GUACAMOLE-2293: Release active connection when guacd socket teardown throws on close.

ActiveConnectionService.deleteObject() only closed the tunnel when
tunnel.isOpen() was true. AbstractGuacamoleTunnel.isOpen() delegates to
the underlying socket, so once the remote peer (e.g. a WebSocket client
that disconnected abruptly behind a proxy/tunnel) is gone, isOpen()
returns false and the kill request becomes a no-op: the
ConnectionCleanupTask never runs, so the in-memory active connection
record and its concurrency seat are never released. The 'Kill session'
UI/REST action then appears to succeed while the ghost session persists.

More fundamentally, ManagedInetGuacamoleSocket.close() and
ManagedSSLGuacamoleSocket.close() ran the socket-closed cleanup task
after super.close() with no finally. When the underlying guacd socket is
being torn down concurrently (the read thread and @onclose both close it),
super.close() can throw (JDK's NIO layer surfaces a spurious IOException
on the second close) and the cleanup task is skipped, leaking the active
connection record even on a normal disconnect.

Always call tunnel.close() on delete (the cleanup task is idempotent),
and run the socket-closed cleanup task in a finally block so cleanup
happens even when closing an already-dead socket throws.

Author: nachumb

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java

@@ -121,9 +121,11 @@ public void deleteObject(ModeledAuthenticatedUser user, String identifier)
 
         if (hasObjectPermissions(user, identifier, ObjectPermission.Type.DELETE)) {
 
-            // Close connection if not already closed
+            // Always close, even if the peer already vanished (isOpen() may be
+            // false). close() releases the active connection record and is
+            // idempotent.
             GuacamoleTunnel tunnel = activeConnection.getTunnel();
-            if (tunnel != null && tunnel.isOpen())
+            if (tunnel != null)
                 tunnel.close();
 
         }

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ManagedInetGuacamoleSocket.java

@@ -59,8 +59,14 @@ public ManagedInetGuacamoleSocket(String hostname, int port,
 
     @Override
     public void close() throws GuacamoleException {
-        super.close();
-        socketClosedTask.run();
+        // Run cleanup even if super.close() throws, or the active connection
+        // record could leak.
+        try {
+            super.close();
+        }
+        finally {
+            socketClosedTask.run();
+        }
     }
 
 }

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ManagedSSLGuacamoleSocket.java

@@ -59,8 +59,14 @@ public ManagedSSLGuacamoleSocket(String hostname, int port,
 
     @Override
     public void close() throws GuacamoleException {
-        super.close();
-        socketClosedTask.run();
+        // Run cleanup even if super.close() throws, or the active connection
+        // record could leak.
+        try {
+            super.close();
+        }
+        finally {
+            socketClosedTask.run();
+        }
     }
 
 }