Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/answertime_test.go

@@ -29,12 +29,12 @@ import (
 )
 
 const (
-	// answerTimeLimit is the default of rproxy's SWW_RPROXY_TIMEOUT_MS, the time
-	// waf has to answer.
+	// answerTimeLimit is the default of rproxy's
+	// SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS, the time waf has to answer.
 	answerTimeLimit = 2 * time.Second
-	// defaultLookupWait is the default of SWW_WAF_LOOKUP_TIMEOUT.
+	// defaultLookupWait is the default of SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS.
 	defaultLookupWait = 800 * time.Millisecond
-	// defaultReputationWait is the default of SWW_WAF_REPUTATION_TIMEOUT.
+	// defaultReputationWait is the default of SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS.
 	defaultReputationWait = 2 * time.Second
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
@@ -80,7 +80,7 @@ func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(
 ) {
 	t.Parallel()
 
-	s := startWAF(t, "", map[string]string{wafMode: block})
+	s := startWAF(t, "", map[string]string{coreRuleSetMode: block})
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
@@ -160,7 +160,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			s := startWAF(t, "", map[string]string{wafMode: block})
+			s := startWAF(t, "", map[string]string{coreRuleSetMode: block})
 			req := s.question(siteA, client, "/")
 			tc.make(req)
 
@@ -195,9 +195,9 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 	t.Parallel()
 
 	for _, env := range []map[string]string{
-		{wafMode: off},
-		{wafMode: "detect"},
-		{wafMode: block, "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS": "/"},
+		{coreRuleSetMode: off},
+		{coreRuleSetMode: "detect"},
+		{coreRuleSetMode: block, "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS": "/"},
 	} {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
@@ -217,7 +217,7 @@ func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 	s := startWAF(
 		t,
 		"",
-		map[string]string{wafMode: block, allowNets: client},
+		map[string]string{coreRuleSetMode: block, allowNets: client},
 	)
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
@@ -228,7 +228,11 @@ func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
 func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	t.Parallel()
 
-	s := startWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	s := startWAF(
+		t,
+		"",
+		map[string]string{mode: observe, coreRuleSetMode: block},
+	)
 	req := s.question(siteA, client, "/")
 	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
 
@@ -298,7 +302,7 @@ func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
 		},
 		{
 			"a DNS blocklist", map[string]string{
-				dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionDeny,
+				dnsblZones: dnsblZone, dnsblResolver: noResolver, dnsblAbuseIPDBAction: actionDeny,
 			},
 			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
 				loadVerdicts(server, map[string][]string{client: {dnsblZone}})
@@ -306,7 +310,7 @@ func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
 		},
 		{
 			"AbuseIPDB",
-			map[string]string{abuseIPDBKey: accountKey, reputationAction: actionDeny},
+			map[string]string{abuseIPDBKey: accountKey, dnsblAbuseIPDBAction: actionDeny},
 			"/", func(_ *testing.T, server *waf.Server, _ time.Time) {
 				// Over SWW_WAF_ABUSEIPDB_MIN_SCORE, 75 by default.
 				loadScores(server, map[string]int64{client: 80})
@@ -325,7 +329,9 @@ func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
 			leaveAsItIs,
 		},
 		{
-			"a block rule", map[string]string{rulesDir: writeRules(t, testRules)}, "/blocked",
+			"a block rule",
+			map[string]string{ruleFilesDir: writeRules(t, testRules)},
+			"/blocked",
 			leaveAsItIs,
 		},
 	} {
@@ -366,9 +372,9 @@ func TestARequestOverTheHeaderLimitsRunsNoOtherCheck(t *testing.T) {
 			t,
 			map[string]standInRoute{client: {prefixDE, 64496}},
 		),
-		dnsblZones: dnsblZone, reputationAction: actionLog,
-		rulesDir: writeRules(t, "noted path log ^/\n"),
-		wafMode:  block,
+		dnsblZones: dnsblZone, dnsblAbuseIPDBAction: actionLog,
+		ruleFilesDir:    writeRules(t, "noted path log ^/\n"),
+		coreRuleSetMode: block,
 	})
 	loadLists(t, s.server, map[string][]string{vpnList: {client}})
 	loadVerdicts(s.server, map[string][]string{client: {dnsblZone}})
@@ -426,7 +432,9 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	// not wait.
 	geojsURL, _ := startGeoJS(t)
 	s := startWAF(t, geojsURL, map[string]string{
-		unknownLimitPercent: "0", lookupTimeout: "1h", rateLimitPerMinute: "1",
+		unknownCountryLimitPercent: "0",
+		asnAndCountryLookupTimeout: "3600000",
+		rateLimitPerMinute:         "1",
 	})
 	countClient(t, s.server, s.clock.Now())
 
@@ -459,7 +467,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(
 	// not wait.
 	geojsURL, _ := startGeoJS(t)
 	s := startWAF(t, geojsURL, map[string]string{
-		unknownLimitPercent: "0", rateLimitPerMinute: "1",
+		unknownCountryLimitPercent: "0", rateLimitPerMinute: "1",
 	})
 	s.server.GeoJS.Load([]lookup.Answer{{
 		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
@@ -494,7 +502,7 @@ func TestObserveModeAsksGeoJSNothingForARequestOverTheHeaderLimits(
 
 	geojsURL, asked := startGeoJS(t)
 	s := startWAF(t, geojsURL, map[string]string{
-		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
+		mode: observe, addLookupHeaders: on, asnAndCountryLookupTimeout: "3600000",
 	})
 	req := s.question(siteA, fromDE, "/")
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
@@ -622,8 +630,10 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 			action: requestlog.ActionClientIsRateLimited,
 		},
 		{
-			name:    "the rate limits, with a biased threshold",
-			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
+			name: "the rate limits, with a biased threshold",
+			env: map[string]string{
+				rateLimitPerMinute: "1", unknownCountryLimitPercent: "50",
+			},
 			prepare: countClient, status: forbidden,
 			action: requestlog.ActionClientIsRateLimited,
 		},
@@ -759,7 +769,7 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
 
 		return waf.New(params)
 	}, silentGeoJSURL, time.Now, map[string]string{
-		tagDeny: "country=KP", wafMode: block,
+		tagDeny: "country=KP", coreRuleSetMode: block,
 		dnsblZones: dnsblZone, dnsblResolver: resolver,
 		abuseIPDBKey:  accountKey,
 		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",