Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has the fields where gitea
sends a search, a file name or a branch name skip the rules that refused
ordinary gitea requests, on gitea's paths only. Referer skips 944130 too.
A registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. A set file that cannot
be read, does not parse or names smallwebwaf's own ids stops the start
in every mode.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

internal/waf/waf.go

@@ -1,8 +1,9 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
-// makes to it, as "Attack detection" under "Settings" in SPEC.md describes
-// them. It reads no response.
+// body while SWWAF_WAF_BODY_LIMIT is set, with the eight changes smallwebwaf
+// makes to it and the exclusions in SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, as
+// "Attack detection" under "Settings" in SPEC.md describes them. It reads no
+// response.
 //
 // smallwebwaf writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -11,10 +12,14 @@
 package waf
 
 import (
+	_ "embed"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/netip"
+	"os"
+	"regexp"
 	"slices"
 	"strconv"
 	"strings"
@@ -26,12 +31,14 @@ import (
 )
 
 // directives are the Core Rule Set as smallwebwaf runs it, with the
-// paranoia level for %d, and bodyDirectives for %s while
-// SWWAF_WAF_BODY_LIMIT is set. Each rule smallwebwaf adds has an id from
-// 900000 to 900999, the ids the Core Rule Set keeps for the rules that set
-// it up, which SWWAF_WAF_DISABLED_RULES refuses, so that no setting
-// switches one off. Coraza joins a line ending in \ to the next, without
-// the spaces at the start of the next.
+// paranoia level for %d, bodyDirectives for the first %s while
+// SWWAF_WAF_BODY_LIMIT is set, the exclusions file for the second, and
+// giteaExclusions for the third.
+// Each rule smallwebwaf adds has an id from 900000 to 900999, the ids the
+// Core Rule Set keeps for the rules that set it up, which
+// SWWAF_WAF_DISABLED_RULES and the exclusions file refuse, so that no
+// setting switches one off. Coraza joins a line ending in \ to the next,
+// without the spaces at the start of the next.
 const directives = `
 # The engine only detects. smallwebwaf compares the request's anomaly
 # score with SWWAF_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
@@ -69,6 +76,14 @@ SecArgumentsLimit 1000
 SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
     severity:'CRITICAL',setvar:'tx.inbound_anomaly_score_pl1=+5'"
 
+# The exclusions file comes before the rules, where the Core Rule Set puts
+# its own file of exclusions that run before the rules, so that they run
+# before the rules of phase 1 too.
+%s
+
+# The eighth change comes before the rules for the same reason.
+%s
+
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
@@ -96,10 +111,19 @@ SecRuleUpdateTargetById 932260 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
     !ARGS:artifactName|!ARGS:redirect_to"
 
 # The fifth, for Referer: it is not checked for a Unix command without
-# arguments, or for Java starting a process. The cookies are left out in
-# Inspect.
+# arguments, for Java starting a process, or for a Java class name. 944130
+# refused every page opened from the page of java.lang.String.md. The
+# cookies are left out in Inspect.
 SecRuleUpdateTargetById 932340 "!REQUEST_HEADERS:Referer"
 SecRuleUpdateTargetById 944110 "!REQUEST_HEADERS:Referer"
+SecRuleUpdateTargetById 944130 "!REQUEST_HEADERS:Referer"
+
+# The seventh: a container image push that reuses a layer names the image
+# it takes the layer from in the query parameter from, which is not
+# checked for command names. 932260 refused the push of a layer from
+# owner/python3-app.
+SecRule REQUEST_FILENAME "@rx ^/v2/.+/blobs/uploads/$" \
+    "id:900500,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:from"
 `
 
 // bodyDirectives have the Core Rule Set read the part of a request body
@@ -144,6 +168,13 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" "id:900450,phase:2,pass,\
     severity:'CRITICAL',setvar:'tx.inbound_anomaly_score_pl1=+5'"
 `
 
+// giteaExclusions are the eighth change: the fields of gitea's own
+// requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed gitea.conf
+var giteaExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -160,6 +191,51 @@ type Params struct {
 	// BodyLimit is the most of a request body the Core Rule Set reads
 	// (SWWAF_WAF_BODY_LIMIT), 0 while it is off and it reads none.
 	BodyLimit int64
+	// ExclusionsFile is the path of a file of exclusions loaded before the
+	// Core Rule Set's rules (SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
+	// there is none.
+	ExclusionsFile string
+}
+
+// The ids of smallwebwaf's own rules, which an exclusions file may not
+// name.
+const (
+	firstOwnRuleID = 900000
+	lastOwnRuleID  = 900999
+)
+
+// numberOrRange matches a number, or a range of numbers such as
+// 900000-900999.
+var numberOrRange = regexp.MustCompile(`(\d+)(?:-(\d+))?`)
+
+// errSmallwebwafRuleID is the error of an exclusions file that names an
+// id of smallwebwaf's own rules.
+var errSmallwebwafRuleID = errors.New("an id of smallwebwaf's own rules")
+
+// ownRuleNamed returns the first number or range in exclusions, the text
+// of an exclusions file, that takes in an id of smallwebwaf's own rules,
+// or "" if none does. Comment lines are skipped, as Coraza skips them.
+func ownRuleNamed(exclusions string) string {
+	for line := range strings.Lines(exclusions) {
+		if strings.HasPrefix(strings.TrimSpace(line), "#") {
+			continue
+		}
+
+		for _, match := range numberOrRange.FindAllStringSubmatch(line, -1) {
+			first, _ := strconv.Atoi(match[1])
+
+			last := first
+			if match[2] != "" {
+				last, _ = strconv.Atoi(match[2])
+			}
+
+			if first <= lastOwnRuleID && last >= firstOwnRuleID {
+				return match[0]
+			}
+		}
+	}
+
+	return ""
 }
 
 // CoreRuleSet is the Core Rule Set, ready to inspect requests. It is safe
@@ -169,16 +245,36 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the six changes, at params'
-// paranoia level, without the rules it switches off, and reading request
-// bodies up to params' limit.
+// New returns the Core Rule Set with the eight changes, at params'
+// paranoia level, without the rules it switches off, reading request
+// bodies up to params' limit, and with params' exclusions file loaded
+// before the Core Rule Set's rules. An exclusions file that cannot be
+// read, does not parse or names an id of smallwebwaf's own rules is an
+// error.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
 	if params.BodyLimit > 0 {
 		body = fmt.Sprintf(bodyDirectives, params.BodyLimit)
 	}
 
-	text := fmt.Sprintf(directives, params.ParanoiaLevel, body)
+	exclusions := ""
+
+	if params.ExclusionsFile != "" {
+		file, err := os.ReadFile(params.ExclusionsFile)
+		if err != nil {
+			return nil, fmt.Errorf("read the exclusions file: %w", err)
+		}
+
+		exclusions = string(file)
+
+		if named := ownRuleNamed(exclusions); named != "" {
+			return nil, fmt.Errorf("the exclusions file names %s: %w", named,
+				errSmallwebwafRuleID)
+		}
+	}
+
+	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
+		giteaExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))