Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

internal/rproxy/rproxy_test.go

@@ -19,9 +19,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -54,27 +54,27 @@ const (
 
 // The headers the tests set and look at.
 const (
-	dispositionHeader    = discriminator.DispositionHeader
+	dispositionHeader    = waf.DispositionHeader
 	forwardedForHeader   = "X-Forwarded-For"
 	forwardedProtoHeader = "X-Forwarded-Proto"
 	requestIDHeader      = "X-Request-ID"
 	asnHeader            = "X-Client-Asn"
 	countryHeader        = "X-Client-Country"
 	contentLengthHeader  = "Content-Length"
-	// fromDiscriminatorHeader is a header the stand-in for discriminator adds to a deny.
-	fromDiscriminatorHeader = "X-From-Discriminator"
+	// fromWAFHeader is a header the stand-in for waf adds to a deny.
+	fromWAFHeader = "X-From-Waf"
 	// addedHeaderValue is the value of a header a test adds to an answer, to see it
 	// reach the visitor.
 	addedHeaderValue = "yes"
 )
 
-// What the stand-in for discriminator answers.
+// What the stand-in for waf answers.
 const (
-	dispositionAllow = discriminator.DispositionAllow
-	dispositionDeny  = discriminator.DispositionDeny
-	dispositionClose = discriminator.DispositionClose
+	dispositionAllow = waf.DispositionAllow
+	dispositionDeny  = waf.DispositionDeny
+	dispositionClose = waf.DispositionClose
 	// deniedBody is the body of a deny.
-	deniedBody = "refused by discriminator"
+	deniedBody = "refused by waf"
 )
 
 // output collects what rproxy writes on stdout.
@@ -158,7 +158,7 @@ func (l heldLog) Write(p []byte) (int, error) {
 	return len(p), nil
 }
 
-// question is what the stand-in for discriminator received as a question.
+// question is what the stand-in for waf received as a question.
 type question struct {
 	method, target, host string
 	header               http.Header
@@ -167,26 +167,26 @@ type question struct {
 	transferEncoding     []string
 }
 
-// Discriminator is a stand-in for discriminator that answers each question as
+// WAF is a stand-in for waf that answers each question as
 // answer does, and keeps the questions and the reports it gets.
-type Discriminator struct {
+type WAF struct {
 	*httptest.Server
 
 	questions chan question
-	reports   chan discriminator.Report
+	reports   chan waf.Report
 }
 
-// startDiscriminator starts a stand-in for discriminator.
-func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator {
+// startWAF starts a stand-in for waf.
+func startWAF(t *testing.T, answer http.HandlerFunc) *WAF {
 	t.Helper()
 
-	s := &Discriminator{
+	s := &WAF{
 		questions: make(chan question, 10),
-		reports:   make(chan discriminator.Report, 10),
+		reports:   make(chan waf.Report, 10),
 	}
 	s.Server = httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) == "" {
+			if r.Header.Get(waf.ClientHeader) == "" {
 				s.takeReport(t, w, r)
 
 				return
@@ -209,17 +209,17 @@ func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator {
 	return s
 }
 
-// takeReport keeps a report and answers it as discriminator does.
-func (s *Discriminator) takeReport(
+// takeReport keeps a report and answers it as waf does.
+func (s *WAF) takeReport(
 	t *testing.T, w http.ResponseWriter, r *http.Request,
 ) {
 	t.Helper()
 
-	var report discriminator.Report
+	var report waf.Report
 
 	err := json.NewDecoder(r.Body).Decode(&report)
 	if err != nil || r.Method != http.MethodPost ||
-		r.URL.Path != discriminator.ReportPath {
+		r.URL.Path != waf.ReportPath {
 		t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err)
 	}
 
@@ -229,7 +229,7 @@ func (s *Discriminator) takeReport(
 }
 
 // wantNoReport checks that no report comes for a moment.
-func (s *Discriminator) wantNoReport(t *testing.T) {
+func (s *WAF) wantNoReport(t *testing.T) {
 	t.Helper()
 
 	select {
@@ -240,7 +240,7 @@ func (s *Discriminator) wantNoReport(t *testing.T) {
 }
 
 // report waits for a report.
-func (s *Discriminator) report(t *testing.T) discriminator.Report {
+func (s *WAF) report(t *testing.T) waf.Report {
 	t.Helper()
 
 	select {
@@ -249,12 +249,12 @@ func (s *Discriminator) report(t *testing.T) discriminator.Report {
 	case <-time.After(waitLimit):
 		t.Fatal("no report")
 
-		return discriminator.Report{}
+		return waf.Report{}
 	}
 }
 
 // question waits for a question.
-func (s *Discriminator) question(t *testing.T) question {
+func (s *WAF) question(t *testing.T) question {
 	t.Helper()
 
 	select {
@@ -267,17 +267,17 @@ func (s *Discriminator) question(t *testing.T) question {
 	}
 }
 
-// startDiscriminatorAnsweringReports starts a stand-in for discriminator that
+// startWAFAnsweringReports starts a stand-in for waf that
 // answers each question as answer does and each report as report does, and
 // returns its URL.
-func startDiscriminatorAnsweringReports(
+func startWAFAnsweringReports(
 	t *testing.T, answer, report http.HandlerFunc,
 ) string {
 	t.Helper()
 
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				answer(w, r)
 
 				return
@@ -299,7 +299,7 @@ func allow(w http.ResponseWriter, _ *http.Request) {
 // deny answers a question with deny, status 403 and a body of its own.
 func deny(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set(dispositionHeader, dispositionDeny)
-	w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
+	w.Header().Set(fromWAFHeader, addedHeaderValue)
 	w.WriteHeader(http.StatusForbidden)
 	_, _ = io.WriteString(w, deniedBody)
 }
@@ -320,7 +320,7 @@ func greet(w http.ResponseWriter, r *http.Request) {
 	_, _ = io.WriteString(w, greeting)
 }
 
-// startRProxy starts rproxy with discriminator at backend and the app at appURL, and
+// startRProxy starts rproxy with waf at backend and the app at appURL, and
 // the settings in env on top of the defaults. It returns where rproxy listens
 // and what it writes.
 func startRProxy(
@@ -502,7 +502,7 @@ func readStatus(t *testing.T, conn net.Conn) int {
 func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, r *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set(asnHeader, "AS64496")
 		w.Header().Set(countryHeader, "DE")
 		allow(w, r)
@@ -561,7 +561,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
 	}
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -606,7 +606,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) {
 func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	seen := make(chan http.Header, 1)
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		seen <- r.Header.Clone()
@@ -645,7 +645,7 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		_, _ = io.WriteString(w, "<html>")
@@ -667,19 +667,19 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
 	}
 }
 
-func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T) {
+func TestRemovesTheVisitorsLookupHeadersWhenWAFGivesNone(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
 		name    string
 		backend func(t *testing.T) string
 	}{
-		{"discriminator allows", func(t *testing.T) string {
+		{"waf allows", func(t *testing.T) string {
 			t.Helper()
 
-			return startDiscriminator(t, allow).URL
+			return startWAF(t, allow).URL
 		}},
-		{"discriminator is down", func(*testing.T) string { return nowhere }},
+		{"waf is down", func(*testing.T) string { return nowhere }},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -705,10 +705,10 @@ func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T)
 	}
 }
 
-func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
+func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {
 		t.Error("the app was asked")
 	})
@@ -716,8 +716,8 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusForbidden || got.body != deniedBody ||
-		got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
-		t.Errorf("answered %+v, want discriminator's answer", got)
+		got.header.Get(fromWAFHeader) != addedHeaderValue {
+		t.Errorf("answered %+v, want waf's answer", got)
 	}
 
 	if len(got.header.Values(dispositionHeader)) != 0 {
@@ -733,21 +733,21 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 
 	line := out.requestLine(t)
 	if line["disposition"] != dispositionDeny || line["default_disposition"] != nil {
-		t.Errorf("line %v, want discriminator's deny", line)
+		t.Errorf("line %v, want waf's deny", line)
 	}
 }
 
-func TestADeniedHeadKeepsDiscriminatorsContentLength(t *testing.T) {
+func TestADeniedHeadKeepsWAFsContentLength(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, deny)
+	standIn := startWAF(t, deny)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
 	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
 	if got.status != http.StatusForbidden ||
 		got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) {
-		t.Errorf("answered %+v, want discriminator's 403 and its length", got)
+		t.Errorf("answered %+v, want waf's 403 and its length", got)
 	}
 }
 
@@ -762,13 +762,13 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 	}{
 		{"a deny", "GET /" + host, deniedBody, http.StatusForbidden},
 		{"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest},
-		{"the health check", "GET " + discriminator.HealthPath + host, "ok\n", http.StatusOK},
+		{"the health check", "GET " + waf.HealthPath + host, "ok\n", http.StatusOK},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			log := heldLog{release: make(chan struct{})}
-			standIn := startDiscriminator(t, deny)
+			standIn := startWAF(t, deny)
 			app := startApp(t, greet)
 			addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard)
 
@@ -798,7 +798,7 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) {
 func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -821,7 +821,7 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) {
 func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set(dispositionHeader, dispositionClose)
 		w.WriteHeader(http.StatusOK)
 	})
@@ -853,7 +853,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) {
 func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t,
+	backend := startWAFAnsweringReports(t,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set(dispositionHeader, dispositionClose)
 		},
@@ -878,17 +878,17 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 	}
 }
 
-// answeringWith returns what starts a stand-in for discriminator that answers each
+// answeringWith returns what starts a stand-in for waf that answers each
 // question as answer does, and returns its URL.
 func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
 	return func(t *testing.T) string {
 		t.Helper()
 
-		return startDiscriminator(t, answer).URL
+		return startWAF(t, answer).URL
 	}
 }
 
-// noAnswers are the ways discriminator can leave the decision to the default.
+// noAnswers are the ways waf can leave the decision to the default.
 func noAnswers() map[string]func(t *testing.T) string {
 	return map[string]func(t *testing.T) string{
 		"no connection": func(*testing.T) string { return nowhere },
@@ -920,7 +920,7 @@ func noAnswers() map[string]func(t *testing.T) string {
 	}
 }
 
-func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.T) {
+func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -929,7 +929,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 	}{
 		{"a refusal", dispositionDeny, deniedBody, http.StatusForbidden},
 		{"a refusal, 429", dispositionDeny, deniedBody, http.StatusTooManyRequests},
-		{"discriminator's 400", "", "refused\n", http.StatusBadRequest},
+		{"waf's 400", "", "refused\n", http.StatusBadRequest},
 		{"a 500", "", "broken\n", http.StatusInternalServerError},
 		{"a 503 denied", dispositionDeny, "busy\n", http.StatusServiceUnavailable},
 		{"no header", "", "who knows\n", http.StatusOK},
@@ -939,12 +939,12 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 			t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
 				t.Parallel()
 
-				standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+				standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 					if tc.disposition != "" {
 						w.Header().Set(dispositionHeader, tc.disposition)
 					}
 
-					w.Header().Set(fromDiscriminatorHeader, addedHeaderValue)
+					w.Header().Set(fromWAFHeader, addedHeaderValue)
 					w.WriteHeader(tc.status)
 					_, _ = io.WriteString(w, tc.body)
 				})
@@ -957,8 +957,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 
 				got := get(t, addr, "/")
 				if got.status != tc.status || got.body != tc.body ||
-					got.header.Get(fromDiscriminatorHeader) != addedHeaderValue {
-					t.Errorf("answered %+v, want discriminator's answer", got)
+					got.header.Get(fromWAFHeader) != addedHeaderValue {
+					t.Errorf("answered %+v, want waf's answer", got)
 				}
 
 				if len(got.header.Values(dispositionHeader)) != 0 {
@@ -970,8 +970,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 					t.Errorf("line %v, want status %d and no default", line, tc.status)
 				}
 
-				if out.has("discriminator gave no answer") {
-					t.Error("rproxy warned that discriminator gave no answer")
+				if out.has("waf gave no answer") {
+					t.Error("rproxy warned that waf gave no answer")
 				}
 			})
 		}
@@ -981,14 +981,14 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.
 func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "refused", http.StatusBadRequest)
 	})
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadRequest {
-		t.Errorf("answered %+v, want discriminator's 400", got)
+		t.Errorf("answered %+v, want waf's 400", got)
 	}
 
 	if line := out.requestLine(t); line["disposition"] != nil {
@@ -1001,7 +1001,7 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) {
 func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.Header()["Content-Type"] = nil
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = io.WriteString(w, "<html>broken")
@@ -1019,7 +1019,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	const size = 1 << 20
 
-	standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) {
+	standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		_, _ = w.Write(make([]byte, size))
 	})
@@ -1027,15 +1027,15 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
 
 	got := get(t, addr, "/")
 	if got.status != http.StatusInternalServerError || len(got.body) != size {
-		t.Errorf("answered %d with %d bytes, want discriminator's 500 with %d",
+		t.Errorf("answered %d with %d bytes, want waf's 500 with %d",
 			got.status, len(got.body), size)
 	}
 }
 
-// startDiscriminatorWriting starts a stand-in for discriminator that reads
+// startWAFWriting starts a stand-in for waf that reads
 // each question and answers it with text, as it is, and returns its URL. It
 // can send what Go's server would not.
-func startDiscriminatorWriting(t *testing.T, text string) string {
+func startWAFWriting(t *testing.T, text string) string {
 	t.Helper()
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -1105,7 +1105,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 		"a status below 100": func(t *testing.T) string {
 			t.Helper()
 
-			return startDiscriminatorWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
+			return startWAFWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n")
 		},
 		"a 101 that holds its connection open": answeringWith(switchAndHold),
 	} {
@@ -1130,7 +1130,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 					t.Errorf("line %v, want status 502 and no disposition", line)
 				}
 
-				out.waitFor(t, "discriminator's answer is dropped")
+				out.waitFor(t, "waf's answer is dropped")
 			})
 		}
 	}
@@ -1139,7 +1139,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
 func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, overOneMiB(dispositionDeny))
+	standIn := startWAF(t, overOneMiB(dispositionDeny))
 	addr, out := startRProxy(t, standIn.URL, nowhere, nil)
 
 	if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
@@ -1196,14 +1196,14 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
 	}
 }
 
-func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T) {
+func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
 	t.Parallel()
 
 	for _, disposition := range []string{dispositionAllow, dispositionDeny} {
 		t.Run("with the default "+disposition, func(t *testing.T) {
 			t.Parallel()
 
-			standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
+			standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 				<-r.Context().Done()
 			})
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1226,8 +1226,8 @@ func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T
 				t.Errorf("line %v, want status 0 and no disposition", line)
 			}
 
-			if out.has("discriminator gave no answer") {
-				t.Error("rproxy warned that discriminator gave no answer")
+			if out.has("waf gave no answer") {
+				t.Error("rproxy warned that waf gave no answer")
 			}
 
 			standIn.wantNoReport(t)
@@ -1242,13 +1242,13 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
 	wantGreeting(t, get(t, addr, "/"))
-	out.waitFor(t, "discriminator gave no answer")
+	out.waitFor(t, "waf gave no answer")
 }
 
 func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) {
+	standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
 	})
 	app := startApp(t, greet)
@@ -1275,29 +1275,29 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) {
 	}
 }
 
-func TestHealthCheckIsAnsweredWhileDiscriminatorIsDown(t *testing.T) {
+func TestHealthCheckIsAnsweredWhileWAFIsDown(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, nowhere, app.URL, nil)
 
-	got := get(t, addr, discriminator.HealthPath)
+	got := get(t, addr, waf.HealthPath)
 	if got.status != http.StatusOK || got.body != "ok\n" {
 		t.Errorf("answered %+v, want ok", got)
 	}
 
 	line := out.requestLine(t)
-	if line["path"] != discriminator.HealthPath || line["disposition"] != nil {
+	if line["path"] != waf.HealthPath || line["disposition"] != nil {
 		t.Errorf("line %v, want one with no disposition", line)
 	}
 
-	// With discriminator up too, it is not asked.
+	// With waf up too, it is not asked.
 	addr, _ = startRProxy(t, standIn.URL, app.URL, nil)
-	get(t, addr, discriminator.HealthPath)
+	get(t, addr, waf.HealthPath)
 
 	if len(standIn.questions) != 0 {
-		t.Error("discriminator was asked about the health check")
+		t.Error("waf was asked about the health check")
 	}
 }
 
@@ -1305,7 +1305,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startDiscriminatorAnsweringReports(t, deny,
+	backend := startWAFAnsweringReports(t, deny,
 		func(w http.ResponseWriter, r *http.Request) {
 			select {
 			case <-release:
@@ -1340,16 +1340,16 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
 		_ = res.Body.Close()
 
 		if res.StatusCode != http.StatusForbidden {
-			t.Errorf("status %d, want discriminator's 403", res.StatusCode)
+			t.Errorf("status %d, want waf's 403", res.StatusCode)
 		}
 	}
 }
 
-func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
+func TestAReportWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
 	t.Parallel()
 
 	release := make(chan struct{})
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			<-release
 
@@ -1369,10 +1369,10 @@ func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.
 	out.waitFor(t, "a report is dropped")
 }
 
-func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) {
+func TestAReportWAFRefusesIsDroppedWithAWarning(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t, allow,
+	backend := startWAFAnsweringReports(t, allow,
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusBadRequest)
 		})
@@ -1387,7 +1387,7 @@ func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) {
 func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 	t.Parallel()
 
-	backend := startDiscriminatorAnsweringReports(t, allow, switchAndHold)
+	backend := startWAFAnsweringReports(t, allow, switchAndHold)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, backend, app.URL, map[string]string{
 		timeoutSetting: "60000",
@@ -1400,7 +1400,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
 func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out, server := startServer(t, standIn.URL, app.URL, nil)
 
@@ -1416,7 +1416,7 @@ func TestReportGivesWhatHappened(t *testing.T) {
 
 	const body = "the visitor's body"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
 
@@ -1446,7 +1446,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 	release := make(chan struct{})
 	backend := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get(discriminator.ClientHeader) != "" {
+			if r.Header.Get(waf.ClientHeader) != "" {
 				allow(w, r)
 
 				return
@@ -1501,7 +1501,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
 func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) {
 	t.Parallel()
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, echoAfterUpgrade)
 	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		maxRequestTime:  "2000",
@@ -1556,7 +1556,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 
 	const goodbye = "sent after the visitor stopped sending\n"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1614,7 +1614,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) {
 //nolint:paralleltest // see above
 func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) {
 	closed := make(chan error, 1)
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		conn, buffered, err := http.NewResponseController(w).Hijack()
 		if err != nil {
@@ -1685,7 +1685,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) {
 
 	const fromTraefik = "an-id-from-traefik"
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
 		trustedProxies: localhost + "/32",
@@ -1715,7 +1715,7 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		body  = "the visitor's body"
 	)
 
-	standIn := startDiscriminator(t, allow)
+	standIn := startWAF(t, allow)
 	app := startApp(t, greet)
 	addr, out := startRProxy(t, standIn.URL, app.URL, nil)