ACCF_TLS(9)

✨ NAME ✨

okay bestie, welcome to the ACCF_TLS(9) page from the Kernel Developer's Manual — manual name folded in, no boring header copy needed 💅. accf_tls is a filter that buffers incoming connections until a TLS handshake like request arrives. periodt. ✨

🌸 SYNOPSIS 🌸

options INET
options ACCEPT_FILTER_TLS

and in rc.conf(5):

kld_list="accf_tls"

🦋 DESCRIPTION 🦋

So here's the tea: this is a filter you place on a socket that will be using accept(2) to receive incoming HTTPS connections. It prevents the application from receiving the connected descriptor via accept(2) until a full TLS handshake has been buffered by the kernel. 🫶

The accf_tls will first check that the byte at offset 0 is 0x16, which matches the handshake type. Then it will read the 2-byte request length value at offset 3 and will continue reading until reading the entire length of the handshake is buffered. If something other than 0x16 is at offset 0, the kernel will allow the application to receive the connection descriptor via accept(2). 👑

The utility of accf_tls is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as select(), poll() or kevent() based servers. lowkey iconic CPU savings 🔥

🎀 EXAMPLES 🎀

Assuming ACCEPT_FILTER_TLS has been included in the kernel config file or the accf_tls module has been loaded, this will enable the TLS accept filter on the socket sok. 🍓

struct accept_filter_arg afa;

bzero(&afa, sizeof(afa));
strcpy(afa.af_name, "tlsready");
setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa));

💜 SEE ALSO 💜

• setsockopt(2)
• accept_filter(9)

🌈 HISTORY 🌈

The accf_tls accept filter was introduced in FreeBSD 15.0. 🧚

👑 AUTHORS 👑

The accf_tls filter was written by Maksim Yevmenkin. 💖

---

and that's the whole page, bestie! this is the Debian version of ACCF_TLS(9), dated April 24, 2024 — mwah! 💅✨