SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/recorded_test.go

@@ -13,8 +13,13 @@ import (
 	"slices"
 	"strings"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
+// appsUnset labels the checks made while SWW_APPS is unset.
+const appsUnset = "SWW_APPS unset"
+
 // giteaRequests returns the recorded ordinary gitea requests in testdata.
 // Each has the Referer of a page that names the same, as a page opened
 // from it has.
@@ -47,16 +52,31 @@ func giteaRequests(t *testing.T) []request {
 	return requests
 }
 
+// TestOrdinaryGiteaRequestsPass checks gitea's recorded requests with
+// SWW_APPS unset, and on giteaHost while SWW_APPS lists only gitea for it.
 func TestOrdinaryGiteaRequestsPass(t *testing.T) {
 	t.Parallel()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
-	crs := atDefaults(t)
+	requests := giteaRequests(t)
+	giteaOnly := map[string][]string{giteaHost: {gitea}}
 
-	for _, r := range giteaRequests(t) {
-		if got := inspect(t, crs, r); got.Score >= threshold {
-			t.Errorf("%s %q refused: %+v", r.target, r.headers[1:], got)
+	for apps, crs := range map[string]*coreruleset.CoreRuleSet{
+		appsUnset:                             atDefaults(t),
+		"SWW_APPS=" + giteaHost + ":" + gitea: servingApps(t, giteaOnly),
+	} {
+		for _, r := range requests {
+			got := inspect(t, crs, withHost(r, giteaHost))
+			if got.Score >= threshold {
+				t.Errorf(
+					"%s: %s %q refused: %+v",
+					apps,
+					r.target,
+					r.headers[1:],
+					got,
+				)
+			}
 		}
 	}
 }
@@ -102,71 +122,116 @@ func recordedRequests(t *testing.T, name string) []recordedRequest {
 }
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
-// requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. A request with neither a body nor a Content-Type
-// header is checked only at the defaults: with neither, the set that reads
-// bodies has nothing more to check. Each request runs as its own parallel
-// subtest.
-func wantRecordedRequestsPass(t *testing.T, name string) {
+// requests in the file name in testdata is refused: with SWW_APPS unset, and
+// on the hostname where they were recorded, otherHost for WordPress and
+// example.com for the other apps, while SWW_APPS lists only app for it. Both
+// times, they are checked at the defaults and while bodies are read. A
+// request with neither a body nor a Content-Type header is checked only at
+// the defaults: with neither, the set that reads bodies has nothing more to
+// check. Each request runs as its own parallel subtest for each setting of
+// SWW_APPS.
+func wantRecordedRequestsPass(t *testing.T, name, app string) {
 	t.Helper()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
-	defaults, bodies := atDefaults(t), readingBodies(t)
+	requests := recordedRequests(t, name)
 
-	for _, recorded := range recordedRequests(t, name) {
-		t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) {
-			t.Parallel()
+	for setting, apps := range map[string]map[string][]string{
+		appsUnset:                    nil,
+		"SWW_APPS lists only " + app: {"example.com": {app}, otherHost: {app}},
+	} {
+		defaults := servingApps(t, apps)
+		bodies := shared(t, coreruleset.Params{
+			ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+			BodyLimit: bodyLimit, Apps: apps,
+		})
 
-			r := request{recorded.Method, recorded.Target, recorded.Headers}
+		for _, recorded := range requests {
+			t.Run(
+				setting+": "+recorded.Method+" "+recorded.Target,
+				func(t *testing.T) {
+					t.Parallel()
 
-			got, _ := inspectBody(t, defaults, r, recorded.Body)
-			if got.Score >= threshold {
-				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
-			}
+					r := request{
+						recorded.Method,
+						recorded.Target,
+						recorded.Headers,
+					}
 
-			typed := slices.ContainsFunc(
-				recorded.Headers,
-				func(header string) bool {
-					name, _, _ := strings.Cut(header, ":")
+					got, _ := inspectBody(t, defaults, r, recorded.Body)
+					if got.Score >= threshold {
+						t.Errorf(
+							"%s %s refused: %+v",
+							r.method,
+							r.target,
+							got,
+						)
+					}
 
-					return strings.EqualFold(name, "Content-Type")
+					typed := slices.ContainsFunc(
+						recorded.Headers,
+						func(header string) bool {
+							name, _, _ := strings.Cut(header, ":")
+
+							return strings.EqualFold(name, "Content-Type")
+						},
+					)
+					if recorded.Body == "" && !typed {
+						return
+					}
+
+					got, _ = inspectBody(t, bodies, r, recorded.Body)
+					if got.Score >= threshold {
+						t.Errorf(
+							"%s %s %.200q refused while bodies are read: %+v",
+							r.method,
+							r.target,
+							recorded.Body,
+							got,
+						)
+					}
 				},
 			)
-			if recorded.Body == "" && !typed {
-				return
-			}
-
-			got, _ = inspectBody(t, bodies, r, recorded.Body)
-			if got.Score >= threshold {
-				t.Errorf("%s %s %.200q refused while bodies are read: %+v",
-					r.method, r.target, recorded.Body, got)
-			}
-		})
+		}
 	}
 }
 
 func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "drupal-requests.txt")
+	wantRecordedRequestsPass(t, "drupal-requests.txt", "drupal")
 }
 
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
-// defaults only. While bodies are read, the Core Rule Set still refuses the
-// file and branch names some of them carry in a form or JSON body, as it does
-// gitea's (TestGiteaBodiesTheCoreRuleSetRefuses).
+// defaults only: with SWW_APPS unset, and on example.com, where they were
+// recorded, while SWW_APPS lists only forgejo for it. While bodies are read,
+// the Core Rule Set still refuses the file and branch names some of them
+// carry in a form or JSON body, as it does gitea's
+// (TestGiteaBodiesTheCoreRuleSetRefuses).
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
 	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
-	crs := atDefaults(t)
+	requests := recordedRequests(t, "forgejo-requests.txt")
+	forgejoOnly := map[string][]string{"example.com": {forgejo}}
 
-	for _, recorded := range recordedRequests(t, "forgejo-requests.txt") {
-		r := request{recorded.Method, recorded.Target, recorded.Headers}
-		if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
-			t.Errorf("%s %s refused: %+v", r.method, r.target, got)
+	for apps, crs := range map[string]*coreruleset.CoreRuleSet{
+		appsUnset:                      atDefaults(t),
+		"SWW_APPS=example.com:forgejo": servingApps(t, forgejoOnly),
+	} {
+		for _, recorded := range requests {
+			r := request{recorded.Method, recorded.Target, recorded.Headers}
+			if got, _ := inspectBody(t, crs, r, recorded.Body); got.Score >= threshold {
+				t.Errorf(
+					"%s: %s %s refused: %+v",
+					apps,
+					r.method,
+					r.target,
+					got,
+				)
+			}
 		}
 	}
 }
@@ -174,29 +239,29 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "mastodon-requests.txt")
+	wantRecordedRequestsPass(t, "mastodon-requests.txt", "mastodon")
 }
 
 func TestOrdinaryMediaWikiRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "mediawiki-requests.txt")
+	wantRecordedRequestsPass(t, "mediawiki-requests.txt", mediawiki)
 }
 
 func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "nextcloud-requests.txt")
+	wantRecordedRequestsPass(t, "nextcloud-requests.txt", nextcloud)
 }
 
 func TestOrdinaryVaultwardenRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "vaultwarden-requests.txt")
+	wantRecordedRequestsPass(t, "vaultwarden-requests.txt", "vaultwarden")
 }
 
 func TestOrdinaryWordPressRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	wantRecordedRequestsPass(t, "wordpress-requests.txt")
+	wantRecordedRequestsPass(t, "wordpress-requests.txt", wordpress)
 }