IT20428: SOCSSLLST THREAD CAN BLOCK FOREVER DURING ACCEPT OF CLIENT CONNECTION, WAITING FOR RESPONSE FROM CLIENT

APAR status

• Closed as program error.

Error description

• During connection setup for ssl connections there appears to be
  some needed back and forth between the client and server.  As
  currently written, during the accept, the socssllst thread can
  block forever while waiting for some response from the client,
  which, if for some reason doesn't come, prevents further ssl
  connections from being made for that listener thread's port.
  
  The stack trace and state of the socssllst thread would look
  like this:
  
  Threads:
   tid     tcb              rstcb            prty status
  vp-class       name
   12       45bd7c58         0                2    cond wait
  sqcrypto     8cpu*        socssllst
  
  yield_processor_mvp
  mt_wait
  sqcrypto_call_n
  ssl_accp
  accpsocket
  tlAccept
  slSQIind_accp
  pfConInd_accp
  ascInd_accp
  ASF_Call
  sql_listener
  startup
  
  So this stack indicates it has handed off work to an encrypt
  thread that would be running on an encrypt vp.  So you should
  see 1 encrypt thread in this state with the stack:
  
  Threads:
   tid     tcb              rstcb            prty status
  vp-class       name
   87       469e3b50         44d36d40         1    cond wait
  netnorm     11encrypt*    encrypt
  
  (/usr/informix_engine/bin/oninit) yield_processor_mvp
  (/usr/informix_engine/bin/oninit) mt_wait
  (/usr/informix_engine/bin/oninit) net_buf_get
  (/usr/informix_engine/bin/oninit) ssl_netbuff_get
  (/usr/informix_engine/bin/oninit) ssl_callback_read
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
  (/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) gsk_secure_soc_init
  (/usr/informix_engine/bin/oninit) ifx_ssl_accp
  (/usr/informix_engine/bin/oninit) crypto_dispatch
  (/usr/informix_engine/bin/oninit) crypto_thread
  (/usr/informix_engine/bin/oninit) th_init_initgls
  (/usr/informix_engine/bin/oninit) startup
  
  So since it's in net_buf_get() doing a condition wait "net
  norm", that indicates it's waiting on some network data from the
  client.  With no control how long this will take, having the
  socssllst thread blocking at this point can prevent further
  connections from being made until either an error is produced,
  or the client response is received.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * informix users with SSL connection                           *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Update to IBM Informix Server 12.10.xC9                      *
  ****************************************************************
  

Problem conclusion

• Problem Fixed In IBM Informix Server 12.10.xC9
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INFORMIX SERVER

• Fixed component ID

  5725A3900

Applicable component levels

• RA10 PSY

     UP