IT23995: IBM MQ .NET managed client proposes incorrect SSL/TLS protocol level

APAR status

• Closed as program error.

Error description

• MQ .NET Managed client proposes incorrect SSL/TLS Protocol
  leading to CipheSpec mismatches reported in the server and
  MQRC_Q_MGR_NOT_AVAILABLE reported to the client application.
  
  The client application has set cipherspec RC4_SHA_US  and the
  svrconn channel has set cipherspec RC4_SHA_US.
  
  0000032F 14:44:32.521295   6972.1           :       Exception
  received
  IBM.WMQ.Nmqi.NmqiException
  Message: MQRC_Q_MGR_NOT_AVAILABLE
  StackTrace:
     at
  IBM.WMQ.Nmqi.MQFAPConnection.Connect(MQConnectionSecurityParamet
  ers securityParms)
     at
  IBM.WMQ.Nmqi.MQConnectionSpecification.CreateAndConnectConnectio
  n(MQChannelDefinition mqcd, MQSSLConfigOptions sslConfigOptions,
  MQConnectionSecurityParameters mqcsp, MQFAP fap, String
  qMgrName, Int32 connectOptions, Int32 maxFapLevel)
  
  12:23:11.890836     9237.1848683      :       (06)-------{
  cciSslConvCiphSpec
   12:23:11.890839     9237.1848683      :            Input
  CipherSpec 'RC4_SHA_US                      '
   12:23:11.890844     9237.1848683      :            CipherSpec
  string resolved (RC4_SHA_US                      ) to
  (TLS_RSA_WITH_RC4_128_SHA            ) Hex(05)
   12:23:11.890847     9237.1848683      :            Returning
  protocol 1 (SSL 3.0)
   12:23:11.890849     9237.1848683      :       (06)-------}
  cciSslConvCiphSpec rc=OK FunctionTime=13
   12:23:11.890852     9237.1848683      :            SSL 3.0 CD
  CipherSpec (TLS_RSA_WITH_RC4_128_SHA                )
   ..
   12:23:11.890988     9237.1848683      :       (06)-------{
  rrxError
   12:23:11.890993     9237.1848683      :            RetCode =
  20009631, rc1 = 0, rc2 = 0, Comment1 = 'CHANNEL.NAME ', Comment2
  = 'RC4_SHA_US                      ', Comment3=
  'TLS_RSA_WITH_AES_128_CBC_SHA    ', File=
  '/build/slot1/p900_P/src/lib/comms/amqccisa.c', Line= '2600'
   12:23:11.890998     9237.1848683      :       (06)-------}!
  rrxError rc=rrcE_SSL_UNMATCHED_CIPHERS FunctionTime=10
   12:23:11.890999     9237.1848683      :       (05)------}!
  cciSslCompCiphSpec rc=rrcE_SSL_UNMATCHED_CIPHERS
  FunctionTime=335
  
   Also the connection succeeds when the client application has
  set cipherspec RC4_SHA_US  and the svrconn channel has set
  cipherspec TLS_RSA_WITH_RC4_128_SHA.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  User of MQ .NET application in managed mode connecting with SSL
  Channel
  
  
  Platforms affected:
  Windows
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When using the MQ managed .NET client, the CipherSpec
  configuration is defined by the Windows security policy
  configuration. However, if a CipherSpec is supplied by the
  application, this can be used to influence the SSL/TLS protocol
  version in use. A logic error in the MQ managed .NET client mean
  that this protocol selection behaved incorrectly, and for some
  CipherSpec combinations, and incorrect SSL/TLS protocol version
  was proposed to the server.
  

Problem conclusion

• The  MQ managed .NET client code has been corrected such that
  the correct SSL/TLS protocol version is proposed to the server
  based on the supplied cipherspec.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.10
  v9.0 LTS   9.0.0.4
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE M/P

• Fixed component ID

  5724H7261

Applicable component levels