Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

internal/waf/staticlists_test.go

@@ -0,0 +1,180 @@
+package waf_test
+
+import (
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The rate limits count an IPv6 client by its /64, so these two addresses
+// are one client for them. The static lists match each address on its own,
+// and the tests list listedAddr alone.
+const (
+	listedAddr   = "2001:db8::1"
+	unlistedAddr = "2001:db8::2"
+)
+
+func TestAllowNetsSkipEveryCheck(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	geojsURL, asked := startGeoJS(t)
+	// fromKP is in SWW_ALLOW_NETS, and in SWW_DENY_NETS too, which
+	// comes after it.
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		allowNets:          "198.51.100.0/24",
+		denyNets:           fromKP,
+		tagDeny:            denyKP,
+		rateLimitPerMinute: "1",
+	})
+
+	// Neither SWW_DENY_NETS, SWW_TAG_DENY nor the limit of one request a
+	// minute refuses the client, and its country is not looked up.
+	wantAnswers(t, addr, out, []sentRequest{
+		{fromKP, http.StatusOK, requestlog.ActionForward},
+		{fromKP, http.StatusOK, requestlog.ActionForward},
+	})
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+
+	if calls.Load() != 2 {
+		t.Errorf("the app was called %d times, want 2", calls.Load())
+	}
+}
+
+func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		allowNets:          listedAddr,
+		rateLimitPerMinute: "1",
+	})
+
+	// listedAddr's requests are not counted, so the first request from
+	// unlistedAddr is within the limit of one a minute.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+	})
+}
+
+func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	geojsURL, asked := startGeoJS(t)
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies: trustLocalhost,
+		denyNets:       "203.0.113.0/24",
+		tagDeny:        denyKP,
+	})
+
+	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
+	req.Header.Set(forwardedFor, fromDE)
+	wantStatus(t, do(t, req), http.StatusForbidden)
+
+	line := out.endedLine(t)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionClientDenied)
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+
+	if calls.Load() != 0 {
+		t.Errorf("the app was called %d times, want none", calls.Load())
+	}
+}
+
+func TestDenyNetsRefusalNamesItsHeuristicAndNetblock(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{denyNets: clientsNet})
+
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
+	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+clientsNet+`"}`)
+}
+
+func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		denyNets:           listedAddr,
+		rateLimitPerMinute: "1",
+	})
+
+	// listedAddr's refused requests are not counted, so the first request
+	// from unlistedAddr is within the limit of one a minute.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+	})
+}
+
+func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	geojsURL, _ := startGeoJS(t)
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:      trustLocalhost,
+		lookupTimeout:       "1h",
+		rateLimitExemptNets: listedAddr + "," + fromKP,
+		tagDeny:             denyKP,
+		rateLimitPerMinute:  "1",
+	})
+
+	// listedAddr's requests are neither refused nor counted, so the first
+	// request from unlistedAddr is within the limit of one a minute.
+	// SWW_TAG_DENY still refuses an exempt client.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{fromKP, http.StatusForbidden, requestlog.ActionClientDenied},
+	})
+}
+
+// sentRequest is a GET request from client, as X-Forwarded-For names it,
+// and the status and log line action it should get.
+type sentRequest struct {
+	client string
+	status int
+	action string
+}
+
+// wantAnswers sends requests to sww at addr one after another and
+// checks each one's answer and log line. They must be the first requests
+// sww is sent, since the log lines are matched to them in order.
+func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest) {
+	t.Helper()
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.status)
+		wantLine(t, out.endedLines(t, i+1)[i], sent.status, sent.action)
+	}
+}