whitelist_mark doesn't pass frang rules

[krizhanovsky]

whitelist_mark 1; and iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.23 -j MARK --set-mark 1 still don't pass frang:

[ 4995.577824] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 51 (lim=50)
[ 4995.579500] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 52 (lim=50)
[ 4995.581117] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 53 (lim=50)
[ 4995.582041] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 54 (lim=50)
[ 4995.583662] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 55 (lim=50)
[ 4995.585283] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 56 (lim=50)
[ 4995.586903] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 57 (lim=50)
[ 4995.588518] [tempesta fw] Warning: frang: new connections rate exceeded for 192.168.1.23: 58 (lim=50)

Tempesta config:

root@server:/tmp/tempesta/configs# cat /etc/tempesta/tempesta_fw.conf
listen 0.0.0.0:80;
whitelist_mark 1;
#INCLUDE VHOSTS
!include /tmp/tempesta/configs/vhosts		
# ddos=True
frang_limits {
        # DDOS rate limits
	#ip_block on;
        request_rate 100;
        connection_rate 50;
        client_header_timeout 20;
        client_body_timeout 10;
        http_header_chunk_cnt 10;        # Message level limits (per-vhost)
        http_methods GET HEAD;
        http_uri_len 1000;
        http_resp_code_block 400 403 404 100 10;
}
block_action attack reply;
block_action error reply;

http_chain {
    # INCLUDE HTTP_CHAINS
    !include /tmp/tempesta/configs/http_chains
}

root@server:/tmp/tempesta/configs# cat vhosts/nb03.com.conf# 
-------------------------------------------------------------------------
#	[nb03.com](http://nb03.com/)
# -------------------------------------------------------------------------
srv_group nb03.com {    server 1.1.1.1:80;}
vhost nb03.com {
    resp_hdr_set Strict-Transport-Security "max-age=31536000; includeSubDomains";
    resp_hdr_set Content-Security-Policy "upgrade-insecure-requests";
     sticky {
        cookie enforce name=cname;
        js_challenge resp_code=503 delay_min=1000 delay_range=1500
        delay_limit=100 ;
     }
    proxy_pass nb03.com;
}

root@server:/tmp/tempesta/configs# cat   http_chains/nb03.com.conf
hdr "Host" == "*.nb03.com"	-> nb03.com;

Tests are defined in #917

[mbabitski-t]

Test is implemented in t_frang.test_whitelist_mark.FrangWhitelistMarkTestCase.test_whitelisted_frang_connection_rate with tcp_connection_rate directive (renamed).