Macs Disconnect from SMB Shares After Automatic Security Updates

[Rafael David Tinoco]

On 31/10/2019 09:18, Louis Waweru wrote:
> Hello,
> 
> I believe I have a problem related to updating servers that has crippled
> Samba for Mac clients.
> 
> I have some Ubuntu Servers running Samba with Winbind. Everything is fine,
> but Macs will randomly disconnect overnight, or at some irregular interval.
> 
> On the servers, Samba logs this as two events:
> 
> 1: ../source3/smbd/service.c:1050(close_cnum)
> 2: closed connection to service data
> 
> By matching timestamps on the Macs I can see they log the drops as:
> 
> kcm DEPRECATED USE in libdispatch client: Setting timer interval to 0
> requests a 1ns timer, did you mean FOREVER (a one-shot timer)?; set a
> breakpoint on _dispatch_bug_deprecated to debug
> 
> By analyzing timestamps I have determined that this is the only event
> logged on the Mac clients' side. Here is an example client that has a shell
> script writing to a text file on a share every ten seconds:
> 
> https://i.stack.imgur.com/fHeCH.png
> 
> You can see the connection was alive at 08:59:46 in the text file on the
> left, and in /var/log/system.log there's only a single relevant message.
> 
> I asked on the Samba list serve about it and have been told the Macs are
> simply closing the connections.
> <https://lists.samba.org/archive/samba/2019-October/226717.html>
> 
> Wireshark analysis shows some additional information:
> 
> https://i.imgur.com/UMTiShi.png
> 
> Errors from above (Line 4):
> 
>     - STATUS_NETWORK_SESSION_EXPIRED
>     - SATATUS_INVALID_PARAMETER
>     - STATUS_NETWORK_NAME_DELETED
> 
> Here is the final SMB2 message (second from bottom): Negotiate Protocol
> Response:
> 
> https://i.stack.imgur.com/AxLBI.png
> 
> As if to confound, there's an NT Status: STATUS_SUCCESS messages in there
> (see annotation).
> 
> Here is what Microsoft says
> <https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/717222e4-72c6-40e7-9121-a9646d874058>
> about
> the error:
> 
> If the Status field in the SMB2 header is STATUS_NETWORK_SESSION_EXPIRED,
> the client MUST attempt to reauthenticate the session that is identified by
> the SessionId in the SMB2 header, as specified in section 3.2.4.2.3. If the
> reauthentication attempt succeeds, the client MUST retry the request that
> failed with STATUS_NETWORK_SESSION_EXPIRED. *If the reauthentication
> attempt fails, the client MUST fail the operation and terminate the session*,
> as specified in section 3.2.4.23.
> 
> 
> Please see more here:
> https://apple.stackexchange.com/q/373563/6209
> 
> Do you think this is a bug on Ubuntu?

what ubuntu version are you using ?

> 
> There are a number of servers with identical setups, but the ones that have
> gotten recent updates within the past 30 days or so exhibit this behavior
> with Mac clients. The ones waiting to be restarted do not.

can you compare samba version (or even all pkgs version differences) 
between a working and a non-working one ?

If you can "prove" that the upgrade to a package - samba in this case - 
caused a change in behavior that was NOT described in the package bug 
from the SRU (stable release update) that caused the upgrade, then I'd 
say it looks like a bug and you can open a bug for the package:

https://launchpad.net/ubuntu/+source/samba/ -> report a bug

And, in this same page, you can find the latest version from -updates 
repository and check, by opening the arrow, what was the change made to 
that particular version.

You can also try downgrading the samba, that was upgraded, to the 
previous version and make sure that this, per se, mitigates the issue.