Pass-through proxy with timeouts, size limits and a request log (closes #13)

Milestone 1, the repo's first code. smallwebwaf passes each request to the app and the answer back unchanged, streaming bodies and WebSocket upgrades, within four timeouts (client and app, request and response) and two size limits, and writes one JSON line per request to stdout. Every setting has an SWWAF_ name and a default, and an invalid value stops the start. The repo gets the standard layout: script/ entrypoints, make targets that call them, a Dockerfile that runs the checks, and the Gitea workflow.

Disclosure: SPEC.md changed. Go's server reads the request line and headers before smallwebwaf sees the request, so slow headers are closed without an answer, and neither slow nor oversized headers get a log line.
Disclosure: standard library only.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -0,0 +1,102 @@
+// Package requestlog writes the lines smallwebwaf prints on stdout: one
+// JSON object per request, marked "type":"request", and the process's own
+// messages as JSON lines marked "type":"process".
+package requestlog
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"time"
+)
+
+// The action a request line names: what smallwebwaf did with the
+// request.
+const (
+	// ActionForward is a request passed to the app.
+	ActionForward = "forward"
+	// ActionTooLarge is a request or response over its size limit.
+	ActionTooLarge = "too_large"
+	// ActionTimedOut is a request or response that ran out of time.
+	ActionTimedOut = "timed_out"
+	// ActionUpstreamError is a request the app could not be reached
+	// for, or whose answer could not be passed on.
+	ActionUpstreamError = "upstream_error"
+)
+
+// timeLayout is RFC 3339 with milliseconds.
+const timeLayout = "2006-01-02T15:04:05.000Z07:00"
+
+// Line is one request's line in the request log. The field names are
+// those of the "Request log" section of SPEC.md.
+//
+//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
+type Line struct {
+	Type           string `json:"type"`
+	Time           string `json:"time"`
+	ClientIP       string `json:"client_ip"`
+	PeerIP         string `json:"peer_ip"`
+	Method         string `json:"method"`
+	Host           string `json:"host"`
+	Path           string `json:"path"`
+	Query          string `json:"query"`
+	Protocol       string `json:"protocol"`
+	Status         int    `json:"status"`
+	UpstreamStatus int    `json:"upstream_status,omitempty"`
+	RequestBytes   int64  `json:"request_bytes"`
+	ResponseBytes  int64  `json:"response_bytes"`
+	Referer        string `json:"referer"`
+	UserAgent      string `json:"user_agent"`
+	Action         string `json:"action"`
+	// Aborted is true when the client went away early.
+	Aborted bool `json:"aborted,omitempty"`
+	// DurationTotal and DurationUpstreamTotal are in milliseconds.
+	DurationTotal         float64 `json:"duration_total"`
+	DurationUpstreamTotal float64 `json:"duration_upstream_total,omitempty"`
+}
+
+// Write writes line to w as one JSON line marked "type":"request".
+func Write(w io.Writer, line *Line) error {
+	line.Type = "request"
+
+	encoded, err := json.Marshal(line)
+	if err != nil {
+		return fmt.Errorf("encode the request log line: %w", err)
+	}
+
+	_, err = w.Write(append(encoded, '\n'))
+	if err != nil {
+		return fmt.Errorf("write the request log line: %w", err)
+	}
+
+	return nil
+}
+
+// FormatTime formats t for a line's time field: RFC 3339 in UTC, with
+// milliseconds.
+func FormatTime(t time.Time) string {
+	return t.UTC().Format(timeLayout)
+}
+
+// Milliseconds is d in milliseconds, to the microsecond.
+func Milliseconds(d time.Duration) float64 {
+	return float64(d.Microseconds()) / float64(time.Millisecond/time.Microsecond)
+}
+
+// NewProcessLogger returns the logger for the process's own messages:
+// JSON lines on w, marked "type":"process", with the time in the same form
+// as a request line's.
+func NewProcessLogger(w io.Writer) *slog.Logger {
+	handler := slog.NewJSONHandler(w, &slog.HandlerOptions{
+		ReplaceAttr: func(groups []string, attr slog.Attr) slog.Attr {
+			if attr.Key == slog.TimeKey && len(groups) == 0 {
+				return slog.String(slog.TimeKey, FormatTime(attr.Value.Time()))
+			}
+
+			return attr
+		},
+	})
+
+	return slog.New(handler).With("type", "process")
+}