Core Rule Set: Nextcloud's calendar and contacts sync pass (closes #280)

rproxy passes MKCALENDAR on. nextcloud.conf allows it on
/remote.php/dav/calendars/ and PROPFIND on /.well-known/caldav and
carddav. The XML of an MKCOL there skips 930120, 932120, 932250 and
932260. That of an MKCALENDAR, and of an MKCOL on the address books'
paths, also skips 932125 and 932230, for the description. A PUT of
text/calendar or text/vcard there skips 920530: the Calendar and
Contacts apps name the charset twice when they change an event or a
contact.

Recorded from Nextcloud 35.0.2 with Calendar 6.6.5, Contacts 8.9.5 and
requests imitating DAVx5.

Model: opus-5-5

internal/coreruleset/nextcloud.conf

@@ -246,3 +246,63 @@ SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/systemtags/?$" \
 SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
     "id:900118,phase:1,pass,nolog,chain"
     SecRule REQUEST_METHOD "@streq PUT" "ctl:requestBodyProcessor=RAW"
+
+# The Calendar and Contacts apps, and the CalDAV and CardDAV clients of phones
+# and desktops, keep calendars under /remote.php/dav/calendars/ and address
+# books under /remote.php/dav/addressbooks/. A CalDAV client makes a calendar
+# with MKCALENDAR, which 911100 refused.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/calendars/" \
+    "id:900119,phase:1,pass,nolog,\
+    setvar:'tx.allowed_methods=%{tx.allowed_methods} MKCALENDAR'"
+
+# Such a client first asks where the calendars and address books are, with a
+# PROPFIND on /.well-known/caldav or /.well-known/carddav. Nextcloud answers
+# with a redirect to /remote.php/dav/. 911100 refused the PROPFIND.
+SecRule REQUEST_FILENAME "@rx ^/\.well-known/(?:caldav|carddav)$" \
+    "id:900120,phase:1,pass,nolog,\
+    setvar:'tx.allowed_methods=%{tx.allowed_methods} PROPFIND'"
+
+# A new calendar or address book has its name in the XML body of an MKCOL,
+# <d:displayname>Python3 and powershell</d:displayname>. An address book's
+# MKCOL may also hold its description (900124).
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/(?:calendars|addressbooks)/" \
+    "id:900121,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq MKCOL" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*"
+
+# The XML body of an MKCALENDAR holds the new calendar's name and its
+# description. The description is a sentence, and two rules for sentences
+# refused it too:
+#   932125, 932230: Powershell and python3 meetings; ls -la first
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/calendars/" \
+    "id:900122,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq MKCALENDAR" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932125;XML:/*,\
+        ctl:ruleRemoveTargetById=932230;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*"
+
+# When the Calendar app changes an event, it names the charset twice in the
+# Content-Type of the PUT:
+#   text/calendar; charset=UTF-8; component=vevent; charset=UTF-8
+# The Contacts app does the same with text/vcard when it changes a contact.
+# 920530 refused both. The body of such a PUT is not read (900118).
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/(?:calendars|addressbooks)/" \
+    "id:900123,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq PUT" "chain"
+        SecRule REQUEST_HEADERS:Content-Type "@rx ^text/(?:calendar|vcard);" \
+            "ctl:ruleRemoveById=920530"
+
+# The XML body of a new address book's MKCOL may hold its description. Like a
+# calendar's (900122), it is a sentence, and the same two rules refused it:
+#   932125, 932230: Powershell and python3 contacts; ls -la first
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/addressbooks/" \
+    "id:900124,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq MKCOL" \
+        "ctl:ruleRemoveTargetById=932125;XML:/*,\
+        ctl:ruleRemoveTargetById=932230;XML:/*"