IJ01481: JAVA 8 SSLENGINE ISSUE WITH DEBUG TRACING ON Z/OS PLATFORM

APAR status

• Closed as program error.

Error description

• Error Message: None
  .
  Stack Trace: N/A
  .
  Problem Description:
  Some of the output from an SSL trace appears 1 byte per line.
  This is seen on z/OS only and with trace options such as
  javax.net.debug=ssl.
  
  The problematic trace will follow the string "[Raw read (bb)]:
  length".
  Here follows, by way of example, a fragment of trace showing the
  issue resolved by this APAR.
  Notice that the bytes are output 1 per line.
  The characters '##' and 'C' are used to represent a byte and a
  character.
  
  ---- start example problem output ----
  [Raw read (bb)]: length = <number>
  #
  ##
  #
  #
  ##
  #
  ---- end example problem output ----
  
  Whilst the data is correct the format is expected to be tabular,
  for example:
  
  ---- start expected output ----
  [Raw read (bb)]: length = <number>
   0000: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
  C.....C.....CC..
   0010: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
  .....CC.........
  ---- end expected problem output ----
  .
  

Local fix

Problem summary

• Java 8 JSSE2 SSLEngine trace output prints vertically on z/OS,
  making it difficult to read and can produce large traces.
  When enabling trace debug flag javax.net.debug=ssl (or =true)
  the trace output is:
  (The characters '##' are used to represent a byte.)
  .
  [Raw read (bb)]: length = <number>
  #
  ##
  #
  #
  ##
  #
  ...
  

Problem conclusion

• Java 8 JSSE2 SSLEngine code was fixed to produce a more readable
   output such as:
  (The characters '##' and 'C' are used to represent a byte and a
  character.)
  .
  [Raw read (bb)]: length = <number>
   0000: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
  C.....C.....CC..
   0010: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
  .....CC.........
  
  Update ibmjsseprovider2.jar
  CMVC Defect 117728
  RTC 135763
  build level 20171107
  .
  This APAR will be fixed in the following Java Releases:
   8 SR5 FP5 (8.0.5.5)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R270 PSY

     UP