PI76643: WARM START CISS ABEND AIPD DFHISCOP WEB DOMAIN INITIALIZING

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• IPIC IPCONN connections will acquire after a COLD start,
  but will not after a warm start.
  Tranid CISS gets abend AIPD.
  .
  The message in the log is:
  .
  DFHAC2236 Transaction CISS abend AIPD in program DFHISCOP
  .
  In the internal trace:
  .
  ISCOP ENTRY
  XMIQ  ENTRY INQUIRE_TRANSACTION   18709958,00000000,0000000C
  XMIQ  EXIT  INQUIRE_TRANSACTION/OK
  PRIMARY_CLIENT_TYPE(SOCKET)
  START_CODE(C)
  ATTACH_PARMS(18709958 , 00000000 , 0000000C)
  ISCOP *EXC* INVALID_ATTACH_PARMS
  EIP   ENTRY ABEND  DFHISCOP + X'3D2'
  EXEC  ENTRY ABEND  'AIPD' AT X'977F2ADC',PLX,00000197
  .
  The DFHISCOP program fails because the Web Domain
  never finished initializing.
  .
  ===WB: WEB DOMAIN - SUMMARY
  Domain State     : INITIALIZING
  XRSINDI user exit: Active
  XWBOPEN user exit: Active
  XWBSNDO user exit: Inactive
  XWBAUTH user exit: Inactive
  .
  The issue is with a URIMAP using a ciphers file.
  The ciphers file gets processed
  and CICS finds it has to reduce the list of ciphers
  to prevent against known vulnerabilities.
  This causes DFHWBUR to return an exception response
  with reason of WBUR_CIPHER_LIST reduced.
  DFHWBRP attempts to check for this response
  but instead of checking the response and reason fields,
  it checks the response field twice.  This fails to match
  and ends up in the general disaster processing.
  DFHWBDM then makes things worse by returning immediately
  without setting DMDM_RESPONSE to DMDM_DISASTER.
  This allows CICS to come up with a partially initialised WB
  domain.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS Users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: During a warm restart of CICS message   *
  *                      DFHWB0109 is issued to indicate that    *
  *                      the web domain initialization has       *
  *                      started, however message DFHWB0110 is   *
  *                      never issued to indicate the web domain *
  *                      has finished initialization.            *
  ****************************************************************
  * RECOMMENDATION: .                                            *
  ****************************************************************
  During a warm restart of CICS the web domain will attempt to
  reinstate all URIMAP definitions from the catalog.  One of  the
  URIMAPs has a CIPHERS attribute that specifies the name of a
  ciphers file to be used.  DFHWBUR reads the file and then
  searches for any unsupported ciphers.  If an unsupported cipher
  is found it is removed and DFHWBUR will return an exception
  indicating the cipher list has been reduced.  DFHWBRP does  not
  process this response correctly and returns a disaster response
  to DFHWBDM.  DFHWBDM then incorrectly returns immediately to the
  CICS domain manager with an OK response.  This allows CICS
  startup to continue, but most of the web domain  initialization
  has not been performed.
  
  After CICS has initialised, attempts to use web related
  resources will fail.  For example IPCONNs will fail to  acquire
  and issue an AIPD abend.
  

Problem conclusion

• DFHWBRP has been changed to correctly check the reason of
  WBUR_CIPHER_LIST_REDUCED and DFHWBDM has been changed to
  correctly set a disaster response when initialize_urimaps or
  recover_definitions fails.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI47714 UI47715 UI47716 PI83331

Modules/Macros

• DFHWBDM  DFHWBRP
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R000 PSY UI47714

     UP17/06/07 P F706 ¢

• R800 PSY UI47716

     UP17/06/07 P F706 ¢

• R900 PSY UI47715

     UP17/06/07 P F706 ¢

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.