Re: Socket filtering
Re: Socket filtering
- Subject: Re: Socket filtering
- From: Michael Smith <email@hidden>
- Date: Wed, 26 Apr 2006 17:46:40 -0700
On Apr 26, 2006, at 4:49 PM, Eric Long wrote:
You are asking for a hook to use as a warning that the socket will
close. Do you mean a hook before the client calls close on the
socket? I'm not sure how one would predict such a thing. A hook after
the client calls close seems useless because the client is done
calling read, so there is no point in injecting data.
Well, I'm scanning data looking for pattern matches. I don't
necessarily
know the protocol, so I don't know for sure how much data to
expect. If I
find a partial match in a packet, I want to see if the next packet
contains
the end of the data I am looking for, so I swallow the packet and
wait for
the next packet. If it turns out there is no next packet, I've got a
problem. If I discard the data, I've messed up the stream. I need to
properly reinject it before the socket closes.
Why? The socket is closing, nobody will ever read the data. Just
throw it away; that's all the system would do if you were to reinject
it anyway...
= Mike
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden