1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.server.session;
20
21 import java.security.SecureRandom;
22 import java.util.Random;
23
24 import javax.servlet.http.HttpServletRequest;
25
26 import org.eclipse.jetty.server.SessionIdManager;
27 import org.eclipse.jetty.util.component.AbstractLifeCycle;
28 import org.eclipse.jetty.util.log.Log;
29 import org.eclipse.jetty.util.log.Logger;
30
31 public abstract class AbstractSessionIdManager extends AbstractLifeCycle implements SessionIdManager
32 {
33 private static final Logger LOG = Log.getLogger(AbstractSessionIdManager.class);
34
35 private final static String __NEW_SESSION_ID="org.eclipse.jetty.server.newSessionId";
36
37 protected Random _random;
38 protected boolean _weakRandom;
39 protected String _workerName;
40
41
42 public AbstractSessionIdManager()
43 {
44 }
45
46
47 public AbstractSessionIdManager(Random random)
48 {
49 _random=random;
50 }
51
52
53
54
55
56
57
58
59
60 public String getWorkerName()
61 {
62 return _workerName;
63 }
64
65
66
67
68
69
70
71
72 public void setWorkerName(String workerName)
73 {
74 if (workerName.contains("."))
75 throw new IllegalArgumentException("Name cannot contain '.'");
76 _workerName=workerName;
77 }
78
79
80 public Random getRandom()
81 {
82 return _random;
83 }
84
85
86 public synchronized void setRandom(Random random)
87 {
88 _random=random;
89 _weakRandom=false;
90 }
91
92
93
94
95
96
97
98 public String newSessionId(HttpServletRequest request, long created)
99 {
100 synchronized (this)
101 {
102 if (request!=null)
103 {
104
105 String requested_id=request.getRequestedSessionId();
106 if (requested_id!=null)
107 {
108 String cluster_id=getClusterId(requested_id);
109 if (idInUse(cluster_id))
110 return cluster_id;
111 }
112
113
114 String new_id=(String)request.getAttribute(__NEW_SESSION_ID);
115 if (new_id!=null&&idInUse(new_id))
116 return new_id;
117 }
118
119
120 String id = newSessionId(request.hashCode());
121
122 request.setAttribute(__NEW_SESSION_ID,id);
123 return id;
124 }
125 }
126
127
128 public String newSessionId(long seedTerm)
129 {
130
131 String id=null;
132 while (id==null||id.length()==0||idInUse(id))
133 {
134 long r0=_weakRandom
135 ?(hashCode()^Runtime.getRuntime().freeMemory()^_random.nextInt()^((seedTerm)<<32))
136 :_random.nextLong();
137 if (r0<0)
138 r0=-r0;
139 long r1=_weakRandom
140 ?(hashCode()^Runtime.getRuntime().freeMemory()^_random.nextInt()^((seedTerm)<<32))
141 :_random.nextLong();
142 if (r1<0)
143 r1=-r1;
144 id=Long.toString(r0,36)+Long.toString(r1,36);
145
146
147
148 if (_workerName!=null)
149 id=_workerName + id;
150 }
151 return id;
152 }
153
154
155
156 public abstract void renewSessionId(String oldClusterId, String oldNodeId, HttpServletRequest request);
157
158
159
160
161 @Override
162 protected void doStart() throws Exception
163 {
164 initRandom();
165 }
166
167
168 @Override
169 protected void doStop() throws Exception
170 {
171 }
172
173
174
175
176
177
178
179 public void initRandom ()
180 {
181 if (_random==null)
182 {
183 try
184 {
185 _random=new SecureRandom();
186 }
187 catch (Exception e)
188 {
189 LOG.warn("Could not generate SecureRandom for session-id randomness",e);
190 _random=new Random();
191 _weakRandom=true;
192 }
193 }
194 else
195 _random.setSeed(_random.nextLong()^System.currentTimeMillis()^hashCode()^Runtime.getRuntime().freeMemory());
196 }
197
198
199 }