tree 395eb5e617dc6d13e0c324ac2a01866eaf106095
parent 1a68794418fea904d19efd8258468f02b4b95ba2
author Willy Tarreau <w@1wt.eu> 1274648340 +0200
committer Willy Tarreau <w@1wt.eu> 1276505592 +0200

[MEDIUM] tcp: check for pure layer4 rules immediately after accept()

The tcp inspection rules were fast but were only processed after a
schedule had occurred and all resources were allocated. When defending
against DDoS, it's important to be able to apply some protection the
earliest possible instant.

Thus we introduce a new set of rules : tcp-request rules which act
on pure layer4 information (no content). They are evaluated even
before the buffers are allocated for the session, saving as much
time as possible. That way it becomes possible to check an incoming
connection's source IP address against a list of authorized/blocked
networks, and immediately drop the connection.

The rules are checked even before we perform any socket-specific
operation, so that we can optimize the reject case, which will be the
problematic one during a DDoS. The second stream interface and s->txn
are also now initialized after the rules are parsed for the same
reason. All these optimisations have permitted to reach up to 212000
connnections/s with a real rule rejecting based on the source IP
address.