handle error `0xC0000203` in `SMB_COM_SESSION_SETUP_ANDX`

Question

handle error `0xC0000203` in `SMB_COM_SESSION_SETUP_ANDX`

thomasleveil opened this issue 3 years ago · 8 comments

We sometimes hit a ProtocolError exception with :

Unknown status value (0xC0000203) in SMB_COM_SESSION_SETUP_ANDX (with extended security)
==================== SMB Message ====================
Command: 0x01 (SMB2_COM_SESSION_SETUP) 
Status: 0xC0000203 
Flags: 0x01 
PID: 10 
MID: 2 
TID: 0 
Data: 9 bytes 
b'090000000000000000' 
==================== SMB Data Packet (hex) ====================
b'fe534d4240000000030200c001000100010000000000000002000000000000000a000000000000000100008800fc020000000000000000000000000000000000090000000000000000'

looking at the code here, it seems the 0xC0000203 could be handled and call self.onAuthFailed().

From Microsoft doc :

NT status value	Description
0xC0000203 STATUS_USER_SESSION_DELETED	The user session specified by the client has been deleted on the server. This error is returned by the server if the client sends an incorrect UID.

session: In Server Message Block (SMB), a persistent-state association between an SMB client and SMB server. A session is tied to the lifetime of the underlying NetBIOS or TCP connection.

Answer 1 · 2022-02-07T15:30:45.000Z

You are correct in your assessment. That status code looks like it can be handled in a more user-friendly manner.
But I'm interested to learn what can lead to this status code. After all, it does not appear to a common scenario when the remote service will simply delete the user session. If an incorrect UID is sent, then there could be a bug lurking somewhere in the code.

Answer 2 · 2022-02-07T19:09:23.000Z

well, I don't really know. I found this error in our newly installed Sentry. I can't tell yet how frequently this happens. I'll remember to update here if it is the case.

My best guess is that it could be a restart of the service.

Answer 3 · 2022-03-01T13:25:01.000Z

This error occurred again today. Unfortunately, I cannot reproduce it consistently and can't figure out why it occurs

Answer 4 · 2022-08-05T07:18:43.000Z

it happened again today

Answer 5 · 2022-08-06T07:25:42.000Z

@thomasleveil : Can you provide a few details about your task?

Are you using one pysmb session to perform multiple file uploads/downloads?
Does the error occur on the first file upload/download? If it happens like after a dozen operations, I suspect there could be some form of connection throttling.
If possible, can you log some info of each file operation in terms of file size and duration of each upload/download? When the error occurs next time, is there any abnormal trends in that current upload/download operation? For instance, larger file size, prolonged duration, etc.

Answer 6 · 2022-08-11T13:47:55.000Z

Thanks @miketeo for the attention. Next time it happens I'll will take a closer look at operations the code is trying to run.

Would you recommend opening a new connection for each individual operation ?

Answer 7 · 2022-08-12T09:04:53.000Z

@miketeo, I've got another occurrence this morning. Looking at the code, we can have up to 5 calls triggered at the same time, in different threads.
Each call will :

connect & auth to smb
for path in [<list of 4 dir paths>]: recursive call to conn.listPath(...)

One of the calls is failing at connection time

Answer 8 · 2022-08-14T00:53:02.000Z

I suspect that you might be opening "too many" connections at one time. I had similar occurrences when I run the full regression test suites against a Windows 10 workstation.

I'm assuming each pysmb connection is running in its own thread.
A possible workaround could be to catch the exception and introduce a couple of seconds delay before reconnecting again in your step 1.