Cloudflare blocking DAVx5 user-agent

[kopsis]

I just spent two days troubleshooting this, so I figured I'd share my findings in case someone else runs into the same issue. I run a Radicale CALDAV/CARDDAV server proxied by Cloudflare DNS. In trying to set up the DAVx5 client, I found that the discovery (PROPFIND) request was getting a 403 response with the content "you got permanently banned from this server".

After quite a few hours of research, TCP dumps, etc., I discovered I could issue a "bare" PROPFIND request using curl on a workstation and get the same result. If I leave the user-agent set to the curl default (curl/8.4.0) the request succeeds. If I change the user-agent to the DAVx5 string (both -ose and -gplay values have the same problem), I get the 403 "banned" result.

Digging through the dozen layers of Cloudflare security settings, I couldn't see any specific UA blacklist settings. But I did find that I could create a "header rewrite" rule and change the user-agent from the DAVx5 value to the curl default value. With that change DAVx5 client setup works with no issues. So if you are getting a 403 "banned" from Cloudflare, add a header rewrite on Cloudflare (or suggest it to the server owner) before you assume it's an IP address ban (which most online troubleshooting advice will suggest).