Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/biased_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"net/netip"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"testing/synctest"
@@ -22,10 +23,10 @@ import (
 
 // The biased thresholds.
 const (
-	tagLimitPercent     = "SWW_WAF_TAG_LIMIT_PERCENT"
-	asnBytesPercent     = "SWW_WAF_ASN_BYTES_PERCENT"
-	countryBytesPercent = "SWW_WAF_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent = "SWW_WAF_UNKNOWN_LIMIT_PERCENT"
+	tagLimitPercent            = "SWW_WAF_TAG_LIMIT_PERCENT"
+	asnBytesLimitPercent       = "SWW_WAF_ASN_BYTES_LIMIT_PERCENT"
+	countryBytesLimitPercent   = "SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT"
+	unknownCountryLimitPercent = "SWW_WAF_UNKNOWN_COUNTRY_LIMIT_PERCENT"
 )
 
 const (
@@ -60,7 +61,7 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 	}{
 		{tagLimitPercent, asnTagDEHalf, fromDE},
 		{tagLimitPercent, countryTagDEHalf, fromDE},
-		{unknownLimitPercent, "50", unplaced},
+		{unknownCountryLimitPercent, "50", unplaced},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
 			t.Parallel()
@@ -108,9 +109,9 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 	}{
 		{tagLimitPercent, asnTagDEHalf, fromDE},
 		{tagLimitPercent, "Country=de:50", fromDE},
-		{unknownLimitPercent, "50", unplaced},
-		{asnBytesPercent, "as64496:50", fromDE},
-		{countryBytesPercent, countryDEHalf, fromDE},
+		{unknownCountryLimitPercent, "50", unplaced},
+		{asnBytesLimitPercent, "as64496:50", fromDE},
+		{countryBytesLimitPercent, countryDEHalf, fromDE},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
 			t.Parallel()
@@ -163,22 +164,28 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(
 	}{
 		{
 			"lowering the byte limits alone",
-			map[string]string{asnBytesPercent: asnDEHalf},
-			none, "50 from " + asnBytesPercent, minuteBytes,
+			map[string]string{asnBytesLimitPercent: asnDEHalf},
+			none, "50 from " + asnBytesLimitPercent, minuteBytes,
 		},
 		{
 			"lowering the byte limits alone, by country",
-			map[string]string{countryBytesPercent: countryDEHalf},
-			none, "50 from " + countryBytesPercent, minuteBytes,
+			map[string]string{countryBytesLimitPercent: countryDEHalf},
+			none, "50 from " + countryBytesLimitPercent, minuteBytes,
 		},
 		{
 			"raising the byte limits back",
-			map[string]string{tagLimitPercent: asnTagDEHalf, asnBytesPercent: asnDE + ":100"},
+			map[string]string{
+				tagLimitPercent:      asnTagDEHalf,
+				asnBytesLimitPercent: asnDE + ":100",
+			},
 			"50 from " + tagLimitPercent, none, "",
 		},
 		{
 			"raising the byte limits back, by country",
-			map[string]string{tagLimitPercent: countryTagDEHalf, countryBytesPercent: "de:100"},
+			map[string]string{
+				tagLimitPercent:          countryTagDEHalf,
+				countryBytesLimitPercent: "de:100",
+			},
 			"50 from " + tagLimitPercent, none, "",
 		},
 	} {
@@ -214,7 +221,7 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 
 	s, _, _ := startWithLookups(
 		t,
-		map[string]string{unknownLimitPercent: "0"},
+		map[string]string{unknownCountryLimitPercent: "0"},
 	)
 
 	// The first request breaks the limit, and bans the client; the log line
@@ -225,12 +232,12 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 		requestlog.ActionClientIsRateLimited,
 	)
 	if line.fields["rate_limit_percent"] != float64(0) ||
-		line.fields["rate_limit_percent_setting"] != unknownLimitPercent {
+		line.fields["rate_limit_percent_setting"] != unknownCountryLimitPercent {
 		t.Errorf(
 			"log line has rate_limit_percent %v from %v, want 0 from %s",
 			line.fields["rate_limit_percent"],
 			line.fields["rate_limit_percent_setting"],
-			unknownLimitPercent,
+			unknownCountryLimitPercent,
 		)
 	}
 
@@ -264,11 +271,11 @@ func TestLowestPercentageApplies(t *testing.T) {
 		},
 		{
 			"that for a client without a country",
-			map[string]string{tagLimitPercent: "asn=64500:50", unknownLimitPercent: "25"},
-			noCountry, "25 from " + unknownLimitPercent,
+			map[string]string{tagLimitPercent: "asn=64500:50", unknownCountryLimitPercent: "25"},
+			noCountry, "25 from " + unknownCountryLimitPercent,
 		},
 		{
-			// SWW_WAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
+			// SWW_WAF_UNKNOWN_COUNTRY_LIMIT_PERCENT is left at its default, 100.
 			"the AS number's, for a client without a country",
 			map[string]string{tagLimitPercent: "asn=64500:25"},
 			noCountry, "25 from " + tagLimitPercent,
@@ -302,7 +309,7 @@ func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(
 	t.Parallel()
 
 	s, _, _ := startWithLookups(t, map[string]string{
-		rateLimitPerMinute: fourAMinute, unknownLimitPercent: "50",
+		rateLimitPerMinute: fourAMinute, unknownCountryLimitPercent: "50",
 	})
 
 	// One the lookup database does not hold, and one on a private address,
@@ -330,7 +337,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
 		server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
-			map[string]string{unknownLimitPercent: "0"})
+			map[string]string{unknownCountryLimitPercent: "0"})
 
 		// Once the time the request waits for its answer is up, the client
 		// counts as without a country, and its zero allowance refuses the
@@ -346,7 +353,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		)
 		wantPercent(t, "rate_limit_percent",
 			line.RateLimitPercent, line.RateLimitPercentSetting,
-			"0 from "+unknownLimitPercent)
+			"0 from "+unknownCountryLimitPercent)
 	})
 }
 
@@ -365,12 +372,12 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 		// A tag the lookup does not give needs no answer.
 		{tagLimitPercent, "vpn:50", false},
 		{tagDeny, "vpn", false},
-		{asnBytesPercent, asnDEHalf, true},
-		{countryBytesPercent, countryDEHalf, true},
-		{unknownLimitPercent, "99", true},
+		{asnBytesLimitPercent, asnDEHalf, true},
+		{countryBytesLimitPercent, countryDEHalf, true},
+		{unknownCountryLimitPercent, "99", true},
 		{asnLimitPercentURL, asnURL, true},
 		// At 100, its default, it lowers no limit.
-		{unknownLimitPercent, "100", false},
+		{unknownCountryLimitPercent, "100", false},
 	} {
 		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
@@ -380,7 +387,10 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
 				server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 					map[string]string{
-						lookupTimeout: timeout.String(), tagLists: "vpn=" + vpnList, tc.setting: tc.value,
+						asnAndCountryLookupTimeout: strconv.FormatInt(
+							timeout.Milliseconds(), 10),
+						tagLists:   "vpn=" + vpnList,
+						tc.setting: tc.value,
 					})
 				began := time.Now()
 
@@ -449,10 +459,10 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(
 			"a byte limit",
 			map[string]string{
 				bytesLimitPerMinute: twoUploads, tagLimitPercent: asnTagDEQuarter,
-				asnBytesPercent: asnDEHalf,
+				asnBytesLimitPercent: asnDEHalf,
 			},
 			0, http.StatusOK, requestlog.ActionForward,
-			"bytes per minute over the limit of 99", "50 from " + asnBytesPercent,
+			"bytes per minute over the limit of 99", "50 from " + asnBytesLimitPercent,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {