CloudFlare's new WAF: compiling to Lua
Aug 23, 2013John Graham-Cumming
Summary
This post details the technical implementation of Cloudflare's new Web Application Firewall (WAF) which is written in Lua and embedded within Nginx using the HttpLuaModule. It describes the compilation process of WAF rules from mod_security and a new Cloudflare rule language into Lua code, including optimizations like clause reordering and regex simplification. The post also highlights the use of performance analysis tools like lulip and flame graphs to identify and address bottlenecks, leading to a median WAF decision time under 1ms. It also mentions the use of local variables, memoization, and caching for further optimization.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack