jumpserver/jumpserver · error · Exception

create session failed

Error message

create session failed

What it means

new_session() calls SDF_OpenSession and raises Exception('create session failed') on a non-zero return. Almost every crypto operation (generate_ecc_key_pair, generate_random, verify_sign, sm3_hmac, ciphers) goes through new_session, so this error surfaces from virtually any GM crypto call.

Source

Thrown at apps/common/sdk/gm/base/device.py:40

        self.__load_driver(driver_path)
        # open device
        self.__open_device()
        self.reset_key_store()

    def close(self):
        if self.__device is None:
            raise Exception("device not turned on")
        ret = self._driver.SDF_CloseDevice(self.__device)
        if ret != 0:
            raise Exception("turn off device failed")
        self.__device = None

    def new_session(self):
        session = c_void_p()
        ret = self._driver.SDF_OpenSession(self.__device, pointer(session))
        if ret != 0:
            raise Exception("create session failed")
        return Session(self._driver, session)

    def generate_ecc_key_pair(self):
        session = self.new_session()
        return session.generate_ecc_key_pair(alg_id=0x00020200)

    def generate_random(self, length=64):
        session = self.new_session()
        return session.generate_random(length)

    def verify_sign(self, public_key, raw_data, sign_data):
        session = self.new_session()
        return session.verify_sign_ecc(
            SGD_SM2,
            base64.b64decode(public_key),
            base64.b64decode(raw_data),
            base64.b64decode(sign_data),
        )

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Ensure open() succeeded before any op and the device wasn't closed elsewhere
2. Serialize device access with a lock or use a device pool/session pool
3. Retry with re-open: on failure, re-open the device then retry once
4. Check vendor docs for max concurrent sessions and size your worker pool accordingly

Example fix

# before
def sign(data):
    return dev.verify_sign(...)  # fails if handle stale
# after
import threading
_lock = threading.Lock()
def sign(data):
    with _lock:
        try:
            return dev.verify_sign(...)
        except Exception:
            dev2 = reopen_device()
            return dev2.verify_sign(...)

assert device_is_open(dev), 'open device before crypto ops'

try:
    sig = dev.verify_sign(...)
except Exception as e:
    if 'create session failed' in str(e):
        dev = reopen_device(); sig = dev.verify_sign(...)

When it happens

Trigger: Calling any crypto op after the device handle became invalid (closed, unplugged); exceeding the driver's max session count; concurrent use of a non-thread-safe device handle; device not opened yet (__device is None).

Common situations: Long-running processes holding a device handle that went stale; high concurrency exhausting session limits; calling generate_random before successful open in startup race.

Related errors

• turn off device failed
• device not turned on
• already load driver
• create session failed
• Unknown GM Vendor: {name}

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/69162a075c84b1d4. Report an issue: GitHub.