INFORMIX SERVER / 5725A3900 / C10 - IDS 12.10

During connection setup for ssl connections there appears to be
some needed back and forth between the client and server.  As
currently written, during the accept, the socssllst thread can
block forever while waiting for some response from the client,
which, if for some reason doesn't come, prevents further ssl
connections from being made for that listener thread's port.

The stack trace and state of the socssllst thread would look
like this:

Threads:
 tid     tcb              rstcb            prty status
vp-class       name
 12       45bd7c58         0                2    cond wait
sqcrypto     8cpu*        socssllst

yield_processor_mvp
mt_wait
sqcrypto_call_n
ssl_accp
accpsocket
tlAccept
slSQIind_accp
pfConInd_accp
ascInd_accp
ASF_Call
sql_listener
startup

So this stack indicates it has handed off work to an encrypt
thread that would be running on an encrypt vp.  So you should
see 1 encrypt thread in this state with the stack:

Threads:
 tid     tcb              rstcb            prty status
vp-class       name
 87       469e3b50         44d36d40         1    cond wait
netnorm     11encrypt*    encrypt

(/usr/informix_engine/bin/oninit) yield_processor_mvp
(/usr/informix_engine/bin/oninit) mt_wait
(/usr/informix_engine/bin/oninit) net_buf_get
(/usr/informix_engine/bin/oninit) ssl_netbuff_get
(/usr/informix_engine/bin/oninit) ssl_callback_read
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) (null)
(/u/ibm/gsk8_64/lib64/libgsk8ssl_64.so) gsk_secure_soc_init
(/usr/informix_engine/bin/oninit) ifx_ssl_accp
(/usr/informix_engine/bin/oninit) crypto_dispatch
(/usr/informix_engine/bin/oninit) crypto_thread
(/usr/informix_engine/bin/oninit) th_init_initgls
(/usr/informix_engine/bin/oninit) startup

So since it's in net_buf_get() doing a condition wait "net
norm", that indicates it's waiting on some network data from the
client.  With no control how long this will take, having the
socssllst thread blocking at this point can prevent further
connections from being made until either an error is produced,
or the client response is received.

****************************************************************
* USERS AFFECTED:                                              *
* informix users with SSL connection                           *
****************************************************************
* PROBLEM DESCRIPTION:                                         *
* See Error Description                                        *
****************************************************************
* RECOMMENDATION:                                              *
* Update to IBM Informix Server 12.10.xC9                      *
****************************************************************

not known / see Local fix

Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :

02.05.2017
10.07.2017
10.07.2017

12.10.xC9