Can http3 be used with Coraza?

[boschje]

Caddy webserver support the http3 protocol. However it looks like it can not be used with Coraza.

To enable http3 both 443/tcp and 443/udp need to be opened in the firewall. But access to the site is then blocked by Coraza and I see these entries in the log:
Coraza: Access denied (phase 1). HTTP protocol version is not allowed by policy @owasp_crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf

When I close 443/udp in the firewall Caddy will serve http2 and then all is working as expected.

[jcchavezs]

I think http3 isn't supported yet by crs? See coreruleset/coreruleset#3218

…

On Mon, 10 Jul 2023, 15:45 Michiel Bosch, ***@***.***> wrote: Caddy webserver support the http3 protocol. However it looks like it can not be used with Coraza. To enable http3 both 444/tcp and 443/udp need to be opened in the firewall. But access to the site is then blocked by Coraza and I see these entries in the log: Coraza: Access denied (phase 1). HTTP protocol version is not allowed by policy @owasp_crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf When I close 443/udp in the firewall Caddy will serve http2 and then all is working as expected. — Reply to this email directly, view it on GitHub <#86>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAX2OBNFL6R5DJEAZBDXPQBN3ANCNFSM6AAAAAA2ESG5IM> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jptosso]

In the meantime, it can be addressed with the following rule before importing CRS:

SecAction \
    "id:900230,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'"

[boschje]

Thank you for that extra rule, it worked well

[jpds]

Fixed in the code itself by corazawaf/coraza-coreruleset#7