Copyright (c) 2000 Alfred Perlstein All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or ...
NAMEaccf_http - buffer incoming connections until a certain complete HTTP requests arrive
DESCRIPTIONThis is a filter to be placed on a socket that will be using Fn accept to receive incoming HTTP connections.
It prevents the application from receiving the connected descriptor via Fn accept until either a full HTTP/1.0 or HTTP/1.1 HEAD or GET request has been buffered by the kernel.
If something other than a HTTP/1.0 or HTTP/1.1 HEAD or GET request is received the kernel will allow the application to receive the connection descriptor via Fn accept .
The utility of sysctl Cm net.inet.tcp.syncookies is such that a server will not have to context switch several times before performing the initial parsing of the request. This effectively reduces the amount of required CPU utilization to handle incoming requests by keeping active processes in preforking servers such as Apache low and reducing the size of the file descriptor set that needs to be managed by interfaces such as Fn select , Fn poll or Fn kevent based servers.
The sysctl Cm net.inet.tcp.syncookies kernel option is also a module that can be enabled at runtime via kldload(8) if the INET option has been compiled into the kernel.
EXAMPLESAssuming ACCEPT_FILTER_HTTP has been included in the kernel config file or the sysctl Cm net.inet.tcp.syncookies module has been loaded, this will enable the http accept filter on the socket Fa sok .
struct accept_filter_arg afa; bzero(&afa, sizeof(afa)); strcpy(afa.af_name, "httpready"); setsockopt(sok, SOL_SOCKET, SO_ACCEPTFILTER, &afa, sizeof(afa));