Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198)

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE before the Core Rule Set's rules,
  covers Gitea's search, file-name and branch-name fields, Referer, file
  paths, API attachment names and Actions artifact uploads;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start, in every mode. internal/waf's tests
and script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

internal/servewaf/proxy.go

@@ -4,6 +4,7 @@
 package servewaf
 
 import (
+	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
@@ -60,6 +61,9 @@ type Params struct {
 	// LookupFile is the lookup database they are looked up in while
 	// SWWAF_LOOKUP_SOURCE is file, and nil otherwise.
 	LookupFile *lookup.File
+	// CoreRuleSet is what NewCoreRuleSet returns: what inspects requests
+	// while SWWAF_WAF_MODE is not off, and nil while it is.
+	CoreRuleSet *waf.CoreRuleSet
 	// Now tells the time by which requests are counted for the rate
 	// limits, bans are made and run out, and GeoJS's answers are kept,
 	// normally time.Now in UTC, the time the state files give.
@@ -144,7 +148,7 @@ func newHandler(params Params) *handler {
 		dnsbl:       dnsbl,
 		abuseIPDB:   abuseIPDB,
 		rules:       params.Rules,
-		coreRuleSet: newCoreRuleSet(params.Config),
+		coreRuleSet: params.CoreRuleSet,
 		alerts:      params.Alerts,
 	}
 	h.geojs = lookup.New(lookup.Params{
@@ -202,29 +206,35 @@ func newReputation(
 	return lists, dnsbl, abuseIPDB
 }
 
-// newCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
+// NewCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
 // without the rules SWWAF_WAF_DISABLED_RULES switches off, reading bodies
-// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off. It reads at
-// most QuestionBodyMaxBytes less one byte: a question's body of
+// up to SWWAF_WAF_BODY_LIMIT, with the exclusions in
+// SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWWAF_WAF_MODE is off. It
+// reads at most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
-// JSON or XML body over its limit.
-func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
-	if cfg.WAFMode == config.WAFModeOff {
-		return nil
+// JSON or XML body over its limit. An exclusions file that cannot be read, does
+// not parse or names an id of smallwebwaf's own rules is an error in every
+// mode. While the mode is off, a set file is loaded with the Core Rule Set only
+// to check it.
+func NewCoreRuleSet(cfg *config.Config) (*waf.CoreRuleSet, error) {
+	if cfg.WAFMode == config.WAFModeOff && cfg.CoreRuleSetExclusionsFile == "" {
+		return nil, nil //nolint:nilnil // off is no Core Rule Set, and no error
 	}
 
 	coreRuleSet, err := waf.New(waf.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
-		BodyLimit: min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
+		BodyLimit:      min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
+		ExclusionsFile: cfg.CoreRuleSetExclusionsFile,
 	})
 	if err != nil {
-		// The Core Rule Set is built in, and the settings cannot break it:
-		// the paranoia level is from 1 to 4, and the id of no rule switches
-		// nothing off.
-		panic(err)
+		return nil, fmt.Errorf("SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE: %w", err)
 	}
 
-	return coreRuleSet
+	if cfg.WAFMode == config.WAFModeOff {
+		return nil, nil //nolint:nilnil // off is no Core Rule Set, and no error
+	}
+
+	return coreRuleSet, nil
 }
 
 // handler is servewaf's handler. It holds what every request shares; what

internal/servewaf/proxy_test.go

@@ -463,6 +463,11 @@ func newServeWAFWith(
 		}
 	}
 
+	coreRuleSet, err := servewaf.NewCoreRuleSet(cfg)
+	if err != nil {
+		t.Fatalf("Core Rule Set: %v", err)
+	}
+
 	server := build(servewaf.Params{
 		Config:       cfg,
 		RequestLog:   out,
@@ -470,6 +475,7 @@ func newServeWAFWith(
 		GeoJSURL:     geojsURL,
 		AbuseIPDBURL: abuseIPDBURL,
 		LookupFile:   lookupFile,
+		CoreRuleSet:  coreRuleSet,
 		Now:          now,
 		Rules:        ruleFiles,
 		Alerts:       alertQueue,