings without any application code changes.

Hardware acceleration is used automatically when the processor supports it. On processors without DFLTCC support, the existing software implementation continues to be used transparently.

The DFLTCC instruction handles both the deflate (compress) and inflate (expand) operations natively in hardware, including CRC-32 computation, providing throughput improvements that scale with data size.

New and changed commands

DISPLAY DSNAMES [pattern] displays the data set names allocated to the run, including Model 204 database files and in-memory files, optionally restricted to those matching pattern.

VIEW FILEORG displays the file organization of the current file, including whether the file is an in-memory or Imagine Transparency file.

DISPLAY IMAGINESYNC displays the status of outstanding Imagine Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.

IMAGINE controls Imagine Transparency operations, such as IMAGINE EXTRACT and IMAGINE SYNC.

SWITCH STREAM TCPLOG switches the TCPLOG output stream, where TCPLOG is the DDNAME specified by the DEFINE JANUS TCPLOG command.