IT26592: TCPIP NODES MAY DROP THE FIRST PACKET AFTER AN SSL HANDSHAKE

APAR status

• Closed as program error.

Error description

• It is possible for the TCPIP Nodes to drop a packet if this
  occurs within the same TCP/IP read
  as the end of an SSL handshake. This may lead to an error
  containing the explanation string
  
  "error: java error, bad record mac"
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM Integration Bus version 10 or IBM App Connect
  Enterprise version 11 using the TCPIP Nodes with SSL/TLS
  enabled.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  It is possible for the TCPIP Nodes to drop a packet if this
  occurs within the same TCP/IP read as the end of a TLS/SSL
  handshake. This may lead to an error containing the explanation
  string
  
  "error: java error, bad record mac"
  
  This happens because the excess data after the handshake is
  complete is not made eligible to satisfy application level data
  reads. This causes the application to read from the socket and
  pass SSL packets to the encryption/decryption routines in an out
  of order sequence.
  

Problem conclusion

• The excess data read during handshaking is now passed on so that
  is eligible for application level reads so the exception no
  longer happens.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v10.0      10.0.0.15
  v11.0      11.0.0.3
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0540

Applicable component levels