Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/proxy_test.go

@@ -56,35 +56,35 @@ const (
 
 // The settings the tests set.
 const (
-	mode                 = "SWW_WAF_MODE"
-	trustedProxies       = "SWW_RPROXY_TRUSTED_PROXIES"
-	ipv6GroupPrefix      = "SWW_WAF_IPV6_GROUP_PREFIX"
-	maxTrackedClients    = "SWW_WAF_MAX_TRACKED_CLIENTS"
-	allowNets            = "SWW_WAF_ALLOW_NETS"
-	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
-	denyNets             = "SWW_WAF_DENY_NETS"
-	rateLimitPerMinute   = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
-	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
-	lookupTimeout        = "SWW_WAF_LOOKUP_TIMEOUT"
-	addLookupHeaders     = "SWW_WAF_ADD_LOOKUP_HEADERS"
-	tagDeny              = "SWW_WAF_TAG_DENY"
+	mode                       = "SWW_WAF_MODE"
+	trustedProxies             = "SWW_RPROXY_TRUSTED_PROXIES"
+	ipv6GroupPrefix            = "SWW_WAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients          = "SWW_WAF_MAX_TRACKED_CLIENTS"
+	allowNets                  = "SWW_WAF_ALLOW_NETS"
+	rateLimitExemptNets        = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets                   = "SWW_WAF_DENY_NETS"
+	rateLimitPerMinute         = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerDay            = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths       = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
+	lookupSource               = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath               = "SWW_WAF_LOOKUP_DB_PATH"
+	asnAndCountryLookupTimeout = "SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS"
+	addLookupHeaders           = "SWW_WAF_ADD_LOOKUP_HEADERS"
+	tagDeny                    = "SWW_WAF_TAG_DENY"
 	// denyKP is the value of SWW_WAF_TAG_DENY that refuses fromKP's country.
-	denyKP               = "country=KP"
-	allowedCountries     = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	banResponse          = "SWW_WAF_BAN_RESPONSE"
-	limitBanDuration     = "SWW_WAF_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration       = "SWW_WAF_MAX_BAN_DURATION"
-	maxBans              = "SWW_WAF_MAX_BANS"
-	banScopeV4Prefix     = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
-	instanceName         = "SWW_WAF_INSTANCE_NAME"
-	logRequestHeaders    = "SWW_WAF_LOG_REQUEST_HEADERS"
-	attackBanDuration    = "SWW_WAF_ATTACK_BAN_DURATION"
-	rulesDir             = "SWW_WAF_RULES_DIR"
-	wafMode              = "SWW_WAF_CORE_RULE_SET_MODE"
+	denyKP                 = "country=KP"
+	allowedCountries       = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse            = "SWW_WAF_BAN_RESPONSE"
+	limitBanDuration       = "SWW_WAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow   = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
+	limitBanPermanentAbove = "SWW_WAF_LIMIT_BAN_PERMANENT_ABOVE"
+	maxBans                = "SWW_WAF_MAX_BANS"
+	banScopeV4Prefix       = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
+	instanceName           = "SWW_WAF_INSTANCE_NAME"
+	logRequestHeaders      = "SWW_WAF_LOG_REQUEST_HEADERS"
+	attackBanDuration      = "SWW_WAF_ATTACK_BAN_DURATION"
+	ruleFilesDir           = "SWW_WAF_RULE_FILES_DIR"
+	coreRuleSetMode        = "SWW_WAF_CORE_RULE_SET_MODE"
 )
 
 // off is the value that switches a setting off.
@@ -301,7 +301,7 @@ func startProxyWithGeoJS(
 
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
 // bans made by the time now tells, and returns waf's server as well, whose
-// Addr is where waf listens. Unless env sets SWW_WAF_RULES_DIR, it is an empty
+// Addr is where waf listens. Unless env sets SWW_WAF_RULE_FILES_DIR, it is an empty
 // directory, of no rules, and unless it sets SWW_WAF_INSTANCE_NAME, that is app,
 // the label instance of every metric.
 func startProxyWithClock(
@@ -362,17 +362,19 @@ func serve(t *testing.T, server *waf.Server) {
 
 // startRProxy starts rproxy in front of the app at appURL, asking the waf
 // at wafAddr, with the settings in env on top of the defaults, and returns
-// where it listens. What it writes is dropped. SWW_RPROXY_TIMEOUT_MS is a minute unless
-// env sets it, so that on a busy host SWW_RPROXY_DEFAULT_DISPOSITION does not decide.
+// where it listens. What it writes is dropped.
+// SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS is a minute unless env sets it, so that
+// on a busy host SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION does not
+// decide.
 func startRProxy(
 	t *testing.T, wafAddr, appURL string, env map[string]string,
 ) string {
 	t.Helper()
 
 	settings := map[string]string{
-		"SWW_RPROXY_WAF_BACKEND":  "http://" + wafAddr,
-		"SWW_RPROXY_UPSTREAM_URL": appURL,
-		"SWW_RPROXY_TIMEOUT_MS":   "60000",
+		"SWW_RPROXY_WAF_BACKEND":            "http://" + wafAddr,
+		"SWW_RPROXY_UPSTREAM_URL":           appURL,
+		"SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS": "60000",
 	}
 	maps.Copy(settings, env)
 
@@ -440,7 +442,7 @@ func newWAFWith(
 	t.Helper()
 
 	settings := map[string]string{
-		rulesDir: t.TempDir(), instanceName: "app", wafMode: off,
+		ruleFilesDir: t.TempDir(), instanceName: "app", coreRuleSetMode: off,
 	}
 	if geojsURL == "" {
 		settings[lookupSource] = off
@@ -448,7 +450,7 @@ func newWAFWith(
 
 	maps.Copy(settings, env)
 
-	cfg, err := config.FromEnvironment(configtest.Viper(settings))
+	cfg, err := config.WAFFromEnvironment(configtest.Viper(settings))
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}
@@ -461,7 +463,7 @@ func newWAFWith(
 	)
 
 	ruleFiles, err := rules.Load(rules.Params{
-		Dir: cfg.RulesDir, Enabled: cfg.RulesEnabled, ProcessLog: processLog,
+		Dir: cfg.RuleFilesDir, Enabled: cfg.RuleFilesEnabled, ProcessLog: processLog,
 	})
 	if err != nil {
 		t.Fatalf("rule files: %v", err)