Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

SWWAF_WAF_BODY_LIMIT (default off) has the Core Rule Set read form data
and multipart up to the limit, the rest streaming on, and JSON and XML no
larger than it; other bodies pass uninspected. The part read is held and
sent to the app ahead of the rest. The client has
SWWAF_CLIENT_REQUEST_TIMEOUT to send it, and a size or time limit met
while it is read ends the request before it reaches the app.
Content-Encoding is refused again on those four kinds. Rule 900300 moves
to phase 2, so it counts form and JSON fields past Coraza's 1000 too.

Judgement call: Content-Encoding is refused on a JSON or XML body too
large to be read, which SPEC.md allows.

Model: opus-5-5

internal/config/config_test.go

@@ -96,6 +96,7 @@ const (
 	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
 	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
 	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit            = "SWWAF_WAF_BODY_LIMIT"
 	trapPaths               = "SWWAF_TRAP_PATHS"
 	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
 	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
@@ -580,15 +581,20 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
+				wafBodyLimit: "128K",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
+				WAFBodyLimit:     128 << 10,
 			},
 		},
 		{
-			environment{wafMode: off, wafAnomalyThreshold: off, wafDisabledRules: ""},
+			environment{
+				wafMode: off, wafAnomalyThreshold: off, wafDisabledRules: "",
+				wafBodyLimit: off,
+			},
 			config.Config{
 				WAFMode: config.WAFModeOff, WAFParanoiaLevel: 1, WAFAnomalyThreshold: 0,
 				WAFDisabledRules: []int{}, WAFExemptPaths: []string{},
@@ -601,6 +607,7 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			WAFMode: cfg.WAFMode, WAFParanoiaLevel: cfg.WAFParanoiaLevel,
 			WAFAnomalyThreshold: cfg.WAFAnomalyThreshold,
 			WAFDisabledRules:    cfg.WAFDisabledRules, WAFExemptPaths: cfg.WAFExemptPaths,
+			WAFBodyLimit: cfg.WAFBodyLimit,
 		}
 		if !reflect.DeepEqual(got, tc.want) {
 			t.Errorf("%v gave\n%+v\nwant\n%+v", tc.env, got, tc.want)
@@ -646,6 +653,10 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafExemptPaths, "api/",
 			`"api/" is not a path prefix starting with /, such as /assets/`,
 		},
+		{
+			wafBodyLimit, "128KB",
+			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
+		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
@@ -2403,6 +2414,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafAnomalyThreshold:     "5",
 		wafDisabledRules:        defaultWAFDisabledRules,
 		wafExemptPaths:          "",
+		wafBodyLimit:            off,
 		trapPaths:               "",
 		errorBurstThreshold:     "30",
 		logRemoteURL:            "",