Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

Log field, metric, action and event names now say what they count
and, for timings, the unit. Package internal/waf is internal/coreruleset.

Model: opus-5-5

internal/state/state.go

@@ -64,7 +64,7 @@ var (
 	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
-	errScope       = errors.New("is not client, net, asn, total or watch")
+	errScope       = errors.New("is not client, net, asn, total or watched_net")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
 		`destination: put the list under "webhook", as "waiting": {"webhook": [...]}, ` +
 		`or remove the file`)
@@ -858,8 +858,8 @@ func (f *alertsFile) check([]byte) error {
 }
 
 // checkAnomalyCounters refuses an anomaly counter whose scope is not
-// client, net, asn, total or watch, most likely misspelt, and one without
-// a field it needs, as missingFromCounter tells.
+// client, net, asn, total or watched_net, most likely misspelt, and one
+// without a field it needs, as missingFromCounter tells.
 func checkAnomalyCounters(counters []anomaly.Counter) error {
 	for i, counter := range counters {
 		if !slices.Contains(anomaly.Scopes(), counter.Scope) {
@@ -879,9 +879,9 @@ func checkAnomalyCounters(counters []anomaly.Counter) error {
 // missingFromCounter returns the first field counter, an anomaly counter,
 // needs and has not, or "" when it has them all: what tells it from the
 // others in its scope, without which it would never be counted again, the
-// netblock of a client, net or watch counter, the AS number of an asn one
-// and the name of a watch one; and the start of a window in which it has
-// requests or bytes, without which they would be dropped.
+// netblock of a client, net or watched_net counter, the AS number of an
+// asn one and the name of a watched_net one; and the start of a window in
+// which it has requests or bytes, without which they would be dropped.
 func missingFromCounter(counter anomaly.Counter) string {
 	scope := counter.Scope
 
@@ -891,7 +891,7 @@ func missingFromCounter(counter anomaly.Counter) string {
 		return "netblock"
 	case scope == anomaly.ScopeASN && counter.ASN == "":
 		return "asn"
-	case scope == anomaly.ScopeWatch && counter.Name == "":
+	case scope == anomaly.ScopeWatchedNet && counter.Name == "":
 		return "name"
 	case countsWithoutStart(counter.Minute):
 		return "minute.start"

internal/state/state_test.go

@@ -208,7 +208,7 @@ const filledAlertsJSON = `{
             }
         },
         {
-            "scope": "watch",
+            "scope": "watched_net",
             "netblock": "203.0.113.0/24",
             "name": "office",
             "hour": {
@@ -534,7 +534,7 @@ func TestFileThatDoesNotParseStopsTheStart(t *testing.T) {
 			`{"version": 1, "anomaly_counters": [{"scope": "total"}, ` +
 				`{"scope": "nett", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 2's scope "nett" is not client, net, asn, total ` +
-				`or watch`,
+				`or watched_net`,
 		},
 		{
 			"a copy of a list with a line that does not read", reputationJSON,
@@ -831,12 +831,12 @@ func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 		{
 			"an anomaly counter of a named netblock without its name",
 			`{"version": 1, "anomaly_counters": [` +
-				`{"scope": "watch", "netblock": "203.0.113.0/24"}]}`,
+				`{"scope": "watched_net", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 1 has no "name"`,
 		},
 		{
 			"an anomaly counter of a named netblock without its netblock",
-			`{"version": 1, "anomaly_counters": [{"scope": "watch", "name": "office"}]}`,
+			`{"version": 1, "anomaly_counters": [{"scope": "watched_net", "name": "office"}]}`,
 			`: anomaly_counters entry 1 has no "netblock"`,
 		},
 		{
@@ -1729,7 +1729,7 @@ func newParams(dir string) state.Params {
 		Dir:             dir,
 		WriteDelay:      time.Hour,
 		CounterInterval: time.Hour,
-		Ledger: bans.New(bans.Rules{
+		Ledger: bans.New(bans.Params{
 			LimitBanDuration:     time.Hour,
 			LimitBanRepeatWindow: 24 * time.Hour,
 			MaxBanDuration:       7 * 24 * time.Hour,