Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/request.go

@@ -48,16 +48,16 @@ type decision struct {
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
-	// the byte limits count once it has ended. limitPercent and
-	// bytesPercent are then its client's limit percentages for the rate
+	// the byte limits count once it has ended. rateLimitPercent and
+	// bytesLimitPercent are then its client's limit percentages for the rate
 	// limits and for the byte limits.
-	counted                    bool
-	limitPercent, bytesPercent percentage
+	counted                             bool
+	rateLimitPercent, bytesLimitPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
 	// trap path, blockedByBlockRule for one a block rule refused, and
-	// wafBlocked for one the Core Rule Set refused, each an offence its
-	// client's history counts.
-	attack, blockedByBlockRule, wafBlocked bool
+	// blockedByCoreRuleSet for one the Core Rule Set refused, each an offence
+	// its client's history counts.
+	attack, blockedByBlockRule, blockedByCoreRuleSet bool
 	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
@@ -188,7 +188,7 @@ func (rq *request) check(ctx context.Context) *refusal {
 
 		return nil
 	case action == requestlog.ActionBlockedByBlockRule ||
-		action == requestlog.ActionWAFBlocked:
+		action == requestlog.ActionBlockedByCoreRuleSet:
 		return &refusal{status: http.StatusForbidden, action: action}
 	case action == requestlog.ActionRequestHeaderTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
@@ -262,8 +262,8 @@ func (rq *request) finish() {
 	}
 
 	duration := time.Since(rq.start)
-	line.DurationTotal = requestlog.Milliseconds(duration)
-	line.DurationChecks = timing(rq.start, rq.checked)
+	line.DurationTotalMS = requestlog.Milliseconds(duration)
+	line.DurationChecksMS = timing(rq.start, rq.checked)
 
 	// Counted before the log line is written, so that the metrics count
 	// every request whose line is out. An allowed request is the exception:
@@ -304,15 +304,15 @@ func timing(start, end time.Time) *float64 {
 // when it comes.
 func (rq *request) addToHistory() {
 	request := ratelimit.Request{
-		Forwarded:          rq.allowed,
-		Refused:            rq.refused != nil,
-		Status:             rq.out.status,
-		RequestBytes:       rq.requestBytes,
-		ResponseBytes:      rq.out.bytes,
-		BrokeLimit:         rq.line.Offence == requestlog.OffenceLimit,
-		Attack:             rq.attack,
-		BlockedByBlockRule: rq.blockedByBlockRule,
-		WAFBlocked:         rq.wafBlocked,
+		Forwarded:            rq.allowed,
+		Refused:              rq.refused != nil,
+		Status:               rq.out.status,
+		RequestBytes:         rq.requestBytes,
+		ResponseBytes:        rq.out.bytes,
+		BrokeLimit:           rq.line.Offence == requestlog.OffenceLimit,
+		Attack:               rq.attack,
+		BlockedByBlockRule:   rq.blockedByBlockRule,
+		BlockedByCoreRuleSet: rq.blockedByCoreRuleSet,
 	}
 
 	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)