Re: Socket filtering
Re: Socket filtering
- Subject: Re: Socket filtering
- From: Ronnie Misra <email@hidden>
- Date: Wed, 26 Apr 2006 18:23:59 -0700
Perhaps the client is closing the socket because they time out
waiting for the packet that you've swallowed? Anyway, as Mike points
out, once the client has decided to close the socket, you're too
late. And there is nothing the system could do to warn you before the
client makes the decision to close the socket...
Ronnie
On Apr 26, 2006, at 5:46 PM, Michael Smith wrote:
On Apr 26, 2006, at 4:49 PM, Eric Long wrote:
You are asking for a hook to use as a warning that the socket will
close. Do you mean a hook before the client calls close on the
socket? I'm not sure how one would predict such a thing. A hook
after
the client calls close seems useless because the client is done
calling read, so there is no point in injecting data.
Well, I'm scanning data looking for pattern matches. I don't
necessarily
know the protocol, so I don't know for sure how much data to
expect. If I
find a partial match in a packet, I want to see if the next packet
contains
the end of the data I am looking for, so I swallow the packet and
wait for
the next packet. If it turns out there is no next packet, I've
got a
problem. If I discard the data, I've messed up the stream. I
need to
properly reinject it before the socket closes.
Why? The socket is closing, nobody will ever read the data. Just
throw it away; that's all the system would do if you were to
reinject it anyway...
= Mike
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
40apple.com
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden