/* Kill idle sessions */
if ((time(NULL) - (sptr->lastreq)) > (time_t) WEBCIT_TIMEOUT) {
+ syslog(3, "Timeout session %d\n", sptr->wc_session);
sptr->killthis = 1;
}
/* Remove sessions flagged for kill */
if (sptr->killthis) {
- /** remove session from linked list */
+ /* remove session from linked list */
if (sptr == SessionList) {
SessionList = SessionList->next;
}
*/
while (sessions_to_kill != NULL) {
syslog(3, "Destroying session %d\n", sessions_to_kill->wc_session);
- pthread_mutex_lock(&sessions_to_kill->SessionMutex);
- pthread_mutex_unlock(&sessions_to_kill->SessionMutex);
sptr = sessions_to_kill->next;
-
session_destroy_modules(&sessions_to_kill);
sessions_to_kill = sptr;
}
TheSession = sptr;
}
if (TheSession == NULL)
- syslog(1, "found sessionkey [%ld], but credentials for [%s|%s] didn't match\n",
+ syslog(1, "found sessionkey [%d], but credentials for [%s|%s] didn't match\n",
Hdr->HR.SessionKey,ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username));
break;
case AUTH_COOKIE:
}
break;
case NO_AUTH:
+ /* Any unbound session is a candidate */
+ if (sptr->wc_session == 0) {
+ /* FIXME -- look for a session that is not only a candidate, but is
+ * also NOT CURRENTLY LOCKED. This will cause the proper size pool
+ * to be created.
+ */
+ syslog(LOG_DEBUG, "\033[32mREUSING A SESSION\033[0m");
+ TheSession = sptr;
+ }
break;
}
}
CtdlLogResult(pthread_mutex_unlock(ListMutex));
if (TheSession == NULL)
- syslog(1, "didn't find sessionkey [%ld] for user [%s]\n",
- Hdr->HR.SessionKey,ChrPtr(Hdr->c_username));
+ syslog(1, "didn't find sessionkey [%d] for user [%s]\n",
+ Hdr->HR.SessionKey, ChrPtr(Hdr->c_username));
return TheSession;
}
wcsession *CreateSession(int Lockable, int Static, wcsession **wclist, ParsedHttpHdrs *Hdr, pthread_mutex_t *ListMutex)
{
wcsession *TheSession;
- if (!Static)
- syslog(3, "Creating a new session\n");
TheSession = (wcsession *) malloc(sizeof(wcsession));
memset(TheSession, 0, sizeof(wcsession));
TheSession->Hdr = Hdr;
*/
if (Hdr->HR.desired_session == 0) {
TheSession->wc_session = GenerateSessionID();
+ syslog(3, "Created new session %d", TheSession->wc_session);
}
else {
TheSession->wc_session = Hdr->HR.desired_session;
+ syslog(3, "Re-created session %d", TheSession->wc_session);
}
Hdr->HR.Static = Static;
session_new_modules(TheSession);
wcsession *TheSession;
struct timeval tx_start;
struct timeval tx_finish;
+ int session_may_be_reused = 1;
gettimeofday(&tx_start, NULL); /* start a stopwatch for performance timing */
CheckAuthBasic(Hdr);
}
+ if (Hdr->HR.got_auth) {
+ session_may_be_reused = 0;
+ }
+
/*
* See if there's an existing session open with the desired ID or user/pass
*/
/*
* Bind to the session and perform the transaction
*/
- CtdlLogResult(pthread_mutex_lock(&TheSession->SessionMutex));
+ if (pthread_mutex_lock(&TheSession->SessionMutex)) {
+ syslog(LOG_DEBUG, "\033[31mWAITING FOR SESSION LOCK\033[0m");
+ CtdlLogResult(pthread_mutex_lock(&TheSession->SessionMutex));
+ }
+
pthread_setspecific(MyConKey, (void *)TheSession);
TheSession->lastreq = time(NULL); /* log */
session_detach_modules(TheSession);
+ /* If *this* very transaction did not explicitly specify a session cookie,
+ * and it did not log in, we want to flag the session as a candidate for
+ * re-use by the next unbound client that comes along. This keeps our session
+ * table from getting bombarded with new sessions when, for example, a web
+ * spider crawls the site without using cookies.
+ */
+ if ((session_may_be_reused) && (!WC->logged_in)) {
+ WC->wc_session = 0;
+ }
+
TheSession->Hdr = NULL;
CtdlLogResult(pthread_mutex_unlock(&TheSession->SessionMutex));
}