Release notes for Model 204 version 8.0
Overview
These release notes contain installation and features information for the Rocket Model 204 version 8.0 release. Before beginning your installation, please read through this information about product installation and changes.
New in this release
The table below cites some highlights of Model 204 version 8.0. For a full list of features, refer to the Table of Contents.
| Category | Feature |
|---|---|
| Data access |
|
| Security | |
| Performance |
|
| New commands |
|
Imagine Transparency support
A new facility called Imagine Transparency is now available to allow files in an Imagine database to be accessed from Model 204 as if they were native files. Applications can issue ordinary SOUL FIND, FOR EACH RECORD, and update statements against a Transparency file, and Model 204 transparently retrieves and updates the underlying records through an Imagine broker.
A new port type, IMAGINET, is now available. It allows Model 204 files to be stored on an Imagine server rather than in operating system files. A new option on the ALLOCATE command indicates that a file is to be accessed via the IMAGINET port rather than from operating system files.
The following related features support Imagine Transparency:
- The IMAGINE command controls Transparency operations, including IMAGINE EXTRACT (extract records into an Imagine file) and IMAGINE SYNC (synchronize an Imagine file with its underlying database).
- The DISPLAY IMAGINESYNC command displays the status of outstanding Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.
- The RELEASE statement has a new RELEASE IMAGINE RECORDS form that releases the records held for the current Transparency transaction. An optional COMMIT or BACKOUT keyword commits or backs out the associated Imagine transaction, and an optional CLEARLISTS keyword also clears associated $lists and StringLists.
- The new SOUL Imagine class lets applications interact with the Imagine Transparency broker for the current transaction. It is a collection of shared methods (there is no Imagine object), including Call, which runs Imagine code on the broker and accepts StringList and DollarList parameters and an optional apsySuffix named parameter, along with methods that return the broker version, DBS name, and APSY suffix. See the List of Imagine methods.
- A single IMAGINET port can route to multiple Imagine database servers (DBS), selected by an APSY suffix character. The suffix-to-DBS mappings are managed with the new JANUS ADDSUFFIX, JANUS DELETESUFFIX, JANUS DISPLAYSUFFIX, and JANUS SUFFIXSTAT commands, and the active suffix and DBS name are available to SOUL through the Imagine class.
Janus product enhancements
TLS 1.3 support
Janus SSL ports now support TLS 1.3 (RFC 8446) for both client and server connections. TLS 1.3 provides improved security and performance over TLS 1.2, including a simplified handshake with fewer round trips, and the removal of legacy features such as renegotiation.
The following TLS 1.3 cipher suites are supported:
TLS_AES_128_GCM_SHA256TLS_AES_256_GCM_SHA384
Key exchange is performed using X25519 (Curve25519 Elliptic Curve Diffie-Hellman, per RFC 7748). Certificate authentication uses RSA-PSS signatures.
Key derivation uses the HKDF-based key schedule defined in RFC 8446, replacing the PRF-based approach of earlier TLS versions.
TLS 1.3 is enabled by default on ports that allow TLS 1.2. To restrict a port to earlier protocol versions, use the existing SSLVERSION parameter on the JANUS DEFINE command.
Client-side TLS 1.3 and post-handshake authentication
Janus client connections (for example, clients built with the $SOCK functions or the equivalent Socket class methods, and Janus Web Server outbound HTTPS requests) now negotiate and complete a full TLS 1.3 handshake as the client, including X25519 key exchange, the HKDF-based key schedule, and RSA-PSS certificate verification of the server.
Client certificate authentication is supported both during the initial handshake
and after it completes. When a TLS 1.3 server sends a post-handshake
CertificateRequest (RFC 8446 Section 4.6.2) — for example, when a
server application requests a client certificate on a connection that did not
originally require one — the Janus client automatically responds with its
Certificate, CertificateVerify, and Finished
messages, allowing the authenticated request to proceed without interrupting the
connection.
No application changes are required. Post-handshake authentication is used automatically when a server requests it and a client certificate is available for the port.
Janus SSH server
A new SSH Janus port type provides a built-in SSH (Secure Shell) server, allowing users to connect to a Model 204 Online from a standard SSH client over an encrypted connection. An SSH port is defined with the JANUS DEFINE command; for example:
JANUS DEFINE SSHPORT 5996 SSH 10 SSL PROFILE SSH.PKEY
In addition to password authentication, SSH ports support trusted public-key login, in which a user is authenticated by an SSH public key that has been registered with the port. The following commands manage trusted keys (see Janus SSH for full details):
| Command | Description |
|---|---|
| JANUS TRUST portname userid base64key | Registers a trusted SSH public key for userid on the named SSH port. |
| JANUS DELTRUST portname userid | Removes the trusted key for userid on the named port. |
| JANUS DISPLAYTRUST [portname] | Displays the trusted keys registered on a port (or on all ports). |
| JANUS DISTOFU [portname] | Displays keys that were auto-registered by trust-on-first-use (TOFU). |
| JANUS SSHKEY | Displays the SSH public key of the current user. |
Trust-on-first-use (TOFU) can be enabled on an SSH port with the TOFU option on the JANUS DEFINE command. When enabled, a user's public key is automatically registered on first connection, up to a specified maximum number of keys.
Performance enhancements
Hardware-accelerated deflate/inflate compression
The SOUL compression functions (Deflate, Inflate, Gzip, Gunzip, Zip, and Unzip) now exploit the IBM z15 (and above) DFLTCC (Deflate Conversion Call) hardware instruction when available. This provides significant performance improvement for compression and decompression of longstrings without any application code changes.
Hardware acceleration is used automatically when the processor supports it. On processors without DFLTCC support, the existing software implementation continues to be used transparently.
The DFLTCC instruction handles both the deflate (compress) and inflate (expand) operations natively in hardware, including CRC-32 computation, providing throughput improvements that scale with data size.
New and changed commands
New commands
DISPLAY DSNAMES [pattern] displays the data set names allocated to the run, including Model 204 database files and in-memory files, optionally restricted to those matching pattern.
DISPLAY IMAGINESYNC displays the status of outstanding Imagine Transparency synchronization requests. It replaces the earlier IMAGINE LISTSYNC command.
IMAGINE controls Imagine Transparency operations, such as IMAGINE EXTRACT and IMAGINE SYNC.
Changed commands
VIEW FILEORG is not a new command, but its output has changed: the displayed file organization now indicates whether the current file is an in-memory file or an Imagine Transparency file.
VIEW CURLOC is likewise not a new command, but its output now shows (IMAGINE) when the current file is an Imagine Transparency file. Local files, including in-memory files, continue to display (LOCAL).
SWITCH STREAM TCPLOG is a new operand of the existing SWITCH command. It switches the TCPLOG output stream, where TCPLOG is the DDNAME specified by the DEFINE JANUS TCPLOG command.
New JANUS commands
Several new JANUS subcommands support Imagine Transparency and the Janus SSH server:
- JANUS ADDSUFFIX, JANUS DELETESUFFIX, JANUS DISPLAYSUFFIX, and JANUS SUFFIXSTAT manage the suffix-to-DBS mappings that let a single IMAGINET port serve multiple Imagine database servers.
- JANUS TRUST, JANUS DELTRUST, JANUS DISPLAYTRUST, JANUS DISTOFU, and JANUS SSHKEY manage trusted public-key login on SSH ports.