The header size and the idle time as settings (closes #70)

SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES (default 32K) and
SWWAF_CLIENT_IDLE_TIMEOUT (default 120s) replace the two values the
proxy fixed. The idle time is read like the other durations, and can
be off.

Go's server reads 4K past the header limit it is given before it
refuses, so it is still given the setting less 4K. The header size
must be more than 4K and cannot be off; any other value stops the
start with a message that does not offer off.

SPEC.md and README.md say so. README.md lists both settings, no longer
calls them fixed, and names them as built.

Model: opus-5-5

README.md

@@ -13,15 +13,17 @@ JSON log line for every request.
 
 Status: the first two milestones are built
 (https://git.eeqj.de/sneak/smallwebwaf/issues/13 and
-https://git.eeqj.de/sneak/smallwebwaf/issues/14), and so are the static lists,
-which come next in the build order. `smallwebwaf` passes each request to the app
-and the app's answer back, unchanged, within its timeouts and size limits, works
-out each client's address, refuses a client that sends too many requests, comes
-from a country you refuse or from a network you refuse, lets the networks you
-choose through, and writes a JSON log line for every request. It comes as the
-image the app's own image is built on. The rest of the design comes after that,
-in the order of the build order in [`SPEC.md`](SPEC.md). The survey of existing
-tools that led to the design is in [`EVALUATION.md`](EVALUATION.md).
+https://git.eeqj.de/sneak/smallwebwaf/issues/14), and so are two parts of
+milestone 3: the static lists, which come next in the build order, and the
+header size and the idle time as settings, which come last in it. `smallwebwaf`
+passes each request to the app and the app's answer back, unchanged, within its
+timeouts and size limits, works out each client's address, refuses a client that
+sends too many requests, comes from a country you refuse or from a network you
+refuse, lets the networks you choose through, and writes a JSON log line for
+every request. It comes as the image the app's own image is built on. The rest
+of the design comes after that, in the order of the build order in
+[`SPEC.md`](SPEC.md). The survey of existing tools that led to the design is in
+[`EVALUATION.md`](EVALUATION.md).
 
 ## Getting started
 
@@ -58,16 +60,16 @@ and `make run` builds and runs it, listening on port 8080 in front of an app at
   is inside, the leftmost is, and with no header the peer is. The app sees what
   it would see from traefik directly: the same `Host`, the same
   `X-Forwarded-Proto`, and `X-Forwarded-For` with the peer added at the end.
-- Enforces the four timeouts and the two size limits below. A limit passed
-  before the response has started gets `smallwebwaf`'s own answer: `408` for a
-  client too slow to send its request, `413` for a request body that is too
-  large, `504` for an app too slow to answer, and `502` for a response that is
-  too large or an app that cannot be reached. A request that announces a body
-  over the limit is refused before anything reaches the app. While a request
-  body is still on its way, a request timeout that runs out answers `408` if
-  `smallwebwaf` was waiting for the client to send more, and `504` if it was
-  waiting for the app to take what it had. Once the response has started, a
-  limit can only cut the connection.
+- Enforces the timeouts and the size limits below. A limit passed before the
+  response has started gets `smallwebwaf`'s own answer: `408` for a client too
+  slow to send its request, `413` for a request body that is too large, `504`
+  for an app too slow to answer, and `502` for a response that is too large or
+  an app that cannot be reached. A request that announces a body over the limit
+  is refused before anything reaches the app. While a request body is still on
+  its way, a request timeout that runs out answers `408` if `smallwebwaf` was
+  waiting for the client to send more, and `504` if it was waiting for the app
+  to take what it had. Once the response has started, a limit can only cut the
+  connection.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with `429`
   before anything reaches the app, and so is each request after it until the
@@ -113,6 +115,16 @@ it, and the effective settings are logged at start.
 - `SWWAF_CLIENT_REQUEST_TIMEOUT` (default `60s`): how long a client may take to
   send its request line and headers, and then, from the end of the headers, its
   body.
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest request
+  line and headers a client may send. Over it, the answer is `431` and nothing
+  reaches the app. It must be more than `4K`, and cannot be `off`: Go's HTTP
+  server always has such a limit, and reads 4 KiB past the one it is given
+  before it refuses.
+- `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open connection
+  may wait for its next request before `smallwebwaf` closes it. The default is
+  longer than the 90 seconds after which traefik closes a connection it is not
+  using, so traefik never sends a request on a connection `smallwebwaf` is
+  closing.
 - `SWWAF_CLIENT_RESPONSE_TIMEOUT` (default `30m`): how long the response may
   take to reach the client, from the end of the request to the last byte.
 - `SWWAF_UPSTREAM_REQUEST_TIMEOUT` (default `60s`): how long connecting to the
@@ -145,16 +157,13 @@ and a bare address stands for itself alone. Countries are the two-letter codes
 ISO 3166-1 assigns today, and `xk` for Kosovo, in either case (`de` and `DE` are
 the same); any other code, such as `nk` (North Korea is `kp`) or the withdrawn
 `su`, stops the start, and so does a code on both country lists. `off` switches
-a timeout, a size limit or a rate limit off.
+a timeout, a size limit or a rate limit off; only
+`SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` cannot be off.
 
-Several limits are fixed rather than settings. The request line and headers may
-take up to 32 KiB, above which the answer is `431` and nothing reaches the app.
-A kept-open connection that sends nothing for 120 seconds is closed. That is
-longer than the 90 seconds after which traefik closes a connection it is not
-using, so traefik never sends a request on a connection `smallwebwaf` is
-closing. At most 20,000 clients are kept for the rate limits, and an IPv6 client
-is counted by its /64. A new client waits at most a second for its country, and
-at most 100,000 answers from GeoJS are kept, for 7 days each.
+Several limits are fixed rather than settings. At most 20,000 clients are kept
+for the rate limits, and an IPv6 client is counted by its /64. A new client
+waits at most a second for its country, and at most 100,000 answers from GeoJS
+are kept, for 7 days each.
 
 ## Request log
 
@@ -193,10 +202,10 @@ settings, stop, errors) share the stream as JSON lines marked
 
 Go's HTTP server, on which `smallwebwaf` is built, reads a request's line and
 headers before `smallwebwaf` sees the request, and some requests end there,
-without a line in the log: headers over 32 KiB, which it answers `431`, headers
-slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`, whose connection it closes without
-an answer, and requests it cannot read at all, which it answers itself, mostly
-with `400`.
+without a line in the log: headers over `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`,
+which it answers `431`, headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`,
+whose connection it closes without an answer, and requests it cannot read at
+all, which it answers itself, mostly with `400`.
 
 ## Why
 
@@ -535,8 +544,9 @@ so that they run in minimal containers.
 
 ## TODO
 
-- The rest of milestone 3, after the static lists, and the rest of the design,
-  in the order of the build order in [`SPEC.md`](SPEC.md).
+- The rest of milestone 3, from the bans that broken request limits lead to
+  through the metrics endpoint, and the rest of the design, in the order of the
+  build order in [`SPEC.md`](SPEC.md).
 
 ## Documents