[confighttp] Add read_timeout and read_header_timeout options to confighttp

.chloggen/confighttp_read_timeout.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: confighttp
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add `read_timeout` and `read_header_timeout` options to confighttp, to use as HTTP server config options.
+
+# One or more tracking issues or pull requests related to the change
+issues: [5699]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

.golangci.yml

@@ -147,10 +147,6 @@ issues:
     - text: "G402:"
       linters:
         - gosec
-    # https://github.com/open-telemetry/opentelemetry-collector/issues/5699
-    - text: "G112:"
-      linters:
-        - gosec
 
   # The list of ids of default excludes to include or disable. By default it's empty.
   # See the list of default excludes here https://golangci-lint.run/usage/configuration.

config/confighttp/README.md

@@ -82,6 +82,11 @@ will not be enabled.
 - `compression_algorithms`: configures the list of compression algorithms the server can accept. Default: ["", "gzip", "zstd", "zlib", "snappy", "deflate"]
 - [`tls`](../configtls/README.md)
 - [`auth`](../configauth/README.md)
+- [`read_timeout`]: maximum duration for reading the entire request, including the body.
+  A zero or negative value means there will be no timeout. Default: `0` (no timeout)
+- [`read_header_timeout`]: amount of time allowed to read request headers. The connection's read deadline is reset
+  after reading the headers and the Handler can decide what is considered too slow for the body.
+  If set to zero, the value of `read_timeout` is used. If both are zero, there is no timeout. Default: `0` (no timeout)
 
 You can enable [`attribute processor`][attribute-processor] to append any http header to span's attribute using custom key. You also need to enable the "include_metadata"
 

config/confighttp/confighttp.go

@@ -306,6 +306,24 @@ type ServerConfig struct {
 
 	// CompressionAlgorithms configures the list of compression algorithms the server can accept. Default: ["", "gzip", "zstd", "zlib", "snappy", "deflate"]
 	CompressionAlgorithms []string `mapstructure:"compression_algorithms"`
+
+	// ReadTimeout is the maximum duration for reading the entire
+	// request, including the body. A zero or negative value means
+	// there will be no timeout.
+	//
+	// Because ReadTimeout does not let Handlers make per-request
+	// decisions on each request body's acceptable deadline or
+	// upload rate, most users will prefer to use
+	// ReadHeaderTimeout. It is valid to use them both.
+	ReadTimeout time.Duration `mapstructure:"read_timeout"`
+
+	// ReadHeaderTimeout is the amount of time allowed to read
+	// request headers. The connection's read deadline is reset
+	// after reading the headers and the Handler can decide what
+	// is considered too slow for the body. If ReadHeaderTimeout
+	// is zero, the value of ReadTimeout is used. If both are
+	// zero, there is no timeout.
+	ReadHeaderTimeout time.Duration `mapstructure:"read_header_timeout"`
 }
 
 // ToListener creates a net.Listener.
@@ -429,7 +447,9 @@ func (hss *ServerConfig) ToServer(_ context.Context, host component.Host, settin
 	}
 
 	return &http.Server{
-		Handler: handler,
+		Handler:           handler,
+		ReadTimeout:       hss.ReadTimeout,
+		ReadHeaderTimeout: hss.ReadHeaderTimeout,
 	}, nil
 }
 

service/internal/proctelemetry/config.go

@@ -44,6 +44,8 @@ const (
 	// supported protocols
 	protocolProtobufHTTP = "http/protobuf"
 	protocolProtobufGRPC = "grpc/protobuf"
+
+	defaultReadHeaderTimeout = 10 * time.Second
 )
 
 var (
@@ -101,8 +103,9 @@ func InitPrometheusServer(registry *prometheus.Registry, address string, asyncEr
 	mux := http.NewServeMux()
 	mux.Handle("/metrics", promhttp.HandlerFor(registry, promhttp.HandlerOpts{}))
 	server := &http.Server{
-		Addr:    address,
-		Handler: mux,
+		Addr:              address,
+		Handler:           mux,
+		ReadHeaderTimeout: defaultReadHeaderTimeout,
 	}
 	go func() {
 		if serveErr := server.ListenAndServe(); serveErr != nil && !errors.Is(serveErr, http.ErrServerClosed) {