Merge pull request #70 from natsys/http-dos-protector

HTTP DoS protection module

etc/tfw_frang.conf

@@ -0,0 +1,49 @@
+#
+# Tempesta FW configuration: "frang" classifier.
+#
+# "include" directives are not supported yet, so paste the configuration to
+# the main configuration file.
+
+# TAG: frang_limits
+#
+# The section containing static limits for the classifier.
+#
+# Syntax:
+#   frang_limits {
+#	request_rate NUM;
+#	request_burst NUM;
+#	connection_rate NUM;
+#	connection_burst NUM;
+#	concurrent_connections NUM;
+#	client_header_timeout NUM;
+#	client_body_timeout NUM;
+#	http_uri_len NUM;
+#	http_field_len NUM;
+#	http_body_len NUM;
+#	http_host_required true|false;
+#	http_methods [METHOD]...;
+#	http_ct_required true|false;
+#	http_ct_vals ["CONTENT_TYPE"]...;
+#  }
+#
+#  - options with names *_rate define requests/connections rate per second.
+#  - *_burst are temporal burst for 1/FRANG_FREQ of second.
+#  - http_* are static limits for contents of a HTTP request.
+#
+# Example:
+#    frang_limits {
+#        request_rate 20;
+#        request_burst 15;
+#        connection_rate 8;
+#        concurrent_connections 8;
+#        client_header_timeout 20;
+#        client_body_timeout 10;
+#        http_uri_len 1024;
+#        http_field_len 256;
+#        http_ct_required false;
+#        http_methods get post head;
+#        http_ct_vals "text/plain" "text/html";
+#   }
+#
+# Default:
+#   All limits are disabled (the values are set to zero/false/empty).

tempesta_fw/addr.c

@@ -231,8 +231,6 @@ tfw_addr_pton(const char *str, TfwAddr *addr)
 	else if (mode == 6)
 		ret = tfw_addr_pton_v6(str, &addr->v6);
 
-	if (ret)
-		TFW_ERR("Can't parse IP address: '%s'\n", str);
 	return ret;
 }
 DEBUG_EXPORT_SYMBOL(tfw_addr_pton);

tempesta_fw/classifier/Makefile

@@ -17,8 +17,8 @@
 # Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 
 EXTRA_CFLAGS += -I$(src)/../../sync_socket -I$(src)/../../tempesta_db/core \
-		-DDEBUG
+		-DDEBUG -Werror -O0 -g3
 
-obj-m = tfw_req_conn_limit.o
-tfw_req_conn_limit-objs = req_conn_limit.o
+obj-m = tfw_frang.o
+tfw_frang-objs = frang.o