PQ72957: FTP SSL TRANSACTION FAILS WHEN A CLOSE NOTIFY ALERT IS RECEIVED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• The problem occurs when either the ftp client or server
  has established a secure session (SSL/TLS) and the library
  being used by the non-390 system is based on the open ssl
  architecture.  This will cause a PUT to fail in the case
  where the System 390 or z/OSseries is the server with a
  "451 Transfer aborted due to receive error" and a GET to fail
  in the case where the System 390 or z/OS series is the client
  doing a GET.
  ADDITIONAL KEYWORDS: TLS SSL/TLS SSL OPEN
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of the IBM Communications Server   *
  *                 for z/OS Version 1 Release 2 or Release 4    *
  *                 IP: FTP                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: FTP SSL PUT/STORE (to our server) or    *
  *                      RETRIEVE/GET (from our client)          *
  *                      fails when an SSL close_notify          *
  *                      alert is received.                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The sending side of the FTP transfer sends an SSL close_notify
  alert to tell FTP the transfer is complete.  Our SSL library
  function did not indicate to FTP that a close_notify had been
  processed indicating end of file.  Since FTP was not notified,
  it assumed the transfer had failed and if CONDDISP was set to
  DELETE in the FTP.DATA options, the file would not be saved and
  the transfer fails.  SSL needs to return a unique return code
  to FTP to indicate that it has processed a close_notify.  In
  addition, FTP needs to recognize this return code, and complete
  the file transfer process successfully.
  +-------------------------------------------------------------+
  + Please check our Communications Server for OS/390 homepages +
  + for common networking tips and fixes.  The URL for these    +
  + homepages can be found in Informational APAR II11334.       +
  +-------------------------------------------------------------+
  

Problem conclusion

• SSL will provide the unique return code in R120 via APAR
  OA02499.  This function already exists in R140 SSL.  Also,
  the FTP server and client have been modified to recognize the
  return code and complete the transfer.
  
  * Cross Reference between External and Internal Names
  PREFTPCX (EZAFTPCX)  PREFTPLS (EZAFTPLS)  PREFTPCX (EZAFTPCX)
  PREFTPLS (EZAFTPLS)
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UQ76310 UQ76311

Modules/Macros

• EZAFTPCX EZAFTPFU EZAFTPLS
  

Fix information

• Fixed component name

  TCP/IP V3 MVS

• Fixed component ID

  5655HAL00

Applicable component levels

• R120 PSY UQ76520

     UP03/05/20 P F305

• R140 PSY UQ76311

     UP03/06/05 P F305

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.