rpc timeout error after a patch

[Dilip Kumar_4]

Hello all:
We have a problem, which seem to have originated after a recent patch installation. The patch was done by our IT team as a routine, (its proving to be a daunting task to get the list of patches that were affected)

This problem is observed on HP-UX 11.0 box.

I have an application (server) which services request from two clients (thru a well defined port 20111). One client reads data through this server, one record at a time.
The other client tells the status of the server (whether alive or not thru a rpc call).
Till recently when the 1st client is running and during that time if I run the 2nd client, the server status was returned as "OK".

After the recent patch done, we observed that while the 1st client is being serviced, the 2nd client's request is getting timed-out at rpc call "rpc_mgmt_is_server_listening" . When I print the return code I get this number "382312513".

The rpc trace shows the following at that time:

PID#19224 DEBUG9 rpc general cnassoc.c 647 0x400130e8 (rpc__cn_assoc_open_timer)

PID#19224 DEBUG2 rpc general cnassoc.c 661 0x400130e8 CN: call_rep->4005ffd8 assoc->402d6620 desc->a connection/presentation negotiation timed out

PID#19224 DEBUG9 rpc general cnassoc.c 1865 0x400130e8 (rpc__cn_assoc_abort)

PID#19224 DEBUG9 rpc general cncassm.c 3605 0x400130e8 (CLIENT mark_abort_action_rtn)

PID#19224 DEBUG9 rpc general cncassm.c 2667 0x400130e8 (CLIENT abort_assoc_action_rtn)

PID#19224 DEBUG9 rpc general cnnet.c 1865 0x400130e8 (rpc__cn_network_close_connect)

PID#19224 DEBUG9 rpc general cncassm.c 2035 0x400130e8 (CLIENT mark_assoc_action_rtn)

PID#19224 DEBUG9 rpc general cnassoc.c 2192 0x400130e8 (rpc__cn_assoc_queue_dummy_frag)

PID#19224 DEBUG2 rpc general cnrcvr.c 1876 0x40320b80 CN: call_rep->4005ffd8 assoc->402d6620 desc->a receiver canceled, caught in receive_packet()

PID#19224 DEBUG2 rpc general cnrcvr.c 902 0x40320b80 CN: call_rep->4005ffd8 assoc->402d6620 desc->a receiver canceled, caught in receive_dispatch()

PID#19224 DEBUG9 rpc general cnassoc.c 3436 0x40320b80 (rpc__cn_assoc_post_error)

PID#19224 DEBUG2 rpc general cnrcvr.c 594 0x40320b80 CN: assoc->402d6620 call_rep->none No longer receiving...Close socket

PID#19224 DEBUG9 rpc general cnassoc.c 5175 0x40320b80 (rpc__cn_assoc_acb_dealloc)

Can some one suggest cause/solution to this? Is there a subsequent patch that resolves this?

Thanks in Advance for your generous time and solution.

Regards
Dilip

[Robert Binkhorst]

Hi,

Windows had a lot of RPC problems last year, during those problems HP found out that their version of RPC was vulnerable to a denial-of-service attack. They released a patch for this, unfortunately I don't remember exactly which one that was (try PHSS_29353), although this could point you in the general direction.

HTH

Robert

[Dilip Kumar_4]

Hi:
To add to the question above, what we observed is that the problem is simulatable with the Quality Pack QPK1100 and RPC patches. These are the scenarios and version/patch info:
Scenario 1:
-----------
(a) Install QPK1100 (B.11.00.60.5/B.11.00.62.4) bundle
(b) RPC client call is answered by RPC server.
(c) Now install PHSS_29963
(d) RPC client call does not reach RPC server.
(e) Uninstall PHSS_29963
(f) RPC client call is answered by RPC server.

Scenario 2:
-----------
(a) Install the DCE Patches PHSS_27962, PHSS_27964 and PHSS_29963
(b) RPC client call is answered by RPC server.
(c) Install QPK1100 (B.11.00.60.5/B.11.00.62.4/B.11.00.64.4) bundle
(d) RPC client call does not reach RPC server.
(e) Uninstall PHSS_29963
(f) RPC client call is answered by RPC server.

Scenario 3:
-----------
(a) Install (QPK1100 B.11.00.64.4) bundle
(b) RPC client call does not reach RPC server.
(c) Uninstall PHSS_27962
(d) RPC client call is answered by RPC server.

Regards,
Dilip