Hi Daniel,

I just repushed this branch. Originally, I only considered tcp connection kill via TCP RST (which results in read() == -1 && errno == ECONNRESET) and timeout events (read() == -1 && errno == ETIMEDOUT). I have revised my branch to also execute the event_route on gracefully-closed TCP connections (i.e. via TCP FIN), which is delivered to the program as read() == 0 (i.e. EOF).

Additionally, I have restricted the execution of this event_route that have a $conid variable that does not evaluate to "" in the script. This is determined via connections that have TCP_REQ_COMPLETE(req) set to true (which is when con->id is copied to con->proto_reserved1). Do let me know if this is not the correct strategy here.

Thanks!

—
Reply to this email directly or view it on GitHub.