NAME
accf_tls – buffer incoming connections until a TLS handshake like request arrives
SYNOPSIS
options INET options ACCEPT_FILTER_TLS
In rc.conf(5): kld_list="accf_tls"
DESCRIPTION
This is a filter to be placed on a socket that will be using accept(2) to receive incoming HTTPS connections. It prevents the application from receiving the connected descriptor via accept(2) until a full TLS handshake has been buffered by the kernel. The accf_tls will first check that byte at offset 0 is 0x16, which matches handshake type. Then it will read 2-byte request length value at offset 3 and will continue reading until reading the entire length of the handshake is buffered. If something other than 0x16 is at offset 0, the kernel will allow the application to receive the connection descriptor via accept(2).
The utility of accf_tls is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as select(), poll() or kevent() based servers.
EXAMPLES
Assuming ACCEPT_FILTER_TLS has been included in the kernel config file or the accf_tls module has been loaded, this will enable the TLS accept filter on the socket sok.
struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "tlsready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa));
SEE ALSO
HISTORY
The accf_tls accept filter was introduced in FreeBSD 15.0.
AUTHORS
The accf_tls filter was written by Maksim Yevmenkin.