Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/bans/bans.go

@@ -1,6 +1,6 @@
 // Package bans is the ban ledger: the bans sww makes on the
-// netblocks of clients that break a rate limit, a byte limit or the error
-// burst, show a clear sign of attack or are listed by the CrowdSec
+// netblocks of clients that break a rate limit, a byte limit or the refusal
+// limit, show a clear sign of attack or are listed by the CrowdSec
 // decision list, and
 // those an admin makes, with their notes, as the "Bans" section of SPEC.md
 // describes. The bans are kept in memory, and written to bans.json and
@@ -49,9 +49,9 @@ type Params struct {
 	// CrowdSec's decision, a broken limit counts as a repeat, which bans for
 	// repeatFactor times as long as that ban.
 	LimitBanRepeatWindow time.Duration
-	// MaxBanDuration is the longest ban for a broken limit; one that would
-	// be longer is permanent instead.
-	MaxBanDuration time.Duration
+	// A ban for a broken limit that would be longer than
+	// LimitBanPermanentAbove is permanent instead.
+	LimitBanPermanentAbove time.Duration
 	// AttackBanDuration is how long a first ban for a clear sign of attack
 	// lasts.
 	AttackBanDuration time.Duration
@@ -105,7 +105,7 @@ type Notes struct {
 	Country string `json:"country"`
 	// Kind, Limit, Window and Count are, for a ban for a broken limit,
 	// what the limit was on, "requests" for a rate limit, "bytes" for a
-	// byte limit or "refusals" for the error burst, the limit that was
+	// byte limit or "refusals" for the refusal limit, the limit that was
 	// broken, its window, "minute", "hour" or "day", and the count reached:
 	// the client's requests, bytes or refusals in the window, those of the
 	// request that broke the limit included.
@@ -306,7 +306,7 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 // last, other than one for a clear sign of attack or for CrowdSec's
 // decision, or a lifted one, lasts
 // repeatFactor times as long as that one. A ban that would be longer
-// than MaxBanDuration is permanent instead. If a ban on netblock is still
+// than LimitBanPermanentAbove is permanent instead. If a ban on netblock is still
 // active, as when two of its requests break a limit at once, that ban is
 // returned with false, and no other is made. The ledger fills in the
 // notes' Refused and EarlierBans itself, and gives the ban the reason
@@ -932,16 +932,16 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	if last != nil &&
 		now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
-		// This is repeatFactor * lastLength > MaxBanDuration, written so
+		// This is repeatFactor * lastLength > LimitBanPermanentAbove, written so
 		// that it cannot overflow.
-		if lastLength > l.params.MaxBanDuration/repeatFactor {
+		if lastLength > l.params.LimitBanPermanentAbove/repeatFactor {
 			return time.Time{}
 		}
 
 		length = repeatFactor * lastLength
 	}
 
-	if length > l.params.MaxBanDuration {
+	if length > l.params.LimitBanPermanentAbove {
 		return time.Time{}
 	}