We're talking about 5-15 seconds, so this really isn't a big deal. Tomcat
could not previously serve a request that generated a session id without
initializing the PRNG and we got several complaints about how long it took
to process the first request (due to seed generation). The original
solution was to generate our own seed, but that turned out to be
cryptographically weak so we need to switch back to the default seed
generator. That leaves us with three choices:
1) Initialize the PRNG as part of the container initialization, before we
start processing requests.
2) Initialize the PRNG when the first session id is generated.
3) Initiaiize the PRNG on a separate thread that is created during the
container initializaion. We can start processing requests before this
thread completes, but we have to synchronize the session id generation to
make sure the PRNG initialization is complete before we generate any new
session.
All of these solutions works. We already know that lots of people
(including myself) complained about number 2 (that's the way it used to
work). Option 3 is more complicated and all it buys you is that non-session
requests can be processed in the first few seconds that the container is
running. Option 1 is simple, does not involve new threads or thread
synchronization and the only down side is that we delay processing requests
for a few seconds.
In my opinion, option 1 made the most sense.
Marc Saegesser
> -----Original Message-----
> From: David Rees [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, September 04, 2001 11:51 PM
> To: [EMAIL PROTECTED]
> Subject: Re: cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/util
> SessionIdGenerator.java
>
>
> On Wed, Sep 05, 2001 at 02:42:14AM -0000, [EMAIL PROTECTED] wrote:
> > marcsaeg 01/09/04 19:42:14
> >
> > Modified: src/share/org/apache/tomcat/startup Tag: tomcat_32
> > Tomcat.java
> > src/share/org/apache/tomcat/util Tag: tomcat_32
> > SessionIdGenerator.java
> > Log:
> > Switch back to the default PRNG seed generator to avoid
> security weakness
> > in the manual seed generator. The PRNG is now initialized
> when the container
> > starts so that we don't take the hit on the first request.
> >
> > Submitted by: Kevin E. Fu ([EMAIL PROTECTED])
>
> Does this prevent Tomcat from accepting requests until after the PRNG is
> initialized? If so, IMHO Tomcat should accept requests ASAP,
> even if it can't
> completely serve them until the PRNG is accepted. Isn't that better than
> rejecting requests?
>
> -Dave
