CloudFlare's new WAF: compiling to Lua

What this post added

This post details the technical implementation of Cloudflare's new Web Application Firewall (WAF) which is written in Lua and embedded within Nginx using the HttpLuaModule. It describes the compilation process of WAF rules from mod_security and a new Cloudflare rule language into Lua code, including optimizations like clause reordering and regex simplification. The post also highlights the use of performance analysis tools like lulip and flame graphs to identify and address bottlenecks, leading to a median WAF decision time under 1ms. It also mentions the use of local variables, memoization, and caching for further optimization.