Header limit of 32 KiB, upstream URL checks, build and run scripts

The request line and headers are now refused above 32 KiB exactly: Go's
server reads 4 KiB past MaxHeaderBytes, so that is set to 28 KiB, and
the tests try exactly 32 KiB and one byte more. SWWAF_UPSTREAM_URL now
needs a host, and a given port must be from 1 to 65535. make build and
make run call script/build and script/run.

Model: opus-5-5

internal/proxy/passthrough_test.go

@@ -309,7 +309,7 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 		ProcessLog: requestlog.NewProcessLogger(io.Discard),
 	})
 
-	if server.Addr != ":8080" || server.MaxHeaderBytes != 32<<10 ||
+	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
 		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
 		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
 			"header timeout %s", server.Addr, server.MaxHeaderBytes,
@@ -327,16 +327,23 @@ func TestRefusesHeadersOver32KiB(t *testing.T) {
 	})
 	addr, _ := startProxy(t, app.URL, nil)
 
+	// size counts every byte of the request: the request line, the
+	// headers and the blank line that ends them.
+	const (
+		start = "GET / HTTP/1.1\r\nHost: app\r\nX-Large: "
+		end   = "\r\n\r\n"
+	)
+
 	for _, tc := range []struct {
-		headerSize int
-		want       int
+		size int
+		want int
 	}{
-		{headerSize: 30 << 10, want: http.StatusOK},
-		{headerSize: 40 << 10, want: http.StatusRequestHeaderFieldsTooLarge},
+		{size: 32 << 10, want: http.StatusOK},
+		{size: 32<<10 + 1, want: http.StatusRequestHeaderFieldsTooLarge},
 	} {
-		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
-		req.Header.Set("X-Large", strings.Repeat("a", tc.headerSize))
-		wantStatus(t, do(t, req), tc.want)
+		conn := dial(t, addr)
+		send(t, conn, start+strings.Repeat("a", tc.size-len(start)-len(end))+end)
+		wantStatus(t, readResponse(t, conn), tc.want)
 	}
 
 	if calls.Load() != 1 {

internal/proxy/proxy.go

@@ -15,11 +15,14 @@ import (
 
 // The request line and headers a client may send, and how long a
 // kept-open client connection may wait for its next request, are fixed
-// rather than settings. The idle time is longer than the 90 seconds after
-// which traefik closes a connection it is not using, so traefik never
-// sends a request on a connection smallwebwaf is closing.
+// rather than settings. The limit on the request line and headers is
+// 32 KiB, but Go's server reads 4 KiB past its MaxHeaderBytes before it
+// refuses, so MaxHeaderBytes is set 4 KiB lower. The idle time is longer
+// than the 90 seconds after which traefik closes a connection it is not
+// using, so traefik never sends a request on a connection smallwebwaf is
+// closing.
 const (
-	requestHeaderMaxBytes = 32 << 10
+	requestHeaderMaxBytes = 32<<10 - 4<<10
 	clientIdleTimeout     = 120 * time.Second
 )