ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » Channel is in retry state after adding security exit program

Post new topic  Reply to topic
 Channel is in retry state after adding security exit program « View previous topic :: View next topic » 
Author Message
jennifer99
PostPosted: Thu Nov 14, 2013 11:09 am    Post subject: Channel is in retry state after adding security exit program Reply with quote

Newbie

Joined: 14 Nov 2013
Posts: 2

Hi Experts,

I am new to MQ world and i was told to write a channel security exit program. In order to understand the entire flow, i installed MQ in my local windows machine and created two Queue ManagerS and assigned them as "MY COMPANY"and the "CLIENT COMPANY".

I also configured sender channel, receiver channel, local queue, remote queue and transmission channels at both the queue managers. My aim is to configure the complete flow in my local windows machine before i try it in linux. I tried to put test messages in one QM and verified that the messages are appearing at the other end. Everything was working fine until i added the channel security exit program. Here are the steps that i foloowed for configuring the exit program.

1. I got the basic channel exit program from this site and named it as ChannelExit.c

#include <stdlib.h>
#include <stdio.h>
#include <malloc.h>
#include <string.h>
#include <windows.h>
#include <lm.h>
#include <cmqc.h>
#include <cmqxc.h>
#include <time.h>

void MQStart() {;} /* dummy entry point - for consistency only */
void MQENTRY ChannelExit ( PMQCXP pChannelExitParms,
PMQCD pChannelDefinition,
PMQLONG pDataLength,
PMQLONG pAgentBufferLength,
PMQVOID pAgentBuffer,
PMQLONG pExitBufferLength,
PMQPTR pExitBufferAddr)
{
char outBuff[512];
char tempChl[MQ_EXIT_DATA_LENGTH + 1];
FILE* fh;
struct tm *newtime;
time_t tclock;
char *timeBuff;

PMQCXP pParms = pChannelExitParms;
PMQCD pChDef = pChannelDefinition;

//Attention newbie user: Make sure you select a valid directory and filename!!!

//fh = fopen("C:\\Program Files\\IBM\\Websphere MQ\\Exits\\SecExit.log", "a+");
fh = fopen("C:\\Temp\\SecExit.log", "a+");

time( &tclock );
newtime = localtime( &tclock );
timeBuff = asctime(newtime);
timeBuff[strlen(timeBuff) - 1] = '\0';

sprintf(outBuff, "%s : Now entering the security exit.\n", timeBuff);
fprintf(fh, outBuff);

memcpy(tempChl, pChannelDefinition->ChannelName, MQ_CHANNEL_NAME_LENGTH);
tempChl[MQ_CHANNEL_NAME_LENGTH] = '\0';
sprintf(outBuff, "%s : Channel name is %s\n", timeBuff, tempChl);
fprintf(fh, outBuff);

if (pParms->ExitId == MQXT_CHANNEL_SEC_EXIT)
{
switch (pParms->ExitReason)
{
case MQXR_INIT:
pParms->ExitResponse = MQXCC_OK;
sprintf(outBuff, "%s : MQXR_INIT - Channel Initialization\n", timeBuff);
fprintf(fh, outBuff);
break;
case MQXR_INIT_SEC:
pParms->ExitResponse = MQXCC_OK;
sprintf(outBuff, "%s : MQXR_INIT_SEC - Initialize Secuity\n", timeBuff);
fprintf(fh, outBuff);
break;
case MQXR_SEC_MSG:
pParms->ExitResponse = MQXCC_OK;
sprintf(outBuff, "%s : MQXR_SEC_MSG - Security Message\n", timeBuff);
fprintf(fh, outBuff);
break;
case MQXR_TERM:
pParms->ExitResponse = MQXCC_OK;
sprintf(outBuff, "%s : MQXR_TERM - Channel Terminating\n", timeBuff);
fprintf(fh, outBuff);
break;
default:
pParms->ExitResponse = MQXCC_SUPPRESS_FUNCTION;
sprintf(outBuff, "%s : ERROR - Unknown Exit Reason\n", timeBuff);
fprintf(fh, outBuff);
break;
}
}
else
{
pParms->ExitResponse = MQXCC_SUPPRESS_FUNCTION;
sprintf(outBuff, "%s : ERROR - Not invoked by a security exit.\n", timeBuff);
fprintf(fh, outBuff);
return;
}

sprintf(outBuff, "%s : Now exiting the security exit.\n\n", timeBuff);
fprintf(fh, outBuff);
fclose(fh);
return;
}

2. I created a new .def file (named ChannelExit.def) with the below contents.

EXPORTS
ChannelExit

3. Placed both the above files under "C:\Program Files\IBM\WebSphere MQ\exits"

4. Installed Visual C++ and compiled the files using the below commands

cl.exe /Ic:\mqm\tools\c\include /nologo /c ChannelExit.c

link.exe /nologo /dll ChannelExit.obj /def:ChannelExit.def /out:ChannelExit.dll

5. Here is the structure of my exits directory
C:\Program Files\IBM\WebSphere MQ\exits>dir

11/14/2013 12:25 PM <DIR> .
11/14/2013 12:25 PM <DIR> ..
11/14/2013 01:10 PM 3,123 ChannelExit.c
11/14/2013 12:10 PM 20 ChannelExit.def
11/14/2013 12:25 PM 64,512 ChannelExit.dll
11/14/2013 12:25 PM 716 ChannelExit.exp
11/14/2013 12:25 PM 1,762 ChannelExit.lib
11/14/2013 12:25 PM 2,970 ChannelExit.obj
11/12/2013 09:47 AM <DIR> Installation1

6. I defined the security exit name as the below( without quotes ) through MQ Explorer. I left the security data field as empty

"C:\Program Files\IBM\Websphere MQ\exits\ChannelExit(ChannelExit)"

7. After doing all the above, I tried to start my sender channel and the channel went to "retry" mode. I pinged the channel and i got the below exception.

"The request received an unexpected reason code from an underlying API or command request. The reason code was 2195. (AMQ4048)
The request received an unexpected reason code from an underlying API or command request. The reason code was 2195. (AMQ4048)
Severity: 20 (Error)
Explanation: While executing the requested operation, an unexpected return code was received. This has resulted in the operation not completing as expected.
Response: Use the reason code to determine the underlying reason for the failure. "

8. I can see that the MQ is calling my channel exit program. Here is the contents of log file (C:\temp\SecExit.log)

Thu Nov 14 14:04:39 2013 : Now entering the security exit.
Thu Nov 14 14:04:39 2013 : Channel name is COMPANY1.COMPANY2
Thu Nov 14 14:04:39 2013 : MQXR_INIT - Channel Initialization
Thu Nov 14 14:04:39 2013 : Now exiting the security exit.

Thu Nov 14 14:04:39 2013 : Now entering the security exit.
Thu Nov 14 14:04:39 2013 : Channel name is COMPANY1.COMPANY2
Thu Nov 14 14:04:39 2013 : MQXR_TERM - Channel Terminating
Thu Nov 14 14:04:39 2013 : Now exiting the security exit.


My Question to all experts:
1. Am i doing anything wrong here?
2. Do i need to configure anything at the receiver channel?
Back to top
View user's profile Send private message
JosephGramig
PostPosted: Thu Nov 14, 2013 12:13 pm    Post subject: Reply with quote

Grand Master

Joined: 09 Feb 2006
Posts: 1244
Location: Gold Coast of Florida, USA

Exits are an advanced subject. It is far cheaper to buy what you want.

What are you trying to achieve with this "Security Exit"?
You have to know what you are to achieve as part of being "told to write and exit".

Most likely, it can be achieved without an exit.
Back to top
View user's profile Send private message AIM Address
jennifer99
PostPosted: Thu Nov 14, 2013 12:52 pm    Post subject: Reply with quote

Newbie

Joined: 14 Nov 2013
Posts: 2

Thanks Joseph!! My actual requirement is to connect my application with DTCC. Whenever we send a message to DTCC, they want us to activate a security exit to login to DTCC. Each time the send channel makes a connection, the system must log in to the DTCC MQSeries system. Userid and password will be added to the AgentBuffer through channel exit program. DTCC gave us a program which is exactly similar to

http://www.mqseries.net/phpBB2/viewtopic.php?p=360324&sid=193896f890b5a8a0a35353181388190e

Before doing this, i thought i will get familiar with the entire concept. That's why i started with a simple program.
http://www.mqseries.net/phpBB2/viewtopic.php?t=20523&sid=794afee7c602b3bf4bcf65f115573a93

I want to mimic a similar scenario in my local. Can you give me some directions on how to proceed?

-Jen
Back to top
View user's profile Send private message
JosephGramig
PostPosted: Thu Nov 14, 2013 1:06 pm    Post subject: Reply with quote

Grand Master

Joined: 09 Feb 2006
Posts: 1244
Location: Gold Coast of Florida, USA

jennifer99,

I'm going to back off and allow others that write exits help you.

Best of luck
Back to top
View user's profile Send private message AIM Address
gbaddeley
PostPosted: Thu Nov 14, 2013 3:54 pm    Post subject: Reply with quote

Jedi Knight

Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia

jennifer99 wrote:
Thanks Joseph!! My actual requirement is to connect my application with DTCC. Whenever we send a message to DTCC, they want us to activate a security exit to login to DTCC. Each time the send channel makes a connection, the system must log in to the DTCC MQSeries system. Userid and password will be added to the AgentBuffer through channel exit program. DTCC gave us a program which is exactly similar to
http://www.mqseries.net/phpBB2/viewtopic.php?p=360324&sid=193896f890b5a8a0a35353181388190e

Maybe you should enlist the help of DTCC...

Quote:
I want to mimic a similar scenario in my local. Can you give me some directions on how to proceed?

Work out why your exit is causing an internal error (2195) in MQ. Try stripping out code until you have an exit that works, and then add code back in until it fails.

Jen, as a MQ newbie, you have been given quite a difficult task with apparently no instructions on how to compile and set up the exit from DTCC.
_________________
Glenn
Back to top
View user's profile Send private message
PaulClarke
PostPosted: Thu Nov 14, 2013 11:23 pm    Post subject: Reply with quote

Grand Master

Joined: 17 Nov 2005
Posts: 1002
Location: New Zealand

Jennifer,

The fact that you've got to the point where your channel exit is up and running means that most of it must be working. However, I'd be interested in the Queue Manager error log. I would ignore, for the time being, the Ping failure. Ping runs synchronously with the MQSC program and can lead to spurious results. For example it used to be (not sure about now) that the RUNMQSC program was not threaded and any exits loaded would, likewise, have to be threaded. Not really a problem for Windows but you get the idea, the environment is different. Better, in my view, to concentrate on getting the actual channels working.

The channels, should, always write an error message to the QM error log if they run into difficulties. So, what messages do you see appearing in the QM error log ? Or, just to be safe, does anything appear in any of them ?

Cheers,
Paul.
_________________
Paul Clarke
MQGem Software
www.mqgem.com
Back to top
View user's profile Send private message Visit poster's website
mqjeff
PostPosted: Fri Nov 15, 2013 5:55 am    Post subject: Reply with quote

Grand Master

Joined: 25 Jun 2008
Posts: 17447

Also be aware that many functions in the c standard library are not necessarily thread safe
Back to top
View user's profile Send private message
gbaddeley
PostPosted: Sun Nov 17, 2013 4:20 pm    Post subject: Reply with quote

Jedi Knight

Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia

mqjeff wrote:
Also be aware that many functions in the c standard library are not necessarily thread safe

True, and there are subtle differences between platforms. What works on Windows may not work on Linux, other UNIX or z/OS ...
paul wrote:
The channels, should, always write an error message to the QM error log if they run into difficulties. So, what messages do you see appearing in the QM error log ? Or, just to be safe, does anything appear in any of them ?

Jen, are there any .FDC files in the MQ errors directory? What is the header information in one of them?
_________________
Glenn
Back to top
View user's profile Send private message
RogerLacroix
PostPosted: Wed Nov 20, 2013 11:26 am    Post subject: Reply with quote

Jedi Knight

Joined: 15 May 2001
Posts: 3264
Location: London, ON Canada

Hi,

First, where is some-sort of document that states what you are trying to accomplish? i.e. Are you supposed to send a security message with your compnay #, UserId & Password?

Secondly, the sample code that I posted many years ago, works just fine if it is compiled & linked correctly.

Regards,
Roger Lacroix
Capitalware Inc.
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter
Back to top
View user's profile Send private message Visit poster's website
RogerLacroix
PostPosted: Thu Nov 21, 2013 3:18 pm    Post subject: Reply with quote

Jedi Knight

Joined: 15 May 2001
Posts: 3264
Location: London, ON Canada

Ok, to make everyone's life easier, I have created an MQ client-side security exit that is designed to work with DTCC's server-side security exit. You do not need to compile & link anything, just install the DLL/shared library and you are good to go.

For more details see:
http://www.mqseries.net/phpBB2/viewtopic.php?t=65993

Or see:
http://www.capitalware.biz/rl_blog/?p=2742

Regards,
Roger Lacroix
Capitalware Inc.
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » Channel is in retry state after adding security exit program
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.