diff --git a/share/man/man9/accf_data.9 b/share/man/man9/accf_data.9 index 17584288b753..47d84d17aad7 100644 --- a/share/man/man9/accf_data.9 +++ b/share/man/man9/accf_data.9 @@ -1,76 +1,79 @@ .\" .\" Copyright (c) 2000 Alfred Perlstein .\" .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. .\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT, .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" " .Dd November 15, 2000 .Dt ACCF_DATA 9 .Os .Sh NAME .Nm accf_data .Nd buffer incoming connections until data arrives .Sh SYNOPSIS -.Nm options INET -.Nm options ACCEPT_FILTER_DATA -.Nm kldload accf_data +.Cd options INET +.Cd options ACCEPT_FILTER_DATA +.Pp +In +.Xr rc.conf 5 : +.Cd kld_list="accf_data" .Sh DESCRIPTION This is a filter to be placed on a socket that will be using .Fn accept to receive incoming connections. .Pp It prevents the application from receiving the connected descriptor via .Fn accept until data arrives on the connection. .Pp The .Fa ACCEPT_FILTER_DATA kernel option is also a module that can be enabled at runtime via .Xr kldload 8 if the INET option has been compiled into the kernel. .Sh EXAMPLES Assuming ACCEPT_FILTER_DATA has been included in the kernel config file or the .Nm module has been loaded, this will enable the data accept filter on the socket .Fa sok . .Bd -literal -offset 0i struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "dataready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa)); .Ed .Sh SEE ALSO .Xr setsockopt 2 , .Xr accept_filter 9 , .Xr accf_dns 9 , .Xr accf_http 9 .Sh HISTORY The accept filter mechanism and the accf_data filter were introduced in .Fx 4.0 . .Sh AUTHORS This manual page and the filter were written by .An Alfred Perlstein . diff --git a/share/man/man9/accf_dns.9 b/share/man/man9/accf_dns.9 index 971dd964e530..00b7bcf1765d 100644 --- a/share/man/man9/accf_dns.9 +++ b/share/man/man9/accf_dns.9 @@ -1,77 +1,80 @@ .\" .\" Copyright (c) 2008 David Malone .\" .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. .\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT, .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" " .Dd July 16, 2008 .Dt ACCF_DNS 9 .Os .Sh NAME .Nm accf_dns .Nd buffer incoming DNS requests until the whole first request is present .Sh SYNOPSIS -.Nm options INET -.Nm options ACCEPT_FILTER_DNS -.Nm kldload accf_dns +.Cd options INET +.Cd options ACCEPT_FILTER_DNS +.Pp +In +.Xr rc.conf 5 : +.Cd kld_list="accf_dns" .Sh DESCRIPTION This is a filter to be placed on a socket that will be using .Fn accept to receive incoming connections. .Pp It prevents the application from receiving the connected descriptor via .Fn accept until a whole DNS request is available on the socket. It does this by reading the first two bytes of the request, to determine its size, and waiting until the required amount of data is available to be read. .Pp The .Fa ACCEPT_FILTER_DNS kernel option is also a module that can be enabled at runtime via .Xr kldload 8 if the INET option has been compiled into the kernel. .Sh EXAMPLES If the .Nm module is available in the kernel, the following code will enable the DNS accept filter on a socket .Fa sok . .Bd -literal -offset 0i struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "dnsready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa)); .Ed .Sh SEE ALSO .Xr setsockopt 2 , .Xr accept_filter 9 , .Xr accf_data 9 , .Xr accf_http 9 .Sh HISTORY The accept filter mechanism was introduced in .Fx 4.0 . .Sh AUTHORS This manual page and the filter were written by .An David Malone . diff --git a/share/man/man9/accf_http.9 b/share/man/man9/accf_http.9 index f48894807312..e19b540f21f5 100644 --- a/share/man/man9/accf_http.9 +++ b/share/man/man9/accf_http.9 @@ -1,96 +1,99 @@ .\" .\" Copyright (c) 2000 Alfred Perlstein .\" .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. .\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT, .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" " .Dd November 15, 2000 .Dt ACCF_HTTP 9 .Os .Sh NAME .Nm accf_http .Nd "buffer incoming connections until a certain complete HTTP requests arrive" .Sh SYNOPSIS -.Nm options INET -.Nm options ACCEPT_FILTER_HTTP -.Nm kldload accf_http +.Cd options INET +.Cd options ACCEPT_FILTER_HTTP +.Pp +In +.Xr rc.conf 5 : +.Cd kld_list="accf_http" .Sh DESCRIPTION This is a filter to be placed on a socket that will be using .Fn accept to receive incoming HTTP connections. .Pp It prevents the application from receiving the connected descriptor via .Fn accept until either a full HTTP/1.0 or HTTP/1.1 HEAD or GET request has been buffered by the kernel. .Pp If something other than a HTTP/1.0 or HTTP/1.1 HEAD or GET request is received the kernel will allow the application to receive the connection descriptor via .Fn accept . .Pp The utility of .Nm is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as .Fn select , .Fn poll or .Fn kevent based servers. .Pp The .Nm kernel option is also a module that can be enabled at runtime via .Xr kldload 8 if the INET option has been compiled into the kernel. .Sh EXAMPLES Assuming ACCEPT_FILTER_HTTP has been included in the kernel config file or the .Nm module has been loaded, this will enable the http accept filter on the socket .Fa sok . .Bd -literal -offset 0i struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "httpready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa)); .Ed .Sh SEE ALSO .Xr setsockopt 2 , .Xr accept_filter 9 .Sh HISTORY The accept filter mechanism and the accf_http filter were introduced in .Fx 4.0 . .Sh AUTHORS This manual page and the filter were written by .An Alfred Perlstein . diff --git a/share/man/man9/accf_tls.9 b/share/man/man9/accf_tls.9 index 331ea2aa4fb8..cdc025c24da6 100644 --- a/share/man/man9/accf_tls.9 +++ b/share/man/man9/accf_tls.9 @@ -1,95 +1,98 @@ .\" .\" Copyright (c) 2024 Gleb Smirnoff .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. .\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT, .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" " .Dd April 24, 2024 .Dt ACCF_TLS 9 .Os .Sh NAME .Nm accf_tls .Nd "buffer incoming connections until a TLS handshake like requests arrive" .Sh SYNOPSIS -.Nm options INET -.Nm options ACCEPT_FILTER_TLS -.Nm kldload accf_tls +.Cd options INET +.Cd options ACCEPT_FILTER_TLS +.Pp +In +.Xr rc.conf 5 : +.Cd kld_list="accf_tls" .Sh DESCRIPTION This is a filter to be placed on a socket that will be using .Fn accept 2 to receive incoming HTTPS connections. It prevents the application from receiving the connected descriptor via .Fn accept 2 until a full TLS handshake has been buffered by the kernel. The .Nm will first check that byte at offset 0 is .Va 0x16 , which matches handshake type. Then it will read 2-byte request length value at offset 3 and will continue reading until reading the entire length of the handshake is buffered. If something other than .Va 0x16 is at offset 0, the kernel will allow the application to receive the connection descriptor via .Fn accept 2 . .Pp The utility of .Nm is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as .Fn select , .Fn poll or .Fn kevent based servers. .Sh EXAMPLES Assuming ACCEPT_FILTER_TLS has been included in the kernel config file or the .Nm module has been loaded, this will enable the TLS accept filter on the socket .Fa sok . .Bd -literal -offset 0i struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "tlsready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa)); .Ed .Sh SEE ALSO .Xr setsockopt 2 , .Xr accept_filter 9 .Sh HISTORY The .Nm accept filter was introduced in .Fx 15.0 . .Sh AUTHORS The .Nm filter was written by .An Maksim Yevmenkin .