Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,9 +1,9 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the five changes sww
-// makes to it, the fixes for the apps SWW_WAF_APPS names, and the exclusions in
-// SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
-// in SPEC.md describes them. It reads no response.
+// body while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, with the
+// five changes sww makes to it, the fixes for the apps SWW_WAF_APPS names,
+// and the exclusions in SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack
+// detection" under "Settings" in SPEC.md describes them. It reads no response.
 //
 // sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -34,8 +34,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second,
-// and the directives of every app in apps for the third.
+// SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, the exclusions file for
+// the second, and the directives of every app in apps for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
@@ -43,7 +43,7 @@ import (
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -224,9 +224,10 @@ type Params struct {
 	// DisabledRules are the ids of the rules switched off
 	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
-	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
-	BodyLimit int64
+	// BodyInspectionSize is the most of a request body the Core Rule Set
+	// reads (SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE), 0 while it is off
+	// and it reads none.
+	BodyInspectionSize int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
 	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
@@ -351,8 +352,8 @@ type CoreRuleSet struct {
 // it.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
-	if params.BodyLimit > 0 {
-		body = fmt.Sprintf(bodyDirectives, params.BodyLimit)
+	if params.BodyInspectionSize > 0 {
+		body = fmt.Sprintf(bodyDirectives, params.BodyInspectionSize)
 	}
 
 	exclusions := ""
@@ -397,7 +398,7 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	return &CoreRuleSet{
 		engine:         engine,
-		bodyLimit:      params.BodyLimit,
+		bodyLimit:      params.BodyInspectionSize,
 		appsByHostname: params.Apps,
 	}, nil
 }
@@ -481,10 +482,11 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
-// of a kind the Core Rule Set reads: form data and multipart, of which it
-// reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
-// when they are no longer than that, since they cannot be read in part.
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
+// set and the body is of a kind the Core Rule Set reads: form data and
+// multipart, of which it reads the first c.bodyLimit bytes, and JSON and
+// XML, which it reads only when they are no longer than that, since they
+// cannot be read in part.
 // readBody reads one byte past the limit, to tell which they are, gives
 // the Core Rule Set what it reads, and returns what it read and the error
 // that ended the reading early, if one did.