---
name: "accf_tls"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/accf_tls"
---

# accf\_tls(9)

buffer incoming connections until a TLS handshake like request arrives

## NAME

**accf\_tls** – buffer incoming connections until a TLS handshake like request arrives

## SYNOPSIS

**options** **INET** **options** **ACCEPT\_FILTER\_TLS**

In [rc.conf(5)](/rc.conf/5.md): **kld\_list="accf\_tls"**

## DESCRIPTION

This is a filter to be placed on a socket that will be using **accept**(*2*) to receive incoming HTTPS connections. It prevents the application from receiving the connected descriptor via **accept**(*2*) until a full TLS handshake has been buffered by the kernel. The **accf\_tls** will first check that byte at offset 0 is *0x16*, which matches handshake type. Then it will read 2-byte request length value at offset 3 and will continue reading until reading the entire length of the handshake is buffered. If something other than *0x16* is at offset 0, the kernel will allow the application to receive the connection descriptor via **accept**(*2*).

The utility of **accf\_tls** is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as **select**(), **poll**() or **kevent**() based servers.

## EXAMPLES

Assuming ACCEPT\_FILTER\_TLS has been included in the kernel config file or the **accf\_tls** module has been loaded, this will enable the TLS accept filter on the socket *sok*.

```
	struct accept_filter_arg afa;
	bzero(&afa, sizeof(afa));
	strcpy(afa.af_name, "tlsready");
	setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa));
```

## SEE ALSO

[setsockopt(2)](/setsockopt/2.md), [accept\_filter(9)](/accept_filter/9.md)

## HISTORY

The **accf\_tls** accept filter was introduced in FreeBSD 15.0.

## AUTHORS

The **accf\_tls** filter was written by Maksim Yevmenkin.