The header size and the idle time as settings (closes #70)

SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES (default 32K) and
SWWAF_CLIENT_IDLE_TIMEOUT (default 120s) replace the two values the
proxy fixed. The idle time is read like the other durations, and can
be off.

Go's server reads 4K past the header limit it is given before it
refuses, so it is still given the setting less 4K. The header size
must be more than 4K and cannot be off; any other value stops the
start with a message that does not offer off.

SPEC.md and README.md say so. README.md lists both settings, no longer
calls them fixed, and names them as built.

Model: opus-5-5

internal/proxy/proxy.go

@@ -16,19 +16,6 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The request line and headers a client may send, and how long a
-// kept-open client connection may wait for its next request, are fixed
-// rather than settings. The limit on the request line and headers is
-// 32 KiB, but Go's server reads 4 KiB past its MaxHeaderBytes before it
-// refuses, so MaxHeaderBytes is set 4 KiB lower. The idle time is longer
-// than the 90 seconds after which traefik closes a connection it is not
-// using, so traefik never sends a request on a connection smallwebwaf is
-// closing.
-const (
-	requestHeaderMaxBytes = 32<<10 - 4<<10
-	clientIdleTimeout     = 120 * time.Second
-)
-
 // How smallwebwaf keeps connections to the app open between requests.
 const (
 	appIdleConns       = 100
@@ -52,8 +39,9 @@ type Params struct {
 }
 
 // New returns the server smallwebwaf runs: each request it reads passes
-// through the proxy. Go's server itself refuses headers over 32 KiB, with
-// 431, closes a connection idle for 120 seconds, and applies
+// through the proxy. Go's server itself refuses a request line and
+// headers over SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES, with 431, closes a
+// connection idle for SWWAF_CLIENT_IDLE_TIMEOUT, and applies
 // SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
 // applies the timeouts and size limits from then on.
 func New(params Params) *http.Server {
@@ -79,9 +67,13 @@ func New(params Params) *http.Server {
 			}),
 		},
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
-		IdleTimeout:       clientIdleTimeout,
-		MaxHeaderBytes:    requestHeaderMaxBytes,
-		ErrorLog:          errorLog,
+		// Off is an IdleTimeout of 0, which Go's server replaces with
+		// ReadTimeout: no limit, as long as ReadTimeout stays unset.
+		IdleTimeout: params.Config.ClientIdleTimeout,
+		// Go's server reads 4 KiB past MaxHeaderBytes before it refuses,
+		// so the limit a client meets is the setting.
+		MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
+		ErrorLog:       errorLog,
 	}
 }