Re: Socket filtering
Re: Socket filtering
- Subject: Re: Socket filtering
- From: Peter Lovell <email@hidden>
- Date: Thu, 27 Apr 2006 21:06:23 -0400
On Apr 26, 2006, at 7:49 PM, Eric Long wrote:
I'm not sure what you are trying to accomplish here.
When the socket is closed, any uninjected data should be discarded.
You are asking for a hook to use as a warning that the socket will
close. Do you mean a hook before the client calls close on the
socket? I'm not sure how one would predict such a thing. A hook after
the client calls close seems useless because the client is done
calling read, so there is no point in injecting data.
Well, I'm scanning data looking for pattern matches. I don't
necessarily
know the protocol, so I don't know for sure how much data to
expect. If I
find a partial match in a packet, I want to see if the next packet
contains
the end of the data I am looking for, so I swallow the packet and
wait for
the next packet. If it turns out there is no next packet, I've got a
problem. If I discard the data, I've messed up the stream. I need to
properly reinject it before the socket closes.
Eric
And of course you might split the packet, sending what seems OK and
retaining the rest until you know. Assuming the protocol allows
splits, that is.
Of course, if the send and receive sides are closely dependent,
holding any data might cause a logical deadlock between the local
and remote ends. But if you're looking for a more contained hunk then
it may just be buffer boundaries and you'll soon get the remaining
piece.
Cheers.....Peter
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden