Protocol detection with Cloudflare Gateway
Mar 8, 2024Ankur Aggarwal
Summary
Introduced protocol detection to Cloudflare Gateway, allowing for filtering of network traffic based on protocol signatures (e.g., SSH, HTTP, MQTT) rather than solely relying on port numbers. This was implemented by adding a TCP socket pre-read hook to OXY, Cloudflare's Rust-based policy framework, to buffer initial data bytes for comparison against a protocol signature database. This enables more precise security policies and reduces the risk of over/under-filtering.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack