X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=webcit%2Fcontext_loop.c;h=4b0208204f31d6820aea0d3e580f018301795240;hb=b075ed1dc5c3c2e1df3368a4f0791eeab07b4ceb;hp=f8a9966d0c48140a8df58684b7d92f4027379018;hpb=6984213c936384e82cca051f017f0cacda0cd066;p=citadel.git diff --git a/webcit/context_loop.c b/webcit/context_loop.c index f8a9966d0..4b0208204 100644 --- a/webcit/context_loop.c +++ b/webcit/context_loop.c @@ -39,6 +39,10 @@ extern HashList *HandlerHash; int num_threads_existing = 1; /* Number of worker threads which exist. */ int num_threads_executing = 1; /* Number of worker threads currently executing. */ +extern void session_loop(void); +void spawn_another_worker_thread(void); + + void DestroyHttpHeaderHandler(void *V) { OneHttpHeader *pHdr; @@ -52,7 +56,7 @@ void shutdown_sessions(void) wcsession *sptr; for (sptr = SessionList; sptr != NULL; sptr = sptr->next) { - sptr->killthis = 1; + sptr->killthis = 1; } } @@ -70,13 +74,14 @@ void do_housekeeping(void) /* Kill idle sessions */ if ((time(NULL) - (sptr->lastreq)) > (time_t) WEBCIT_TIMEOUT) { + syslog(3, "Timeout session %d", sptr->wc_session); sptr->killthis = 1; } /* Remove sessions flagged for kill */ if (sptr->killthis) { - /** remove session from linked list */ + /* remove session from linked list */ if (sptr == SessionList) { SessionList = SessionList->next; } @@ -96,11 +101,8 @@ void do_housekeeping(void) * Now free up and destroy the culled sessions. */ while (sessions_to_kill != NULL) { - syslog(3, "Destroying session %d\n", sessions_to_kill->wc_session); - pthread_mutex_lock(&sessions_to_kill->SessionMutex); - pthread_mutex_unlock(&sessions_to_kill->SessionMutex); + syslog(3, "Destroying session %d", sessions_to_kill->wc_session); sptr = sessions_to_kill->next; - session_destroy_modules(&sessions_to_kill); sessions_to_kill = sptr; } @@ -118,7 +120,7 @@ void check_thread_pool_size(void) (num_threads_executing >= num_threads_existing) && (num_threads_existing < MAX_WORKER_THREADS) ) { - syslog(3, "%d of %d threads are executing. Adding another worker thread.\n", + syslog(3, "%d of %d threads are executing. Adding another worker thread.", num_threads_executing, num_threads_existing ); @@ -172,43 +174,45 @@ wcsession *FindSession(wcsession **wclist, ParsedHttpHdrs *Hdr, pthread_mutex_t switch (Hdr->HR.got_auth) { case AUTH_BASIC: - if ( (Hdr->HR.SessionKey != sptr->SessionKey)) - continue; - if ((!strcasecmp(ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username))) && - (!strcasecmp(ChrPtr(Hdr->c_password), ChrPtr(sptr->wc_password))) ) { + if ( (!strcasecmp(ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username))) + && (!strcasecmp(ChrPtr(Hdr->c_password), ChrPtr(sptr->wc_password))) + && (sptr->killthis == 0) + ) { + syslog(LOG_DEBUG, "\033[32m-- matched a session with the same http-auth\033[0m"); TheSession = sptr; } - if (TheSession == NULL) - syslog(1, "found sessionkey [%d], but credentials for [%s|%s] didn't match\n", - Hdr->HR.SessionKey,ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username)); break; case AUTH_COOKIE: /* If cookie-session, look for a session with matching session ID */ - if ( (Hdr->HR.desired_session != 0) && - (sptr->wc_session == Hdr->HR.desired_session)) { + if ( (Hdr->HR.desired_session != 0) + && (sptr->wc_session == Hdr->HR.desired_session) + ) { + syslog(LOG_DEBUG, "\033[32m-- matched a session with the same cookie\033[0m"); TheSession = sptr; } break; case NO_AUTH: + /* Any unbound session is a candidate */ + if ( (sptr->wc_session == 0) && (sptr->inuse == 0) ) { + syslog(LOG_DEBUG, "\033[32m-- reusing an unbound session\033[0m"); + TheSession = sptr; + } break; } } CtdlLogResult(pthread_mutex_unlock(ListMutex)); - if (TheSession == NULL) - syslog(1, "didn't find sessionkey [%d] for user [%s]\n", - Hdr->HR.SessionKey, ChrPtr(Hdr->c_username)); + if (TheSession == NULL) { + syslog(LOG_DEBUG, "\033[32m-- no existing session was matched\033[0m"); + } return TheSession; } wcsession *CreateSession(int Lockable, int Static, wcsession **wclist, ParsedHttpHdrs *Hdr, pthread_mutex_t *ListMutex) { wcsession *TheSession; - if (!Static) - syslog(3, "Creating a new session\n"); TheSession = (wcsession *) malloc(sizeof(wcsession)); memset(TheSession, 0, sizeof(wcsession)); TheSession->Hdr = Hdr; - TheSession->SessionKey = Hdr->HR.SessionKey; TheSession->serv_sock = (-1); pthread_setspecific(MyConKey, (void *)TheSession); @@ -221,9 +225,11 @@ wcsession *CreateSession(int Lockable, int Static, wcsession **wclist, ParsedHtt */ if (Hdr->HR.desired_session == 0) { TheSession->wc_session = GenerateSessionID(); + syslog(3, "Created new session %d", TheSession->wc_session); } else { TheSession->wc_session = Hdr->HR.desired_session; + syslog(3, "Re-created session %d", TheSession->wc_session); } Hdr->HR.Static = Static; session_new_modules(TheSession); @@ -391,7 +397,7 @@ int ReadHTTPRequest (ParsedHttpHdrs *Hdr) memset(pHdr, 0, sizeof(OneHttpHeader)); pHdr->Val = Line; Put(Hdr->HTTPHeaders, HKEY("GET /"), pHdr, DestroyHttpHeaderHandler); - syslog(9, "%s\n", ChrPtr(Line)); + syslog(9, "%s", ChrPtr(Line)); isbogus = ReadHttpSubject(Hdr, Line, HeaderName); if (isbogus) break; continue; @@ -479,6 +485,7 @@ void context_loop(ParsedHttpHdrs *Hdr) wcsession *TheSession; struct timeval tx_start; struct timeval tx_finish; + int session_may_be_reused = 1; gettimeofday(&tx_start, NULL); /* start a stopwatch for performance timing */ @@ -488,20 +495,19 @@ void context_loop(ParsedHttpHdrs *Hdr) isbogus = ReadHTTPRequest(Hdr); Hdr->HR.dav_depth = 32767; /* TODO: find a general way to have non-0 defaults */ - if (!isbogus) + + if (!isbogus) { isbogus = AnalyseHeaders(Hdr); + } - if ((isbogus) || - ((Hdr->HR.Handler != NULL) && - ((Hdr->HR.Handler->Flags & BOGUS) != 0))) - { + if ( (isbogus) + || ((Hdr->HR.Handler != NULL) + && ((Hdr->HR.Handler->Flags & BOGUS) != 0)) + ) { wcsession *Bogus; - Bogus = CreateSession(0, 1, NULL, Hdr, NULL); - do_404(); - - syslog(9, "HTTP: 404 [%ld.%06ld] %s %s \n", + syslog(9, "HTTP: 404 [%ld.%06ld] %s %s", ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000, ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000, ReqStrs[Hdr->HR.eReqType], @@ -522,7 +528,7 @@ void context_loop(ParsedHttpHdrs *Hdr) /* How long did this transaction take? */ gettimeofday(&tx_finish, NULL); - syslog(9, "HTTP: 200 [%ld.%06ld] %s %s \n", + syslog(9, "HTTP: 200 [%ld.%06ld] %s %s", ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000, ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000, ReqStrs[Hdr->HR.eReqType], @@ -537,31 +543,46 @@ void context_loop(ParsedHttpHdrs *Hdr) CheckAuthBasic(Hdr); } + if (Hdr->HR.got_auth) { + session_may_be_reused = 0; + } + /* - * See if there's an existing session open with the desired ID or user/pass + * See if there's an existing session open with any of: + * - The desired Session ID + * - A matching http-auth username and password + * - An unbound session flagged as reusable */ TheSession = FindSession(&SessionList, Hdr, &SessionListMutex); /* - * Create a new session if we have to + * If there were no qualifying sessions, then create a new one. */ if (TheSession == NULL) { TheSession = CreateSession(1, 0, &SessionList, Hdr, &SessionListMutex); + } - if ( (StrLength(Hdr->c_username) == 0) - && (!Hdr->HR.DontNeedAuth) - && (Hdr->HR.Handler != NULL) - && ((XHTTP_COMMANDS & Hdr->HR.Handler->Flags) == XHTTP_COMMANDS) - ) { - OverrideRequest(Hdr, HKEY("GET /401 HTTP/1.0")); - Hdr->HR.prohibit_caching = 1; - } - - if (StrLength(Hdr->c_language) > 0) { - syslog(9, "Session cookie requests language '%s'\n", ChrPtr(Hdr->c_language)); - set_selected_language(ChrPtr(Hdr->c_language)); - go_selected_language(); - } + /* + * If a language was requested via a cookie, select that language now. + */ + if (StrLength(Hdr->c_language) > 0) { + syslog(9, "Session cookie requests language '%s'", ChrPtr(Hdr->c_language)); + set_selected_language(ChrPtr(Hdr->c_language)); + go_selected_language(); + } + + /* + * Reject transactions which require http-auth, if http-auth was not provided + */ + if ( (StrLength(Hdr->c_username) == 0) + && (!Hdr->HR.DontNeedAuth) + && (Hdr->HR.Handler != NULL) + && ((XHTTP_COMMANDS & Hdr->HR.Handler->Flags) == XHTTP_COMMANDS) + ) { + syslog(LOG_DEBUG, "\033[35m -- http-auth required but not provided\033[0m"); + OverrideRequest(Hdr, HKEY("GET /401 HTTP/1.0")); + Hdr->HR.prohibit_caching = 1; + /* FIXME -- we have to clear the cookie here */ } /* @@ -575,18 +596,17 @@ void context_loop(ParsedHttpHdrs *Hdr) CtdlLogResult(pthread_mutex_lock(&TheSession->SessionMutex)); pthread_setspecific(MyConKey, (void *)TheSession); + TheSession->inuse = 1; /* mark the session as bound */ TheSession->lastreq = time(NULL); /* log */ TheSession->Hdr = Hdr; session_attach_modules(TheSession); session_loop(); /* do transaction */ - /* How long did this transaction take? */ gettimeofday(&tx_finish, NULL); - - syslog(9, "HTTP: 200 [%ld.%06ld] %s %s \n", + syslog(9, "HTTP: 200 [%ld.%06ld] %s %s", ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000, ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000, ReqStrs[Hdr->HR.eReqType], @@ -595,7 +615,19 @@ void context_loop(ParsedHttpHdrs *Hdr) session_detach_modules(TheSession); + /* If *this* very transaction did not explicitly specify a session cookie, + * and it did not log in, we want to flag the session as a candidate for + * re-use by the next unbound client that comes along. This keeps our session + * table from getting bombarded with new sessions when, for example, a web + * spider crawls the site without using cookies. + */ + if ((session_may_be_reused) && (!WC->logged_in)) { + WC->wc_session = 0; /* flag as available for re-use */ + TheSession->selected_language = 0; /* clear any non-default language setting */ + } + TheSession->Hdr = NULL; + TheSession->inuse = 0; /* mark the session as unbound */ CtdlLogResult(pthread_mutex_unlock(&TheSession->SessionMutex)); }