Protocol detection with Cloudflare Gateway

What this post added

Introduced protocol detection to Cloudflare Gateway, allowing for filtering of network traffic based on protocol signatures (e.g., SSH, HTTP, MQTT) rather than solely relying on port numbers. This was implemented by adding a TCP socket pre-read hook to OXY, Cloudflare's Rust-based policy framework, to buffer initial data bytes for comparison against a protocol signature database. This enables more precise security policies and reduces the risk of over/under-filtering.