Core Rule Set: Nextcloud's calendar and contacts sync pass (closes #280)

rproxy passes MKCALENDAR on. nextcloud.conf allows it on
/remote.php/dav/calendars/ and PROPFIND on /.well-known/caldav and
carddav. The XML of an MKCOL there skips 930120, 932120, 932250 and
932260; that of an MKCALENDAR also 932125 and 932230, for its
description. A PUT of text/calendar or text/vcard there skips 920530:
the Calendar and Contacts apps name the charset twice when they change
an event or a contact.

Recorded from Nextcloud 35.0.2 with Calendar 6.6.5, Contacts 8.9.5 and
requests imitating DAVx5.

Model: opus-5-5

internal/coreruleset/nextcloud.conf

@@ -246,3 +246,54 @@ SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/systemtags/?$" \
 SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
     "id:900118,phase:1,pass,nolog,chain"
     SecRule REQUEST_METHOD "@streq PUT" "ctl:requestBodyProcessor=RAW"
+
+# The Calendar and Contacts apps, and the CalDAV and CardDAV clients of phones
+# and desktops, keep calendars under /remote.php/dav/calendars/ and address
+# books under /remote.php/dav/addressbooks/. A CalDAV client makes a calendar
+# with MKCALENDAR, which 911100 refused.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/calendars/" \
+    "id:900119,phase:1,pass,nolog,\
+    setvar:'tx.allowed_methods=%{tx.allowed_methods} MKCALENDAR'"
+
+# Such a client first asks where the calendars and address books are, with a
+# PROPFIND on /.well-known/caldav or /.well-known/carddav. Nextcloud answers
+# with a redirect to /remote.php/dav/. 911100 refused the PROPFIND.
+SecRule REQUEST_FILENAME "@rx ^/\.well-known/(?:caldav|carddav)$" \
+    "id:900120,phase:1,pass,nolog,\
+    setvar:'tx.allowed_methods=%{tx.allowed_methods} PROPFIND'"
+
+# A new calendar or address book has its name in the XML body of an MKCOL,
+# <d:displayname>Python3 and powershell</d:displayname>, which holds nothing
+# else a person writes.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/(?:calendars|addressbooks)/" \
+    "id:900121,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq MKCOL" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*"
+
+# The XML body of an MKCALENDAR holds the new calendar's name and its
+# description. The description is a sentence, and two rules for sentences
+# refused it too:
+#   932125, 932230: Powershell and python3 meetings; ls -la first
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/calendars/" \
+    "id:900122,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq MKCALENDAR" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932125;XML:/*,\
+        ctl:ruleRemoveTargetById=932230;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*"
+
+# When the Calendar app changes an event, it names the charset twice in the
+# Content-Type of the PUT:
+#   text/calendar; charset=UTF-8; component=vevent; charset=UTF-8
+# The Contacts app does the same with text/vcard when it changes a contact.
+# 920530 refused both. The body of such a PUT is not read (900118).
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/(?:calendars|addressbooks)/" \
+    "id:900123,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq PUT" "chain"
+        SecRule REQUEST_HEADERS:Content-Type "@rx ^text/(?:calendar|vcard);" \
+            "ctl:ruleRemoveById=920530"