Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

internal/alerts/alerts.go

@@ -151,7 +151,7 @@ type Params struct {
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
 // with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
 // Country are, for a ban, the client's as the ban's notes give them. Host is
-// the site of the request that raised the alert, while one discriminator serves
+// the site of the request that raised the alert, while one waf serves
 // many sites, and "" otherwise.
 //
 //nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case

internal/config/config.go

@@ -1,6 +1,6 @@
 // Package config reads sww's settings, and is the one place they are
 // read. Every setting is an environment variable. The settings of `sww
-// discriminator` start with SWW_, every one of them has a default, and most can be
+// waf` start with SWW_, every one of them has a default, and most can be
 // given as a file instead. Those of `sww rproxy` start with SWRP_. Each
 // of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
 // since rproxy never touches disk. SWW_COMMAND chooses which of the two
@@ -32,10 +32,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is the settings of `sww discriminator`. A time or size limit of
+// Config is the settings of `sww waf`. A time or size limit of
 // zero is off.
 type Config struct {
-	// ListenAddr is where discriminator listens (SWW_LISTEN_ADDR).
+	// ListenAddr is where waf listens (SWW_LISTEN_ADDR).
 	ListenAddr string
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWW_INSTANCE_NAME),
@@ -239,7 +239,7 @@ type Config struct {
 	// attack (SWW_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that discriminator may refuse after a rule file or Core Rule Set match; one
+	// that waf may refuse after a rule file or Core Rule Set match; one
 	// more breaks a limit (SWW_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
@@ -378,8 +378,8 @@ var (
 	errNeedsDBPath     = errors.New("it names the file to look clients up in")
 	errDBPathUnused    = errors.New("only file reads it")
 	errOver64K         = errors.New(
-		"is more than 64K, the most discriminator gets of a body")
-	errNotCommand           = errors.New("is not rproxy or discriminator")
+		"is more than 64K, the most waf gets of a body")
+	errNotCommand           = errors.New("is not rproxy or waf")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -627,7 +627,7 @@ func FromEnvironment(
 }
 
 // Command reads only SWW_COMMAND, the command the image runs and its
-// health check checks: rproxy when it is unset or empty, or discriminator. It cannot
+// health check checks: rproxy when it is unset or empty, or waf. It cannot
 // be given as a file. Any other value is an error that names the setting.
 func Command(lookupEnv func(string) (string, bool)) (string, error) {
 	command, _ := lookupEnv("SWW_COMMAND")
@@ -635,17 +635,17 @@ func Command(lookupEnv func(string) (string, bool)) (string, error) {
 	switch command {
 	case "", "rproxy":
 		return "rproxy", nil
-	case "discriminator":
+	case "waf":
 		return command, nil
 	default:
 		return "", fmt.Errorf("SWW_COMMAND: %q %w", command, errNotCommand)
 	}
 }
 
-// DiscriminatorListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
-// file, as FromEnvironment does. The health check in discriminator's container needs
+// WAFListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in waf's container needs
 // no other setting, so it reads no other, nor a file that another names.
-func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+func WAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	listenAddr := env.address("SWW_LISTEN_ADDR")
 
@@ -1610,7 +1610,7 @@ func parseSize(value string) (int64, error) {
 }
 
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since discriminator
+// reads: a size as parseSize reads it, or off, but at most 64K, since waf
 // gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
@@ -1955,7 +1955,7 @@ func ParseASN(value string) (string, error) {
 	return "AS" + strconv.FormatUint(number, 10), nil
 }
 
-// The tags a request can get that the settings can name, as discriminator
+// The tags a request can get that the settings can name, as waf
 // writes them. The prefixes are followed by a value.
 const (
 	ASNTagPrefix     = "asn="

internal/config/config_test.go

@@ -636,11 +636,11 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafBodyLimit, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{wafBodyLimit, "65K", `"65K" is more than 64K, the most discriminator ` +
+		{wafBodyLimit, "65K", `"65K" is more than 64K, the most waf ` +
 			`gets of a body`},
 		{
 			wafBodyLimit, "65537",
-			`"65537" is more than 64K, the most discriminator gets of a body`,
+			`"65537" is more than 64K, the most waf gets of a body`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {

internal/config/rproxy.go

@@ -22,12 +22,12 @@ type RProxy struct {
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
 	// (SWRP_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
-	// WAFBackend is discriminator's URL (SWRP_WAF_BACKEND).
+	// WAFBackend is waf's URL (SWRP_WAF_BACKEND).
 	WAFBackend *url.URL
-	// Timeout is how long rproxy waits for discriminator's answer to a question,
+	// Timeout is how long rproxy waits for waf's answer to a question,
 	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
-	// DefaultDisposition is what is done with a request when discriminator cannot be
+	// DefaultDisposition is what is done with a request when waf cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
 	// allow or deny (SWRP_DEFAULT_DISPOSITION).
 	DefaultDisposition string
@@ -50,7 +50,7 @@ type RProxy struct {
 
 var (
 	errNeedsWAFBackend = errors.New(
-		"is required: it is discriminator's URL, such as http://discriminator:8080")
+		"is required: it is waf's URL, such as http://waf:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
 	errNotMilliseconds = errors.New(
 		"is not a whole number of milliseconds above zero, such as 2000")
@@ -124,7 +124,7 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
-// wafBackend reads the setting that is discriminator's URL, which must be set.
+// wafBackend reads the setting that is waf's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
 	if value == "" {
@@ -139,7 +139,7 @@ func (e *environment) wafBackend(name string) *url.URL {
 	return backend
 }
 
-// disposition reads the setting that is what is done with a request when discriminator
+// disposition reads the setting that is what is done with a request when waf
 // cannot be connected to, does not answer at all, or does not answer in time:
 // allow or deny.
 func (e *environment) disposition(name, defaultValue string) string {

internal/config/rproxy_test.go

@@ -24,7 +24,7 @@ const (
 	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
 	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
 	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
-	backendURL        = "http://discriminator:8080"
+	backendURL        = "http://waf:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
 	notASize          = "a lot"
@@ -114,8 +114,8 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
 		name, value string
 	}{
 		{wafBackend, ""},
-		{wafBackend, "discriminator:8080"},
-		{wafBackend, "http://discriminator:8080/path"},
+		{wafBackend, "waf:8080"},
+		{wafBackend, "http://waf:8080/path"},
 		{rproxyTimeout, "0"},
 		{rproxyTimeout, "-1"},
 		{rproxyTimeout, off},

internal/ratelimit/ratelimit.go

@@ -92,7 +92,7 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those discriminator allowed,
+	// Requests are all the client's requests: Forwarded those waf allowed,
 	// Refused those it refused, and neither those for a path under
 	// /_sww/.
 	Requests  int64 `json:"requests"`
@@ -136,7 +136,7 @@ type Offences struct {
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request discriminator allowed, and Refused for one it
+	// Forwarded is true for a request waf allowed, and Refused for one it
 	// refused. Both are false for a request for a path under /_sww/.
 	Forwarded bool
 	Refused   bool

internal/requestlog/requestlog.go

@@ -1,5 +1,5 @@
 // Package requestlog writes the lines sww prints on stdout: one
-// JSON object per request, two from discriminator and a short one from rproxy,
+// JSON object per request, two from waf and a short one from rproxy,
 // marked "type":"request", and the process's own messages as JSON lines marked
 // "type":"process".
 package requestlog
@@ -14,9 +14,9 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
-// The action a request line names: what discriminator did with the request.
+// The action a request line names: what waf did with the request.
 const (
-	// ActionForward is a request discriminator allowed, which rproxy passes to
+	// ActionForward is a request waf allowed, which rproxy passes to
 	// the app.
 	ActionForward = "forward"
 
@@ -55,7 +55,7 @@ const (
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
-	// ActionOwnEndpoint is a request discriminator answered at one of its own
+	// ActionOwnEndpoint is a request waf answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
 	ActionOwnEndpoint = "own_endpoint"
 )
@@ -69,14 +69,14 @@ const OffenceLimit = "limit"
 // that broke the error burst.
 const LimitHitMinuteRefusals = "minute_refusals"
 
-// The discriminator_line a request line names, which says which of
-// discriminator's two lines about a question it is.
+// The waf_line a request line names, which says which of
+// waf's two lines about a question it is.
 const (
-	// DiscriminatorLineDecision is discriminator's line at its decision.
-	DiscriminatorLineDecision = "decision"
-	// DiscriminatorLineReport is discriminator's line when rproxy's report
+	// WAFLineDecision is waf's line at its decision.
+	WAFLineDecision = "decision"
+	// WAFLineReport is waf's line when rproxy's report
 	// comes, with the decision's fields and the report's together.
-	DiscriminatorLineReport = "report"
+	WAFLineReport = "report"
 )
 
 // timeLayout is RFC 3339 with milliseconds.
@@ -89,9 +89,9 @@ const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
-	// DiscriminatorLine is DiscriminatorLineDecision or DiscriminatorLineReport
-	// on discriminator's two lines about a question.
-	DiscriminatorLine string `json:"discriminator_line,omitempty"`
+	// WAFLine is WAFLineDecision or WAFLineReport
+	// on waf's two lines about a question.
+	WAFLine string `json:"waf_line,omitempty"`
 
 	// The standard web log fields. Scheme is how the client reached rproxy, or
 	// the trusted proxy in front of it.
@@ -111,7 +111,7 @@ type Line struct {
 	UserAgent     string `json:"user_agent"`
 
 	// Request detail. RequestID is the id rproxy made for the request, or for a
-	// request to discriminator's own endpoints a new one. ForwardedFor is the
+	// request to waf's own endpoints a new one. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
 	// client is counted as. ASN, ASName and Country are the client's AS
 	// number, AS name and country, as looked up.
@@ -131,7 +131,7 @@ type Line struct {
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
 
-	// Response detail, of discriminator's own answer. Aborted is true when
+	// Response detail, of waf's own answer. Aborted is true when
 	// rproxy, or the admin's tool, went away before the answer.
 	ResponseContentType string `json:"response_content_type,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
@@ -142,7 +142,7 @@ type Line struct {
 	// taken with a request it would have refused: ActionClientDenied,
 	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
 	// ActionClientIsRateLimited, ActionBlockedByBlockRule,
-	// ActionBlockedByCoreRuleSet, or, in discriminator,
+	// ActionBlockedByCoreRuleSet, or, in waf,
 	// ActionRequestHeaderTooLarge for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
@@ -151,7 +151,7 @@ type Line struct {
 	Heuristic        string         `json:"heuristic,omitempty"`
 	HeuristicFigures map[string]any `json:"heuristic_figures,omitempty"`
 	// AfterAnswerHeuristic and AfterAnswerHeuristicFigures are the same for
-	// the heuristic that banned the client after discriminator answered the
+	// the heuristic that banned the client after waf answered the
 	// request.
 	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
 	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
@@ -231,7 +231,7 @@ type RProxyLine struct {
 	// sooner. DurationResponseMS runs from then until the answer ends.
 	DurationRequestMS  float64 `json:"duration_request_ms"`
 	DurationResponseMS float64 `json:"duration_response_ms"`
-	// Disposition is the valid disposition discriminator answered or, while
+	// Disposition is the valid disposition waf answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`

internal/rproxy/client.go

@@ -18,7 +18,7 @@ const (
 )
 
 // peerAddress is the address of the request's TCP peer, normally traefik, without
-// any IPv6 zone, which discriminator refuses.
+// any IPv6 zone, which waf refuses.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
@@ -34,7 +34,7 @@ func peerAddress(r *http.Request) netip.Addr {
 // address outside them is the visitor; if every address in it is inside, the
 // leftmost is, and with no header, the peer. An entry that is not an address
 // ends the reading, since nothing to its left can be believed. The visitor's
-// address never has an IPv6 zone, which discriminator refuses.
+// address never has an IPv6 zone, which waf refuses.
 func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {

internal/rproxy/limits_test.go

@@ -17,9 +17,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // post is the start of a POST whose headers end with what follows it.
@@ -59,7 +59,7 @@ func TestServerHasTheFixedLimits(t *testing.T) {
 	}
 }
 
-func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing.T) {
+func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -72,7 +72,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
@@ -101,7 +101,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing
 func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestSize: "1K",
@@ -110,7 +110,7 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
 	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
 		bytes.NewReader(make([]byte, 1025))))
 	if got.status != http.StatusForbidden {
-		t.Errorf("answered %+v, want discriminator's 403", got)
+		t.Errorf("answered %+v, want waf's 403", got)
 	}
 }
 
@@ -133,7 +133,7 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
 
 			var asked atomic.Bool
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				asked.Store(true)
 				greet(w, r)
@@ -166,7 +166,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("announced, is refused", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startDiscriminator(t, allow)
+		standIn := startWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
 			_, _ = io.WriteString(w, large)
@@ -188,7 +188,7 @@ func TestAResponseOverItsLimit(t *testing.T) {
 	t.Run("not announced, is cut off", func(t *testing.T) {
 		t.Parallel()
 
-		standIn := startDiscriminator(t, allow)
+		standIn := startWAF(t, allow)
 		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = io.WriteString(w, large[:1])
 			_ = http.NewResponseController(w).Flush()
@@ -218,7 +218,7 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.
 
 	const announced = "2048"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(contentLengthHeader, announced)
 	})
@@ -241,7 +241,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 		t.Run(setting, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				setting: "off",
@@ -252,7 +252,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) {
 			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
 				strings.NewReader("a body"))))
 
-			if got := get(t, addr, discriminator.HealthPath); got.status != http.StatusOK {
+			if got := get(t, addr, waf.HealthPath); got.status != http.StatusOK {
 				t.Errorf("answered %+v, want rproxy's own 200", got)
 			}
 		})
@@ -271,7 +271,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				maxRequestTime: "500",
@@ -290,7 +290,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -301,7 +301,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
 func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -315,7 +315,7 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
 	}
 
 	if len(standIn.questions) != 0 {
-		t.Error("discriminator was asked")
+		t.Error("waf was asked")
 	}
 }
 
@@ -335,7 +335,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -366,7 +366,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 		})
 	}
@@ -412,7 +412,7 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
 		announced = 100 * questionBodyMaxBytes
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
@@ -456,13 +456,13 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
 		name, target string
 		status       int
 	}{
-		{"discriminator's deny", "/", http.StatusForbidden},
+		{"waf's deny", "/", http.StatusForbidden},
 		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
 				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
@@ -494,7 +494,7 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
 
 	const least = 10 * time.Second
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
 		maxResponseTime: "300",
@@ -516,7 +516,7 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) {
 func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: "3000",
@@ -585,7 +585,7 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
 		map[string]string{maxRequestTime: "3000"})
 
@@ -612,7 +612,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		<-release
 	})
@@ -658,7 +658,7 @@ func visitAsTheTimeRunsOut(t *testing.T) {
 	// answerAfter is how long the app waits before it answers.
 	var answerAfter atomic.Int64
 
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusNoContent)
 		})
@@ -701,7 +701,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
 	const start = "the start"
 
 	release := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, start)
 		_ = http.NewResponseController(w).Flush()
@@ -750,7 +750,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 		writeSize = 32 << 10
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		part := make([]byte, writeSize)
 
@@ -787,7 +787,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
 func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 	got := get(t, addr, "/")
@@ -803,7 +803,7 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
 func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, greeting)
 	})
@@ -867,7 +867,7 @@ func readAnswer(t *testing.T, conn net.Conn) answered {
 func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, answerBeforeTheBody)
 	// The request time limit is longer than the 10 seconds the status and headers
 	// of an answer have to be sent, and than dial's deadline.
@@ -887,7 +887,7 @@ func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing.
 
 	const limit = 2 * time.Second
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, answerBeforeTheBody)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
@@ -914,7 +914,7 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
 	t.Parallel()
 
 	working := make(chan struct{})
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 		close(working)
 		<-r.Context().Done()
@@ -955,7 +955,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing
 
 	const answer = "the end of a long answer"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
 		_ = http.NewResponseController(w).Flush()
@@ -984,14 +984,14 @@ func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T
 		{"a deny", post, http.StatusForbidden},
 		{
 			"the health check",
-			"GET " + discriminator.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			"GET " + waf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
 			http.StatusOK,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			// The request time limit is longer than the 10 seconds an answer rproxy
 			// gives itself has to be sent, and than dial's deadline.

internal/rproxy/question_test.go

@@ -12,11 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // questionBodyMaxBytes is the most of a body a question carries.
-const questionBodyMaxBytes = discriminator.QuestionBodyMaxBytes
+const questionBodyMaxBytes = waf.QuestionBodyMaxBytes
 
 // chunked is the encoding of a body whose length the visitor did not announce.
 const chunked = "chunked"
@@ -29,7 +29,7 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
 func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -42,9 +42,9 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	req.Header.Set(forwardedForHeader, "198.51.100.1")
 	req.Header.Set(forwardedProtoHeader, "gopher")
 	req.Header.Set(requestIDHeader, "the-visitor's")
-	req.Header.Set(discriminator.ClientHeader, "198.51.100.2")
-	req.Header.Set(discriminator.PeerHeader, "198.51.100.3")
-	req.Header.Set(discriminator.ContentLengthHeader, "12345")
+	req.Header.Set(waf.ClientHeader, "198.51.100.2")
+	req.Header.Set(waf.PeerHeader, "198.51.100.3")
+	req.Header.Set(waf.ContentLengthHeader, "12345")
 	// Go's client then sends no User-Agent, so that one in the question would be
 	// Go's own.
 	req.Header["User-Agent"] = nil
@@ -68,8 +68,8 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
 	want.Set(forwardedForHeader, "198.51.100.1")
 	want.Set(forwardedProtoHeader, "http")
 	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
-	want.Set(discriminator.ClientHeader, localhost)
-	want.Set(discriminator.PeerHeader, localhost)
+	want.Set(waf.ClientHeader, localhost)
+	want.Set(waf.PeerHeader, localhost)
 
 	if !maps.EqualFunc(asked.header, want, slices.Equal) {
 		t.Errorf("the question's headers are %v, want %v", asked.header, want)
@@ -93,7 +93,7 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			forwarded := make(chan http.Header, 1)
 			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 				forwarded <- r.Header.Clone()
@@ -110,8 +110,8 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
 			wantGreeting(t, visit(t, req))
 
 			asked := standIn.question(t)
-			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
-				asked.header.Get(discriminator.PeerHeader) != localhost ||
+			if asked.header.Get(waf.ClientHeader) != tc.client ||
+				asked.header.Get(waf.PeerHeader) != localhost ||
 				asked.header.Get(forwardedForHeader) != visitor ||
 				asked.header.Get(forwardedProtoHeader) != tc.proto {
 				t.Errorf("the question's headers are %v", asked.header)
@@ -157,7 +157,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32,10.0.0.0/8",
@@ -167,7 +167,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
 			req.Header[forwardedForHeader] = tc.header
 			wantGreeting(t, visit(t, req))
 
-			if got := standIn.question(t).header.Get(discriminator.ClientHeader); got !=
+			if got := standIn.question(t).header.Get(waf.ClientHeader); got !=
 				tc.client {
 				t.Errorf("the question names %s, want %s", got, tc.client)
 			}
@@ -183,7 +183,7 @@ func randomBytes(n int) []byte {
 	return body
 }
 
-func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
+func TestFirst64KiBReachWAFAndTheWholeBodyTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, size := range []int{
@@ -198,7 +198,7 @@ func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) {
 				t.Parallel()
 
 				body := randomBytes(size)
-				standIn := startDiscriminator(t, allow)
+				standIn := startWAF(t, allow)
 				received := make(chan []byte, 1)
 				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 					whole, _ := io.ReadAll(r.Body)
@@ -244,7 +244,7 @@ func wantQuestionBody(
 			len(want))
 	}
 
-	values := asked.header.Values(discriminator.ContentLengthHeader)
+	values := asked.header.Values(waf.ContentLengthHeader)
 
 	if announced {
 		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
@@ -265,7 +265,7 @@ func wantQuestionBody(
 func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -276,7 +276,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
 		strings.Repeat("x", questionBodyMaxBytes))
 
 	if status := readStatus(t, conn); status != http.StatusForbidden {
-		t.Errorf("status %d, want discriminator's 403", status)
+		t.Errorf("status %d, want waf's 403", status)
 	}
 
 	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
@@ -307,14 +307,14 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
 			t.Run(method+" "+tc.name, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startDiscriminator(t, deny)
+				standIn := startWAF(t, deny)
 				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
 
 				conn := dial(t, addr)
 				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
 
 				if status := readStatus(t, conn); status != http.StatusForbidden {
-					t.Errorf("status %d, want discriminator's 403", status)
+					t.Errorf("status %d, want waf's 403", status)
 				}
 
 				asked := standIn.question(t)
@@ -335,7 +335,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
 				t.Error("the app was asked")
 			})
@@ -356,7 +356,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -364,7 +364,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
 	}
 }
 
-func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
+func TestEachMethodPassedOnReachesWAFAndTheApp(t *testing.T) {
 	t.Parallel()
 
 	for _, method := range []string{
@@ -377,7 +377,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 			t.Parallel()
 
 			reached := make(chan string, 1)
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
 				reached <- r.Method
 			})
@@ -389,7 +389,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 			}
 
 			if asked := standIn.question(t); asked.method != method {
-				t.Errorf("discriminator was asked about %s", asked.method)
+				t.Errorf("waf was asked about %s", asked.method)
 			}
 
 			if atApp := <-reached; atApp != method {
@@ -399,7 +399,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) {
 	}
 }
 
-func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
+func TestARequestThatCannotGoToWAFAsSentIsRefused(t *testing.T) {
 	t.Parallel()
 
 	const host = "Host: site.example\r\n\r\n"
@@ -421,7 +421,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, allow)
+			standIn := startWAF(t, allow)
 			app := startApp(t, greet)
 			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -439,7 +439,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 			}
 
 			if len(standIn.questions) != 0 {
-				t.Error("discriminator was asked")
+				t.Error("waf was asked")
 			}
 
 			standIn.wantNoReport(t)
@@ -447,12 +447,12 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) {
 	}
 }
 
-func TestAHostWithAPercentSignButNoBracketGoesToDiscriminator(t *testing.T) {
+func TestAHostWithAPercentSignButNoBracketGoesToWAF(t *testing.T) {
 	t.Parallel()
 
 	const host = "a%b"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -473,7 +473,7 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
 
 	const want = "http"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -502,7 +502,7 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
 				trustedProxies: localhost + "/32",
@@ -515,8 +515,8 @@ func TestAQuestionNamesNoZone(t *testing.T) {
 			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 
 			asked := standIn.question(t)
-			if asked.header.Get(discriminator.ClientHeader) != tc.client ||
-				asked.header.Get(discriminator.PeerHeader) != tc.peer {
+			if asked.header.Get(waf.ClientHeader) != tc.client ||
+				asked.header.Get(waf.PeerHeader) != tc.peer {
 				t.Errorf("the question's headers are %v", asked.header)
 			}
 

internal/rproxy/request.go

@@ -16,16 +16,16 @@ import (
 	"sync/atomic"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
 // soon as it arrives.
 const flushAfterEachWrite time.Duration = -1
 
-// reportStatusMax is the highest status discriminator takes in a report. An app can
+// reportStatusMax is the highest status waf takes in a report. An app can
 // send a higher one, up to 999, and the visitor gets that as it is.
 const reportStatusMax = 599
 
@@ -60,14 +60,14 @@ type request struct {
 	peerTrusted bool
 	start       time.Time
 
-	// disposition is what is done with the request: discriminator's valid disposition,
+	// disposition is what is done with the request: waf's valid disposition,
 	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
 	disposition string
-	// answered is true when discriminator gave disposition, which makes a report due,
+	// answered is true when waf gave disposition, which makes a report due,
 	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
 	answered  bool
 	byDefault bool
-	// asn and country are discriminator's X-Client-ASN and X-Client-Country, for the
+	// asn and country are waf's X-Client-ASN and X-Client-Country, for the
 	// app.
 	asn, country string
 
@@ -131,14 +131,14 @@ func (rq *request) answerHealth() {
 // visitor too slow to send it is answered 408. For a malformed chunk, or a
 // visitor that went away or stopped its sending side, the connection is closed
 // without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
-// read, so that discriminator is asked first; passToApp then refuses it.
+// read, so that waf is asked first; passToApp then refuses it.
 func (rq *request) readFirstPartOfBody() bool {
 	if rq.body == nil {
 		return true
 	}
 
 	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
-	held, err := io.ReadAll(io.LimitReader(rq.body, discriminator.QuestionBodyMaxBytes))
+	held, err := io.ReadAll(io.LimitReader(rq.body, waf.QuestionBodyMaxBytes))
 	// From here on, the request timer ends a read of the rest of the body, so that
 	// the answer can name the side rproxy was waiting on.
 	_ = rq.rc.SetReadDeadline(time.Time{})
@@ -200,7 +200,7 @@ func (rq *request) forward(ctx context.Context) {
 // rewrite makes the request the app receives: the visitor's request, unchanged,
 // sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
 // without any X-Client-ASN or X-Client-Country the visitor sent, and with
-// discriminator's.
+// waf's.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
@@ -333,7 +333,7 @@ func (rq *request) answer(status int) {
 // handler has returned, after finish has written the log line and sent the report.
 // Without Content-Length, the flush would send the body in chunks, the last of
 // which would still wait for the handler. A HEAD's answer has no body, so any
-// Content-Length it has stays as discriminator gave it.
+// Content-Length it has stays as waf gave it.
 func (rq *request) send(status int, body []byte) {
 	if rq.in.Method != http.MethodHead {
 		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
@@ -379,7 +379,7 @@ func (rq *request) refuse(status int) {
 	}
 }
 
-// finish ends the request's time limits, writes its log line and, if discriminator
+// finish ends the request's time limits, writes its log line and, if waf
 // answered the question, sends the report. ctx is the request's own context.
 func (rq *request) finish(ctx context.Context) {
 	rq.stopTimers()
@@ -416,7 +416,7 @@ func (rq *request) finish(ctx context.Context) {
 		return
 	}
 
-	report := &discriminator.Report{
+	report := &waf.Report{
 		RequestID:       rq.id,
 		Status:          min(rq.out.status, reportStatusMax),
 		RequestBytes:    requestBytes,

internal/rproxy/rproxy.go

@@ -1,10 +1,10 @@
-// Package rproxy is the reverse proxy in front of one app that asks discriminator
-// about each request. It passes a request discriminator allows to the app and the
+// Package rproxy is the reverse proxy in front of one app that asks waf
+// about each request. It passes a request waf allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
-// discriminator goes to the visitor as discriminator gave it. SWRP_DEFAULT_DISPOSITION
-// decides only when discriminator cannot be connected to, does not answer at all, or
+// waf goes to the visitor as waf gave it. SWRP_DEFAULT_DISPOSITION
+// decides only when waf cannot be connected to, does not answer at all, or
 // does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
-// method it does not pass on, or one it cannot put to discriminator as the visitor
+// method it does not pass on, or one it cannot put to waf as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
 package rproxy
@@ -22,10 +22,10 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// How rproxy keeps connections to the app and to discriminator open between
+// How rproxy keeps connections to the app and to waf open between
 // requests.
 const (
 	idleConns       = 100
@@ -80,14 +80,14 @@ func New(params Params) *Server {
 	backend := params.Config.WAFBackend
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	h := &handler{
-		config:                 params.Config,
-		requestLog:             params.RequestLog,
-		processLog:             params.ProcessLog,
-		errorLog:               errorLog,
-		transport:              newTransport(),
-		discriminatorTransport: newDiscriminatorTransport(),
+		config:       params.Config,
+		requestLog:   params.RequestLog,
+		processLog:   params.ProcessLog,
+		errorLog:     errorLog,
+		transport:    newTransport(),
+		wafTransport: newWAFTransport(),
 		reportURL: (&url.URL{
-			Scheme: backend.Scheme, Host: backend.Host, Path: discriminator.ReportPath,
+			Scheme: backend.Scheme, Host: backend.Host, Path: waf.ReportPath,
 		}).String(),
 	}
 
@@ -122,10 +122,10 @@ type handler struct {
 	requestLog io.Writer
 	processLog *slog.Logger
 	errorLog   *log.Logger
-	// transport carries requests to the app, and discriminatorTransport questions and
-	// reports to discriminator.
-	transport              http.RoundTripper
-	discriminatorTransport http.RoundTripper
+	// transport carries requests to the app, and wafTransport questions and
+	// reports to waf.
+	transport    http.RoundTripper
+	wafTransport http.RoundTripper
 	// reportURL is where the reports go.
 	reportURL string
 	// reports waits for the reports being sent. reportsMu guards starting one
@@ -147,11 +147,11 @@ func newTransport() *http.Transport {
 	}
 }
 
-// newDiscriminatorTransport returns what carries questions and reports to
-// discriminator. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send
+// newWAFTransport returns what carries questions and reports to
+// waf. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send
 // a visitor's Upgrade header, or a Connection header other than close or
-// keep-alive, and that would read as discriminator giving no answer.
-func newDiscriminatorTransport() *http.Transport {
+// keep-alive, and that would read as waf giving no answer.
+func newWAFTransport() *http.Transport {
 	transport := newTransport()
 	transport.Protocols = new(http.Protocols)
 	transport.Protocols.SetHTTP1(true)
@@ -160,15 +160,15 @@ func newDiscriminatorTransport() *http.Transport {
 }
 
 // ServeHTTP handles one request: it answers the health check itself, refuses a
-// request with a method it does not pass on or one it cannot put to discriminator as
+// request with a method it does not pass on or one it cannot put to waf as
 // the visitor sent it, and for any other request reads the first part of the
-// body, asks discriminator, and does what the answer says. Once the answer has ended,
+// body, asks waf, and does what the answer says. Once the answer has ended,
 // it writes the request's log line and sends its report.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish(r.Context())
 
-	if r.Method == http.MethodGet && r.URL.Path == discriminator.HealthPath {
+	if r.Method == http.MethodGet && r.URL.Path == waf.HealthPath {
 		rq.answerHealth()
 
 		return
@@ -201,9 +201,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq.noteAnswer(answer)
 
 	switch rq.disposition {
-	case discriminator.DispositionAllow:
+	case waf.DispositionAllow:
 		rq.passToApp(r.Context())
-	case discriminator.DispositionClose:
+	case waf.DispositionClose:
 		// This panic has Go's server close the connection without an answer,
 		// and log nothing; the deferred finish still runs.
 		panic(http.ErrAbortHandler)
@@ -213,7 +213,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
-// it from the app. discriminator answers a path under ownEndpointPrefix itself, so
+// it from the app. waf answers a path under ownEndpointPrefix itself, so
 // such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {

internal/rproxy/rproxy_test.go

@@ -19,9 +19,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -54,27 +54,27 @@ const (
 
 // The headers the tests set and look at.
 const (
-	dispositionHeader    = discriminator.DispositionHeader
+	dispositionHeader    = waf.DispositionHeader
 	forwardedForHeader   = "X-Forwarded-For"
 	forwardedProtoHeader = "X-Forwarded-Proto"
 	requestIDHeader      = "X-Request-ID"
 	asnHeader            = "X-Client-Asn"
 	countryHeader        = "X-Client-Country"
 	contentLengthHeader  = "Content-Length"
-	// fromDiscriminatorHeader is a header the stand-in for discriminator adds to a deny.
-	fromDiscriminatorHeader = "X-From-Discriminator"
+	// fromWAFHeader is a header the stand-in for waf adds to a deny.
+	fromWAFHeader = "X-From-Waf"
 	// addedHeaderValue is the value of a header a test adds to an answer, to see it
 	// reach the visitor.
 	addedHeaderValue = "yes"
 )
 
-// What the stand-in for discriminator answers.
+// What the stand-in for waf answers.
 const (
-	dispositionAllow = discriminator.DispositionAllow
-	dispositionDeny  = discriminator.DispositionDeny
-	dispositionClose = discriminator.DispositionClose
+	dispositionAllow = waf.DispositionAllow
+	dispositionDeny  = waf.DispositionDeny
+	dispositionClose = waf.DispositionClose
 	// deniedBody is the body of a deny.
-	deniedBody = "refused by discriminator"
+	deniedBody = "refused by waf"
 )
 
 // output collects what rproxy writes on stdout.
@@ -158,7 +158,7 @@ func (l heldLog) Write(p []byte) (int, error) {
 	return len(p), nil
 }
 
-// question is what the stand-in for discriminator received as a question.
+// question is what the stand-in for waf received as a question.
 type question struct {
 	method, target, host string
 	header               http.Header
@@ -167,26 +167,26 @@ type question struct {
 	transferEncoding     []string
 }
 
-// Discriminator is a stand-in for discriminator that answers each question as
+// WAF is a stand-in for waf that answers each question as
 // answer does, and keeps the questions and the reports it gets.
-type Discriminator struct {
+type WAF struct {
 	*httptest.Server
 
 	questions chan question
-	reports   chan discriminator.Report
+	reports   chan waf.Report
 }
 
-// startDiscriminator starts a stand-in for discriminator.
-func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator {
+// startWAF starts a stand-in for waf.
+func startWAF(t *testing.T, answer http.HandlerFunc) *WAF {
 	t.Helper()
 
-	s := &Discriminator{
+	s := &WAF{
 		questions: make(chan question, 10),
-		reports:   make(chan discriminator.Report, 10),
+		reports:   make(chan waf.Report, 10),
 	}
 	s.Server = httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) == "" {
+			if r.Header.Get(waf.ClientHeader) == "" {
 				s.takeReport(t, w, r)
 
 				return
@@ -209,17 +209,17 @@ func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator {
 	return s
 }
 
-// takeReport keeps a report and answers it as discriminator does.
-func (s *Discriminator) takeReport(
+// takeReport keeps a report and answers it as waf does.
+func (s *WAF) takeReport(
 	t *testing.T, w http.ResponseWriter, r *http.Request,
 ) {
 	t.Helper()
 
-	var report discriminator.Report
+	var report waf.Report
 
 	err := json.NewDecoder(r.Body).Decode(&report)
 	if err != nil || r.Method != http.MethodPost ||
-		r.URL.Path != discriminator.ReportPath {
+		r.URL.Path != waf.ReportPath {
 		t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err)
 	}
 
@@ -229,7 +229,7 @@ func (s *Discriminator) takeReport(
 }
 
 // wantNoReport checks that no report comes for a moment.
-func (s *Discriminator) wantNoReport(t *testing.T) {
+func (s *WAF) wantNoReport(t *testing.T) {
 	t.Helper()
 
 	select {
@@ -240,7 +240,7 @@ func (s *Discriminator) wantNoReport(t *testing.T) {
 }
 
 // report waits for a report.
-func (s *Discriminator) report(t *testing.T) discriminator.Report {
+func (s *WAF) report(t *testing.T) waf.Report {
 	t.Helper()
 
 	select {
@@ -249,12 +249,12 @@ func (s *Discriminator) report(t *testing.T) discriminator.Report {
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 
-		return discriminator.Report{}
+		return waf.Report{}
 	}
 }
 
 // question waits for a question.
-func (s *Discriminator) question(t *testing.T) question {
+func (s *WAF) question(t *testing.T) question {
 	t.Helper()
 
 	select {
@@ -267,17 +267,17 @@ func (s *Discriminator) question(t *testing.T) question {
 	}
 }
 
-// startDiscriminatorAnsweringReports starts a stand-in for discriminator that
+// startWAFAnsweringReports starts a stand-in for waf that
 // answers each question as answer does and each report as report does, and
 // returns its URL.
-func startDiscriminatorAnsweringReports(
+func startWAFAnsweringReports(
 	t *testing.T, answer, report http.HandlerFunc,
 ) string {
 	t.Helper()
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				answer(w, r)
 
 				return
@@ -299,7 +299,7 @@ func allow(w http.ResponseWriter, _ *http.Request) {
 // deny answers a question with deny, status 403 and a body of its own.
 func deny(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set(dispositionHeader, dispositionDeny)
-	w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
+	w.Header().Set(fromWAFHeader, addedHeaderValue)
 	w.WriteHeader(http.StatusForbidden)
 	_, _ = io.WriteString(w, deniedBody)
 }
@@ -320,7 +320,7 @@ func greet(w http.ResponseWriter, r *http.Request) {
 	_, _ = io.WriteString(w, greeting)
 }
 
-// startRProxy starts rproxy with discriminator at backend and the app at appURL, and
+// startRProxy starts rproxy with waf at backend and the app at appURL, and
 // the settings in env on top of the defaults. It returns where rproxy listens
 // and what it writes.
 func startRProxy(
@@ -502,7 +502,7 @@ func readStatus(t *testing.T, conn net.Conn) int {
 func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, r *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set(asnHeader, "AS64496")
 		w.Header().Set(countryHeader, "DE")
 		allow(w, r)
@@ -561,7 +561,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	}
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -606,7 +606,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -645,7 +645,7 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		_, _ = io.WriteString(w, "<html>")
@@ -667,19 +667,19 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	}
 }
 
-func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T) {
+func TestRemovesTheVisitorsLookupHeadersWhenWAFGivesNone(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
 		name    string
 		backend func(t *testing.T) string
 	}{
-		{"discriminator allows", func(t *testing.T) string {
+		{"waf allows", func(t *testing.T) string {
 			t.Helper()
 
-			return startDiscriminator(t, allow).URL
+			return startWAF(t, allow).URL
 		}},
-		{"discriminator is down", func(*testing.T) string { return nowhere }},
+		{"waf is down", func(*testing.T) string { return nowhere }},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -705,10 +705,10 @@ func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T)
 	}
 }
 
-func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
+func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
@@ -716,8 +716,8 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
-		got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
-		t.Errorf("answered %+v, want discriminator's answer", got)
+		got.header.Get(fromWAFHeader) != addedHeaderValue {
+		t.Errorf("answered %+v, want waf's answer", got)
 	}
 
 	if len(got.header.Values(dispositionHeader)) != 0 {
@@ -733,21 +733,21 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 
 	line := out.requestLine(t)
 	if line["disposition"] != dispositionDeny || line["default_disposition"] != nil {
-		t.Errorf("line %v, want discriminator's deny", line)
+		t.Errorf("line %v, want waf's deny", line)
 	}
 }
 
-func TestADeniedHeadKeepsDiscriminatorsContentLength(t *testing.T) {
+func TestADeniedHeadKeepsWAFsContentLength(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
 		got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) {
-		t.Errorf("answered %+v, want discriminator's 403 and its length", got)
+		t.Errorf("answered %+v, want waf's 403 and its length", got)
 	}
 }
 
@@ -762,13 +762,13 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
-		{"the health check", "GET " + discriminator.HealthPath + host, "ok\n", http.StatusOK},
+		{"the health check", "GET " + waf.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			log := heldLog{release: make(chan struct{})}
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
 
@@ -798,7 +798,7 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -821,7 +821,7 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
@@ -853,7 +853,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t,
+	backend := startWAFAnsweringReports(t,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(dispositionHeader, dispositionClose)
 		},
@@ -878,17 +878,17 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	}
 }
 
-// answeringWith returns what starts a stand-in for discriminator that answers each
+// answeringWith returns what starts a stand-in for waf that answers each
 // question as answer does, and returns its URL.
 func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 	return func(t *testing.T) string {
 		t.Helper()
 
-		return startDiscriminator(t, answer).URL
+		return startWAF(t, answer).URL
 	}
 }
 
-// noAnswers are the ways discriminator can leave the decision to the default.
+// noAnswers are the ways waf can leave the decision to the default.
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
 		"no connection": func(*testing.T) string { return nowhere },
@@ -920,7 +920,7 @@ func noAnswers() map[string]func(t *testing.T) string {
 	}
 }
 
-func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.T) {
+func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -929,7 +929,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 	}{
 		{"a refusal", dispositionDeny, deniedBody, http.StatusForbidden},
 		{"a refusal, 429", dispositionDeny, deniedBody, http.StatusTooManyRequests},
-		{"discriminator's 400", "", "refused\n", http.StatusBadRequest},
+		{"waf's 400", "", "refused\n", http.StatusBadRequest},
 		{"a 500", "", "broken\n", http.StatusInternalServerError},
 		{"a 503 denied", dispositionDeny, "busy\n", http.StatusServiceUnavailable},
 		{"no header", "", "who knows\n", http.StatusOK},
@@ -939,12 +939,12 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+				standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
 
-					w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
+					w.Header().Set(fromWAFHeader, addedHeaderValue)
 					w.WriteHeader(tc.status)
 					_, _ = io.WriteString(w, tc.body)
 				})
@@ -957,8 +957,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 
 				got := get(t, addr, "/")
 				if got.status != tc.status || got.body != tc.body ||
-					got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
-					t.Errorf("answered %+v, want discriminator's answer", got)
+					got.header.Get(fromWAFHeader) != addedHeaderValue {
+					t.Errorf("answered %+v, want waf's answer", got)
 				}
 
 				if len(got.header.Values(dispositionHeader)) != 0 {
@@ -970,8 +970,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 					t.Errorf("line %v, want status %d and no default", line, tc.status)
 				}
 
-				if out.has("discriminator gave no answer") {
-					t.Error("rproxy warned that discriminator gave no answer")
+				if out.has("waf gave no answer") {
+					t.Error("rproxy warned that waf gave no answer")
 				}
 			})
 		}
@@ -981,14 +981,14 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
-		t.Errorf("answered %+v, want discriminator's 400", got)
+		t.Errorf("answered %+v, want waf's 400", got)
 	}
 
 	if line := out.requestLine(t); line["disposition"] != nil {
@@ -1001,7 +1001,7 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
@@ -1019,7 +1019,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	const size = 1 << 20
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
@@ -1027,15 +1027,15 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
-		t.Errorf("answered %d with %d bytes, want discriminator's 500 with %d",
+		t.Errorf("answered %d with %d bytes, want waf's 500 with %d",
 			got.status, len(got.body), size)
 	}
 }
 
-// startDiscriminatorWriting starts a stand-in for discriminator that reads
+// startWAFWriting starts a stand-in for waf that reads
 // each question and answers it with text, as it is, and returns its URL. It
 // can send what Go's server would not.
-func startDiscriminatorWriting(t *testing.T, text string) string {
+func startWAFWriting(t *testing.T, text string) string {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -1105,7 +1105,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 		"a status below 100": func(t *testing.T) string {
 			t.Helper()
 
-			return startDiscriminatorWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
+			return startWAFWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
 		},
 		"a 101 that holds its connection open": answeringWith(switchAndHold),
 	} {
@@ -1130,7 +1130,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 					t.Errorf("line %v, want status 502 and no disposition", line)
 				}
 
-				out.waitFor(t, "discriminator's answer is dropped")
+				out.waitFor(t, "waf's answer is dropped")
 			})
 		}
 	}
@@ -1139,7 +1139,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, overOneMiB(dispositionDeny))
+	standIn := startWAF(t, overOneMiB(dispositionDeny))
 	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
@@ -1196,14 +1196,14 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 	}
 }
 
-func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T) {
+func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
 	t.Parallel()
 
 	for _, disposition := range []string{dispositionAllow, dispositionDeny} {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
+			standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 				<-r.Context().Done()
 			})
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1226,8 +1226,8 @@ func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T
 				t.Errorf("line %v, want status 0 and no disposition", line)
 			}
 
-			if out.has("discriminator gave no answer") {
-				t.Error("rproxy warned that discriminator gave no answer")
+			if out.has("waf gave no answer") {
+				t.Error("rproxy warned that waf gave no answer")
 			}
 
 			standIn.wantNoReport(t)
@@ -1242,13 +1242,13 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
 	wantGreeting(t, get(t, addr, "/"))
-	out.waitFor(t, "discriminator gave no answer")
+	out.waitFor(t, "waf gave no answer")
 }
 
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
+	standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	app := startApp(t, greet)
@@ -1275,29 +1275,29 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
 	}
 }
 
-func TestHealthCheckIsAnsweredWhileDiscriminatorIsDown(t *testing.T) {
+func TestHealthCheckIsAnsweredWhileWAFIsDown(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, discriminator.HealthPath)
+	got := get(t, addr, waf.HealthPath)
 	if got.status != http.StatusOK || got.body != "ok\n" {
 		t.Errorf("answered %+v, want ok", got)
 	}
 
 	line := out.requestLine(t)
-	if line["path"] != discriminator.HealthPath || line["disposition"] != nil {
+	if line["path"] != waf.HealthPath || line["disposition"] != nil {
 		t.Errorf("line %v, want one with no disposition", line)
 	}
 
-	// With discriminator up too, it is not asked.
+	// With waf up too, it is not asked.
 	addr, _ = startRProxy(t, standIn.URL, app.URL, nil)
-	get(t, addr, discriminator.HealthPath)
+	get(t, addr, waf.HealthPath)
 
 	if len(standIn.questions) != 0 {
-		t.Error("discriminator was asked about the health check")
+		t.Error("waf was asked about the health check")
 	}
 }
 
@@ -1305,7 +1305,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startDiscriminatorAnsweringReports(t, deny,
+	backend := startWAFAnsweringReports(t, deny,
 		func(w http.ResponseWriter, r *http.Request) {
 			select {
 			case <-release:
@@ -1340,16 +1340,16 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 		_ = res.Body.Close()
 
 		if res.StatusCode != http.StatusForbidden {
-			t.Errorf("status %d, want discriminator's 403", res.StatusCode)
+			t.Errorf("status %d, want waf's 403", res.StatusCode)
 		}
 	}
 }
 
-func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
+func TestAReportWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			<-release
 
@@ -1369,10 +1369,10 @@ func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.
 	out.waitFor(t, "a report is dropped")
 }
 
-func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) {
+func TestAReportWAFRefusesIsDroppedWithAWarning(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusBadRequest)
 		})
@@ -1387,7 +1387,7 @@ func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) {
 func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t, allow, switchAndHold)
+	backend := startWAFAnsweringReports(t, allow, switchAndHold)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
 		timeoutSetting: "60000",
@@ -1400,7 +1400,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out, server := startServer(t, standIn.URL, app.URL, nil)
 
@@ -1416,7 +1416,7 @@ func TestReportGivesWhatHappened(t *testing.T) {
 
 	const body = "the visitor's body"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -1446,7 +1446,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				allow(w, r)
 
 				return
@@ -1501,7 +1501,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, echoAfterUpgrade)
 	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime:  "2000",
@@ -1556,7 +1556,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 
 	const goodbye = "sent after the visitor stopped sending\n"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1614,7 +1614,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1685,7 +1685,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 
 	const fromTraefik = "an-id-from-traefik"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -1715,7 +1715,7 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		body  = "the visitor's body"
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 

internal/rproxy/waf.go

@@ -11,15 +11,15 @@ import (
 	"net/http"
 	"strings"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// answerBodyMaxBytes is the most of the body of discriminator's answer that is read.
+// answerBodyMaxBytes is the most of the body of waf's answer that is read.
 // It is far above any answer's.
 const answerBodyMaxBytes = 1 << 20
 
 // reportAnswerMaxBytes is the most of the answer to a report that is read,
-// which has no body when discriminator takes the report.
+// which has no body when waf takes the report.
 const reportAnswerMaxBytes = 4 << 10
 
 var (
@@ -27,22 +27,22 @@ var (
 	errReportRefused = errors.New("the report was answered")
 )
 
-// discriminatorAnswer is what discriminator answered to a question.
-type discriminatorAnswer struct {
+// wafAnswer is what waf answered to a question.
+type wafAnswer struct {
 	status int
 	header http.Header
 	body   []byte
 }
 
-// noteAnswer notes what discriminator answered. An answer without a valid disposition
-// notes nothing, and no report is due for it: discriminator holds no decision to report
+// noteAnswer notes what waf answered. An answer without a valid disposition
+// notes nothing, and no report is due for it: waf holds no decision to report
 // on.
-func (rq *request) noteAnswer(answer *discriminatorAnswer) {
-	disposition := answer.header.Get(discriminator.DispositionHeader)
+func (rq *request) noteAnswer(answer *wafAnswer) {
+	disposition := answer.header.Get(waf.DispositionHeader)
 
 	switch disposition {
-	case discriminator.DispositionAllow, discriminator.DispositionDeny,
-		discriminator.DispositionClose:
+	case waf.DispositionAllow, waf.DispositionDeny,
+		waf.DispositionClose:
 		rq.disposition = disposition
 		rq.answered = true
 		rq.asn = answer.header.Get(asnHeader)
@@ -55,27 +55,27 @@ func (rq *request) noteAnswer(answer *discriminatorAnswer) {
 func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	switch {
 	case ctx.Err() != nil:
-		// The visitor went away while discriminator was being asked. discriminator has not
+		// The visitor went away while waf was being asked. waf has not
 		// failed, and nothing is noted. This panic has Go's server close the
 		// connection without an answer, and log nothing; the deferred finish still
 		// runs.
 		panic(http.ErrAbortHandler)
 	case errors.Is(err, errCannotPassOn):
-		rq.h.processLog.Warn("discriminator's answer is dropped", "error", err.Error())
+		rq.h.processLog.Warn("waf's answer is dropped", "error", err.Error())
 		rq.answer(http.StatusBadGateway)
 	default:
-		// discriminator cannot be connected to, does not answer at all, or does not answer
-		// within SWRP_TIMEOUT_MS. A request that keeps discriminator busy past
-		// SWRP_TIMEOUT_MS, like any request while discriminator is overloaded, gets
+		// waf cannot be connected to, does not answer at all, or does not answer
+		// within SWRP_TIMEOUT_MS. A request that keeps waf busy past
+		// SWRP_TIMEOUT_MS, like any request while waf is overloaded, gets
 		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
-		// whenever discriminator is slow. Making such requests hard to send is
+		// whenever waf is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
-		rq.h.processLog.Warn("discriminator gave no answer", "error", err.Error())
+		rq.h.processLog.Warn("waf gave no answer", "error", err.Error())
 
 		rq.disposition = rq.h.config.DefaultDisposition
 		rq.byDefault = true
 
-		if rq.disposition == discriminator.DispositionAllow {
+		if rq.disposition == waf.DispositionAllow {
 			rq.passToApp(ctx)
 		} else {
 			rq.answer(http.StatusServiceUnavailable)
@@ -83,10 +83,10 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	}
 }
 
-// ask sends discriminator the question, and returns its answer, which must have come
+// ask sends waf the question, and returns its answer, which must have come
 // whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
-func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
+func (rq *request) ask(ctx context.Context) (*wafAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
 	defer cancel()
 
@@ -95,7 +95,7 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 		return nil, err
 	}
 
-	res, err := rq.h.discriminatorTransport.RoundTrip(question)
+	res, err := rq.h.wafTransport.RoundTrip(question)
 	if err != nil {
 		return nil, fmt.Errorf("send the question: %w", err)
 	}
@@ -120,17 +120,17 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
 	}
 
-	return &discriminatorAnswer{res.StatusCode, res.Header, body}, nil
+	return &wafAnswer{res.StatusCode, res.Header, body}, nil
 }
 
-// canBeAsked reports whether Go's client can send discriminator r as the visitor sent
+// canBeAsked reports whether Go's client can send waf r as the visitor sent
 // it. It cannot send these as they came:
 //   - a target that does not start with /, or that starts with //;
-//   - an empty Host, for which it sends discriminator's own address;
+//   - an empty Host, for which it sends waf's own address;
 //   - a Host holding an IPv6 zone, which it removes;
 //   - more than one User-Agent, of which it sends the first;
 //   - an empty User-Agent, which it leaves out, the one case that still goes to
-//     discriminator.
+//     waf.
 func canBeAsked(r *http.Request) bool {
 	target, host := r.RequestURI, r.Host
 	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
@@ -170,13 +170,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	question.TransferEncoding = in.TransferEncoding
 
 	question.Header = in.Header.Clone()
-	question.Header.Set(discriminator.ClientHeader, rq.client.String())
-	question.Header.Set(discriminator.PeerHeader, rq.peer.String())
-	question.Header.Del(discriminator.ContentLengthHeader)
+	question.Header.Set(waf.ClientHeader, rq.client.String())
+	question.Header.Set(waf.PeerHeader, rq.peer.String())
+	question.Header.Del(waf.ContentLengthHeader)
 
 	announced := in.Header.Get("Content-Length")
 	if announced != "" {
-		question.Header.Set(discriminator.ContentLengthHeader, announced)
+		question.Header.Set(waf.ContentLengthHeader, announced)
 	}
 
 	question.Header.Set(requestIDHeader, rq.id)
@@ -191,13 +191,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
 	return question, nil
 }
 
-// answerWith gives the visitor discriminator's answer, less its disposition.
-func (rq *request) answerWith(answer *discriminatorAnswer) {
+// answerWith gives the visitor waf's answer, less its disposition.
+func (rq *request) answerWith(answer *wafAnswer) {
 	rq.prepareOwnAnswer(rq.requestDeadline())
 
 	header := rq.out.Header()
 	maps.Copy(header, answer.header)
-	header.Del(discriminator.DispositionHeader)
+	header.Del(waf.DispositionHeader)
 
 	// Go's server adds a Content-Type it guesses from the body to a response whose
 	// headers have no Content-Type key. The key with no value sends none.
@@ -208,10 +208,10 @@ func (rq *request) answerWith(answer *discriminatorAnswer) {
 	rq.send(answer.status, answer.body)
 }
 
-// sendReport sends discriminator report on a goroutine of its own, so that the
+// sendReport sends waf report on a goroutine of its own, so that the
 // visitor does not wait for it. The report goes on after ctx, the request's own
 // context, has ended.
-func (h *handler) sendReport(ctx context.Context, report *discriminator.Report) {
+func (h *handler) sendReport(ctx context.Context, report *waf.Report) {
 	h.reportsMu.Lock()
 	defer h.reportsMu.Unlock()
 
@@ -227,9 +227,9 @@ func (h *handler) sendReport(ctx context.Context, report *discriminator.Report)
 	})
 }
 
-// postReport posts report to discriminator, and waits for its answer for up to
+// postReport posts report to waf, and waits for its answer for up to
 // SWRP_TIMEOUT_MS.
-func (h *handler) postReport(ctx context.Context, report *discriminator.Report) error {
+func (h *handler) postReport(ctx context.Context, report *waf.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {
 		return fmt.Errorf("encode the report: %w", err)
@@ -246,7 +246,7 @@ func (h *handler) postReport(ctx context.Context, report *discriminator.Report)
 
 	req.Header.Set("Content-Type", "application/json")
 
-	res, err := h.discriminatorTransport.RoundTrip(req)
+	res, err := h.wafTransport.RoundTrip(req)
 	if err != nil {
 		return fmt.Errorf("send the report: %w", err)
 	}

internal/sww/healthcheck.go

@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // healthCheckTimeout bounds the whole health check.
@@ -19,8 +19,8 @@ const healthCheckTimeout = 5 * time.Second
 
 var errHealthEndpoint = errors.New("the health endpoint answered")
 
-// HealthCheck is the container's health check. In discriminator's container, where
-// SWW_COMMAND is discriminator, it returns 0 while discriminator answers its health
+// HealthCheck is the container's health check. In waf's container, where
+// SWW_COMMAND is waf, it returns 0 while waf answers its health
 // endpoint on 127.0.0.1, at the port in SWW_LISTEN_ADDR. In rproxy's container,
 // where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
 // answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
@@ -49,8 +49,8 @@ func HealthCheck(
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
-	case command == "discriminator":
-		err = checkDiscriminator(ctx, lookupEnv)
+	case command == "waf":
+		err = checkWAF(ctx, lookupEnv)
 	default:
 		err = checkRProxyAndApp(ctx, lookupEnv)
 	}
@@ -64,18 +64,18 @@ func HealthCheck(
 	return 0
 }
 
-// checkDiscriminator asks discriminator's health endpoint.
-func checkDiscriminator(
+// checkWAF asks waf's health endpoint.
+func checkWAF(
 	ctx context.Context, lookupEnv func(string) (string, bool),
 ) error {
-	listenAddr, err := config.DiscriminatorListenAddr(lookupEnv)
+	listenAddr, err := config.WAFListenAddr(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
 
 	err = askHealthEndpoint(ctx, listenAddr)
 	if err != nil {
-		return fmt.Errorf("ask discriminator: %w", err)
+		return fmt.Errorf("ask waf: %w", err)
 	}
 
 	return nil
@@ -109,7 +109,7 @@ func checkRProxyAndApp(
 // listenAddr, which the settings have checked has one.
 func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
-	health := "http://" + net.JoinHostPort("127.0.0.1", port) + discriminator.HealthPath
+	health := "http://" + net.JoinHostPort("127.0.0.1", port) + waf.HealthPath
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody)
 	if err != nil {

internal/sww/healthcheck_test.go

@@ -19,11 +19,11 @@ const (
 	// commandSetting says which command a container runs, and which the health
 	// check checks.
 	commandSetting = "SWW_COMMAND"
-	// discriminatorCommand is the command that runs discriminator.
-	discriminatorCommand = "discriminator"
+	// wafCommand is the command that runs waf.
+	wafCommand = "waf"
 )
 
-func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
+func TestHealthCheckInWAFsContainer(t *testing.T) {
 	t.Parallel()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -47,7 +47,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":" + port,
+		commandSetting: wafCommand, listenAddr: ":" + port,
 	}, 0, "")
 
 	// The health check reads that setting alone, here given as a file: a removed
@@ -59,7 +59,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 		{"SWW_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			commandSetting:       discriminatorCommand,
+			commandSetting:       wafCommand,
 			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 			other.name:           other.value,
 		}, 0, "")
@@ -68,10 +68,10 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":0",
-	}, 1, "unhealthy: ask discriminator: ")
+		commandSetting: wafCommand, listenAddr: ":0",
+	}, 1, "unhealthy: ask waf: ")
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: "8080",
+		commandSetting: wafCommand, listenAddr: "8080",
 	}, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ")
 
 	stop()
@@ -90,7 +90,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	defer app.Close()
 
 	// Nothing listens at the backend. The health check asks rproxy and the app,
-	// whether or not discriminator answers.
+	// whether or not waf answers.
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
@@ -107,7 +107,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 
 	// SWW_COMMAND cannot be given as a file.
-	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "discriminator\n")),
+	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "waf\n")),
 		0, "")
 
 	// Another setting does not fail it, even an invalid one, and neither does
@@ -137,7 +137,7 @@ func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
 
 	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
 		"unhealthy: invalid setting: SWW_COMMAND: "+
-			"\"healthcheck\" is not rproxy or discriminator\n")
+			"\"healthcheck\" is not rproxy or waf\n")
 }
 
 func TestHealthCheckRefusesAnArgument(t *testing.T) {

internal/sww/rproxy_test.go

@@ -19,18 +19,18 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
-	// wafBackend is the setting that names discriminator to rproxy.
+	// wafBackend is the setting that names waf to rproxy.
 	wafBackend = "SWRP_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
 	rproxyListenAddr = "SWRP_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
 	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
-	// rproxyTimeout is the setting that says how long rproxy waits for discriminator.
+	// rproxyTimeout is the setting that says how long rproxy waits for waf.
 	rproxyTimeout = "SWRP_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
@@ -52,7 +52,7 @@ func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	})
 }
 
-// startRProxy runs rproxy with discriminator at backend and the app at appURL, and
+// startRProxy runs rproxy with waf at backend and the app at appURL, and
 // returns its URL and what it writes. It believes X-Forwarded-For from the
 // tests. It stops as the test ends, and that it stopped in order is checked.
 func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
@@ -91,10 +91,10 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 	return "http://" + addr, out
 }
 
-// startDiscriminator runs discriminator with the settings in env, and returns
+// startWAF runs waf with the settings in env, and returns
 // its address and URL, what it writes, and what stops it, which checks that it
 // stopped in order.
-func startDiscriminator(t *testing.T, env map[string]string) (string, *output, func()) {
+func startWAF(t *testing.T, env map[string]string) (string, *output, func()) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -113,17 +113,17 @@ func startDiscriminator(t *testing.T, env map[string]string) (string, *output, f
 		select {
 		case status := <-exited:
 			if status != 0 {
-				t.Fatalf("discriminator's exit status %d, want 0; output:\n%s", status, out.text())
+				t.Fatalf("waf's exit status %d, want 0; output:\n%s", status, out.text())
 			}
 		case <-time.After(waitLimit):
-			t.Fatal("discriminator still running after being told to stop")
+			t.Fatal("waf still running after being told to stop")
 		}
 	}
 }
 
-// discriminatorSettings are discriminator's settings with the default rule
+// wafSettings are waf's settings with the default rule
 // file, to listen at any free port.
-func discriminatorSettings(t *testing.T) map[string]string {
+func wafSettings(t *testing.T) map[string]string {
 	t.Helper()
 
 	return map[string]string{
@@ -136,7 +136,7 @@ func discriminatorSettings(t *testing.T) map[string]string {
 func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	t.Parallel()
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	backend := "http://" + addr
@@ -151,32 +151,32 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
 	wantStatus(t, second+"/", placed, http.StatusForbidden)
 	wantStatus(t, second+"/", otherClient, http.StatusOK)
 
-	// One request's three lines carry one id, rproxy's with discriminator's answer.
+	// One request's three lines carry one id, rproxy's with waf's answer.
 	line := firstOut.line(t, "path", bannedProbe)
-	if line["disposition"] != discriminator.DispositionDeny ||
+	if line["disposition"] != waf.DispositionDeny ||
 		line["client_ip"] != placed {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
 	id, _ := line["request_id"].(string)
-	decision := discriminatorLine(t, discriminatorOut, id, "decision")
-	report := discriminatorLine(t, discriminatorOut, id, "report")
+	decision := wafLine(t, wafOut, id, "decision")
+	report := wafLine(t, wafOut, id, "report")
 
 	if decision["host"] != line["host"] || decision["client_ip"] != placed ||
 		report["status"] != float64(http.StatusForbidden) {
-		t.Errorf("discriminator's lines are %v and %v", decision, report)
+		t.Errorf("waf's lines are %v and %v", decision, report)
 	}
 }
 
-// discriminatorLine waits for discriminator's line with request id and
-// discriminator_line kind.
-func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]any {
+// wafLine waits for waf's line with request id and
+// waf_line kind.
+func wafLine(t *testing.T, out *output, id, kind string) map[string]any {
 	t.Helper()
 
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
 		line := out.findLine(t, func(fields map[string]any) bool {
-			return fields["request_id"] == id && fields["discriminator_line"] == kind
+			return fields["request_id"] == id && fields["waf_line"] == kind
 		})
 		if line != nil {
 			return line
@@ -190,14 +190,14 @@ func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]an
 	return nil
 }
 
-func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T) {
+func TestTheSiteAnswersWhileWAFIsStoppedAndStartedAgain(t *testing.T) {
 	t.Parallel()
 
-	env := discriminatorSettings(t)
-	addr, _, stop := startDiscriminator(t, env)
+	env := wafSettings(t)
+	addr, _, stop := startWAF(t, env)
 
-	// rproxy asks discriminator through an address the test holds throughout,
-	// so no other test can take it while discriminator is stopped.
+	// rproxy asks waf through an address the test holds throughout,
+	// so no other test can take it while waf is stopped.
 	backend, forwardTo := startForwarder(t)
 	forwardTo(addr)
 
@@ -228,22 +228,22 @@ func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T)
 	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
 	wantStatus(t, site+"/", placed, http.StatusForbidden)
 
-	// rproxy's connections are closed at once from here, before discriminator
+	// rproxy's connections are closed at once from here, before waf
 	// stops and frees its port.
 	forwardTo("")
 	stop()
 
-	// With discriminator down, the site answers, and rproxy says the default did it.
+	// With waf down, the site answers, and rproxy says the default did it.
 	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
 
 	line := out.line(t, "path", "/after-stop")
-	if line["disposition"] != discriminator.DispositionAllow ||
+	if line["disposition"] != waf.DispositionAllow ||
 		line["default_disposition"] != true {
 		t.Errorf("rproxy's line is %v", line)
 	}
 
 	// Started again with its state files, it applies the ban again.
-	addr, _, stop = startDiscriminator(t, env)
+	addr, _, stop = startWAF(t, env)
 	forwardTo(addr)
 
 	defer func() {
@@ -397,10 +397,10 @@ func sendRaw(t *testing.T, site, request string) int {
 	return res.StatusCode
 }
 
-func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
+func TestAChunkedBodyStaysABodyAtWAF(t *testing.T) {
 	t.Parallel()
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, _ := startRProxy(t, "http://"+addr, startApp(t))
@@ -409,7 +409,7 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
 	const smuggledID = "smuggled-request"
 
 	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
-		discriminator.ClientHeader + ": " + otherClient + "\r\n" +
+		waf.ClientHeader + ": " + otherClient + "\r\n" +
 		"X-Request-ID: " + smuggledID + "\r\n\r\n"
 
 	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
@@ -425,18 +425,18 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) {
 		time.Sleep(pollInterval)
 	}
 
-	line := discriminatorOut.findLine(t, func(fields map[string]any) bool {
+	line := wafOut.findLine(t, func(fields map[string]any) bool {
 		return fields["request_id"] == smuggledID
 	})
 	if line != nil {
-		t.Errorf("discriminator read the body as a request: %v", line)
+		t.Errorf("waf read the body as a request: %v", line)
 	}
 }
 
-func TestATargetThatCannotGoToDiscriminatorIsRefusedForABannedClient(t *testing.T) {
+func TestATargetThatCannotGoToWAFIsRefusedForABannedClient(t *testing.T) {
 	t.Parallel()
 
-	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, _, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
@@ -460,7 +460,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 
 	const zoned = "2001:db8::1%eth0"
 
-	addr, _, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, _, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, startApp(t))
@@ -475,7 +475,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
 	}
 }
 
-func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
+func TestAStatusWAFDoesNotTakeIsReportedAs599(t *testing.T) {
 	t.Parallel()
 
 	const status = 799
@@ -486,7 +486,7 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
 		}))
 	t.Cleanup(app.Close)
 
-	addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t))
+	addr, wafOut, stop := startWAF(t, wafSettings(t))
 	defer stop()
 
 	site, out := startRProxy(t, "http://"+addr, app.URL)
@@ -500,9 +500,9 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) {
 
 	id, _ := line["request_id"].(string)
 
-	report := discriminatorLine(t, discriminatorOut, id, "report")
+	report := wafLine(t, wafOut, id, "report")
 	if report["status"] != 599.0 {
-		t.Errorf("discriminator's line is %v, want status 599", report)
+		t.Errorf("waf's line is %v, want status 599", report)
 	}
 }
 
@@ -544,16 +544,16 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 	return addr, cmd, out
 }
 
-func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
+func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	t.Parallel()
 
 	protocols := make(chan string, 10)
 	backend := httptest.NewUnstartedServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				protocols <- r.Proto
 
-				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionDeny)
+				w.Header().Set(waf.DispositionHeader, waf.DispositionDeny)
 				w.WriteHeader(http.StatusForbidden)
 			}
 		}))
@@ -563,7 +563,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 
 	// rproxy has no setting for the certificates it trusts, so it is told of this
 	// one as Go's client is told of any, in a process of its own.
-	certificates := filepath.Join(t.TempDir(), "discriminator.pem")
+	certificates := filepath.Join(t.TempDir(), "waf.pem")
 
 	err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{
 		Type: "CERTIFICATE", Bytes: backend.Certificate().Raw,
@@ -585,7 +585,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 	} {
 		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
 		if status != http.StatusForbidden {
-			t.Errorf("with %s: status %d, want discriminator's 403", name, status)
+			t.Errorf("with %s: status %d, want waf's 403", name, status)
 		}
 
 		select {
@@ -594,7 +594,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
 			}
 		case <-time.After(waitLimit):
-			t.Errorf("with %s: discriminator was not asked", name)
+			t.Errorf("with %s: waf was not asked", name)
 		}
 	}
 }
@@ -623,8 +623,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
-				w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
+			if r.Header.Get(waf.ClientHeader) != "" {
+				w.Header().Set(waf.DispositionHeader, waf.DispositionAllow)
 
 				return
 			}
@@ -731,7 +731,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow)
+			w.Header().Set(waf.DispositionHeader, waf.DispositionAllow)
 		}))
 	t.Cleanup(backend.Close)
 
@@ -794,7 +794,7 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
 		{"no backend", wafBackend, nil},
 		{
 			"another invalid", rproxyTimeout,
-			map[string]string{wafBackend: "http://discriminator:8080", rproxyTimeout: "soon"},
+			map[string]string{wafBackend: "http://waf:8080", rproxyTimeout: "soon"},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -831,7 +831,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 	out := &output{}
 
 	status := runRProxy(t.Context(), map[string]string{
-		wafBackend:       "http://discriminator:8080",
+		wafBackend:       "http://waf:8080",
 		rproxyListenAddr: taken.Addr().String(),
 	}, out)
 	if status != 1 {
@@ -848,7 +848,7 @@ func TestMainRunsRProxy(t *testing.T) {
 	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
 
 	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
-		"http://"+addr+discriminator.HealthPath, http.NoBody)
+		"http://"+addr+waf.HealthPath, http.NoBody)
 	if err != nil {
 		t.Fatalf("new request: %v", err)
 	}

internal/sww/sww.go

@@ -1,9 +1,9 @@
 // Package sww runs the sww process, as the command it is given.
-// `sww discriminator` reads the settings, the rule files, the lookup database
+// `sww waf` reads the settings, the rule files, the lookup database
 // and the state files, answers rproxy's questions until it is told to stop, and
 // then stops in an orderly way, writing the state files. `sww rproxy`
 // reads rproxy's settings alone, and runs the reverse proxy in front of one app
-// that asks discriminator about each request. `sww healthcheck` is the
+// that asks waf about each request. `sww healthcheck` is the
 // container's health check.
 package sww
 
@@ -23,13 +23,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/state"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // shutdownTimeout is how long requests in progress may take to finish
@@ -37,7 +37,7 @@ import (
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
 
-// remoteLogStopTimeout is how long, as discriminator stops, the log lines still
+// remoteLogStopTimeout is how long, as waf stops, the log lines still
 // waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
@@ -51,11 +51,11 @@ const usage = `usage: sww <command>
 
 commands:
   rproxy          the reverse proxy in front of one app
-  discriminator   decides for rproxy, and keeps bans, counters and history
+  waf   decides for rproxy, and keeps bans, counters and history
   healthcheck     the container's health check
 `
 
-// Params are what RunDiscriminator and RunRProxy need from the process.
+// Params are what RunWAF and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -66,7 +66,7 @@ type Params struct {
 }
 
 // Main runs the command os.Args names, and returns the process's exit status.
-// `sww rproxy` and `sww discriminator` run until SIGTERM or SIGINT.
+// `sww rproxy` and `sww waf` run until SIGTERM or SIGINT.
 // With no command, or one it does not know, it prints the commands and returns
 // usageStatus.
 func Main(version string) int {
@@ -84,8 +84,8 @@ func Main(version string) int {
 	switch args[0] {
 	case "rproxy":
 		return RunRProxy(ctx, params)
-	case "discriminator":
-		return RunDiscriminator(ctx, params)
+	case "waf":
+		return RunWAF(ctx, params)
 	case "healthcheck":
 		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
 	default:
@@ -100,10 +100,10 @@ func printUsage(w io.Writer) int {
 	return usageStatus
 }
 
-// RunDiscriminator is `sww discriminator`: it reads the settings, the rule files,
+// RunWAF is `sww waf`: it reads the settings, the rule files,
 // the lookup database and the state files, then serves requests until ctx is
-// done. It returns the process's exit status, 1 when discriminator cannot start.
-func RunDiscriminator(ctx context.Context, params Params) int {
+// done. It returns the process's exit status, 1 when waf cannot start.
+func RunWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWW_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -151,7 +151,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 		return 1
 	}
 
-	crs, err := discriminator.NewCoreRuleSet(cfg)
+	crs, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
 		processLog.Error("cannot use the Core Rule Set", "error", err.Error())
 
@@ -191,14 +191,14 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
 
-// newServer returns the server discriminator runs, with the metrics of the alerts,
+// newServer returns the server waf runs, with the metrics of the alerts,
 // after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	crs *coreruleset.CoreRuleSet,
-) (*discriminator.Server, error) {
+) (*waf.Server, error) {
 	var lookupFile *lookup.File
 
 	if cfg.LookupSource == "file" {
@@ -215,7 +215,7 @@ func newServer(
 		}
 	}
 
-	server := discriminator.New(discriminator.Params{
+	server := waf.New(waf.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -239,7 +239,7 @@ func newServer(
 // loadStateFiles reads the state files into the parts of server and into
 // alertQueue, as state.Load does.
 func loadStateFiles(
-	cfg *config.Config, server *discriminator.Server, alertQueue *alerts.Queue,
+	cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue,
 	now func() time.Time, processLog *slog.Logger,
 ) (*state.Files, error) {
 	return state.Load(state.Params{
@@ -325,7 +325,7 @@ func startSending(
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
-	ctx context.Context, server *discriminator.Server, listener net.Listener,
+	ctx context.Context, server *waf.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {

internal/sww/sww_test.go

@@ -20,9 +20,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -123,11 +123,11 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
-// run runs `sww discriminator` with the settings in env until ctx is done,
+// run runs `sww waf` with the settings in env until ctx is done,
 // and returns its exit status. SWW_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return sww.RunDiscriminator(ctx, sww.Params{
+	return sww.RunWAF(ctx, sww.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -1245,7 +1245,7 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
 
-// runUntilStopped runs `sww discriminator` with the settings in env, has use
+// runUntilStopped runs `sww waf` with the settings in env, has use
 // send it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
@@ -1319,7 +1319,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	}
 }
 
-// wantAllowed checks that discriminator at url allows a request from localhost.
+// wantAllowed checks that waf at url allows a request from localhost.
 func wantAllowed(t *testing.T, url string) {
 	t.Helper()
 
@@ -1504,7 +1504,7 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
 
-// wantRefused checks that discriminator at url refuses a request from localhost with
+// wantRefused checks that waf at url refuses a request from localhost with
 // 403, the default SWW_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
@@ -1681,8 +1681,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 }
 
 // statusFrom returns the status a request to url from the client at from is
-// answered with. The request serves rproxy and discriminator alike. rproxy reads the
-// client from X-Forwarded-For, and replaces the other two headers. To discriminator,
+// answered with. The request serves rproxy and waf alike. rproxy reads the
+// client from X-Forwarded-For, and replaces the other two headers. To waf,
 // they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
@@ -1694,7 +1694,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(discriminator.ClientHeader, from)
+	req.Header.Set(waf.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}

internal/sww/waf_test.go

@@ -14,8 +14,8 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // commandForMain, while set in the environment, has this test binary run Main
@@ -34,7 +34,7 @@ func TestMain(m *testing.M) {
 	os.Exit(sww.Main(testVersion))
 }
 
-func TestMainRunsDiscriminator(t *testing.T) {
+func TestMainRunsWAF(t *testing.T) {
 	t.Parallel()
 
 	binary, err := os.Executable()
@@ -50,7 +50,7 @@ func TestMainRunsDiscriminator(t *testing.T) {
 	cmd.Stdout = out
 
 	cmd.Env = append(os.Environ(),
-		commandForMain+"="+discriminatorCommand,
+		commandForMain+"="+wafCommand,
 		listenAddr+"="+localhost+":0",
 		stateDir+"="+t.TempDir(),
 		rulesDir+"="+t.TempDir(),
@@ -67,7 +67,7 @@ func TestMainRunsDiscriminator(t *testing.T) {
 	})
 
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
-	ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
+	ask(t, addr, "/", http.StatusOK, waf.DispositionAllow)
 
 	err = cmd.Process.Signal(syscall.SIGTERM)
 	if err != nil {
@@ -108,7 +108,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 				t.Errorf("exit status %d (%v), want 2", code, err)
 			}
 
-			for _, name := range []string{"rproxy", discriminatorCommand, "healthcheck"} {
+			for _, name := range []string{"rproxy", wafCommand, "healthcheck"} {
 				if !strings.Contains(stderr.String(), name) {
 					t.Errorf("stderr %q does not name %s", stderr.String(), name)
 				}
@@ -121,7 +121,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
 	}
 }
 
-// ask sends discriminator at addr rproxy's question about a request for path from
+// ask sends waf at addr rproxy's question about a request for path from
 // placed, checks the answer's status and disposition, and closes it.
 func ask(t *testing.T, addr, path string, status int, disposition string) {
 	t.Helper()
@@ -132,7 +132,7 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 		t.Fatalf("new request: %v", err)
 	}
 
-	req.Header.Set(discriminator.ClientHeader, placed)
+	req.Header.Set(waf.ClientHeader, placed)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}
@@ -147,16 +147,16 @@ func ask(t *testing.T, addr, path string, status int, disposition string) {
 	_ = res.Body.Close()
 
 	if res.StatusCode != status ||
-		res.Header.Get(discriminator.DispositionHeader) != disposition {
+		res.Header.Get(waf.DispositionHeader) != disposition {
 		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
-			res.Header.Get(discriminator.DispositionHeader), status, disposition)
+			res.Header.Get(waf.DispositionHeader), status, disposition)
 	}
 }
 
-// runDiscriminator runs `sww discriminator` with the settings in env, has use
+// runWAF runs `sww waf` with the settings in env, has use
 // send it requests at the address it listens on, stops it as SIGTERM does, and
 // checks that it stopped in order.
-func runDiscriminator(t *testing.T, env map[string]string, use func(addr string)) {
+func runWAF(t *testing.T, env map[string]string, use func(addr string)) {
 	t.Helper()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -183,7 +183,7 @@ func runDiscriminator(t *testing.T, env map[string]string, use func(addr string)
 	out.line(t, "msg", "stopped")
 }
 
-func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
+func TestWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 	t.Parallel()
 
 	env := map[string]string{
@@ -192,13 +192,13 @@ func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
 		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
 	}
 
-	runDiscriminator(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow)
+	runWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusOK, waf.DispositionAllow)
 		// The default rule file bans a probe for this.
-		ask(t, addr, "/.env", http.StatusForbidden, discriminator.DispositionDeny)
+		ask(t, addr, "/.env", http.StatusForbidden, waf.DispositionDeny)
 	})
 
-	runDiscriminator(t, env, func(addr string) {
-		ask(t, addr, "/", http.StatusForbidden, discriminator.DispositionDeny)
+	runWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusForbidden, waf.DispositionDeny)
 	})
 }

internal/waf/abuseipdb.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY,
 // SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION.

internal/waf/admin.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"bytes"
@@ -49,7 +49,7 @@ func (rq *request) answerHealth() {
 	_, _ = io.WriteString(rq.out, "ok\n")
 }
 
-// answerAdmin answers a request for one of discriminator's own endpoints. Each
+// answerAdmin answers a request for one of waf's own endpoints. Each
 // needs a token, sent as Authorization: Bearer <token>: the metrics
 // SWW_METRICS_TOKEN, the others SWW_ADMIN_TOKEN. A request without it is
 // refused with 401. An endpoint whose token is unset answers 404, as any other
@@ -250,7 +250,7 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
 
-// showClient answers GET ClientsPath<ip> with what discriminator knows of the client:
+// showClient answers GET ClientsPath<ip> with what waf knows of the client:
 // its counters, its history, which holds its country as last looked up and its
 // offences, and its bans with their notes.
 func (rq *request) showClient() {

internal/waf/admin_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"encoding/json"
@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/state"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -88,11 +88,11 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 
 	// Any other request under /_sww/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, discriminator.BansPath, banOtherClient},
-		{http.MethodDelete, discriminator.BansPath, ""},
-		{http.MethodGet, discriminator.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, discriminator.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(discriminator.ClientsPath, "/"), ""},
+		{http.MethodPut, waf.BansPath, banOtherClient},
+		{http.MethodDelete, waf.BansPath, ""},
+		{http.MethodGet, waf.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, waf.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(waf.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -118,7 +118,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient,
+	wantBans(t, s.admin(http.MethodPost, waf.BansPath, banOtherClient,
 		http.StatusOK), want)
 
 	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -129,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -138,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, waf.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(http.MethodDelete, waf.BansPath+"/"+client, "", http.StatusNotFound)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -181,7 +181,7 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, body, http.StatusOK),
+		wantBans(t, s.admin(http.MethodPost, waf.BansPath, body, http.StatusOK),
 			want)
 	}
 }
@@ -251,7 +251,7 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, discriminator.BansPath, tc.body,
+		got := s.admin(http.MethodPost, waf.BansPath, tc.body,
 			http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
 			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
@@ -285,7 +285,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, discriminator.ClientsPath+addr, "",
+		decode(t, s.admin(http.MethodGet, waf.ClientsPath+addr, "",
 			http.StatusOK), &got)
 
 		if got.Client == nil {
@@ -308,15 +308,15 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, discriminator.ClientsPath+"198.51.100.99", "",
+	got := s.admin(http.MethodGet, waf.ClientsPath+"198.51.100.99", "",
 		http.StatusOK)
 	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, discriminator.ClientsPath+"203.0.113", "",
+	s.admin(http.MethodGet, waf.ClientsPath+"203.0.113", "",
 		http.StatusBadRequest)
-	s.admin(http.MethodDelete, discriminator.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodDelete, waf.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
@@ -347,14 +347,14 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, discriminator.BansPath, ""},
-		{http.MethodPost, discriminator.BansPath, banOtherClient},
-		{http.MethodDelete, discriminator.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, discriminator.ClientsPath + otherClient, ""},
+		{http.MethodGet, waf.BansPath, ""},
+		{http.MethodPost, waf.BansPath, banOtherClient},
+		{http.MethodDelete, waf.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, waf.ClientsPath + otherClient, ""},
 	}
 }
 
-// admin sends a request with method for path, with body, to discriminator's own
+// admin sends a request with method for path, with body, to waf's own
 // address, with the admin token, and checks that it is answered with status, its
 // log line's action own_endpoint. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
@@ -370,7 +370,7 @@ func (s *sender) ownEndpointRequest(
 ) answer {
 	s.t.Helper()
 
-	req := newRequest(s.t, method, s.discriminatorAddr, path, strings.NewReader(body))
+	req := newRequest(s.t, method, s.wafAddr, path, strings.NewReader(body))
 	if authorization != "" {
 		req.Header.Set("Authorization", authorization)
 	}

internal/waf/alerts_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"maps"
@@ -10,8 +10,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -203,7 +203,7 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
 // never sent them, and returns the queue they wait in as well.
 func startWithAlerts(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
+) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
 	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
@@ -212,7 +212,7 @@ func startWithAlerts(
 // startAppWithAlerts is startWithAlerts in front of the app handler.
 func startAppWithAlerts(
 	t *testing.T, handler http.HandlerFunc, env map[string]string,
-) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
+) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
 	app := startApp(t, handler)
@@ -226,7 +226,7 @@ func startAppWithAlerts(
 
 	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
 
-	s := &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}
+	s := &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}
 
 	return s, clk, server, queue
 }

internal/waf/anomaly_internal_test.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"net/netip"

internal/waf/anomaly_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"maps"
@@ -13,9 +13,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // The anomaly thresholds: the prefix of a scope followed by the end of a
@@ -319,7 +319,7 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
 	// kept.
 	geojsURL, _, release := startHeldGeoJS(t)
 
-	var server atomic.Pointer[discriminator.Server]
+	var server atomic.Pointer[waf.Server]
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		release()

internal/waf/answertime_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"fmt"
@@ -15,16 +15,16 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
 	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
-	// discriminator has to answer.
+	// waf has to answer.
 	answerTimeLimit = 2 * time.Second
 	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
@@ -33,7 +33,7 @@ const (
 	headerFieldLimit = 100
 	// cookieHeader is the header the cookie limit counts.
 	cookieHeader = "Cookie"
-	// tooLarge is how discriminator refuses a request over the header limits.
+	// tooLarge is how waf refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
 	// that silentGeoJSURL names too.
@@ -56,7 +56,7 @@ func cookies(count int) string {
 }
 
 // fillHeaders adds headers to a question until the checks see total header
-// fields: all but ClientHeader and PeerHeader, which discriminator removes. Go's
+// fields: all but ClientHeader and PeerHeader, which waf removes. Go's
 // client sends nothing else but Host, which the limit does not count, once
 // User-Agent is set.
 func fillHeaders(req *http.Request, total int) {
@@ -70,13 +70,13 @@ func fillHeaders(req *http.Request, total int) {
 func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", map[string]string{wafMode: block})
+	s := startWAF(t, "", map[string]string{wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
 	got := do(t, req)
 
-	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
+	wantDisposition(t, got, tooLarge, waf.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
@@ -89,7 +89,7 @@ func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testin
 func TestHeaderLimitRefusalNamesItsHeuristicCountsAndLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", nil)
+	s := startWAF(t, "", nil)
 	req := s.question(siteA, client, "/")
 	fillHeaders(req, headerFieldLimit+1)
 	do(t, req)
@@ -143,7 +143,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startDiscriminator(t, "", map[string]string{wafMode: block})
+			s := startWAF(t, "", map[string]string{wafMode: block})
 			req := s.question(siteA, client, "/")
 			tc.make(req)
 
@@ -151,13 +151,13 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			line := s.out.requestLine(t)
 
 			if tc.refused {
-				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
+				wantDisposition(t, got, tooLarge, waf.DispositionDeny)
 				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 				return
 			}
 
-			wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
+			wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 			if line.DurationCoreRuleSetMS == nil {
@@ -178,11 +178,11 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
 
-			s := startDiscriminator(t, "", env)
+			s := startWAF(t, "", env)
 			req := s.question(siteA, client, "/")
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
+			wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
 		})
 	}
 }
@@ -190,23 +190,23 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", map[string]string{wafMode: block, allowNets: client})
+	s := startWAF(t, "", map[string]string{wafMode: block, allowNets: client})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow)
+	wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow)
 }
 
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", map[string]string{mode: observe, wafMode: block})
+	s := startWAF(t, "", map[string]string{mode: observe, wafMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
 	got := do(t, req)
 
-	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
 
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
@@ -219,7 +219,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"})
+	s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
 	ask := func() answer {
 		req := s.question(siteA, client, "/")
 		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
@@ -227,8 +227,8 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 		return do(t, req)
 	}
 
-	wantDisposition(t, ask(), tooLarge, discriminator.DispositionDeny)
-	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
+	wantDisposition(t, ask(), tooLarge, waf.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, waf.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
 	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
@@ -246,13 +246,13 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startDiscriminator(t, "", map[string]string{
+			s := startWAF(t, "", map[string]string{
 				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
 			})
 			req := s.question(siteA, client, tc.path)
 			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-			wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
+			wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny)
 			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
 		})
 	}
@@ -262,13 +262,13 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{
+	s := startWAF(t, geojsURL, map[string]string{
 		unknownLimitPercent: "0", lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
+	wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny)
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
@@ -278,14 +278,14 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
-	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, discriminator.DispositionAllow)
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, waf.DispositionAllow)
 }
 
 func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s := startWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
 		Answered: s.clock.Now(), Used: s.clock.Now(),
@@ -294,7 +294,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
-	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
+	wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
 		requestlog.ActionClientIsRateLimited)
 }
@@ -303,14 +303,14 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	t.Parallel()
 
 	geojsURL, _ := startGeoJS(t)
-	s := startDiscriminator(t, geojsURL, map[string]string{
+	s := startWAF(t, geojsURL, map[string]string{
 		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	got := do(t, req)
-	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
+	wantDisposition(t, got, http.StatusOK, waf.DispositionAllow)
 
 	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
 	if asn != asnDE || country != "DE" {
@@ -319,18 +319,18 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
 	}
 }
 
-// newDiscriminatorInBubble makes a discriminator for a synctest bubble: GeoJS never
+// newWAFInBubble makes a waf for a synctest bubble: GeoJS never
 // answers, a setting needs its answer, and everything is at its default but
 // for env. No request to it may use the network.
-func newDiscriminatorInBubble(
+func newWAFInBubble(
 	t *testing.T, env map[string]string,
-) (*discriminator.Server, *output) {
+) (*waf.Server, *output) {
 	t.Helper()
 
 	settings := map[string]string{tagDeny: "country=KP"}
 	maps.Copy(settings, env)
 
-	server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, settings)
+	server, out, _ := newWAF(t, silentGeoJSURL, time.Now, settings)
 
 	return server, out
 }
@@ -338,13 +338,13 @@ func newDiscriminatorInBubble(
 // askDirectly hands a question about a request from client straight to server,
 // as change leaves it, and returns the answer's status and how long it took.
 func askDirectly(
-	t *testing.T, server *discriminator.Server, change func(*http.Request),
+	t *testing.T, server *waf.Server, change func(*http.Request),
 ) (int, time.Duration) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
 	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
-	req.Header.Set(discriminator.ClientHeader, client)
+	req.Header.Set(waf.ClientHeader, client)
 	req.Header.Set(requestIDHeader, "the-id")
 	change(req)
 
@@ -357,17 +357,17 @@ func askDirectly(
 }
 
 // banClient bans client at now.
-func banClient(_ *testing.T, server *discriminator.Server, now time.Time) {
+func banClient(_ *testing.T, server *waf.Server, now time.Time) {
 	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
 }
 
 // countClient counts one request from client at now for the rate limits.
-func countClient(_ *testing.T, server *discriminator.Server, now time.Time) {
+func countClient(_ *testing.T, server *waf.Server, now time.Time) {
 	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
 }
 
 // listClient puts client on the blocklist at dropURL.
-func listClient(t *testing.T, server *discriminator.Server, now time.Time) {
+func listClient(t *testing.T, server *waf.Server, now time.Time) {
 	t.Helper()
 
 	err := server.Lists.Load([]reputation.List{{
@@ -379,13 +379,13 @@ func listClient(t *testing.T, server *discriminator.Server, now time.Time) {
 }
 
 // decideOnClient puts client on the CrowdSec decision list.
-func decideOnClient(t *testing.T, server *discriminator.Server, now time.Time) {
+func decideOnClient(t *testing.T, server *waf.Server, now time.Time) {
 	t.Helper()
 	loadDecisions(t, server, now, clientsDecision)
 }
 
 // leaveAsItIs prepares nothing.
-func leaveAsItIs(*testing.T, *discriminator.Server, time.Time) {}
+func leaveAsItIs(*testing.T, *waf.Server, time.Time) {}
 
 func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	t.Parallel()
@@ -396,7 +396,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
 		// cookie is the request's Cookie header.
 		cookie string
 		status int
@@ -443,7 +443,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, so that a request that does not wait takes no time at all.
 			synctest.Test(t, func(t *testing.T) {
-				server, out := newDiscriminatorInBubble(t, tc.env)
+				server, out := newWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
 				status, took := askDirectly(t, server, func(req *http.Request) {
@@ -471,7 +471,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 		name string
 		env  map[string]string
 		// prepare gets the server ready, at now, before the question.
-		prepare func(t *testing.T, server *discriminator.Server, now time.Time)
+		prepare func(t *testing.T, server *waf.Server, now time.Time)
 		status  int
 		action  string
 	}{
@@ -500,7 +500,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 			t.Parallel()
 
 			synctest.Test(t, func(t *testing.T) {
-				server, out := newDiscriminatorInBubble(t, tc.env)
+				server, out := newWAFInBubble(t, tc.env)
 				tc.prepare(t, server, time.Now())
 
 				status, took := askDirectly(t, server, func(*http.Request) {})
@@ -516,7 +516,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
 	}
 }
 
-func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
+func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 	t *testing.T,
 ) {
 	t.Parallel()
@@ -531,12 +531,12 @@ func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 
 	t.Cleanup(func() { _ = resolver.Close() })
 
-	server, out, _ := newDiscriminatorWith(t, func(
-		params discriminator.Params,
-	) *discriminator.Server {
+	server, out, _ := newWAFWith(t, func(
+		params waf.Params,
+	) *waf.Server {
 		params.AbuseIPDBURL = silentAbuseIPDBURL
 
-		return discriminator.New(params)
+		return waf.New(params)
 	}, held, time.Now, map[string]string{
 		tagDeny: "country=KP", wafMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),

internal/waf/bans.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic active_ban, and the code that makes bans, which several
 // heuristics share. active_ban reads SWW_MODE; the bans are the ban ledger's.

internal/waf/bans_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"bufio"
@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -393,14 +393,14 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
 
-// startWithClock starts discriminator, and rproxy in front of an app that answers 200,
+// startWithClock starts waf, and rproxy in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
 // X-Forwarded-For, clients' AS numbers and countries looked up at
 // geojsURL, and a clock set to midnight, the start of a bucket in every
 // window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *discriminator.Server) {
+) (*sender, *clock, *waf.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
@@ -410,20 +410,20 @@ func startWithClock(
 
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
 
-	return &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}, clk, server
+	return &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}, clk, server
 }
 
 // sender sends requests to rproxy one after another, each on a connection of its
-// own, and checks each one's answer and log line. discriminatorAddr is where
-// discriminator's own endpoints are, which ownEndpointRequest asks. Every request
-// discriminator gets must come through the sender, since the log lines are
+// own, and checks each one's answer and log line. wafAddr is where
+// waf's own endpoints are, which ownEndpointRequest asks. Every request
+// waf gets must come through the sender, since the log lines are
 // matched to them in order.
 type sender struct {
-	t                 *testing.T
-	addr              string
-	discriminatorAddr string
-	out               *output
-	sent              int
+	t       *testing.T
+	addr    string
+	wafAddr string
+	out     *output
+	sent    int
 }
 
 // get sends a GET request for / from the client at from.

internal/waf/biased.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"sneak.berlin/go/smallwebwaf/internal/config"

internal/waf/biased_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"fmt"
@@ -15,9 +15,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // The biased thresholds.
@@ -291,7 +291,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
+		server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 			map[string]string{unknownLimitPercent: "0"})
 
 		// Once the time the request waits for its answer is up, the client
@@ -335,7 +335,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
+				server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 					map[string]string{
 						lookupTimeout: timeout.String(), tagLists: "vpn=" + vpnList, tc.setting: tc.value,
 					})
@@ -437,7 +437,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 // clock.
 func startWithLookups(
 	t *testing.T, env map[string]string,
-) (*sender, *discriminator.Server, *alerts.Queue) {
+) (*sender, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
 	s, _, server, queue := startWithLookupsAndClock(t, env)
@@ -452,7 +452,7 @@ func startWithLookups(
 // country, and no other address.
 func startWithLookupsAndClock(
 	t *testing.T, env map[string]string,
-) (*sender, *clock, *discriminator.Server, *alerts.Queue) {
+) (*sender, *clock, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
 	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
@@ -482,12 +482,12 @@ func (s *sender) uploadFrom(from string) logLine {
 // straight to server's handler, without the network, and returns once it is
 // answered.
 func serveFromDE(
-	t *testing.T, server *discriminator.Server, method string, body io.Reader,
+	t *testing.T, server *waf.Server, method string, body io.Reader,
 ) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.Header.Set(discriminator.ClientHeader, fromDE)
+	req.Header.Set(waf.ClientHeader, fromDE)
 	req.Header.Set(requestIDHeader, "the-id")
 
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)

internal/waf/blocklists.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic blocklists. It reads SWW_BLOCKLIST_ACTION, and the blocklists
 // through the reputation lists.

internal/waf/bytelimits.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic byte_limits. It reads SWW_BYTES_COUNT, and the byte limits
 // and biased thresholds through the limiter and limitPercentages.

internal/waf/bytelimits_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"bufio"

internal/waf/client.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"crypto/rand"

internal/waf/coreruleset.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic core_rule_set. It reads SWW_WAF_MODE, SWW_WAF_EXEMPT_PATHS
 // and SWW_WAF_ANOMALY_THRESHOLD.

internal/waf/coreruleset_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"io"

internal/waf/countries.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic countries. It reads SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 

internal/waf/countries_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"encoding/json"

internal/waf/crowdsec.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic crowdsec. It reads SWW_CROWDSEC_LAPI_URL, and the decisions
 // through the reputation lists.

internal/waf/crowdsec_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"
@@ -9,9 +9,9 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // The CrowdSec settings, and the tests' engine, which is never asked: each
@@ -184,7 +184,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 // decisionsURL, answer, the engine's answer, fetched at fetched, as
 // reputation.json would at start.
 func loadDecisions(
-	t *testing.T, server *discriminator.Server, fetched time.Time, answer string,
+	t *testing.T, server *waf.Server, fetched time.Time, answer string,
 ) {
 	t.Helper()
 

internal/waf/denynets.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic deny_nets. It reads SWW_DENY_NETS.
 

internal/waf/dnsbl.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic dnsbl. It reads SWW_REPUTATION_ACTION, and the DNSBL zones'
 // verdicts through the DNSBL checker.

internal/waf/headerlimits.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic header_limits. It reads no setting: its limits are fixed.
 

internal/waf/health_test.go

@@ -1,11 +1,11 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
@@ -21,7 +21,7 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "",
+		got := s.ownEndpointRequest("", http.MethodGet, waf.HealthPath, "",
 			http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {

internal/waf/heuristics.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"context"
@@ -9,7 +9,7 @@ import (
 // and add one line for it to one of the lists below. Its settings go in
 // config.Config, and the comment at the top of its file names them.
 
-// heuristic is one of the checks that decide what discriminator does with a
+// heuristic is one of the checks that decide what waf does with a
 // request.
 type heuristic interface {
 	// name is the heuristic's name, which the log line gives.
@@ -70,7 +70,7 @@ func afterLookup() []heuristic {
 	}
 }
 
-// afterAnswer are the heuristics that run on a request once discriminator has
+// afterAnswer are the heuristics that run on a request once waf has
 // answered it, before its decision line is written. They ban the client, and do
 // not change what the request got: their verdict's action is not used.
 func afterAnswer() []heuristic {

internal/waf/history_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"io"
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
@@ -100,8 +100,8 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 
 	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
-	s.ownEndpointRequest("", http.MethodGet, discriminator.MetricsPath, "",
+	s.ownEndpointRequest("", http.MethodGet, waf.HealthPath, "", http.StatusOK)
+	s.ownEndpointRequest("", http.MethodGet, waf.MetricsPath, "",
 		http.StatusUnauthorized)
 	s.scrape()
 
@@ -128,7 +128,7 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 
 // historyOf returns the history of the client at addr.
 func historyOf(
-	t *testing.T, server *discriminator.Server, addr string,
+	t *testing.T, server *waf.Server, addr string,
 ) ratelimit.History {
 	t.Helper()
 

internal/waf/lookup.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"context"

internal/waf/lookup_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"
@@ -379,13 +379,13 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// clock of the test's own: the wait lasts exactly as long as it should,
 	// however slowly the test process runs. Nothing in it may wait on the
 	// network, which would keep that clock from moving on: the request is
-	// handed to discriminator's handler, and GeoJS is one that never answers.
+	// handed to waf's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
 		// Not the default. The exclusive list needs the answer, and the app
 		// is never reached.
 		const timeout = 3 * time.Second
 
-		server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
+		server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 			map[string]string{
 				lookupTimeout:    timeout.String(),
 				allowedCountries: "DE",

internal/waf/metrics_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"io"
@@ -11,9 +11,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{bearer, "Bearer ", ""} {
-		s.ownEndpointRequest(authorization, http.MethodGet, discriminator.MetricsPath, "",
+		s.ownEndpointRequest(authorization, http.MethodGet, waf.MetricsPath, "",
 			http.StatusNotFound)
 	}
 }
@@ -46,19 +46,19 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		method, path, authorization string
 		status                      int
 	}{
-		{http.MethodGet, discriminator.MetricsPath, "", http.StatusUnauthorized},
+		{http.MethodGet, waf.MetricsPath, "", http.StatusUnauthorized},
 		{
-			http.MethodGet, discriminator.MetricsPath, "Bearer " + strings.ToUpper(token),
+			http.MethodGet, waf.MetricsPath, "Bearer " + strings.ToUpper(token),
 			http.StatusUnauthorized,
 		},
-		{http.MethodGet, discriminator.MetricsPath, "Basic " + token,
+		{http.MethodGet, waf.MetricsPath, "Basic " + token,
 			http.StatusUnauthorized},
-		{http.MethodGet, discriminator.MetricsPath, bearer, http.StatusOK},
-		{http.MethodGet, discriminator.MetricsPath, "bearer " + token, http.StatusOK},
-		{http.MethodPost, discriminator.MetricsPath, bearer, http.StatusNotFound},
-		{http.MethodGet, discriminator.MetricsPath + "/", bearer, http.StatusNotFound},
+		{http.MethodGet, waf.MetricsPath, bearer, http.StatusOK},
+		{http.MethodGet, waf.MetricsPath, "bearer " + token, http.StatusOK},
+		{http.MethodPost, waf.MetricsPath, bearer, http.StatusNotFound},
+		{http.MethodGet, waf.MetricsPath + "/", bearer, http.StatusNotFound},
 		{http.MethodGet, "/_sww/bans", bearer, http.StatusNotFound},
-		{http.MethodPost, discriminator.HealthPath, "", http.StatusNotFound},
+		{http.MethodPost, waf.HealthPath, "", http.StatusNotFound},
 	} {
 		got := s.ownEndpointRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
@@ -181,7 +181,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	wantMetric(t, s.scrape(), admins, 1)
 
 	// And a ban made through the endpoint.
-	s.admin(http.MethodPost, discriminator.BansPath, banOtherClient, http.StatusOK)
+	s.admin(http.MethodPost, waf.BansPath, banOtherClient, http.StatusOK)
 	wantMetric(t, s.scrape(), admins, 2)
 }
 
@@ -361,12 +361,12 @@ func keptAnswer(addr, country string) lookup.Answer {
 	}
 }
 
-// scrape asks discriminator at addr for the metrics, with the token, and returns
+// scrape asks waf at addr for the metrics, with the token, and returns
 // them.
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
 
-	req := newRequest(t, http.MethodGet, addr, discriminator.MetricsPath, http.NoBody)
+	req := newRequest(t, http.MethodGet, addr, waf.MetricsPath, http.NoBody)
 	req.Header.Set("Authorization", bearer)
 
 	got := do(t, req)
@@ -381,7 +381,7 @@ func scrape(t *testing.T, addr string) string {
 func (s *sender) scrape() string {
 	s.t.Helper()
 
-	return string(s.ownEndpointRequest(bearer, http.MethodGet, discriminator.MetricsPath,
+	return string(s.ownEndpointRequest(bearer, http.MethodGet, waf.MetricsPath,
 		"", http.StatusOK).body)
 }
 

internal/waf/observe_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/proxy.go

@@ -1,7 +1,7 @@
-// Package discriminator is the server the discriminator command runs. It answers
+// Package waf is the server the waf command runs. It answers
 // rproxy's questions, takes rproxy's reports and answers its own endpoints, and
 // writes a log line for each.
-package discriminator
+package waf
 
 import (
 	"fmt"
@@ -25,11 +25,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
-// ownEndpointPrefix starts the path of each of discriminator's own endpoints. The app
+// ownEndpointPrefix starts the path of each of waf's own endpoints. The app
 // never sees a path under it.
 const ownEndpointPrefix = "/_sww/"
 
-// HealthPath is the health endpoint of discriminator and of rproxy, which the
+// HealthPath is the health endpoint of waf and of rproxy, which the
 // container's health check asks.
 const HealthPath = "/_sww/healthz"
 
@@ -41,7 +41,7 @@ const MetricsPath = "/_sww/metrics"
 // a client's address, lifts them, with SWW_ADMIN_TOKEN.
 const BansPath = "/_sww/bans"
 
-// ClientsPath is where an admin asks what discriminator knows of a client, by
+// ClientsPath is where an admin asks what waf knows of a client, by
 // the client's address after it, with SWW_ADMIN_TOKEN.
 const ClientsPath = "/_sww/clients/"
 
@@ -49,7 +49,7 @@ const ClientsPath = "/_sww/clients/"
 type Params struct {
 	Config *config.Config
 	// RequestLog receives two JSON lines per question, one at its decision and
-	// one when its report comes, and one per request to discriminator's own
+	// one when its report comes, and one per request to waf's own
 	// endpoints.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
@@ -73,7 +73,7 @@ type Params struct {
 	// Rules are the rule files' rules, which each request is checked
 	// against.
 	Rules *rules.Files
-	// Alerts receive the alert for each ban discriminator makes or makes
+	// Alerts receive the alert for each ban waf makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
 	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
@@ -83,7 +83,7 @@ type Params struct {
 	Alerts *alerts.Queue
 }
 
-// Server is the server discriminator runs, with the parts whose state the state
+// Server is the server waf runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
 // AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while
@@ -248,7 +248,7 @@ func NewCoreRuleSet(cfg *config.Config) (*coreruleset.CoreRuleSet, error) {
 	return coreRuleSet, nil
 }
 
-// handler is discriminator's handler. It holds what every request shares; what
+// handler is waf's handler. It holds what every request shares; what
 // belongs to one request is in a request.
 type handler struct {
 	config      *config.Config

internal/waf/proxy_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"bufio"
@@ -17,11 +17,11 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -177,9 +177,9 @@ func (o *output) requestLine(t *testing.T) logLine {
 	return o.requestLines(t, 1)[0]
 }
 
-// endedLines waits for count requests that went through rproxy, or to discriminator's
+// endedLines waits for count requests that went through rproxy, or to waf's
 // own endpoints, to have ended, and returns the last log line of each, in the
-// order discriminator took them. A question's last line is the one its report writes.
+// order waf took them. A question's last line is the one its report writes.
 func (o *output) endedLines(t *testing.T, count int) []logLine {
 	t.Helper()
 
@@ -189,7 +189,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine {
 
 		ended := len(found) >= count
 		for _, line := range found[:min(count, len(found))] {
-			if line.DiscriminatorLine == requestlog.DiscriminatorLineDecision {
+			if line.WAFLine == requestlog.WAFLineDecision {
 				ended = false
 			}
 		}
@@ -207,7 +207,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine {
 }
 
 // lastLines returns the last request log line written so far of each request,
-// in the order discriminator took them.
+// in the order waf took them.
 func (o *output) lastLines(t *testing.T) []logLine {
 	t.Helper()
 
@@ -273,9 +273,9 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	return server
 }
 
-// startProxy starts discriminator, and rproxy in front of the app at appURL, each with
+// startProxy starts waf, and rproxy in front of the app at appURL, each with
 // the settings in env on top of the defaults, and returns where rproxy listens
-// and what discriminator writes.
+// and what waf writes.
 func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
 	t.Helper()
 
@@ -295,14 +295,14 @@ func startProxyWithGeoJS(
 }
 
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
-// bans made by the time now tells, and returns discriminator's server as well, whose
-// Addr is where discriminator listens. Unless env sets SWW_RULES_DIR, it is an empty
+// bans made by the time now tells, and returns waf's server as well, whose
+// Addr is where waf listens. Unless env sets SWW_RULES_DIR, it is an empty
 // directory, of no rules, and unless it sets SWW_INSTANCE_NAME, that is app,
 // the label instance of every metric.
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *discriminator.Server) {
+) (string, *output, *waf.Server) {
 	t.Helper()
 
 	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
@@ -311,14 +311,14 @@ func startProxyWithClock(
 }
 
 // startProxyWithAlerts is startProxyWithClock, and returns the queue of
-// the alerts discriminator raises as well, as newDiscriminator makes them.
+// the alerts waf raises as well, as newWAF makes them.
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
-) (string, *output, *discriminator.Server, *alerts.Queue) {
+) (string, *output, *waf.Server, *alerts.Queue) {
 	t.Helper()
 
-	server, out, alertQueue := newDiscriminator(t, geojsURL, now, env)
+	server, out, alertQueue := newWAF(t, geojsURL, now, env)
 	serve(t, server)
 
 	return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue
@@ -326,7 +326,7 @@ func startProxyWithAlerts(
 
 // serve serves server on a port of its own until the test ends, and sets its
 // Addr to where it listens.
-func serve(t *testing.T, server *discriminator.Server) {
+func serve(t *testing.T, server *waf.Server) {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -345,17 +345,17 @@ func serve(t *testing.T, server *discriminator.Server) {
 	})
 }
 
-// startRProxy starts rproxy in front of the app at appURL, asking the discriminator
-// at discriminatorAddr, with the settings in env on top of the defaults, and returns
+// startRProxy starts rproxy in front of the app at appURL, asking the waf
+// at wafAddr, with the settings in env on top of the defaults, and returns
 // where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
 // env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
 func startRProxy(
-	t *testing.T, discriminatorAddr, appURL string, env map[string]string,
+	t *testing.T, wafAddr, appURL string, env map[string]string,
 ) string {
 	t.Helper()
 
 	settings := map[string]string{
-		"SWRP_WAF_BACKEND":  "http://" + discriminatorAddr,
+		"SWRP_WAF_BACKEND":  "http://" + wafAddr,
 		"SWRP_UPSTREAM_URL": appURL,
 		"SWRP_TIMEOUT_MS":   "60000",
 	}
@@ -392,7 +392,7 @@ func startRProxy(
 	return listener.Addr().String()
 }
 
-// newDiscriminator makes discriminator's server, without starting it, and
+// newWAF makes waf's server, without starting it, and
 // returns it, what it writes, and the queue of the alerts it raises, as the
 // settings in env make it. No alert is sent from the queue: they wait in it,
 // for the test to look at.
@@ -402,19 +402,19 @@ func startRProxy(
 // at abuseIPDBURL while env sets SWW_ABUSEIPDB_KEY. SWW_WAF_MODE is off unless
 // env sets it, so that only the tests of the Core Rule Set have their requests
 // inspected by it.
-func newDiscriminator(
+func newWAF(
 	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
-) (*discriminator.Server, *output, *alerts.Queue) {
+) (*waf.Server, *output, *alerts.Queue) {
 	t.Helper()
 
-	return newDiscriminatorWith(t, discriminator.New, geojsURL, now, env)
+	return newWAFWith(t, waf.New, geojsURL, now, env)
 }
 
-// newDiscriminatorWith is newDiscriminator for the server build makes.
-func newDiscriminatorWith(
-	t *testing.T, build func(discriminator.Params) *discriminator.Server,
+// newWAFWith is newWAF for the server build makes.
+func newWAFWith(
+	t *testing.T, build func(waf.Params) *waf.Server,
 	geojsURL string, now func() time.Time, env map[string]string,
-) (*discriminator.Server, *output, *alerts.Queue) {
+) (*waf.Server, *output, *alerts.Queue) {
 	t.Helper()
 
 	settings := map[string]string{
@@ -466,12 +466,12 @@ func newDiscriminatorWith(
 		}
 	}
 
-	coreRuleSet, err := discriminator.NewCoreRuleSet(cfg)
+	coreRuleSet, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
 		t.Fatalf("Core Rule Set: %v", err)
 	}
 
-	server := build(discriminator.Params{
+	server := build(waf.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,
@@ -516,7 +516,7 @@ func readAnswer(res *http.Response) answer {
 	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
 }
 
-// newRequest makes a request for path to addr, where rproxy or discriminator listens.
+// newRequest makes a request for path to addr, where rproxy or waf listens.
 func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
 	t.Helper()
 

internal/waf/ratelimits.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic rate_limits. It reads SWW_RATE_LIMIT_EXEMPT_NETS,
 // SWW_RATE_LIMIT_EXEMPT_PATHS and SWW_BAN_RESPONSE, and the rate limits and

internal/waf/ratelimits_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/refusallimit.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic refusal_limit. It reads SWW_ERROR_BURST_THRESHOLD and
 // SWW_BAN_RESPONSE.
@@ -11,7 +11,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// refusalLimit counts the request once it has been answered, if discriminator
+// refusalLimit counts the request once it has been answered, if waf
 // refused it after a rule file match, a trap path or a Core Rule Set match, and
 // in observe mode if enforce mode would have: more than
 // SWW_ERROR_BURST_THRESHOLD such refusals of the client within a minute break

internal/waf/refusallimit_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"maps"
@@ -10,14 +10,14 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const errorBurstThreshold = "SWW_ERROR_BURST_THRESHOLD"
 
-// refused is a request the tests here send, which discriminator refuses after a rule
+// refused is a request the tests here send, which waf refuses after a rule
 // file match.
 type refused int
 
@@ -52,7 +52,7 @@ func (r refused) send(s *sender, from string) logLine {
 // SWW_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
-) (*sender, *clock, *discriminator.Server) {
+) (*sender, *clock, *waf.Server) {
 	t.Helper()
 
 	settings := map[string]string{

internal/waf/reputation.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // What the reputation heuristics share: blocklists, crowdsec, dnsbl and
 // abuseipdb.

internal/waf/reputation_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"fmt"
@@ -15,10 +15,10 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // The reputation settings.
@@ -125,13 +125,13 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T)
 	for _, tc := range []struct {
 		heuristic string
 		env       map[string]string
-		load      func(*testing.T, *discriminator.Server)
+		load      func(*testing.T, *waf.Server)
 		figures   string
 	}{
 		{
 			"blocklists",
 			map[string]string{blocklistURLs: dropURL, blocklistAction: actionDeny},
-			func(t *testing.T, server *discriminator.Server) {
+			func(t *testing.T, server *waf.Server) {
 				t.Helper()
 				loadLists(t, server, map[string][]string{dropURL: {client}})
 			},
@@ -143,7 +143,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T)
 				dnsblZones: dnsblZone, dnsblResolver: noResolver,
 				reputationAction: actionDeny,
 			},
-			func(_ *testing.T, server *discriminator.Server) {
+			func(_ *testing.T, server *waf.Server) {
 				loadVerdicts(server, map[string][]string{client: {dnsblZone}})
 			},
 			`{"zones": ["` + dnsblZone + `"]}`,
@@ -151,7 +151,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T)
 		{
 			"abuseipdb",
 			map[string]string{abuseIPDBKey: accountKey, reputationAction: actionDeny},
-			func(_ *testing.T, server *discriminator.Server) {
+			func(_ *testing.T, server *waf.Server) {
 				loadScores(server, map[string]int64{client: 80})
 			},
 			`{"score": 80, "min_score": 75}`,
@@ -494,7 +494,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) {
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
-		load func(*discriminator.Server)
+		load func(*waf.Server)
 		want []string
 	}{
 		{
@@ -502,7 +502,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) {
 			map[string]string{
 				dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionLog,
 			},
-			func(server *discriminator.Server) {
+			func(server *waf.Server) {
 				loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}})
 			},
 			[]string{"asn=64496", "country=DE", "dnsbl=" + dnsblZone},
@@ -510,7 +510,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) {
 		{
 			abuseipdb,
 			map[string]string{abuseIPDBKey: accountKey, reputationAction: actionLog},
-			func(server *discriminator.Server) {
+			func(server *waf.Server) {
 				loadScores(server, map[string]int64{fromDE: 80})
 			},
 			[]string{abuseipdb, "asn=64496", "country=DE"},
@@ -715,7 +715,7 @@ const (
 // AbuseIPDB.
 const abuseipdb = reputation.AbuseIPDBSource
 
-// abuseIPDBURL is where newDiscriminator has clients checked with AbuseIPDB: at
+// abuseIPDBURL is where newWAF has clients checked with AbuseIPDB: at
 // abuseIPDBStandIn, which TestMain registers with Go's default transport,
 // through which AbuseIPDB is asked.
 const abuseIPDBURL = "abuseipdb://stand-in/api/v2/check"
@@ -1075,7 +1075,7 @@ func verdictsFetched() time.Time {
 // verdictsFetched, as reputation.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.
-func loadVerdicts(server *discriminator.Server, listedBy map[string][]string) {
+func loadVerdicts(server *waf.Server, listedBy map[string][]string) {
 	verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones()))
 
 	for client, zones := range listedBy {
@@ -1093,7 +1093,7 @@ func loadVerdicts(server *discriminator.Server, listedBy map[string][]string) {
 // loadScores puts into server's AbuseIPDB the score scores gives each
 // client, an IPv4 address, fetched at verdictsFetched, as reputation.json
 // would at start.
-func loadScores(server *discriminator.Server, scores map[string]int64) {
+func loadScores(server *waf.Server, scores map[string]int64) {
 	kept := make([]reputation.Score, 0, len(scores))
 	for client, score := range scores {
 		kept = append(kept, reputation.Score{
@@ -1107,7 +1107,7 @@ func loadScores(server *discriminator.Server, scores map[string]int64) {
 
 // wantAbuseIPDBChecks checks how many clients server has checked with
 // AbuseIPDB.
-func wantAbuseIPDBChecks(t *testing.T, server *discriminator.Server, want int) {
+func wantAbuseIPDBChecks(t *testing.T, server *waf.Server, want int) {
 	t.Helper()
 
 	if got := server.AbuseIPDB.Checked(); got != want {
@@ -1117,7 +1117,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *discriminator.Server, want int) {
 
 // loadLists puts copies of lists into server's lists, by URL, each with
 // its lines, fetched at listsFetched, as reputation.json would at start.
-func loadLists(t *testing.T, server *discriminator.Server, copies map[string][]string) {
+func loadLists(t *testing.T, server *waf.Server, copies map[string][]string) {
 	t.Helper()
 
 	lists := make([]reputation.List, 0, len(copies))

internal/waf/request.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"context"
@@ -17,7 +17,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
-// refusal is discriminator refusing a request: the status the visitor is to get, 0
+// refusal is waf refusing a request: the status the visitor is to get, 0
 // to close its connection without an answer, and the action the log line names.
 type refusal struct {
 	status int
@@ -25,7 +25,7 @@ type refusal struct {
 }
 
 // decision is what the checks note of a request: its log line, and what
-// counting the request needs once it has ended. discriminator keeps a copy of it
+// counting the request needs once it has ended. waf keeps a copy of it
 // until the request's report comes. It holds no credentials, since the log line
 // never does, and neither the request's objects nor their bodies.
 type decision struct {
@@ -34,7 +34,7 @@ type decision struct {
 	// requestURI is the path with the query, as a ban's notes keep it.
 	requestURI string
 	// site is, for a question, the host the visitor asked for, which the
-	// alerts name, since one discriminator serves many sites.
+	// alerts name, since one waf serves many sites.
 	site string
 	// allowed is true for a question answered with DispositionAllow.
 	allowed bool
@@ -63,7 +63,7 @@ type decision struct {
 	reputation []bans.ReputationHit
 }
 
-// request is one request to discriminator, from the moment its headers have been
+// request is one request to waf, from the moment its headers have been
 // read to its log line.
 type request struct {
 	decision
@@ -373,7 +373,7 @@ func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
 	return rq.h.geojs.Kept(rq.h.clientGroup(rq.client))
 }
 
-// responseWriter is discriminator's answer to a request. It notes the status and
+// responseWriter is waf's answer to a request. It notes the status and
 // size for the log line, and the first error writing the answer.
 type responseWriter struct {
 	http.ResponseWriter

internal/waf/requestlog_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"encoding/json"
@@ -11,9 +11,9 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -105,7 +105,7 @@ func wantFullLine(t *testing.T, line logLine) {
 	headers := map[string]string{"accept": "text/html", "x-custom": "one, two"}
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport,
+		Type: requestType, WAFLine: requestlog.WAFLineReport,
 		Time: line.Time, Instance: instance,
 		ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure,
 		Host: appHost, Path: "/full", Protocol: protocol,
@@ -131,7 +131,7 @@ func wantBareLine(t *testing.T, line logLine) {
 	t.Helper()
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport,
+		Type: requestType, WAFLine: requestlog.WAFLineReport,
 		Time: line.Time, Instance: instance,
 		ClientIP: localhost, Method: http.MethodPost, Scheme: plain,
 		Host: appHost, Path: "/bare", Protocol: protocol,
@@ -221,7 +221,7 @@ func TestTimingsAreInOrder(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 	refused := out.endedLines(t, 2)[1]
 
-	wantStatus(t, get(t, server.Addr, discriminator.HealthPath), http.StatusOK)
+	wantStatus(t, get(t, server.Addr, waf.HealthPath), http.StatusOK)
 	health := out.endedLines(t, 3)[2]
 
 	// A request passed to the app has every timing; one refused, none of

internal/waf/routewatchtags.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic routewatch_tags. It reads SWW_ROUTEWATCH_URL.
 

internal/waf/routewatchtags_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"context"
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // routeWatchURL is SWW_ROUTEWATCH_URL, and tagsMissing the log line's field
@@ -58,7 +58,7 @@ func startRouteWatch(t *testing.T, routes map[string]standInRoute) string {
 // waitForRouteWatch waits until routewatch's answer about from, in the client
 // group of the given length, is kept, so that the next request gets its tags.
 func waitForRouteWatch(
-	t *testing.T, server *discriminator.Server, from string, bits int,
+	t *testing.T, server *waf.Server, from string, bits int,
 ) {
 	t.Helper()
 

internal/waf/rulefiles.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic rule_files. It reads the rules of the rule files, which
 // SWW_RULES_DIR and SWW_RULES_ENABLED name.

internal/waf/rulefiles_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/staticlists_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/tagdeny.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic tag_deny. It reads SWW_TAG_DENY.
 

internal/waf/tagdeny_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/taglists.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic tag_lists. It reads the address lists of SWW_TAG_LISTS through
 // the reputation lists.

internal/waf/taglists_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/trappaths.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 // The heuristic trap_paths. It reads SWW_TRAP_PATHS.
 

internal/waf/trappaths_test.go

@@ -1,4 +1,4 @@
-package discriminator_test
+package waf_test
 
 import (
 	"net/http"

internal/waf/waf.go

@@ -1,4 +1,4 @@
-package discriminator
+package waf
 
 import (
 	"bytes"
@@ -18,8 +18,8 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The headers of rproxy's question and of discriminator's answer, as
-// "discriminator" in SPEC.md gives them.
+// The headers of rproxy's question and of waf's answer, as
+// "waf" in SPEC.md gives them.
 const (
 	// ClientHeader marks a request as rproxy's question, and gives the
 	// visitor's address.
@@ -28,7 +28,7 @@ const (
 	PeerHeader = "X-Sww-Peer"
 	// ContentLengthHeader gives the body length the visitor announced.
 	ContentLengthHeader = "X-Sww-Content-Length"
-	// DispositionHeader gives discriminator's answer.
+	// DispositionHeader gives waf's answer.
 	DispositionHeader = "X-Sww-Disposition"
 )
 
@@ -41,12 +41,12 @@ const (
 	DispositionDeny = "deny"
 	// DispositionClose tells rproxy to close the visitor's connection
 	// without an answer, which SWW_BAN_RESPONSE asks for when it is close.
-	// discriminator closing the question's connection instead would read as
-	// discriminator being down, and rproxy would then let the request through.
+	// waf closing the question's connection instead would read as
+	// waf being down, and rproxy would then let the request through.
 	DispositionClose = "close"
 )
 
-// ReportPath is where rproxy sends the report of each request discriminator
+// ReportPath is where rproxy sends the report of each request waf
 // answered.
 const ReportPath = "/_sww/report"
 
@@ -70,11 +70,11 @@ const (
 	// maxReportedMilliseconds is the longest duration a report may give,
 	// about 31 years, so that it fits a time.Duration.
 	maxReportedMilliseconds = 1e12
-	// discriminatorTimeout bounds how long a request to discriminator takes to
-	// arrive, and its answer to leave, and discriminatorIdleTimeout how long a
+	// wafTimeout bounds how long a request to waf takes to
+	// arrive, and its answer to leave, and wafIdleTimeout how long a
 	// kept-open connection waits for its next request.
-	discriminatorTimeout     = 60 * time.Second
-	discriminatorIdleTimeout = 120 * time.Second
+	wafTimeout     = 60 * time.Second
+	wafIdleTimeout = 120 * time.Second
 )
 
 var (
@@ -97,7 +97,7 @@ type Report struct {
 	DurationUpstreamTotalMS float64 `json:"duration_upstream_total_ms"`
 }
 
-// New returns the server `sww discriminator` runs. It answers
+// New returns the server `sww waf` runs. It answers
 // rproxy's questions, takes rproxy's reports and answers its own endpoints. It
 // passes nothing to an app. rproxy applies the size and time limits to the
 // visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
@@ -111,9 +111,9 @@ func New(params Params) *Server {
 			Addr:         params.Config.ListenAddr,
 			Handler:      h,
 			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
-			ReadTimeout:  discriminatorTimeout,
-			WriteTimeout: discriminatorTimeout,
-			IdleTimeout:  discriminatorIdleTimeout,
+			ReadTimeout:  wafTimeout,
+			WriteTimeout: wafTimeout,
+			IdleTimeout:  wafIdleTimeout,
 		},
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
@@ -128,8 +128,8 @@ func New(params Params) *Server {
 	}
 }
 
-// ServeHTTP handles one request to discriminator: a request carrying
-// ClientHeader is rproxy's question, and any other is for discriminator
+// ServeHTTP handles one request to waf: a request carrying
+// ClientHeader is rproxy's question, and any other is for waf
 // itself.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if len(r.Header.Values(ClientHeader)) > 0 {
@@ -146,7 +146,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // its client: the heuristic crowdsec, header_limits, blocklists or rate_limits
 // will refuse it, as a function in that heuristic's file says. In observe mode,
 // which refuses nothing, none is. rproxy lets a request through when
-// discriminator answers too late.
+// waf answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
@@ -180,7 +180,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 	defer rq.finish()
 
 	rq.site = r.Host
-	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineDecision
+	rq.line.WAFLine = requestlog.WAFLineDecision
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
 	underOwnPrefix := strings.HasPrefix(r.URL.Path, ownEndpointPrefix)
@@ -206,7 +206,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// The app never sees this prefix. discriminator's own endpoints are at its
+	// The app never sees this prefix. waf's own endpoints are at its
 	// own address, so this answers as a path with no endpoint does.
 	rq.line.Action = requestlog.ActionOwnEndpoint
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
@@ -214,7 +214,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 }
 
 // readQuestion returns the visitor's address and the body a question carries,
-// and whether discriminator takes the question. It answers a question it does not
+// and whether waf takes the question. It answers a question it does not
 // take with 400 and no disposition, which rproxy treats as it treats no
 // answer. The id of a question it takes is held from here on, without a
 // decision yet, so that another question with that id is refused while this
@@ -257,7 +257,7 @@ func (h *handler) readQuestion(
 
 	held, _ := h.awaitingReport.ContainsOrAdd(id, nil)
 	if held {
-		h.refuseQuestion(w, requestIDHeader+" is the id of a request discriminator holds")
+		h.refuseQuestion(w, requestIDHeader+" is the id of a request waf holds")
 
 		return netip.Addr{}, nil, false
 	}
@@ -265,14 +265,14 @@ func (h *handler) readQuestion(
 	return client, body, true
 }
 
-// refuseQuestion answers a question discriminator does not take, for reason.
+// refuseQuestion answers a question waf does not take, for reason.
 func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) {
 	h.processLog.Warn("a question is refused", "reason", reason)
 	http.Error(w, reason, http.StatusBadRequest)
 }
 
 // asTheVisitorSentIt returns a copy of r, a question, as the checks and the
-// log line are to see it: without the headers rproxy adds for discriminator,
+// log line are to see it: without the headers rproxy adds for waf,
 // with body, which has been read of r, and with the length the visitor
 // announced, as -1 when it announced none. The question's own length covers
 // only the part of the body it carries.
@@ -340,7 +340,7 @@ func (rq *request) deny(r refusal) {
 	http.Error(rq.out, http.StatusText(r.status), r.status)
 }
 
-// answerOwnEndpoint answers a request to discriminator's own address. No check
+// answerOwnEndpoint answers a request to waf's own address. No check
 // runs on it: the address is on the private network, where the peers are
 // rproxy and the admin's tools, not visitors.
 func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) {
@@ -455,7 +455,7 @@ func (h *handler) finishWith(ctx context.Context, held *decision, report Report)
 		requestBytes: report.RequestBytes,
 	}
 
-	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineReport
+	rq.line.WAFLine = requestlog.WAFLineReport
 	rq.line.Status = report.Status
 	rq.line.RequestBytes = report.RequestBytes
 	rq.line.ResponseBytes = report.ResponseBytes