SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -36,12 +36,14 @@ var loaded = struct {
 }{loaders: map[string]func() (*coreruleset.CoreRuleSet, error){}}
 
 // loaderFor returns the function that loads the Core Rule Set with params
-// once, making it the first time params are asked for.
+// once, making it the first time params are asked for. %#v writes a nil
+// Apps, which gives every app's fixes, apart from an empty one, which
+// gives none.
 func loaderFor(params coreruleset.Params) func() (*coreruleset.CoreRuleSet, error) {
 	loaded.Lock()
 	defer loaded.Unlock()
 
-	settings := fmt.Sprintf("%+v", params)
+	settings := fmt.Sprintf("%#v", params)
 
 	load, found := loaded.loaders[settings]
 	if !found {
@@ -155,9 +157,10 @@ func inspectBody(
 	}
 
 	for _, header := range r.headers {
-		// Go's server keeps Host and Transfer-Encoding out of the headers.
+		// Go's server keeps Host and Transfer-Encoding out of the headers,
+		// whatever their case.
 		name, value, _ := strings.Cut(header, ": ")
-		switch name {
+		switch http.CanonicalHeaderKey(name) {
 		case "Host":
 			req.Host = value
 		case "Transfer-Encoding":
@@ -202,8 +205,8 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// fourteen changes is for, and still finds result in refused, a request like
-// it that the change is not for.
+// six changes or an app's fixes are for, and still finds result in
+// refused, a request like it that they are not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
 	result coreruleset.Result,
@@ -464,6 +467,123 @@ func TestImagePushThatReusesALayerIsNotCheckedForCommandNames(t *testing.T) {
 		matched(930120, 932160))
 }
 
+// giteaFixed are gitea requests that only gitea's fixes let through, one
+// for each kind of fix, each with what the Core Rule Set finds in it
+// without them.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var giteaFixed = []struct {
+	request request
+	result  coreruleset.Result
+}{
+	// A search of code, on the path of gitea's search.
+	{get("/explore/code?q=SELECT%20*%20FROM%20users%20WHERE"), matched(942100)},
+	// A file name, in a parameter gitea sends names in, on any path.
+	{get("/?path=.gitignore"), matched(930120)},
+	// A file name, in a cookie of gitea's.
+	{
+		get("/owner/repo", "Cookie: gitea_flash=success%3DFile%2Bpackage.json%2Bdeleted"),
+		matched(930120),
+	},
+}
+
+// The hostnames of the tests of SWW_APPS: the one that serves gitea, and
+// one that serves another app.
+const (
+	giteaHost = "git.example"
+	otherHost = "blog.example"
+)
+
+// gitea is gitea's name in SWW_APPS.
+const gitea = "gitea"
+
+// wordpress is WordPress's name in SWW_APPS.
+const wordpress = "wordpress"
+
+// withHost returns r sent to host.
+func withHost(r request, host string) request {
+	return request{r.method, r.target, append([]string{"Host: " + host}, r.headers...)}
+}
+
+// servingApps returns the Core Rule Set at the defaults, with SWW_APPS
+// giving apps.
+func servingApps(t *testing.T, apps map[string][]string) *coreruleset.CoreRuleSet {
+	t.Helper()
+
+	return shared(t, coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, Apps: apps,
+	})
+}
+
+func TestAppsUnsetGivesEveryHostnameEveryAppsFixes(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, nil)
+
+	for _, fixed := range giteaFixed {
+		for _, host := range []string{giteaHost, otherHost} {
+			wantResult(t, crs, withHost(fixed.request, host), coreruleset.Result{})
+		}
+	}
+}
+
+func TestListedHostnameGetsItsAppsFixes(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{giteaHost: {gitea}})
+
+	// The hostname is matched without the port and without regard to case.
+	for _, host := range []string{giteaHost, "GIT.Example:8443"} {
+		for _, fixed := range giteaFixed {
+			wantResult(t, crs, withHost(fixed.request, host), coreruleset.Result{})
+		}
+	}
+}
+
+func TestUnlistedHostnameGetsTheFullCheck(t *testing.T) {
+	t.Parallel()
+
+	for _, apps := range []map[string][]string{
+		{giteaHost: {gitea}},
+		// SWW_APPS set empty lists no hostname.
+		{},
+	} {
+		crs := servingApps(t, apps)
+
+		for _, host := range []string{otherHost, otherHost + ":8443", "git.example.org"} {
+			for _, fixed := range giteaFixed {
+				wantResult(t, crs, withHost(fixed.request, host), fixed.result)
+			}
+		}
+	}
+}
+
+func TestWordPressFixesApplyOnlyToAHostnameThatServesWordPress(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		giteaHost: {gitea}, otherHost: {wordpress},
+	})
+
+	// A search, which only WordPress's fixes let through.
+	search := get("/?s=python3")
+
+	wantResult(t, crs, withHost(search, otherHost), coreruleset.Result{})
+	wantResult(t, crs, withHost(search, giteaHost), matched(932260))
+}
+
+func TestHostnameListingTwoAppsGetsTheFixesOfBoth(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{giteaHost: {gitea, wordpress}})
+
+	// A file name that only gitea's fixes let through, and a search that only
+	// WordPress's fixes let through.
+	for _, target := range []string{"/?path=.gitignore", "/?s=python3"} {
+		wantResult(t, crs, withHost(get(target), giteaHost), coreruleset.Result{})
+	}
+}
+
 // withExclusions returns the Core Rule Set at the defaults, with the
 // exclusions file at path.
 func withExclusions(path string) (*coreruleset.CoreRuleSet, error) {
@@ -625,17 +745,24 @@ const passwordField = "password="
 var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
-// requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. A request with neither a body nor a Content-Type
-// header is checked only at the defaults: with neither, the set that reads
-// bodies has nothing more to check. Each request runs as its own parallel
-// subtest.
-func wantRecordedRequestsPass(t *testing.T, name string) {
+// requests in the file name in testdata is refused on example.com, where
+// they were recorded, while SWW_APPS lists only app for it. They are
+// checked at the defaults and while bodies are read. With SWW_APPS unset,
+// every app's fixes apply. These only switch checks off, so the requests
+// pass then too. A request with neither a body nor a Content-Type header is
+// checked only at the defaults: with neither, the set that reads bodies has
+// nothing more to check. Each request runs as its own parallel subtest.
+func wantRecordedRequestsPass(t *testing.T, name, app string) {
 	t.Helper()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
-	defaults, bodies := atDefaults(t), readingBodies(t)
+	apps := map[string][]string{"example.com": {app}}
+	defaults := servingApps(t, apps)
+	bodies := shared(t, coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		Apps: apps,
+	})
 
 	for _, recorded := range recordedRequests(t, name) {
 		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
@@ -836,12 +963,22 @@ func wordpressAttackTargets(attack string) []string {
 	}
 }
 
-func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
-	t.Parallel()
+// wantWordPressRequestsPass checks that the recorded ordinary WordPress
+// requests pass on otherHost, where they were recorded, while SWW_APPS lists
+// only wordpress for it. They pass at the defaults, and those with a body
+// pass while bodies up to 64 KiB are read too. Every app's fixes only switch
+// checks off, so the requests pass with SWW_APPS unset too.
+func wantWordPressRequestsPass(t *testing.T) {
+	t.Helper()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
-	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
+	apps := map[string][]string{otherHost: {wordpress}}
+	defaults := servingApps(t, apps)
+	bodies := shared(t, coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: 64<<10 - 1,
+		Apps: apps,
+	})
 
 	for _, recorded := range recordedRequests(t, "wordpress-requests.txt") {
 		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
@@ -862,6 +999,16 @@ func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
 			}
 		})
 	}
+}
+
+func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	wantWordPressRequestsPass(t)
+
+	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
 	for _, attack := range []string{
 		sqlInjection,