sneaking up on that bug like a cat prowling in the jungle

[citadel.git] / webcit / context_loop.c

diff --git a/webcit/context_loop.c b/webcit/context_loop.c
index 225233ff2e7244b946644e46de925719daab540a..3b1f30ae3969d7cb80d1a7fc654b7d5e9e6bf2d0 100644 (file)
--- a/webcit/context_loop.c
+++ b/webcit/context_loop.c
@@ -39,6 +39,10 @@ extern HashList *HandlerHash;
 int num_threads_existing = 1;          /* Number of worker threads which exist. */
 int num_threads_executing = 1;         /* Number of worker threads currently executing. */
 
+extern void session_loop(void);
+void spawn_another_worker_thread(void);
+
+
 void DestroyHttpHeaderHandler(void *V)
 {
        OneHttpHeader *pHdr;
@@ -174,27 +178,40 @@ wcsession *FindSession(wcsession **wclist, ParsedHttpHdrs *Hdr, pthread_mutex_t
                                continue;
                        if ((!strcasecmp(ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username))) &&
                            (!strcasecmp(ChrPtr(Hdr->c_password), ChrPtr(sptr->wc_password))) ) {
+                               syslog(LOG_DEBUG, "-- matched a session with the same http-auth");
                                TheSession = sptr;
                        }
                        if (TheSession == NULL)
-                               syslog(1, "found sessionkey [%d], but credentials for [%s|%s] didn't match\n",
-                                       Hdr->HR.SessionKey,ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username));
+                               syslog(1, "found sessionkey [%d], but credentials for [%s|%s] didn't match",
+                                       Hdr->HR.SessionKey,
+                                       ChrPtr(Hdr->c_username),
+                                       ChrPtr(sptr->wc_username)
+                               );
                        break;
                case AUTH_COOKIE:
                        /* If cookie-session, look for a session with matching session ID */
                        if ( (Hdr->HR.desired_session != 0) && 
-                            (sptr->wc_session == Hdr->HR.desired_session)) {
+                            (sptr->wc_session == Hdr->HR.desired_session))
+                       {
+                               syslog(LOG_DEBUG, "-- matched a session with the same cookie");
                                TheSession = sptr;
                        }
                        break;                       
                case NO_AUTH:
+                       /* Any unbound session is a candidate */
+                       if ( (sptr->wc_session == 0) && (sptr->inuse == 0) ) {
+                               syslog(LOG_DEBUG, "-- reusing an unbound session");
+                               TheSession = sptr;
+                       }
                        break;
                }
        }
        CtdlLogResult(pthread_mutex_unlock(ListMutex));
-       if (TheSession == NULL)
-               syslog(1, "didn't find sessionkey [%d] for user [%s]\n",
-                       Hdr->HR.SessionKey, ChrPtr(Hdr->c_username));
+       if (TheSession == NULL) {
+               syslog(1, "didn't find sessionkey [%d] for user [%s]",
+                       Hdr->HR.SessionKey, ChrPtr(Hdr->c_username)
+               );
+       }
        return TheSession;
 }
 
@@ -477,6 +494,7 @@ void context_loop(ParsedHttpHdrs *Hdr)
        wcsession *TheSession;
        struct timeval tx_start;
        struct timeval tx_finish;
+       int session_may_be_reused = 1;
        
        gettimeofday(&tx_start, NULL);          /* start a stopwatch for performance timing */
 
@@ -486,19 +504,18 @@ void context_loop(ParsedHttpHdrs *Hdr)
        isbogus = ReadHTTPRequest(Hdr);
 
        Hdr->HR.dav_depth = 32767; /* TODO: find a general way to have non-0 defaults */
-       if (!isbogus)
+
+       if (!isbogus) {
                isbogus = AnalyseHeaders(Hdr);
+       }
 
-       if ((isbogus) ||
-           ((Hdr->HR.Handler != NULL) &&
-            ((Hdr->HR.Handler->Flags & BOGUS) != 0)))
-       {
+       if (    (isbogus)
+               || ((Hdr->HR.Handler != NULL)
+               && ((Hdr->HR.Handler->Flags & BOGUS) != 0))
+       ) {
                wcsession *Bogus;
-
                Bogus = CreateSession(0, 1, NULL, Hdr, NULL);
-
                do_404();
-
                syslog(9, "HTTP: 404 [%ld.%06ld] %s %s \n",
                        ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
                        ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
@@ -535,6 +552,10 @@ void context_loop(ParsedHttpHdrs *Hdr)
                CheckAuthBasic(Hdr);
        }
 
+       if (Hdr->HR.got_auth) {
+               session_may_be_reused = 0;
+       }
+
        /*
         * See if there's an existing session open with the desired ID or user/pass
         */
@@ -573,16 +594,15 @@ void context_loop(ParsedHttpHdrs *Hdr)
        CtdlLogResult(pthread_mutex_lock(&TheSession->SessionMutex));
        pthread_setspecific(MyConKey, (void *)TheSession);
        
+       TheSession->inuse = 1;                                  /* mark the session as bound */
        TheSession->lastreq = time(NULL);                       /* log */
        TheSession->Hdr = Hdr;
 
        session_attach_modules(TheSession);
        session_loop();                         /* do transaction */
 
-
        /* How long did this transaction take? */
        gettimeofday(&tx_finish, NULL);
-       
 
        syslog(9, "HTTP: 200 [%ld.%06ld] %s %s \n",
                ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
@@ -593,7 +613,19 @@ void context_loop(ParsedHttpHdrs *Hdr)
 
        session_detach_modules(TheSession);
 
+       /* If *this* very transaction did not explicitly specify a session cookie,
+        * and it did not log in, we want to flag the session as a candidate for
+        * re-use by the next unbound client that comes along.  This keeps our session
+        * table from getting bombarded with new sessions when, for example, a web
+        * spider crawls the site without using cookies.
+        */
+       if ((session_may_be_reused) && (!WC->logged_in)) {
+               WC->wc_session = 0;                     /* flag as available for re-use */
+               TheSession->selected_language = 0;      /* clear any non-default language setting */
+       }
+
        TheSession->Hdr = NULL;
+       TheSession->inuse = 0;                                  /* mark the session as unbound */
        CtdlLogResult(pthread_mutex_unlock(&TheSession->SessionMutex));
 }