Detailed Description

Socket-level factory for per-flow filters.

A NetFilter is attached to a NetSocket and acts as a factory for NetFlowFilter instances. When attached, the socket immediately calls createFlow() for every flow already open, and calls createFlow() again each time a new flow opens. For a stream socket this produces exactly one NetFlowFilter; for a datagram socket, one per peer flow.

A NetFilter may carry socket-wide configuration shared by all of its created flow filters – TLS certificate and key material, for example – which a created flow filter accesses by keeping its own reference to self (this NetFilter), captured inside createFlow(). One instance may be attached to as many sockets as needed; each socket acquires its own reference. That is what attaching one to a listener does: every accepted connection inherits it and acquires a reference of its own, so a single filter holding a certificate and key serves the whole server.

A factory that cannot build a usable stage should still return one, in a state that fails on its first pass. Returning NULL leaves the flow unfiltered, which for a transform is harmless and for a security filter means traffic the application believes is protected going out in the clear.

Definition at line 184 of file filter.h.

The documentation for this struct was generated from the following file:

build/cx/net/filter.h