From IP packets to HTTP: the many faces of our Oxy framework

This post introduces Cloudflare's Oxy framework, a Rust-based proxy that operates across multiple OSI layers. It details how Oxy handles raw IP packets for Cloudflare One and Zero Trust principles, implements IP tunneling with context for multi-tenancy (e.g., WARP, Magic WAN), and tracks IP flows for policy enforcement and auditing. Crucially, it explains how Oxy upgrades IP flows to TCP streams by leveraging the Linux kernel's TUN interface and network namespaces, enabling user-space applications to process TCP connections efficiently. This significantly expands the capabilities for managing and securing internal services by providing fine-grained control at various network layers.