Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/coreruleset.go

@@ -1,7 +1,7 @@
 package waf
 
 // The heuristic core_rule_set. It reads SWW_WAF_CORE_RULE_SET_MODE,
-// SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS and SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
+// SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS and SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD.
 
 import (
 	"context"
@@ -17,7 +17,7 @@ import (
 // SWW_WAF_CORE_RULE_SET_MODE is off or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS
 // exempts its path, as pathExempt decides, and notes the rules it matched and
 // its score in the log line, and the rules in the metrics. A score at or over
-// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD is a match: it adds the tag
+// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD is a match: it adds the tag
 // exploitsignature, raises the core_rule_set_match alert, and in block mode
 // refuses the request with 403, which is an offence its client's history
 // counts. Its figures are the score and the threshold.
@@ -31,8 +31,8 @@ func (coreRuleSet) check(
 	_ time.Time,
 ) *verdict {
 	cfg := rq.h.config
-	if cfg.WAFMode == config.WAFModeOff ||
-		pathExempt(rq.in, cfg.WAFExemptPaths) {
+	if cfg.CoreRuleSetMode == config.CoreRuleSetModeOff ||
+		pathExempt(rq.in, cfg.CoreRuleSetExemptPaths) {
 		return nil
 	}
 
@@ -50,10 +50,10 @@ func (coreRuleSet) check(
 	rq.line.CoreRuleSetScore = &result.Score
 
 	for _, id := range result.RuleIDs {
-		rq.h.metrics.CoreRuleSetMatched(cfg.WAFMode, id)
+		rq.h.metrics.CoreRuleSetMatched(cfg.CoreRuleSetMode, id)
 	}
 
-	threshold := cfg.WAFAnomalyThreshold
+	threshold := cfg.CoreRuleSetScoreThreshold
 	if threshold == 0 || result.Score < threshold {
 		return nil
 	}
@@ -61,7 +61,7 @@ func (coreRuleSet) check(
 	rq.addTag(config.ExploitSignatureTag)
 	rq.alertCoreRuleSetMatch(result)
 
-	if cfg.WAFMode == config.WAFModeDetect {
+	if cfg.CoreRuleSetMode == config.CoreRuleSetModeDetect {
 		return nil
 	}
 
@@ -78,7 +78,7 @@ func (coreRuleSet) check(
 
 // alertCoreRuleSetMatch raises the core_rule_set_match alert for the request,
 // which the Core Rule Set scored at result, at or over
-// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD. Its detail gives the rule ids, the
+// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD. Its detail gives the rule ids, the
 // score, the method and the path with the query, and, for a request that is
 // not refused for it, the mode: detect, or observe in observe mode.
 func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
@@ -90,8 +90,8 @@ func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
 	}
 
 	switch {
-	case rq.h.config.WAFMode == config.WAFModeDetect:
-		detail["mode"] = config.WAFModeDetect
+	case rq.h.config.CoreRuleSetMode == config.CoreRuleSetModeDetect:
+		detail["mode"] = config.CoreRuleSetModeDetect
 	case rq.h.config.Observe:
 		detail["mode"] = "observe"
 	}
@@ -105,7 +105,7 @@ func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
 		ASName:   rq.line.ASName,
 		Country:  rq.line.Country,
 		Reason: "scored by the Core Rule Set at or over " +
-			"SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD",
+			"SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD",
 		Detail: detail,
 	})
 }