OF-3155: Fix race condition in resource conflict resolution

The logic that handles resource conflicts closed the old session asynchronously while allowing the new session to be marked as bound immediately. This could cause the new session to be affected by cleanup intended for the old session, such as receiving the old session's unavailable presence. Internal state could also become inconsistent.

This update introduces a temporary wait mechanism that delays promotion of the new session until the old session has fully closed. A busy-wait loop is used as a stopgap, as connectionClosed event listeners are not reliable in clustered deployments and do not guarantee that all listeners have completed execution.

This prevents the new session from being influenced by asynchronous cleanup of the old session and avoids related routing and presence issues.

(cherry picked from commit 50be000)

Author: guusdk

xmppserver/src/main/java/org/jivesoftware/openfire/handler/IQBindHandler.java

@@ -36,6 +36,9 @@
 import org.xmpp.packet.PacketError;
 import org.xmpp.packet.StreamError;
 
+import java.time.Duration;
+import java.time.Instant;
+
 /**
  * Binds a resource to the stream so that the client's address becomes a full JID. Once a resource
  * has been bound to the session the entity (i.e. client) is considered a "connected resource".
@@ -151,6 +154,15 @@ public IQ handleIQ(IQ packet) throws UnauthorizedException {
                                 // the old session again, as that would cause the state of the new session to be affected.
                                 sessionManager.removeDetached((LocalClientSession) oldSession);
                             }
+
+                            // OF-3155: Await closure of the old session, to prevent the _new_ session to be influenced by the closure process.
+                            final Instant deadline = Instant.now().plus(Duration.ofSeconds(20));
+                            do {
+                                // TODO find a better way to wait for closure than using a busy-wait mechanism. Using the connectionClosed event listener
+                                //      a) doesn't work in a cluster and
+                                //      b) doesn't reliably give an indication that all _other_ connectionClosed listeners have been called, which could still cause issues.
+                                Thread.sleep(Duration.ofMillis(50).toMillis());
+                            } while (Instant.now().isBefore(deadline) && routingTable.getClientRoute(desiredJid) != null);
                         } else {
                             Log.debug("Conflict resolution configuration does not allow kicking of old session (yet). Conflict count: {}, conflict limit: {}. Rejecting the bind request with error condition 'conflict'.", conflictCount, conflictLimit);
                             reply.setChildElement(packet.getChildElement().createCopy());