Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

internal/waf/coreruleset.go

@@ -0,0 +1,100 @@
+package waf
+
+// The heuristic core_rule_set. It reads SWW_WAF_MODE, SWW_WAF_EXEMPT_PATHS
+// and SWW_WAF_ANOMALY_THRESHOLD.
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// coreRuleSet inspects the request with the Core Rule Set, unless
+// SWW_WAF_MODE is off or SWW_WAF_EXEMPT_PATHS exempts its path, as
+// pathExempt decides, and notes the rules it matched and its score in the
+// log line, and the rules in the metrics. A score at or over
+// SWW_WAF_ANOMALY_THRESHOLD is a match: it adds the tag exploitsignature,
+// raises the core_rule_set_match alert, and in block mode refuses the request with 403,
+// which is an offence its client's history counts. Its figures are the score
+// and the threshold.
+type coreRuleSet struct{}
+
+func (coreRuleSet) name() string { return "core_rule_set" }
+
+func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
+	cfg := rq.h.config
+	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+		return nil
+	}
+
+	start := time.Now()
+
+	// A question's body has been read into memory, so that reading it here
+	// cannot fail.
+	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+	rq.requestBytes = int64(len(read))
+
+	rq.line.DurationCoreRuleSetMS = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.CoreRuleSetRuleIDs = result.RuleIDs
+	rq.line.CoreRuleSetScore = &result.Score
+
+	for _, id := range result.RuleIDs {
+		rq.h.metrics.CoreRuleSetMatched(cfg.WAFMode, id)
+	}
+
+	threshold := cfg.WAFAnomalyThreshold
+	if threshold == 0 || result.Score < threshold {
+		return nil
+	}
+
+	rq.addTag(config.ExploitSignatureTag)
+	rq.alertCoreRuleSetMatch(result)
+
+	if cfg.WAFMode == config.WAFModeDetect {
+		return nil
+	}
+
+	rq.blockedByCoreRuleSet = true
+
+	return &verdict{
+		action:  requestlog.ActionBlockedByCoreRuleSet,
+		figures: map[string]any{figureScore: result.Score, "threshold": threshold},
+	}
+}
+
+// alertCoreRuleSetMatch raises the core_rule_set_match alert for the request,
+// which the Core Rule Set scored at result, at or over SWW_WAF_ANOMALY_THRESHOLD. Its
+// detail gives the rule ids, the score, the method and the path with the
+// query, and, for a request that is not refused for it, the mode: detect,
+// or observe in observe mode.
+func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
+	detail := map[string]any{
+		"rule_ids": result.RuleIDs,
+		"score":    result.Score,
+		"method":   rq.in.Method,
+		"path":     rq.in.URL.RequestURI(),
+	}
+
+	switch {
+	case rq.h.config.WAFMode == config.WAFModeDetect:
+		detail["mode"] = config.WAFModeDetect
+	case rq.h.config.Observe:
+		detail["mode"] = "observe"
+	}
+
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    alerts.EventCoreRuleSetMatch,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: rq.h.clientGroup(rq.client),
+		ASN:      rq.line.ASN,
+		ASName:   rq.line.ASName,
+		Country:  rq.line.Country,
+		Reason:   "scored by the Core Rule Set at or over SWW_WAF_ANOMALY_THRESHOLD",
+		Detail:   detail,
+	})
+}