* keep track of things. If the HTTP request doesn't belong to any currently
* active session, a new session is started.
*
- * Copyright (c) 1996-2010 by the citadel.org team
+ * Copyright (c) 1996-2011 by the citadel.org team
*
* This program is open source software. You can redistribute it and/or
* modify it under the terms of the GNU General Public License as
int num_threads_existing = 1; /* Number of worker threads which exist. */
int num_threads_executing = 1; /* Number of worker threads currently executing. */
+extern void session_loop(void);
+void spawn_another_worker_thread(void);
+
+
void DestroyHttpHeaderHandler(void *V)
{
OneHttpHeader *pHdr;
/* Kill idle sessions */
if ((time(NULL) - (sptr->lastreq)) > (time_t) WEBCIT_TIMEOUT) {
+ syslog(3, "Timeout session %d\n", sptr->wc_session);
sptr->killthis = 1;
}
/* Remove sessions flagged for kill */
if (sptr->killthis) {
- /** remove session from linked list */
+ /* remove session from linked list */
if (sptr == SessionList) {
SessionList = SessionList->next;
}
* Now free up and destroy the culled sessions.
*/
while (sessions_to_kill != NULL) {
- lprintf(3, "Destroying session %d\n", sessions_to_kill->wc_session);
- pthread_mutex_lock(&sessions_to_kill->SessionMutex);
- pthread_mutex_unlock(&sessions_to_kill->SessionMutex);
+ syslog(3, "Destroying session %d\n", sessions_to_kill->wc_session);
sptr = sessions_to_kill->next;
-
session_destroy_modules(&sessions_to_kill);
sessions_to_kill = sptr;
}
(num_threads_executing >= num_threads_existing)
&& (num_threads_existing < MAX_WORKER_THREADS)
) {
- lprintf(3, "%d of %d threads are executing. Adding another worker thread.\n",
+ syslog(3, "%d of %d threads are executing. Adding another worker thread.\n",
num_threads_executing,
num_threads_existing
);
continue;
if ((!strcasecmp(ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username))) &&
(!strcasecmp(ChrPtr(Hdr->c_password), ChrPtr(sptr->wc_password))) ) {
+ syslog(LOG_DEBUG, "-- matched a session with the same http-auth");
TheSession = sptr;
}
if (TheSession == NULL)
- lprintf(1, "found sessionkey [%ld], but credentials for [%s|%s] didn't match\n",
- Hdr->HR.SessionKey,ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username));
+ syslog(1, "found sessionkey [%d], but credentials for [%s|%s] didn't match",
+ Hdr->HR.SessionKey,
+ ChrPtr(Hdr->c_username),
+ ChrPtr(sptr->wc_username)
+ );
break;
case AUTH_COOKIE:
/* If cookie-session, look for a session with matching session ID */
if ( (Hdr->HR.desired_session != 0) &&
- (sptr->wc_session == Hdr->HR.desired_session)) {
+ (sptr->wc_session == Hdr->HR.desired_session))
+ {
+ syslog(LOG_DEBUG, "-- matched a session with the same cookie");
TheSession = sptr;
}
break;
case NO_AUTH:
+ /* Any unbound session is a candidate */
+ if ( (sptr->wc_session == 0) && (sptr->inuse == 0) ) {
+ syslog(LOG_DEBUG, "-- reusing an unbound session");
+ TheSession = sptr;
+ }
break;
}
}
CtdlLogResult(pthread_mutex_unlock(ListMutex));
- if (TheSession == NULL)
- lprintf(1, "didn't find sessionkey [%ld] for user [%s]\n",
- Hdr->HR.SessionKey,ChrPtr(Hdr->c_username));
+ if (TheSession == NULL) {
+ syslog(1, "didn't find sessionkey [%d] for user [%s]",
+ Hdr->HR.SessionKey, ChrPtr(Hdr->c_username)
+ );
+ }
return TheSession;
}
wcsession *CreateSession(int Lockable, int Static, wcsession **wclist, ParsedHttpHdrs *Hdr, pthread_mutex_t *ListMutex)
{
wcsession *TheSession;
- if (!Static)
- lprintf(3, "Creating a new session\n");
TheSession = (wcsession *) malloc(sizeof(wcsession));
memset(TheSession, 0, sizeof(wcsession));
TheSession->Hdr = Hdr;
TheSession->SessionKey = Hdr->HR.SessionKey;
TheSession->serv_sock = (-1);
- TheSession->is_mobile = -1;
pthread_setspecific(MyConKey, (void *)TheSession);
*/
if (Hdr->HR.desired_session == 0) {
TheSession->wc_session = GenerateSessionID();
+ syslog(3, "Created new session %d", TheSession->wc_session);
}
else {
TheSession->wc_session = Hdr->HR.desired_session;
+ syslog(3, "Re-created session %d", TheSession->wc_session);
}
Hdr->HR.Static = Static;
session_new_modules(TheSession);
}
-/*
- * Detects a 'mobile' user agent
- */
-int is_mobile_ua(char *user_agent) {
- if (strstr(user_agent,"iPhone OS") != NULL) {
- return 1;
- } else if (strstr(user_agent,"Windows CE") != NULL) {
- return 1;
- } else if (strstr(user_agent,"SymbianOS") != NULL) {
- return 1;
- } else if (strstr(user_agent, "Opera Mobi") != NULL) {
- return 1;
- } else if (strstr(user_agent, "Firefox/2.0.0 Opera 9.51 Beta") != NULL) {
- /* For some reason a new install of Opera 9.51beta decided to spoof. */
- return 1;
- }
- return 0;
-}
-
/* If it's a "force 404" situation then display the error and bail. */
void do_404(void)
{
memset(pHdr, 0, sizeof(OneHttpHeader));
pHdr->Val = Line;
Put(Hdr->HTTPHeaders, HKEY("GET /"), pHdr, DestroyHttpHeaderHandler);
- lprintf(9, "%s\n", ChrPtr(Line));
+ syslog(9, "%s\n", ChrPtr(Line));
isbogus = ReadHttpSubject(Hdr, Line, HeaderName);
if (isbogus) break;
continue;
wcsession *TheSession;
struct timeval tx_start;
struct timeval tx_finish;
+ int session_may_be_reused = 1;
gettimeofday(&tx_start, NULL); /* start a stopwatch for performance timing */
isbogus = ReadHTTPRequest(Hdr);
Hdr->HR.dav_depth = 32767; /* TODO: find a general way to have non-0 defaults */
- if (!isbogus)
+
+ if (!isbogus) {
isbogus = AnalyseHeaders(Hdr);
+ }
- if ((isbogus) ||
- ((Hdr->HR.Handler != NULL) &&
- ((Hdr->HR.Handler->Flags & BOGUS) != 0)))
- {
+ if ( (isbogus)
+ || ((Hdr->HR.Handler != NULL)
+ && ((Hdr->HR.Handler->Flags & BOGUS) != 0))
+ ) {
wcsession *Bogus;
-
Bogus = CreateSession(0, 1, NULL, Hdr, NULL);
-
do_404();
-
- lprintf(9, "HTTP: 404 [%ld.%06ld] %s %s \n",
+ syslog(9, "HTTP: 404 [%ld.%06ld] %s %s \n",
((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
ReqStrs[Hdr->HR.eReqType],
/* How long did this transaction take? */
gettimeofday(&tx_finish, NULL);
-#ifdef TECH_PREVIEW
- if ((Hdr->HR.Handler != NULL) ||
- ((Hdr->HR.Handler->Flags & LOGCHATTY) == 0))
-#endif
- lprintf(9, "HTTP: 200 [%ld.%06ld] %s %s \n",
- ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
- ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
- ReqStrs[Hdr->HR.eReqType],
- ChrPtr(Hdr->this_page)
- );
+ syslog(9, "HTTP: 200 [%ld.%06ld] %s %s \n",
+ ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
+ ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
+ ReqStrs[Hdr->HR.eReqType],
+ ChrPtr(Hdr->this_page)
+ );
session_detach_modules(Static);
session_destroy_modules(&Static);
return;
CheckAuthBasic(Hdr);
}
+ if (Hdr->HR.got_auth) {
+ session_may_be_reused = 0;
+ }
+
/*
* See if there's an existing session open with the desired ID or user/pass
*/
if (TheSession == NULL) {
TheSession = CreateSession(1, 0, &SessionList, Hdr, &SessionListMutex);
- if ((StrLength(Hdr->c_username) == 0) && (!Hdr->HR.DontNeedAuth)) {
-
- if ((Hdr->HR.Handler != NULL) &&
- (XHTTP_COMMANDS & Hdr->HR.Handler->Flags) == XHTTP_COMMANDS) {
- OverrideRequest(Hdr, HKEY("GET /401 HTTP/1.0"));
- Hdr->HR.prohibit_caching = 1;
- }
-
- /*
- * I don't think we need this anymore now that guest mode is working
- * ajc 2011jan07
- *
- else {
- OverrideRequest(Hdr, HKEY("GET /static/nocookies.html?force_close_session=yes HTTP/1.0"));
- Hdr->HR.prohibit_caching = 1;
- }
- */
+ if ( (StrLength(Hdr->c_username) == 0)
+ && (!Hdr->HR.DontNeedAuth)
+ && (Hdr->HR.Handler != NULL)
+ && ((XHTTP_COMMANDS & Hdr->HR.Handler->Flags) == XHTTP_COMMANDS)
+ ) {
+ OverrideRequest(Hdr, HKEY("GET /401 HTTP/1.0"));
+ Hdr->HR.prohibit_caching = 1;
}
if (StrLength(Hdr->c_language) > 0) {
- lprintf(9, "Session cookie requests language '%s'\n", ChrPtr(Hdr->c_language));
+ syslog(9, "Session cookie requests language '%s'\n", ChrPtr(Hdr->c_language));
set_selected_language(ChrPtr(Hdr->c_language));
go_selected_language();
}
CtdlLogResult(pthread_mutex_lock(&TheSession->SessionMutex));
pthread_setspecific(MyConKey, (void *)TheSession);
+ TheSession->inuse = 1; /* mark the session as bound */
TheSession->lastreq = time(NULL); /* log */
TheSession->Hdr = Hdr;
session_attach_modules(TheSession);
session_loop(); /* do transaction */
-
/* How long did this transaction take? */
gettimeofday(&tx_finish, NULL);
-
-#ifdef TECH_PREVIEW
- if ((Hdr->HR.Handler != NULL) &&
- ((Hdr->HR.Handler->Flags & LOGCHATTY) == 0))
-#endif
- lprintf(9, "HTTP: 200 [%ld.%06ld] %s %s \n",
- ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
- ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
- ReqStrs[Hdr->HR.eReqType],
- ChrPtr(Hdr->this_page)
- );
+ syslog(9, "HTTP: 200 [%ld.%06ld] %s %s \n",
+ ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
+ ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000,
+ ReqStrs[Hdr->HR.eReqType],
+ ChrPtr(Hdr->this_page)
+ );
session_detach_modules(TheSession);
+ /* If *this* very transaction did not explicitly specify a session cookie,
+ * and it did not log in, we want to flag the session as a candidate for
+ * re-use by the next unbound client that comes along. This keeps our session
+ * table from getting bombarded with new sessions when, for example, a web
+ * spider crawls the site without using cookies.
+ */
+ if ((session_may_be_reused) && (!WC->logged_in)) {
+ WC->wc_session = 0; /* flag as available for re-use */
+ TheSession->selected_language = 0; /* clear any non-default language setting */
+ }
+
TheSession->Hdr = NULL;
+ TheSession->inuse = 0; /* mark the session as unbound */
CtdlLogResult(pthread_mutex_unlock(&TheSession->SessionMutex));
}
hdr->HR.ContentType = Line;
}
-void Header_HandleUserAgent(StrBuf *Line, ParsedHttpHdrs *hdr)
-{
- hdr->HR.user_agent = Line;
-#ifdef TECH_PREVIEW
-/* TODO: do this later on session creating
- if ((WCC->is_mobile < 0) && is_mobile_ua(&buf[12])) {
- WCC->is_mobile = 1;
- }
- else {
- WCC->is_mobile = 0;
- }
-*/
-#endif
-}
-
void Header_HandleHost(StrBuf *Line, ParsedHttpHdrs *hdr)
{
- if (site_prefix == NULL) {
- site_prefix = NewStrBuf();
- StrBufAppendPrintf(site_prefix, "%s://", (is_https ? "https" : "http") );
- StrBufAppendBuf(site_prefix, Line, 0);
+ if (hdr->HostHeader != NULL) {
+ FreeStrBuf(&hdr->HostHeader);
}
+ hdr->HostHeader = NewStrBuf();
+ StrBufAppendPrintf(hdr->HostHeader, "%s://", (is_https ? "https" : "http") );
+ StrBufAppendBuf(hdr->HostHeader, Line, 0);
}
void Header_HandleXFFHost(StrBuf *Line, ParsedHttpHdrs *hdr)
{
- if ( (follow_xff) && (site_prefix == NULL)) {
- site_prefix = NewStrBuf();
- StrBufAppendPrintf(site_prefix, "http://"); /* this is naive; do something about it */
- StrBufAppendBuf(site_prefix, Line, 0);
+ if (!follow_xff) return;
+
+ if (hdr->HostHeader != NULL) {
+ FreeStrBuf(&hdr->HostHeader);
}
+
+ hdr->HostHeader = NewStrBuf();
+ StrBufAppendPrintf(hdr->HostHeader, "http://"); /* this is naive; do something about it */
+ StrBufAppendBuf(hdr->HostHeader, Line, 0);
}
{
RegisterHeaderHandler(HKEY("CONTENT-LENGTH"), Header_HandleContentLength);
RegisterHeaderHandler(HKEY("CONTENT-TYPE"), Header_HandleContentType);
- RegisterHeaderHandler(HKEY("USER-AGENT"), Header_HandleUserAgent);
RegisterHeaderHandler(HKEY("X-FORWARDED-HOST"), Header_HandleXFFHost); /* Apache way... */
RegisterHeaderHandler(HKEY("X-REAL-IP"), Header_HandleXFFHost); /* NGinX way... */
RegisterHeaderHandler(HKEY("HOST"), Header_HandleHost);
(ParsedHttpHdrs *httpreq)
{
FlushStrBuf(httpreq->PlainArgs);
+ FlushStrBuf(httpreq->HostHeader);
FlushStrBuf(httpreq->this_page);
FlushStrBuf(httpreq->PlainArgs);
DeleteHash(&httpreq->HTTPHeaders);
FreeStrBuf(&httpreq->PlainArgs);
FreeStrBuf(&httpreq->this_page);
FreeStrBuf(&httpreq->PlainArgs);
+ FreeStrBuf(&httpreq->HostHeader);
DeleteHash(&httpreq->HTTPHeaders);
}
projects / citadel.git / blobdiff