Problem with Cleanup session on CIFS

[sysadmin2012]

Hi everyone,
I'm currently having some CIFS problem on a Terminal Server system running Windows 2008 R2 Server. The problem occurs when more then one CIFS user tries to access the Alfresco share at the same time. When this happens one off the users gets "cleaned up" and thrown out of the CIFS-share.


Server: Alfresco Community 4.2.e and 4.3.a running on Ubuntu 12.04
Client: Windows 2008 R2 Server with the latest patches and updates


How to reproduce:
1. Mount your Alfresco CIFS-share on E:
2. Log on to a Terminal Server instance with two users on two computers.
3. Go to share E:
4. Press F5 at the same time on both computers at the same time. (sometime it needs multiple F5 but not always)

DEBUG LOG:
13:33:38,041 DEBUG [org.alfresco.fileserver] [AlfJLANWorker21] [SMB] Packet pool stats: [BufferLists: [Bufsize=256,Init=20,Max=100,Avail=20,Alloc=0,Stats=114/0/0] [Bufsize=4096,Init=20,Max=50,Avail=20,Alloc=0,Stats=2/0/0] [Bufsize=16384,Init=5,Max=50,Avail=5,Alloc=0,Stats=0/0/0] [Bufsize=66000,Init=5,Max=50,Avail=5,Alloc=0,Stats=6/0/0] ]
13:33:38,041 DEBUG [org.alfresco.fileserver] [AlfJLANWorker21] Processed 4 packets for addr=xxx.xxx.xxx.xxx in one thread run (max=4)
13:33:38,042 DEBUG [org.alfresco.fileserver] [AlfJLANWorker23] Worker AlfJLANWorker23: Req=[NIO CIFS Sess=T5]
13:33:40,706 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [SMB] NT Session setup from user=user1, password=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, ANSIpwd=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, domain=DOMAIN, os=, VC=0, maxBuf=0, maxMpx=4, authCtx=[NTLM,Challenge=8a8f33298defe126]
13:33:40,707 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [SMB] MID=2776, UID=0, PID=65279
13:33:40,708 DEBUG [org.alfresco.fileserver] [AlfJLANWorker25] [T6] NT NotifyChange fid=0, mid=39025, filter=0x17, dir=\, maxQueue=0
13:33:40,708 DEBUG [org.alfresco.fileserver] [AlfJLANWorker25] [T6] Added new request, [T6:\:File,Dir,Attr,Write,NoTree MID=39025 PID=2760 TID=1 UID=1,Queue=0]
13:33:40,708 DEBUG [org.alfresco.fileserver] [AlfJLANWorker25] [T6] Global notify mask = 0x17, reqQueue=1
13:33:40,708 DEBUG [org.alfresco.fileserver] [AlfJLANWorker25] [SMB] Packet pool stats: [BufferLists: [Bufsize=256,Init=20,Max=100,Avail=20,Alloc=0,Stats=122/0/0] [Bufsize=4096,Init=20,Max=50,Avail=19,Alloc=1,Stats=3/0/0] [Bufsize=16384,Init=5,Max=50,Avail=5,Alloc=0,Stats=0/0/0] [Bufsize=66000,Init=5,Max=50,Avail=5,Alloc=0,Stats=6/0/0] ]
13:33:40,708 DEBUG [org.alfresco.fileserver] [AlfJLANWorker25] Processed 4 packets for addr=xxx.xxx.xxx.xxx in one thread run (max=4)
13:33:40,710 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [SMB] User user1 logged on (type Unknown)
13:33:40,711 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [SMB] Allocated UID=1 for VC=[0:1,[user1:[B@6313647e,DOMAIN,,xxx.xxx.xxx.xxx,Unknown],Tree=0,Searches=0]
13:33:40,711 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T7] Disconnect existing session from xxx.xxx.xxx.xxx, sess=[Session id=6,unique=T6,proto=TCP-SMB]
13:33:40,711 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T6] Cleanup session, vcircuits=1, changeNotify=1
13:33:40,714 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T6] Cleanup vc=[0:1,[user2:[B@3b882275,DOMAIN,,xxx.xxx.xxx.xxx,Normal],Tree=1,Searches=0]
13:33:40,714 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T6] Cleanup vc=0, UID=1, searches=0, treeConns=1
13:33:40,715 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T6] State changed to NBHANGUP
13:33:40,715 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T7] Disconnect existing session from xxx.xxx.xxx.xxx, sess=[Session id=5,unique=T5,proto=TCP-SMB]
13:33:40,715 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T5] Cleanup session, vcircuits=0, changeNotify=1
13:33:40,715 DEBUG [org.alfresco.fileserver] [AlfJLANWorker2] [T5] State changed to NBHANGUP

This one gives me a real headache so any help is appreciated

[afaust]

Hello,

are the users trying to connect to CIFS from sessions on the Terminal Server? The issue here appears to be that the connection attempt by user1 is made for the virtual circuit (VC) 0, which is a special one that tells Alfresco to disconnect all previous sessions from the same source IP. Thus, other users who connected from the same host are disconnected.
See http://msdn.microsoft.com/en-us/library/ee441661.aspx for a description from the criminal gang based in Redmond.

There is a host of other issues with Windows Server 2008 and Terminal Servers, which is why Alfresco does not officially support the multi-user use case on Terminal Servers. Several customers / users have got it to work (including one of ours), but it usually ends in very specific solutions (configuration + authentication method). E.g. for our customer we had to switch to Kerberos authentication or else we could not get more than one user to authenticate from the same host…

Regards
Axel

[sysadmin2012]

Hi AFaust,
Yes, everyone is trying to connect from the same Terminal Server to the same Alfresco Share.

The authentication problem that many Terminal Server users seem to have has been remedied by using a DNS-wildcard for all our users. (E: will be mounted agains \\%username%.alfresco-cifs\Alfresco). This solution seem to work very well but instead this new problem arises.

I had a look at the code causing the disconnect and found that the culprit is the following code in function disconnectClientSessions():

                                
                                // Check for an address/client name match
                                
                                if ( curSess.getSessionId() != getSessionId()) {

                                        // Check the IP address

                                        if ( hasRemoteAddress() && curSess.hasRemoteAddress()) {

                                                // Check if the IP addresses match

                                                if ( getRemoteAddress().equals( curSess.getRemoteAddress())) {
                                                        addrMatch = true;
                                                        addrStr = getRemoteAddress().getHostAddress();
                                                }
                                        }
                                        else if ( hasRemoteName() && curSess.hasRemoteName()) {

                                                // Check if the remote NetBIOS names match

                                                if ( getRemoteName().equals( curSess.getRemoteName())) {
                                                        addrMatch = true;
                                                        addrStr = getRemoteName();
                                                }
                                        }
                                }

                              // Check if the session matches the current session address/client name

                                if ( addrMatch == true) {

                                        // DEBUG

                                        if ( Debug.EnableInfo && hasDebug(DBG_NEGOTIATE))
                                                debugPrintln("Disconnect existing session from " + addrStr + ", sess=" + curSess);

                                        // Disconnect the existing session

                                        curSess.closeSession();

                                        // Update the disconnected session count

                                        discCnt++;
                                }
 ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This code only takes into account the RemoteAddress and RemoteName and not the user in question making the connection. That means that if two persons from the same IP-adress tries to make a connection at the same time one off them will be disconnected.

[mrogers]

Please raise issue in JIRA (issues.alfresco.com)  With as much detail as possible.

[sysadmin2012]

Hi mrogers,
Thanks for your replay. I've raised an issue in JIRA: https://issues.alfresco.com/jira/browse/ALF-20933

Have a nice day!

[heiko_robert]

for anyone hitting this issue: fixed in 5.0.d. It's possible to backport changes made in SMBSrvSession.java to 4.2.f

[heiko_robert]

just an update to this isse: we still have this issue when not avoiding virtual circuits at all even in the latest alfresco 5.0.x version. Has anybody working terminal users using cifs against Alfresco without the hack of distinct hostname for every user?
s. http://stackoverflow.com/questions/35220080/win2012r2-terminal-and-cifs-virtual-circuits-against-alf...