waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

SPEC.md

@@ -2479,7 +2479,7 @@ It refuses a request with `431` for any of:
 - more than 100 header fields. A header sent twice counts twice. `Host` and
   `Transfer-Encoding` do not count. `X-Request-ID` and `X-Forwarded-Proto` do.
 
-Real clients never reach these limits. nginx refuses lines over 8 KiB by
+Real clients rarely reach these limits. nginx refuses lines over 8 KiB by
 default, and Apache's default limit is about the same. The answer is `deny`. The
 log line's action is `request_line_too_long` for `414` and
 `request_header_too_large` for `431`. The refusal makes no ban and is no
@@ -2498,9 +2498,9 @@ other check runs on it.
 
 The Core Rule Set runs each of its rules on each cookie, so thousands of small
 cookies would keep it busy for over a second. One 30 KB cookie or query string
-would keep it busy for a third of a second or more. Within the limits, a request
-takes less of its time. Enough such requests at once can still overload `waf`
-past `SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS`.
+would keep it busy for a third of a second or more. A request within the limits
+keeps the Core Rule Set busy for less time. Enough such requests at once can
+still overload `waf` past `SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS`.
 
 ### The report
 

internal/waf/headerlimits.go

@@ -12,7 +12,7 @@ import (
 
 // The header limits: the most cookies and header fields a request may have,
 // and the longest its request line and each header line may be, in bytes, not
-// counting the line ending. Real clients never reach them. maxLineBytes is
+// counting the line ending. Real clients rarely reach them. maxLineBytes is
 // what nginx allows by default.
 const (
 	maxCookies      = 50