fix: cap listener connections, serve HEAD, fix feed parser CR round-trip

tests/pentest.sh

@@ -135,6 +135,55 @@ probe "extra-headers-tolerated" "HTTP/1.1 200" 'GET /twtxt/tobias.txt HTTP/1.1\r
 curl -s -i "http://$HOST:$HTTP_PORT/twtxt/tobias.txt" -H "X-Evil: $(printf 'injected-header')" \
     | grep -qi "injected-header" && fail "request header reflected in response"
 
+step "http: HEAD serves headers without a body"
+python3 - "$HTTP_PORT" <<'PYEOF'
+import socket, sys
+s = socket.create_connection(("127.0.0.1", int(sys.argv[1])), timeout=15)
+s.sendall(b"HEAD /twtxt/tobias.txt HTTP/1.1\r\n\r\n")
+data = b""
+while b"\r\n\r\n" not in data:
+    chunk = s.recv(4096)
+    if not chunk:
+        break
+    data += chunk
+head, _, body = data.partition(b"\r\n\r\n")
+assert head.startswith(b"HTTP/1.1 200"), head
+assert b"Content-Length:" in head, head
+assert body == b"", "HEAD must not emit a body"
+print("ok    HEAD answers 200 with headers and no body")
+PYEOF
+
+step "http: the connection cap sheds floods with 503"
+python3 - "$HTTP_PORT" <<'PYEOF'
+import socket, sys, time
+port = int(sys.argv[1])
+held = []
+for _ in range(64):
+    s = socket.create_connection(("127.0.0.1", port), timeout=15)
+    s.sendall(b"G")  # a partial request, as slowloris sends
+    held.append(s)
+time.sleep(0.5)
+extra = socket.create_connection(("127.0.0.1", port), timeout=15)
+extra.sendall(b"GET /twtxt/tobias.txt HTTP/1.1\r\n\r\n")
+data = b""
+while b"\r\n" not in data:
+    chunk = extra.recv(512)
+    if not chunk:
+        break
+    data += chunk
+assert data.startswith(b"HTTP/1.1 503"), f"flood absorbed: {data!r}"
+for s in held:
+    s.close()
+extra.close()
+print("ok    the 65th connection was shed with 503")
+PYEOF
+# The listener must recover once the flood closes.
+for _ in $(seq 1 20); do
+    curl -sf "http://$HOST:$HTTP_PORT/twtxt/tobias.txt" >/dev/null && break
+    sleep 1
+done
+curl -sf "http://$HOST:$HTTP_PORT/twtxt/tobias.txt" >/dev/null || fail "listener never recovered after the flood"
+
 step "http: slowloris is bounded by the read timeout"
 python3 - "$HTTP_PORT" <<'EOF'
 import socket, sys, time