Skip to content

Commit 9101a5c

Browse files
maxvpRebeccaTamachiroOxyjun
authored andcommitted
[Gateway] File sandboxing (#16786)
Co-authored-by: Rebecca Tamachiro <[email protected]> Co-authored-by: Jun Lee <[email protected]>
1 parent 80c9626 commit 9101a5c

File tree

10 files changed

+207
-100
lines changed

10 files changed

+207
-100
lines changed

src/content/docs/cloudflare-one/policies/gateway/http-policies/antivirus-scanning.mdx

Lines changed: 78 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -2,111 +2,111 @@
22
pcx_content_type: concept
33
title: AV scanning
44
sidebar:
5-
order: 8
6-
5+
order: 5
76
---
87

9-
Cloudflare Gateway protects users as they browse the Internet. When users download or upload a file to an origin on the Internet, that file could potentially contain malicious code that may cause their device to perform undesired behavior.
8+
import { Render, Details } from "~/components";
109

11-
To prevent this, Cloudflare Gateway allows admins to enable **Anti-Virus (AV) scanning** of files that are uploaded or downloaded by users as the file passes through Gateway.
10+
Cloudflare Gateway protects users as they browse the Internet. When users download or upload a file to an origin on the Internet, that file could potentially contain malicious code that may cause their device to perform undesired behavior. To prevent this, Cloudflare Gateway allows admins to turn on anti-virus (AV) scanning of files that are uploaded or downloaded by users as the file passes through Gateway.
1211

13-
AV scanning of files requires organizations to go to **Settings** > **Network** > **Firewall** and enable **AV inspection**.
12+
In addition to scanning files, Gateway can quarantine files as your users download them. Quarantining files helps protect organizations from zero-day vulnerabilities not yet available in anti-virus databases. For more information, refer to [File sandboxing](/cloudflare-one/policies/gateway/http-policies/file-sandboxing/).
1413

15-
## Enable AV scanning
14+
## Get started
1615

17-
To enable AV scanning:
16+
To turn on AV scanning:
1817

1918
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Network**.
20-
2. In **Firewall**, enable **AV inspection**.
19+
2. In **Firewall**, turn on **AV inspection**.
2120
3. Choose whether to scan files for malicious payloads during uploads, downloads, or both. You can also block requests containing [non-scannable files](#non-scannable-files).
2221

2322
When a request is blocked due to the presence of malware, Gateway will log the match as a Block decision in your [HTTP logs](/cloudflare-one/insights/logs/gateway-logs/#http-logs).
2423

25-
## How Gateway determines if a file should be scanned
26-
27-
If AV scanning is enabled, Gateway will use the following to determine whether a file is present in a request or response, and whether to scan that file (first match will result in the file being scanned):
28-
29-
* If the Content-Disposition HTTP header is `Attachment`
30-
31-
* If the byte signature of the body of the request matches a signature we identify as one of the following file type categories:
24+
## File scan criteria
3225

33-
* **Executable** (e.g., `.exe`, `.bat`, `.dll`, `.wasm`)
34-
* **Documents** (e.g., `.doc`, `.docx`, `.pdf`, `.ppt`, `.xls`)
35-
* **Compressed** (e.g., `.7z`, `.gz`, `.zip`, `.rar`)
26+
If AV scanning is turned on, Gateway will use the following criteria to determine whether a file is present in a request or response, and whether to scan that file. The first match will result in the file being scanned.
3627

37-
* If the file name in the Content-Disposition header contains a file extension that indicates it is one of the file type categories above
28+
- If the `Content-Disposition` HTTP header is `Attachment`
29+
- If the byte signature of the body of the request matches a signature Gateway identifies as one of the following file type categories:
30+
- **Executable** (for example, `.exe`, `.bat`, `.dll`, and `.wasm`)
31+
- **Documents** (for example, `.doc`, `.docx`, `.pdf`, `.ppt`, and `.xls`)
32+
- **Compressed** (for example, `.7z`, `.gz`, `.zip`, and `.rar`)
33+
- If the file name in the `Content-Disposition` header contains a file extension that indicates it is one of the file type categories above
3834

39-
If none of the above conditions trigger a file to be scanned, Gateway will use the origin's Content-Type header to determine whether or not to scan the file. Additionally, Gateway will not scan files it determines to be in the Image, Video, or Audio file type categories.
35+
If none of the above conditions trigger a file to be scanned, Gateway will use the origin's `Content-Type` header to determine whether or not to scan the file. Additionally, Gateway will not scan files it determines to be image, video, or audio files.
4036

4137
If a file does not trigger a scan based on the three methods above but also does not match criteria to be exempted from scanning, Gateway will default to scanning the file for malware.
4238

43-
## Non-scannable files
44-
45-
Not all files are able to be scanned. For example, this is the case for password protected files that cannot be opened due to encryption. Admins can choose whether to **fail open** (allow the file to pass through unscanned) or to **fail closed** (deny the file transfer).
46-
47-
The following files cannot be scanned and will be blocked or allowed based on whether the admin configured Gateway to fail open or closed:
48-
49-
* Files larger than 15MB cannot be scanned.
50-
* Password protected archives
51-
* Archives with more than 3 recursion levels
52-
* Archives with more than 300 files
53-
* PGP encrypted files
54-
5539
## Opt content out from scanning
5640

57-
When an admin enables AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning by leveraging the HTTP rules. All [HTTP selectors](/cloudflare-one/policies/gateway/http-policies/#selectors) can be used to opt HTTP traffic out from AV scanning using the Do Not Scan action. For example, to prevent AV scanning of files uploaded to or downloaded from `example.com`, an admin would configure the following rule:
41+
When an admin turns on AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning using HTTP policies. All [HTTP selectors](/cloudflare-one/policies/gateway/http-policies/#selectors) can opt HTTP traffic out from AV scanning using the **Do Not Scan** action. When traffic matches a Do Not Scan policy, nothing is scanned, regardless of file size or whether the file type is supported or not. For example, to prevent AV scanning of files uploaded to or downloaded from `example.com`, you can create the following policy:
5842

5943
| Selector | Operator | Value | Action |
6044
| -------- | ------------- | ------------- | ----------- |
6145
| Hostname | matches regex | `example.com` | Do Not Scan |
6246

63-
Opting out of AV scanning applies to both uploads and downloads of files (i.e., it matches the global AV scanning setting). If an admin has chosen, for example, to only globally scan uploads, then opting out of AV scanning only applies to uploads.
47+
Opting out of AV scanning applies to uploads and/or downloads of files, matching your account's global AV scanning setting. For example, if you have configured Gateway to globally scan uploads only, then opting out of AV scanning will only apply to uploads.
6448

65-
When traffic matches a Do Not Scan rule, nothing is scanned, regardless of file size or whether the file type is supported or not.
49+
## Compatibility
6650

67-
## Supported compressed file types
51+
### Supported compressed file types
6852

6953
In addition to standard object files like PDFs, Zero Trust supports AV scanning for the following archive types:
7054

71-
* 7-Zip
72-
* 7-Zip SFX
73-
* ACE
74-
* ACE SFX
75-
* AutoHotkey
76-
* AutoIt
77-
* BASE64
78-
* BZ2
79-
* CHM Help Files
80-
* CPIO SVR4
81-
* Chrome Extension (CRX) Package Format
82-
* eXtensible ARchive format (XAR)
83-
* GZIP compressed files
84-
* ISO 9660
85-
* Inno Setup
86-
* Indigo Rose Setup Factory
87-
* Java ARchive
88-
* LZH/LHA
89-
* MacBinary
90-
* MIME base64
91-
* MSCOMPRESS
92-
* Microsoft CAB
93-
* Microsoft TNEF
94-
* NSIS Nullsoft Installer
95-
* Office Legacy XML
96-
* PGP signed message, document, etc.
97-
* RPM
98-
* RAR
99-
* SAPCar
100-
* Self-extracting ARJ
101-
* Self-extracting CA
102-
* Self-extracting LZH/LHA
103-
* Self-extracting RAR
104-
* Self-extracting ZIP
105-
* Smart Install Maker
106-
* TAR
107-
* UUE and XXE compressed files
108-
* Windows Imaging File (WIM)
109-
* XE compressed files (UUE and XXE)
110-
* XZ file format
111-
* ZIP
112-
* ZOO
55+
<Details header="Supported compressed file types">
56+
57+
- 7-Zip
58+
- 7-Zip SFX
59+
- ACE
60+
- ACE SFX
61+
- AutoHotkey
62+
- AutoIt
63+
- BASE64
64+
- BZ2
65+
- CHM Help Files
66+
- CPIO SVR4
67+
- Chrome Extension (CRX) Package Format
68+
- eXtensible ARchive format (XAR)
69+
- GZIP compressed files
70+
- ISO 9660
71+
- Inno Setup
72+
- Indigo Rose Setup Factory
73+
- Java ARchive
74+
- LZH/LHA
75+
- MacBinary
76+
- MIME base64
77+
- MSCOMPRESS
78+
- Microsoft CAB
79+
- Microsoft TNEF
80+
- NSIS Nullsoft Installer
81+
- Office Legacy XML
82+
- PGP signed message, document, etc.
83+
- RPM
84+
- RAR
85+
- SAPCar
86+
- Self-extracting ARJ
87+
- Self-extracting CA
88+
- Self-extracting LZH/LHA
89+
- Self-extracting RAR
90+
- Self-extracting ZIP
91+
- Smart Install Maker
92+
- TAR
93+
- UUE and XXE compressed files
94+
- Windows Imaging File (WIM)
95+
- XE compressed files (UUE and XXE)
96+
- XZ file format
97+
- ZIP
98+
- ZOO
99+
100+
</Details>
101+
102+
Gateway cannot scan [certain archive files](#non-scannable-files) regardless of file type, such as large or encrypted files.
103+
104+
### Non-scannable files
105+
106+
Gateway cannot scan all files for malware. When Gateway encounters a non-scannable file, you can configure AV scanning whether to fail open (allow the file to pass through unscanned) or to fail closed (deny the file transfer).
107+
108+
<Render file="gateway/nonscannable-files" />
109+
110+
- Password protected archives
111+
- Archives with more than three recursion levels
112+
- Archives with more than 300 files
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
pcx_content_type: concept
3+
title: File sandboxing
4+
sidebar:
5+
order: 6
6+
---
7+
8+
import { Render, Details } from "~/components";
9+
10+
In addition to [anti-virus (AV) scanning](/cloudflare-one/policies/gateway/http-policies/antivirus-scanning/), Gateway can quarantine previously unseen files downloaded by your users into a sandbox and scan them for malware.
11+
12+
While the files are quarantined, Gateway will present a scanning page to your users. If a file passes scanning, Gateway will release the file from quarantine and download it to your user's device.
13+
14+
## Get started
15+
16+
To begin quarantining downloaded files, turn on file sandboxing:
17+
18+
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Network**.
19+
2. In **Firewall**, turn on **File sandboxing**.
20+
3. (Optional) To block requests containing [non-scannable files](#non-scannable-files), select **Block requests for files that cannot be scanned**.
21+
22+
You can now create [Quarantine HTTP policies](/cloudflare-one/policies/gateway/http-policies/#quarantine) to determine what files to scan in the sandbox.
23+
24+
## Compatibility
25+
26+
### Supported file types
27+
28+
<Render file="gateway/sandbox-file-types" />
29+
30+
### Non-scannable files
31+
32+
<Render file="gateway/nonscannable-files" />
33+
34+
- Archive files

src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: concept
33
title: HTTP/3
44
sidebar:
5-
order: 5
5+
order: 2
66
---
77

88
import { Details } from "~/components";

src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx

Lines changed: 54 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ sidebar:
88
import { Details, InlineBadge, Render } from "~/components";
99

1010
:::note
11-
12-
Install the <a href="/cloudflare-one/connections/connect-devices/warp/user-side-certificates/">Cloudflare Root Certificate</a> before creating HTTP policies.
13-
11+
To use HTTP policies, install the [Cloudflare root certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/).
1412
:::
1513

1614
HTTP policies allow you to intercept all HTTP and HTTPS requests and either block, allow, or override specific elements such as websites, IP addresses, and file types. HTTP policies operate on Layer 7 for all TCP (and [optionally UDP](/cloudflare-one/policies/gateway/initial-setup/http/#1-connect-to-gateway)) traffic sent over ports 80 and 443.
@@ -90,9 +88,7 @@ The Allow action allows outbound traffic to reach destinations you specify withi
9088
#### Untrusted certificates
9189

9290
:::note
93-
9491
To use this feature, deploy a [custom root certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/custom-certificate/).
95-
9692
:::
9793

9894
The **Untrusted certificate action** determines how to handle insecure requests.
@@ -340,12 +336,61 @@ When an admin enables AV scanning for uploads and/or downloads, Gateway will sca
340336

341337
When a Do Not Scan rule matches, nothing is scanned, regardless of file size or whether the file type is supported or not.
342338

339+
### Quarantine
340+
341+
API value: `quarantine`
342+
343+
<Details header="Available selectors">
344+
345+
**Traffic**
346+
347+
- [Application](#application)
348+
- [Content Categories](#content-categories)
349+
- [Destination Continent IP Geolocation](#destination-continent)
350+
- [Destination Country IP Geolocation](#destination-country)
351+
- [Destination IP](#destination-ip)
352+
- [Domain](#domain)
353+
- [Host](#host)
354+
- [HTTP Method](#http-method)
355+
- [Proxy Endpoint](#proxy-endpoint)
356+
- [Security Risks](#security-risks)
357+
- [Source Continent IP Geolocation](#source-continent)
358+
- [Source Country IP Geolocation](#source-country)
359+
- [Source Internal IP](#source-internal-ip)
360+
- [Source IP](#source-ip)
361+
- [URL](#url)
362+
- [URL Path](#url-path)
363+
- [URL Path & Query](#url-path-and-query)
364+
- [URL Query](#url-query)
365+
- [Virtual Network](#virtual-network)
366+
367+
**Identity**
368+
369+
- [SAML Attributes](#users)
370+
- [User Email](#users)
371+
- [User Group Emails](#users)
372+
- [User Group IDs](#users)
373+
- [User Group Names](#users)
374+
- [User Name](#users)
375+
376+
**Device Posture**
377+
378+
- [Passed Device Posture Checks](#device-posture)
379+
380+
</Details>
381+
382+
The Quarantine action sends files in matching requests to a file sandbox to scan for malware. Gateway will only quarantine files not previously seen in the file sandbox. For more information on this action, refer to [File sandboxing](/cloudflare-one/policies/gateway/http-policies/file-sandboxing/).
383+
384+
#### Sandbox file types
385+
386+
In **Sandbox file types**, you can select which file types to quarantine with your policy. You must select at least one file type.
387+
388+
<Render file="gateway/sandbox-file-types" />
389+
343390
## Selectors
344391

345392
:::note
346-
347393
Policies created using the URL selector are case-sensitive.
348-
349394
:::
350395

351396
Gateway matches HTTP traffic against the following selectors, or criteria:
@@ -371,7 +416,6 @@ For more information, refer to our list of [content categories](/cloudflare-one/
371416
### Destination Continent
372417

373418
:::note
374-
375419
Only applies to traffic sent through the [WARP client](/cloudflare-one/connections/connect-devices/warp/set-up-warp/#gateway-with-warp-default).
376420
:::
377421

@@ -383,7 +427,6 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio
383427
### Destination Country
384428

385429
:::note
386-
387430
Only applies to traffic sent through the [WARP client](/cloudflare-one/connections/connect-devices/warp/set-up-warp/#gateway-with-warp-default).
388431
:::
389432

@@ -395,7 +438,6 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio
395438
### Destination IP
396439

397440
:::note
398-
399441
Only applies to traffic sent through the [WARP client](/cloudflare-one/connections/connect-devices/warp/set-up-warp/#gateway-with-warp-default).
400442
:::
401443

@@ -409,7 +451,7 @@ Only applies to traffic sent through the [WARP client](/cloudflare-one/connectio
409451

410452
### Domain
411453

412-
Use this selector to match against a domain and all subdomains — for example, if you want to block `example.com` and subdomains such as `www.example.com`.
454+
Use this selector to match against a domain and all subdomains -- for example, if you want to block `example.com` and subdomains such as `www.example.com`.
413455

414456
| UI name | API example |
415457
| ------- | ----------------------------------------------- |
@@ -451,16 +493,14 @@ Scans HTTP traffic for the presence of social security numbers and other PII. Yo
451493

452494
### Host
453495

454-
Use this selector to match only the hostname specified — for example, if you want to block `test.example.com` but not `example.com` or `www.test.example.com`.
496+
Use this selector to match only the hostname specified -- for example, if you want to block `test.example.com` but not `example.com` or `www.test.example.com`.
455497

456498
| UI name | API example |
457499
| ------- | ----------------------------------------- |
458500
| Host | `http.request.host == "test.example.com"` |
459501

460502
:::note
461-
462503
Some hostnames (`example.com`) will invisibly redirect to the www subdomain (`www.example.com`). To match this type of website, use the [Domain](#domain) selector instead of the Host selector.
463-
464504
:::
465505

466506
### HTTP Method

src/content/docs/cloudflare-one/policies/gateway/http-policies/tenant-control.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: how-to
33
title: Tenant control
44
sidebar:
5-
order: 7
5+
order: 4
66
---
77

88
With Gateway tenant control, you can allow your users access to corporate SaaS applications while blocking access to personal applications. This helps prevent the loss of sensitive or confidential data from a corporate network.

src/content/docs/cloudflare-one/policies/gateway/http-policies/tls-decryption.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: concept
33
title: TLS decryption
44
sidebar:
5-
order: 6
5+
order: 3
66

77
---
88

src/content/docs/cloudflare-one/policies/gateway/http-policies/websocket.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: how-to
33
title: WebSocket traffic
44
sidebar:
5-
order: 9
5+
order: 7
66

77
---
88

0 commit comments

Comments
 (0)