PH66994: READ SOCKET CALL FAILS WITH ECONNRESET WITH AT-TLS AND SMC

APAR status

• Closed as program error.

Error description

• A client and server are communicating across an SMC-D TCP
  connection that is secured by AT-TLS.
  Near the end of the transaction, the client issues a READ socket
  call while the server issues a WRITE socket call.
  Immediately after the WRITE, the server issues a SETSOCKOPT for
  SO_LINGER and a CLOSE.  This causes an SSL alert to be sent to
  the client side.  The client's TCPIP stack returns an SSL alert
  in response.  The SMC data receive routine on the server side
  sees that data has arrived after the connection closed and
  therefore calls the TCP reset routine.  Thus, a TCP connection
  reset (RST) is sent to the client side.  Since no FIN has
  flowed, the TCPIP stack on the client side decides not to
  ignore the RST.  This results in the client's READ failing with
  RETCODE -1 and ERRNO 54 (ECONNRESET).
  

Local fix

• Turn off SMC.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of the IBM Communications Server   *
  *                 for z/OS 3.2: SMC-D                          *
  ****************************************************************
  * PROBLEM DESCRIPTION: Application read socket call fails      *
  *                      with ECONNRESET when the associated     *
  *                      TCP connection is protected by AT-TLS   *
  *                      and flows over SMC-D.                   *
  *                      When the remote application closes its  *
  *                      socket first the TLS close_notify alert *
  *                      is processed on the local side and a    *
  *                      close_notify alert is sent in response. *
  *                      The arrival of the close_notify on the  *
  *                      remote is treated as inbound data on a  *
  *                      connection where the socket has been    *
  *                      closed.  This results in the remote     *
  *                      sending an SMC-D abortive close and the *
  *                      local side posts an ECONNRESET error to *
  *                      the connection.  If the local           *
  *                      application issues a read after this    *
  *                      abortive close has been received the    *
  *                      read call will fail with ECONNRESET.    *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF.                               *
  ****************************************************************
  

Problem conclusion

• The processing of a close_notify alert inbound is delayed until
  the local application issues a receive operation.  In addition
  an SMC-D abortive close is not surfaced to the application when
  it is solicited by a TLS close_notify response.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PH10558

• APAR is sysrouted TO one or more of the following:

  UO07406

Modules/Macros

• EZB2TLSX EZBCTFME EZBDGDAT EZBDGTLS EZBLCINB EZBTCFRD EZBTCFSH
  EZBTCRD  EZBTCSTR EZBTLCWK EZBTLFIO EZBTLSRH
  

Fix information

• Fixed component name

  TCP/IP MVS

• Fixed component ID

  5655HAL00

Applicable component levels