Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/bans/bans.go

@@ -40,8 +40,8 @@ const repeatFactor = 3
 // maxTextBytes is how much of each text in a ban's notes is kept.
 const maxTextBytes = 256
 
-// Rules are how long a ban lasts, and how many bans are held.
-type Rules struct {
+// Params are how long a ban lasts, and how many bans are held.
+type Params struct {
 	// LimitBanDuration is how long a first ban for a broken limit lasts.
 	LimitBanDuration time.Duration
 	// LimitBanRepeatWindow is how soon after the end of the netblock's
@@ -180,7 +180,7 @@ type Request struct {
 
 // Ledger holds the bans. It is safe for concurrent use.
 type Ledger struct {
-	rules Rules
+	params Params
 	// changed receives a value when a ban is made, unless one is waiting
 	// already.
 	changed chan struct{}
@@ -190,7 +190,7 @@ type Ledger struct {
 	// Find make each netblock they find the most recently seen.
 	netblocks *simplelru.LRU[netip.Prefix, *[]Ban]
 	// held is how many bans netblocks holds whose cause is not CauseAdmin,
-	// at most rules.MaxBans.
+	// at most params.MaxBans.
 	held int
 	// made is how many bans have been made since the start, by cause: by
 	// the ledger, and by an admin, through BanForAdmin or in an edit of
@@ -205,7 +205,7 @@ type Ledger struct {
 }
 
 // New returns a Ledger with no ban yet.
-func New(rules Rules) *Ledger {
+func New(params Params) *Ledger {
 	// The ledger drops bans itself, and never those whose cause is
 	// CauseAdmin, however many there are, so the LRU has no limit of its
 	// own: it keeps the netblocks in the order they were last seen.
@@ -215,7 +215,7 @@ func New(rules Rules) *Ledger {
 	}
 
 	return &Ledger{
-		rules:     rules,
+		params:    params,
 		changed:   make(chan struct{}, 1),
 		netblocks: netblocks,
 		made:      map[string]int{},
@@ -812,7 +812,7 @@ func (l *Ledger) covering(client netip.Addr) []*[]Ban {
 // unless ban's cause is CauseAdmin, which does not count toward MaxBans.
 func (l *Ledger) add(ban Ban) {
 	counted := ban.Cause != CauseAdmin
-	if counted && l.held == l.rules.MaxBans {
+	if counted && l.held == l.params.MaxBans {
 		l.dropOne()
 	}
 
@@ -847,7 +847,7 @@ func (l *Ledger) add(ban Ban) {
 // new ban longer. A ban an admin adds to bans.json can start after
 // another and end before it, so that one is looked for among them all.
 func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
-	length := l.rules.LimitBanDuration
+	length := l.params.LimitBanDuration
 
 	var last *Ban
 
@@ -858,18 +858,18 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 		}
 	}
 
-	if last != nil && now.Sub(last.Expires) <= l.rules.LimitBanRepeatWindow {
+	if last != nil && now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
 		// This is repeatFactor * lastLength > MaxBanDuration, written so
 		// that it cannot overflow.
-		if lastLength > l.rules.MaxBanDuration/repeatFactor {
+		if lastLength > l.params.MaxBanDuration/repeatFactor {
 			return time.Time{}
 		}
 
 		length = repeatFactor * lastLength
 	}
 
-	if length > l.rules.MaxBanDuration {
+	if length > l.params.MaxBanDuration {
 		return time.Time{}
 	}
 
@@ -887,7 +887,7 @@ func (l *Ledger) attackExpiry(held []Ban, now time.Time) time.Time {
 		}
 	}
 
-	return now.Add(l.rules.AttackBanDuration)
+	return now.Add(l.params.AttackBanDuration)
 }
 
 // dropOne drops the earliest ban whose cause is not CauseAdmin of the