The header size and the idle time as settings (closes #70)

SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES (default 32K) and
SWWAF_CLIENT_IDLE_TIMEOUT (default 120s) replace the two values the
proxy fixed, and are read like the other size and duration settings.

Go's server reads 4K past the header limit it is given before it
refuses, so it is still given the setting less 4K, and a header size
of 4K or less, or off, stops the start. The idle time can be off.

README.md lists both settings and no longer calls them fixed.

Model: opus-5-5

internal/config/config_test.go

@@ -20,6 +20,8 @@ const (
 	upstreamURL             = "SWWAF_UPSTREAM_URL"
 	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
 	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
+	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
+	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
 	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
 	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
 	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
@@ -66,16 +68,18 @@ func TestDefaults(t *testing.T) {
 	cfg := fromEnvironment(t, environment{})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:              ":8080",
-		ClientRequestTimeout:    time.Minute,
-		ClientResponseTimeout:   30 * time.Minute,
-		UpstreamRequestTimeout:  time.Minute,
-		UpstreamResponseTimeout: 30 * time.Minute,
-		RequestMaxBytes:         100 << 20,
-		ResponseMaxBytes:        5 << 30,
-		RateLimitPerMinute:      1000,
-		RateLimitPerHour:        10000,
-		RateLimitPerDay:         50000,
+		ListenAddr:                  ":8080",
+		ClientRequestTimeout:        time.Minute,
+		ClientRequestHeaderMaxBytes: 32 << 10,
+		ClientIdleTimeout:           2 * time.Minute,
+		ClientResponseTimeout:       30 * time.Minute,
+		UpstreamRequestTimeout:      time.Minute,
+		UpstreamResponseTimeout:     30 * time.Minute,
+		RequestMaxBytes:             100 << 20,
+		ResponseMaxBytes:            5 << 30,
+		RateLimitPerMinute:          1000,
+		RateLimitPerHour:            10000,
+		RateLimitPerDay:             50000,
 	})
 
 	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
@@ -99,6 +103,8 @@ func TestValuesAsSet(t *testing.T) {
 		upstreamURL:             "https://app.internal:8443/",
 		trustedProxies:          " 192.0.2.1, 10.1.2.3/8 ,2001:db8::/32",
 		clientRequestTimeout:    "90s",
+		clientHeaderMaxBytes:    "8K",
+		clientIdleTimeout:       "5m",
 		clientResponseTimeout:   "7d",
 		upstreamRequestTimeout:  "1h30m",
 		upstreamResponseTimeout: off,
@@ -115,16 +121,18 @@ func TestValuesAsSet(t *testing.T) {
 	})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:              "127.0.0.1:9000",
-		ClientRequestTimeout:    90 * time.Second,
-		ClientResponseTimeout:   7 * 24 * time.Hour,
-		UpstreamRequestTimeout:  90 * time.Minute,
-		UpstreamResponseTimeout: 0,
-		RequestMaxBytes:         512 << 10,
-		ResponseMaxBytes:        1234,
-		RateLimitPerMinute:      60,
-		RateLimitPerHour:        600,
-		RateLimitPerDay:         6000,
+		ListenAddr:                  "127.0.0.1:9000",
+		ClientRequestTimeout:        90 * time.Second,
+		ClientRequestHeaderMaxBytes: 8 << 10,
+		ClientIdleTimeout:           5 * time.Minute,
+		ClientResponseTimeout:       7 * 24 * time.Hour,
+		UpstreamRequestTimeout:      90 * time.Minute,
+		UpstreamResponseTimeout:     0,
+		RequestMaxBytes:             512 << 10,
+		ResponseMaxBytes:            1234,
+		RateLimitPerMinute:          60,
+		RateLimitPerHour:            600,
+		RateLimitPerDay:             6000,
 	})
 
 	if cfg.UpstreamURL.String() != "https://app.internal:8443/" {
@@ -163,12 +171,24 @@ func TestSizesAndOff(t *testing.T) {
 		requestMaxBytes:      "3G",
 		responseMaxBytes:     off,
 		clientRequestTimeout: off,
+		clientIdleTimeout:    off,
 	})
 
 	if cfg.RequestMaxBytes != 3<<30 || cfg.ResponseMaxBytes != 0 ||
-		cfg.ClientRequestTimeout != 0 {
-		t.Errorf("3G, off and off read as %d, %d and %s",
-			cfg.RequestMaxBytes, cfg.ResponseMaxBytes, cfg.ClientRequestTimeout)
+		cfg.ClientRequestTimeout != 0 || cfg.ClientIdleTimeout != 0 {
+		t.Errorf("3G, off, off and off read as %d, %d, %s and %s",
+			cfg.RequestMaxBytes, cfg.ResponseMaxBytes, cfg.ClientRequestTimeout,
+			cfg.ClientIdleTimeout)
+	}
+}
+
+func TestRequestHeaderMaxBytesJustOver4K(t *testing.T) {
+	t.Parallel()
+
+	// 4K and off stop the start, as TestInvalidValueStopsTheStart shows.
+	cfg := fromEnvironment(t, environment{clientHeaderMaxBytes: "4097"})
+	if cfg.ClientRequestHeaderMaxBytes != 4097 {
+		t.Errorf("4097 read as %d", cfg.ClientRequestHeaderMaxBytes)
 	}
 }
 
@@ -222,6 +242,11 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{denyNets, "198.51.100.0/24,"},
 		{clientRequestTimeout, "60"},
 		{clientRequestTimeout, ""},
+		{clientHeaderMaxBytes, "4K"},
+		{clientHeaderMaxBytes, off},
+		{clientHeaderMaxBytes, "32KB"},
+		{clientIdleTimeout, "0s"},
+		{clientIdleTimeout, "2 minutes"},
 		{clientResponseTimeout, "1y"},
 		{upstreamRequestTimeout, "-1s"},
 		{upstreamResponseTimeout, "0s"},
@@ -289,6 +314,8 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		upstreamURL:             "http://127.0.0.1:8081",
 		trustedProxies:          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
 		clientRequestTimeout:    "45s",
+		clientHeaderMaxBytes:    "32K",
+		clientIdleTimeout:       "120s",
 		clientResponseTimeout:   "30m",
 		upstreamRequestTimeout:  "60s",
 		upstreamResponseTimeout: "30m",
@@ -314,6 +341,8 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 
 	if got.ListenAddr != want.ListenAddr ||
 		got.ClientRequestTimeout != want.ClientRequestTimeout ||
+		got.ClientRequestHeaderMaxBytes != want.ClientRequestHeaderMaxBytes ||
+		got.ClientIdleTimeout != want.ClientIdleTimeout ||
 		got.ClientResponseTimeout != want.ClientResponseTimeout ||
 		got.UpstreamRequestTimeout != want.UpstreamRequestTimeout ||
 		got.UpstreamResponseTimeout != want.UpstreamResponseTimeout ||