waf: decide every visitor request within rproxy's timeout (closes #394)

The Core Rule Set is the one check whose time a visitor can stretch.
At paranoia level 4 it took over 2 s on a request with an 8 KiB
request line, three 8 KiB Cookie lines and a 64 KiB form body.
SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE now takes at most 8K, which
brings that request under 1 s.

A test per kind of input times the Core Rule Set on the worst request
within the limits, at the slowest settings. SPEC.md lists the limits
that bound it.

Model: opus-5-5

internal/config/waf.go

@@ -365,8 +365,8 @@ var (
 		"it names the file to look clients up in",
 	)
 	errDBPathUnused = errors.New("only file reads it")
-	errOver64K      = errors.New(
-		"is more than 64K, the most waf gets of a body")
+	errOver8K       = errors.New(
+		"is more than 8K, the most the Core Rule Set can read in time")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -1601,16 +1601,16 @@ func durationOrDays(value string) (time.Duration, error) {
 }
 
 // parseCoreRuleSetBodyInspectionSize reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since waf
-// gets no more of a body than that.
+// reads: a size as parseSize reads it, or off, but at most 8K, so that one
+// request cannot keep the Core Rule Set busy past rproxy's timeout.
 func parseCoreRuleSetBodyInspectionSize(value string) (int64, error) {
 	limit, err := parseSize(value)
 	if err != nil {
 		return 0, err
 	}
 
-	if limit > 64*kibibyte {
-		return 0, fmt.Errorf("%q %w", value, errOver64K)
+	if limit > 8*kibibyte {
+		return 0, fmt.Errorf("%q %w", value, errOver8K)
 	}
 
 	return limit, nil

internal/config/waf_test.go

@@ -616,7 +616,7 @@ func TestCoreRuleSetSettings(t *testing.T) {
 				coreRuleSetScoreThreshold:     "10",
 				coreRuleSetDisabledRules:      "942100, 920350",
 				coreRuleSetExemptPaths:        "/api/, /static/",
-				coreRuleSetBodyInspectionSize: "32K",
+				coreRuleSetBodyInspectionSize: "4K",
 				exclusionsFile:                "/etc/sww/crs-exclusions.conf",
 			},
 			config.WAF{
@@ -625,7 +625,7 @@ func TestCoreRuleSetSettings(t *testing.T) {
 				CoreRuleSetScoreThreshold:     10,
 				CoreRuleSetDisabledRules:      []int{942100, 920350},
 				CoreRuleSetExemptPaths:        []string{"/api/", "/static/"},
-				CoreRuleSetBodyInspectionSize: 32 << 10,
+				CoreRuleSetBodyInspectionSize: 4 << 10,
 				CoreRuleSetExclusionsFile:     "/etc/sww/crs-exclusions.conf",
 			},
 		},
@@ -762,15 +762,15 @@ func TestInvalidAppsStopsTheStart(t *testing.T) {
 	}
 }
 
-func TestCoreRuleSetBodyInspectionSizeOf64K(t *testing.T) {
+func TestCoreRuleSetBodyInspectionSizeOf8K(t *testing.T) {
 	t.Parallel()
 
 	cfg := wafFromEnvironment(
 		t,
-		environment{coreRuleSetBodyInspectionSize: "64K"},
+		environment{coreRuleSetBodyInspectionSize: "8K"},
 	)
-	if cfg.CoreRuleSetBodyInspectionSize != 64<<10 {
-		t.Errorf("64K read as %d", cfg.CoreRuleSetBodyInspectionSize)
+	if cfg.CoreRuleSetBodyInspectionSize != 8<<10 {
+		t.Errorf("8K read as %d", cfg.CoreRuleSetBodyInspectionSize)
 	}
 }
 
@@ -819,11 +819,13 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			coreRuleSetBodyInspectionSize, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{coreRuleSetBodyInspectionSize, "65K", `"65K" is more than 64K, the most waf ` +
-			`gets of a body`},
 		{
-			coreRuleSetBodyInspectionSize, "65537",
-			`"65537" is more than 64K, the most waf gets of a body`,
+			coreRuleSetBodyInspectionSize, "9K",
+			`"9K" is more than 8K, the most the Core Rule Set can read in time`,
+		},
+		{
+			coreRuleSetBodyInspectionSize, "8193",
+			`"8193" is more than 8K, the most the Core Rule Set can read in time`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {