IC81486: POSSIBLE SSL CONNECTION HANGS OR FAILURE TO CLOSE INVOLVING TCP FIN, CLOSURE ALERTS

APAR status

• Closed as program error.

Error description

• Beginning in release 4.0.1.0, DataPower stopped
  sending TCP FIN immediately with its SSL closure alerts.
  Instead, it sent the SSL closure alert with no TCP FIN and
  waited for the SSL peer's closure alert.  Once received,
  then DataPower sent the TCP FIN.
  
  
  This behavior led to a connection hang (failure to close) if
  both sides were waiting for conflicting things (if the SSL peer
  was waiting for DataPower's TCP FIN while DataPower was waiting
  for the SSL peer's closure alert).
  
  In some cases, DataPower will close the connection with TCP FIN
  after three minutes whether or not it has received the peer's
  SSL closure alert.
  

Local fix

• Use SSL peers that send SSL closure alerts without waiting for
  TCP FIN.
  

Problem summary

• Connection hangs may occur when using SSL with
  peers that expect to receive TCP FIN before they send closure
  alerts.
  

Problem conclusion

• The fix is available in 4.0.1.9 and 4.0.2.5.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R401 PSY

     UP

• R402 PSY

     UP

• R500 PSY

     UP