
9/24/2020 · Zak Cutner
What this post added
This post details significant performance optimizations made to Cloudflare's Wirefilter engine, which powers Firewall Rules and is planned for broader use in products like the Web Application Firewall (WAF). It describes the development of a performance measurement framework using hardware counters and the `perf_event_open` API, inspired by Rust compiler benchmarks. The post highlights optimizations to the `contains` operator by leveraging specialized substring search algorithms, inspired by Rust's regex library, and discusses strategies for making benchmarks faster and more representative, such as deduplication, sampling, and partitioning. This directly contributes to the evolution of Cloudflare's WAF by improving the underlying engine's speed and efficiency.