IT43791: MQ application attempts to unload GSKit libraries when it had not loaded them

APAR status

• Closed as program error.

Error description

• The 'runmqdlq' (run dead-letter queue handler) utility was
  connecting to the queue manager over an unsecured socket (not
  using TLS/SSL).
  
  An FDC was generated by 'runmqdlq', indicating that a failure
  had occurred while attempting to unload the GSKit libraries.
  The FDC contained the following pertinent information:
  
    Probe Id          :- CO559000
    Component         :- ccigsk_unload
  

Local fix

• Either use TLS/SSL for the transport connection or set in the
  SSL stanza of the client configuration file (mqclient.init) the
  entry:
  
     EnvironmentScope=PROCESS
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  IBM MQ 9.2.5 CD and 9.3 LTS users of the MQ C API who have
  defined in the SSL stanza of the client configuration file
  (mqclient.ini):
  
    EnvironmentScope=CONNECTION
  
  and are not connecting to the queue manager over a secured
  socket (TLS/SSL).
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  In MQ 9.3 LTS, a new attribute was added to the SSL stanza of
  the mqclient.ini file:
  
    EnvironmentScope
  
  which can take one of two values:
  
    PROCESS (the default value)
    CONNECTION
  
  If the attribute has the value 'CONNECTION' then a GSKit
  environment is created for each connection within the process,
  which allows a TLS keystore change to be immediately picked up
  when a new TLS connection is created.
  
  A consequence of using this 'CONNECTION'attribute value is the
  GSKit environment associated with a connection is unloaded off
  when the connection ends.
  
  
  The IBM MQ C API libraries did not take into account that the
  GSKit environment may not be loaded if the connection was not
  using TLS, and would generate an FDC when trying to close down
  the GSKit environment which had not been created in the first
  place.
  

Problem conclusion

• The IBM MQ C API now verifies the GSKit libraries are loaded
  before attempting to unload them.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.3 LTS   9.3.0.20
  v9.x CD    9.3.3
  
  The latest available maintenance can be obtained from
  'IBM MQ Recommended Fixes'
  https://www.ibm.com/support/pages/recommended-fixes-ibm-mq
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'IBM MQ
  Planned Maintenance Release Dates'
  https://www.ibm.com/support/pages/ibm-mq-planned-maintenance-rel
  
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels