PI34874: DFHTR0112 BAD DATA PASSED FOR TRACING TO MODULE DFHTRPT AFTER ANS SSL HANDSHAKE FAILS WITH INVALID_CERTIFICATE_LABEL

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• CICS TS 5.1 is getting dumps CODE=TR0112 after an SSL handshake
  fails with GSK_CERTIFICATE_NOT_AVAILABLE.
  DFHSOSE tries write the following trace entry :
  67964 S8000 SO 0813 SOSE  *EXC* INVALID_CERTIFICATE_LABEL
                   FUNCTION(SECURE_SOC_INIT) RESPONSE(EXCEPTION)
  REASON()     GSK_RETURN_CODE(7) CERTIFICATE_USERID()
  CIPHER_SELECTED()RET-9C131F8E 12:30:32.8367214062 00.022510343
  .
  The trace is partially written and fails with an 0c4 in
  DFHTRPX.
  The DFHTR0112 dump shows that :
  DFHSOSE KE stack contains a register 1 which points to the list
  of parms supplied by DFHSOSE required by DFHTRPX to build the
  the trace entry . (R1 is the DFHTRPT_PTR)
  
  
  R1 + Offset x'34' into this arguemnt list contains a length
  x'FFFFFFFF'. This bad length is later used by DFHTRPX
  as the lenght value TRPT_DATA2_N.
  
  TRPT_DATA2_N is then used to prepare the lengths for the MVCL at
  offset x'326' in DFHTRPX. The bad value leads to the 0c4
  
  when R10 is incremented( by MVCL) and reaches a value which
  would attempt overlay key zero storage.
  
  
  Details of 0c4 :
  DFHTR0112 Bad data passed for tracing to module DFHTRPT
  
  Error occurred in program DFHTRPX  at offset 00000328 under the
  CICS RB
  Execution key at Program Check/Abend:  8
  Instruction Length: 2   Interrupt Code: 0004   Exception
  Address:
  00000000
  Branch Event Address:  013F52F8  Storage invalid
  PSW:  078D0400 1A740A98 Module DFHSIP + X'40A98'
                          Failing instruction MVCL    R10,R14
  CICS Registers:
  R0:  1A963000
  R1:  1CBB0310
  R2:  000000F3
  R3:  1A740770
  R4:  1CBB0020
  R5:  1A963000
  R6:  1B296EC1
  R7:  00000209
  R8:  FFFFFFFF
  R9:  00000116
  R10: 1B328000
  R11: FFF6EEEA
  R12: 230DD800
  R13: 1CBB0020
  R14: 2010F235
  R15: FFF6EEEA
        SECURE_SOC_WRITE
        DFHSOSE
        SECURE_SOC_INIT
        TRACE_PUT
  *YES* DFHTRPT
        DFHMEME
        SEND
        CONTINUE_SEND
   TAKE_A_DUMP_FOR_CALLER
   DFHDUDU
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHTR0112 issued after SSL handshake    *
  *                      error.                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In the reported problem, an SSL handshake error occurred.
  DFHSOSE attempted to write an exception trace entry to report
  the error but in doing so, passed a negative length of the SSL
  certificate label name to trace domain. This caused trace domain
  to issue trace "TR 0102 TRPT  *EXC* - INVALID-DATA-PASSED" and
  also abend 0C4.
  
  Keywords: ABENDS0C4 S0C4 ABEND0C4
  

Problem conclusion

• DFHSOSE has been modified and will now pass the correct length
  of the certificate label to trace domain which will now issue
  an SO 0813 SOSE  *EXC* trace entry.
  

Temporary fix

• FIX AVAILABLE BY PTF ONLY
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PI32771

• APAR is sysrouted TO one or more of the following:

  UI25832 UI25833

Modules/Macros

• DFHSOSE
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R800 PSY UI25832

     UP15/03/20 P F503

• R900 PSY UI25833

     UP15/03/20 P F503

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.