IC98925: RETRIEVING SSL CERTIFICATES CAUSES MAXSAVEPOSTSIZE TO BE HIT

IBM Integration Bus V9.0 - Fix Pack 9.0.0.2

APAR status

• Closed as program error.

Error description

• As part of processing a POST received using the HTTPS
  connector, action code is used to retrieve the SSL certificates
  after the initial handshake has been completed. This causes a
  re-negotiation to occur.
  
  Due to the timing of this action code call, if the POST
  contains encrypted data the whole encrypted body will be sent
  as part of a the re-negotiation, therefore if the total message
  size is greater than 4kb we will be over the default
  maxSavePostSize limit which governs the maximum size of a POST
  received during Client Auth. This will cause an error such as
  the following to be thrown:
  
  java.io.IOException: The number of bytes read 4096 is less than
  the Content-Length 10445 at
  com.ibm.broker.inlinehttp.tomcatthreadpool.TomcatInstanceManag
  er $Adapter Class.getRequestBodyData(TomcatInstanceManager.java
  

Local fix

• NA
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM Integration Bus V9.0 using the HTTP or Soap
  Input nodes that process messages greater than 4096 bytes and
  are also using HTTPS and WS-Security message part encryption.
  
  
  Platforms affected:
  MultiPlatform, z/OS
  
  ****************************************************************
  PROBLEM SUMMARY:
  As part of processing a POST received using the HTTPS
  connector, action code is used to retrieve the SSL certificates
  after the initial handshake has been completed. This causes a
  re-negotiation to occur.
  
  Due to the timing of this action code call, if the POST
  contains encrypted data the whole encrypted body will be sent
  as part of a the re-negotiation, therefore if the total message
  size is greater than 4kb we will be over the default
  maxSavePostSize limit which governs the maximum size of a POST
  received during Client Auth. This will cause an error such as
  the following to be thrown:
  
  java.io.IOException: The number of bytes read 4096 is less than
  the Content-Length 10445 at
  com.ibm.broker.inlinehttp.tomcatthreadpool.TomcatInstanceManag
  er $Adapter Class.getRequestBodyData(TomcatInstanceManager.java
  
  There are a number of resource name changes between WebSphere
  Message Broker and IBM Integration Bus Version 9.0. For
  details visit
  http://pic.dhe.ibm.com/infocenter/wmbhelp/v9r0m0/topic/com.ibm.e
  tools.mft.doc/bb23814_.htm
  

Problem conclusion

• The product has been modified so that the action code to
  retrieve the SSL certificates is called after we have
  processed the message body.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.0       9.0.0.2
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available, information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0530

Applicable component levels

• R900 PSY

     UP