waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

internal/waf/request.go

@@ -177,7 +177,7 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 // check is the one place where a request can be refused. It returns nil to let
 // the request through. The heuristics of checkClient decide: a request they
 // refuse is answered with SWW_WAF_BAN_RESPONSE, 403 for a block rule or the Core
-// Rule Set, or 431 for the header limits. In observe mode nothing is refused,
+// Rule Set, or 414 or 431 for the header limits. In observe mode nothing is refused,
 // and the log line names what enforce mode would have done. ctx is the
 // request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
@@ -196,6 +196,8 @@ func (rq *request) check(ctx context.Context) *refusal {
 	case action == requestlog.ActionBlockedByBlockRule ||
 		action == requestlog.ActionBlockedByCoreRuleSet:
 		return &refusal{status: http.StatusForbidden, action: action}
+	case action == requestlog.ActionRequestLineTooLong:
+		return &refusal{status: http.StatusRequestURITooLong, action: action}
 	case action == requestlog.ActionRequestHeaderTooLarge:
 		return &refusal{
 			status: http.StatusRequestHeaderFieldsTooLarge,