PH54767: CICS USING AT-TLS CAUSES A S878 ABEND IN TCP/IP 23/09/19 PTF PECHANGE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• The TCP/IP address space suffered private storage growth until
  it became exhausted. This led to an abend878 of the address
  space. The storage growth was due to CICS not closing sockets
  that are associated with TCP connections using AT-TLS.
  
  AT-TLS extracts the security environment so that it can perform
  a TLS handshake on the TCP connection using the userid authority
  of the application associated with the socket.
  This is not required when using native SSL support because the
  interactions with SSL are done under the application unit of
  work. There is no storage growth exposure if AT-TLS is not used
  to secure the CICS workload.
  
  The investigation from the CICS side showed that the accept and
  receive call completed normally, so CSOL continued with its
  usual processing to set up the new socket in CICS. It attempted
  to get the client IP address and that call would have found that
  the connection had been closed.  At this point CICS cleans up
  but crucially misses a call to close the socket itself. This is
  the reason why CICS had no knowledge of the sockets but they
  were still active within TCPIP.
  
  Problem indication on CICS side:
  DFHWB0153 E The web asynchronous socket receive failed with an
  IO error.
  Additional symptoms:
  SO 0E1C SOUS  *EXC* GETSOCKNAME_FAILURE
  DFHSO1002 A UNIX System Services Assembler Callable Service
     error (code X'0C64') has occurred on receipt of a
    severe TCP/IP return code
  MAXSOCKETS Socket
  

Local fix

• Not available
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Abend S878 in the TCPIP address space   *
  *                      when using AT-TLS.                      *
  ****************************************************************
  When a new connection arrives in CICS on an ATTLSAWARE
  TCPIPSERVICE, CICS obtains information related to the connection
  to store in its control blocks. If CICS finds that the
  connection has been closed, DFHSOLS cleans up the control blocks
  associated with the socket, but fails to call TCPIP to close
  the socket. Failing to close the socket leaves it orphaned in
  the TCPIP address space which eventually runs out of storage.
  

Problem conclusion

• UI83808 UI90657 UI83807 UI90656
  DFHSOLS has been changed to call TCPIP to close the socket when
  cleaning up the control blocks.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PH56549 UI93696 UI93697

Modules/Macros

• DFHLEPTS DFHMESOC DFHMESOE DFHMESOK DFHSOAD  DFHSOCK  DFHSODM
  DFHSODS  DFHSODUF DFHSOGH@ DFHSOHN  DFHSOIS  DFHSOL   DFHSOLI
  DFHSOLS  DFHSOLX  DFHSOLX6 DFHSOM01 DFHSOM02 DFHSOM03 DFHSONT
  DFHSOPL  DFHSORD  DFHSORL  DFHSORM  DFHSOS00 DFHSOS01 DFHSOS02
  DFHSOS03 DFHSOS04 DFHSOS05 DFHSOS06 DFHSOS07 DFHSOS08 DFHSOS09
  DFHSOS10 DFHSOS11 DFHSOS12 DFHSOS13 DFHSOS14 DFHSOS15 DFHSOS16
  DFHSOS17 DFHSOS18 DFHSOS19 DFHSOS20 DFHSOS21 DFHSOS22 DFHSOS23
  DFHSOSE  DFHSOSES DFHSOSK  DFHSOSM  DFHSOST  DFHSOTB  DFHSOTI
  DFHSOTRI DFHSOUE  DFHSOXM
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R200 PSY UI93697

     UP23/09/26 P F309 ­

• R300 PSY UI93696

     UP23/09/26 P F309 ­

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.