[Discussion] Cooperative event loops (e.g., libevent) to support asynch I/O

[Martin Fong]

Matt Jonkman wrote:

> Cooperative event loops (e.g., libevent) to support asynch I/O
> 
> Do you mean something like parallel processing of different tools on the
> same stream or event? For instance one stream with http would go through
> regular matching but also be copied out to a http interpreter to pull
> environment variables and the like onto a separate thread/processor?

I'm actually thinking about unix select () loops.  Because the current
implementation simply invokes pcap_loop (), there's no way for a
module to independently perform I/O or respond to a select ()-based
timer.  There have been cases when I've needed to write data to a
socket or read from a pipe, but my preprocessor only got the
opportunity when it "processed" a packet (-- and clearly I don't want
the I/O to block).  (And, yes, I know about the danger of having a
module consume too many cycles doing I/O or computing, but there's
nothing to prevents such abuse now -- and cooperative event processing
_does_ work.)

      As far as your suggestion, that too sounds interesting...!

      Cheers!

      ...Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5193 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.openinfosecfoundation.org/pipermail/discussion/attachments/20090205/16a7d29a/attachment.bin>