Making the WAF 40% faster

This post details performance improvements to the Cloudflare WAF, primarily focusing on the transition from PCRE to RE2 for regular expression matching, which guarantees linear execution time and improves reliability. It also describes the implementation of memoization for expensive function calls within WAF rules, leading to significant execution time reductions (up to 95% for some rules). Rule rewriting and the addition of pre-filter checks further optimized performance. These changes resulted in a 40% decrease in average WAF request processing time at the edge, a 4.3% drop in CPU consumption, and an increase in cache hit percentage from 56% to 74%. The post also mentions the ongoing porting of the WAF to the wirefilter execution engine.