Skip to content

Commit abd7066

Browse files
authored
[WAF] Add note about FW rules migration (#22213)
* Fix formatting * Add back missing tables * Add note about paused filters
1 parent 450a65d commit abd7066

File tree

5 files changed

+216
-122
lines changed

5 files changed

+216
-122
lines changed

src/content/docs/firewall/api/cf-filters/endpoints.mdx

Lines changed: 9 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,8 @@ sidebar:
66
head:
77
- tag: title
88
content: Endpoints - Filters
9-
109
---
1110

12-
13-
1411
To invoke a Cloudflare Filters API operation, append the endpoint to the Cloudflare API base URL:
1512

1613
```txt
@@ -23,19 +20,16 @@ For help with endpoints and pagination, refer to [Getting Started: Endpoints](/f
2320

2421
:::note
2522

26-
2723
The Filters API endpoints require a value for `<ZONE_ID>`.
2824

2925
To retrieve a list of zones associated with your account, use the [List Zones](/api/resources/zones/methods/list/) operation and note the Zone ID associated with the domain for which you want to manage filters.
3026

31-
3227
:::
3328

3429
The Cloudflare Filters API supports the operations outlined below. Visit the pages in this section for examples.
3530

36-
37-
38-
<table style="table-layout:fixed; width:100%">
31+
{/* prettier-ignore */}
32+
<table>
3933
<thead>
4034
<tr>
4135
<th style="width: 20%">Operation</th>
@@ -49,7 +43,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
4943
<a href="/api/resources/filters/methods/create/">Create filters</a>
5044
</td>
5145
<td>
52-
<code class="InlineCode">POST zones/&lt;ZONE_ID&gt;/filters</code>
46+
<code>POST zones/&lt;ZONE_ID&gt;/filters</code>
5347
</td>
5448
<td>Handled as a single transaction. If there is an error, the entire operation fails.</td>
5549
</tr>
@@ -58,7 +52,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
5852
<a href="/api/resources/filters/methods/list/">Get filters</a>
5953
</td>
6054
<td>
61-
<code class="InlineCode">GET zones/&lt;ZONE_ID&gt;/filters</code>
55+
<code>GET zones/&lt;ZONE_ID&gt;/filters</code>
6256
</td>
6357
<td>
6458
Lists all current filters. Results return paginated with 25 items per page by default. Use
@@ -70,9 +64,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
7064
<a href="/api/resources/filters/methods/get/">Get a filter</a>
7165
</td>
7266
<td>
73-
<code class="InlineCode">
74-
GET zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;
75-
</code>
67+
<code>GET zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;</code>
7668
</td>
7769
<td>Retrieve a single filter by ID.</td>
7870
</tr>
@@ -81,7 +73,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
8173
<a href="/api/resources/filters/methods/bulk_update/">Update filters</a>
8274
</td>
8375
<td>
84-
<code class="InlineCode">PUT zones/&lt;ZONE_ID&gt;/filters</code>
76+
<code>PUT zones/&lt;ZONE_ID&gt;/filters</code>
8577
</td>
8678
<td>
8779
Handled as a single transaction. All filters must exist for operation to succeed. If there
@@ -93,9 +85,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
9385
<a href="/api/resources/filters/methods/update/">Update a filter</a>
9486
</td>
9587
<td>
96-
<code class="InlineCode">
97-
PUT zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;
98-
</code>
88+
<code>PUT zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;</code>
9989
</td>
10090
<td>Update a single filter by ID.</td>
10191
</tr>
@@ -104,7 +94,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
10494
<a href="/api/resources/filters/methods/bulk_delete/">Delete filters</a>
10595
</td>
10696
<td>
107-
<code class="InlineCode">DELETE zones/&lt;ZONE_ID&gt;/filters</code>
97+
<code>DELETE zones/&lt;ZONE_ID&gt;/filters</code>
10898
</td>
10999
<td>
110100
<p>Delete existing filters. Must specify list of filter IDs.</p>
@@ -119,9 +109,7 @@ The Cloudflare Filters API supports the operations outlined below. Visit the pag
119109
<a href="/api/resources/filters/methods/delete/">Delete a filter</a>
120110
</td>
121111
<td>
122-
<code class="InlineCode">
123-
DELETE zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;
124-
</code>
112+
<code>DELETE zones/&lt;ZONE_ID&gt;/filters/&lt;FILTER_ID&gt;</code>
125113
</td>
126114
<td>Delete a filter by ID.</td>
127115
</tr>

src/content/docs/firewall/api/cf-filters/json-object.mdx

Lines changed: 62 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,22 +6,78 @@ sidebar:
66
head:
77
- tag: title
88
content: Filter JSON object
9-
109
---
1110

11+
import { Type } from "~/components";
12+
1213
## Filter object structure and properties
1314

1415
A JSON response for the [Filters API](/api/resources/filters/methods/list/) has this structure:
1516

1617
```json
1718
{
18-
"id": "6f58318e7fa2477a23112e8118c66f61",
19-
"expression": "http.request.uri.path ~ \"^.*/wp-login.php$\" or http.request.uri.path ~ \"^.*/xmlrpc.php$\"",
20-
"paused": true,
21-
"description": "WordPress login paths",
22-
"ref": ""
19+
"id": "6f58318e7fa2477a23112e8118c66f61",
20+
"expression": "http.request.uri.path ~ \"^.*/wp-login.php$\" or http.request.uri.path ~ \"^.*/xmlrpc.php$\"",
21+
"paused": true,
22+
"description": "WordPress login paths",
23+
"ref": ""
2324
}
2425
```
2526

2627
The following table summarizes the object properties:
2728

29+
{/* prettier-ignore */}
30+
<table>
31+
<thead>
32+
<tr>
33+
<th>Property</th>
34+
<th>Description</th>
35+
<th>Constraints</th>
36+
</tr>
37+
</thead>
38+
<tbody>
39+
<tr>
40+
<td>
41+
<code>id</code><br />
42+
<Type text="String" />
43+
</td>
44+
<td>A UUIDv4 identifier generated by Cloudflare.</td>
45+
<td>
46+
<p>Unique, read only</p>
47+
<p>Length: 32 characters</p>
48+
</td>
49+
</tr>
50+
<tr>
51+
<td>
52+
<code>expression</code><br />
53+
<Type text="String" />
54+
</td>
55+
<td>A Rules language expression used to evaluate requests. For more information, refer to <a href="/ruleset-engine/rules-language/expressions/">Expressions</a>.</td>
56+
<td></td>
57+
</tr>
58+
<tr>
59+
<td>
60+
<code>paused</code><br />
61+
<Type text="Boolean" />
62+
</td>
63+
<td>Returns <code>true</code> when the filter is not active. Use <code>ref</code> to enable/disable the filter.</td>
64+
<td>Default: <code>false</code></td>
65+
</tr>
66+
<tr>
67+
<td>
68+
<code>description</code><br />
69+
<Type text="String" />
70+
</td>
71+
<td>An informative summary of the filter.</td>
72+
<td>Maximum length: 500 characters</td>
73+
</tr>
74+
<tr>
75+
<td>
76+
<code>ref</code><br />
77+
<Type text="String" />
78+
</td>
79+
<td>A short string for tagging filters.</td>
80+
<td>Maximum length: 50 characters</td>
81+
</tr>
82+
</tbody>
83+
</table>

src/content/docs/firewall/api/cf-firewall-rules/json-object.mdx

Lines changed: 104 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,44 +6,130 @@ sidebar:
66
head:
77
- tag: title
88
content: Firewall rules JSON object
9-
109
---
1110

11+
import { Type } from "~/components";
12+
1213
## Firewall rule example JSON response
1314

1415
A JSON response for the [Firewall Rules API](/api/resources/firewall/subresources/rules/methods/list/) has this structure:
1516

1617
```json
1718
{
18-
"id": "772bf1026a72c400ea576db1ffa16407",
19-
"filter": {
20-
"id": "6f58318e7fa2477a23112e8118c66f61",
21-
"expression": "http.request.uri.path ~ \"^.*/wp-login.php$\" or http.request.uri.path ~ \"^.*/xmlrpc.php$\"",
22-
"paused": false,
23-
"description": "WordPress login paths",
24-
"ref": ""
25-
},
26-
"action": "challenge",
27-
"priority": 1000,
28-
"paused": false,
29-
"description": "Protect blog login page",
30-
"ref": ""
19+
"id": "772bf1026a72c400ea576db1ffa16407",
20+
"filter": {
21+
"id": "6f58318e7fa2477a23112e8118c66f61",
22+
"expression": "http.request.uri.path ~ \"^.*/wp-login.php$\" or http.request.uri.path ~ \"^.*/xmlrpc.php$\"",
23+
"paused": false,
24+
"description": "WordPress login paths",
25+
"ref": ""
26+
},
27+
"action": "challenge",
28+
"priority": 1000,
29+
"paused": false,
30+
"description": "Protect blog login page",
31+
"ref": ""
3132
}
3233
```
3334

3435
This table summarizes the object properties:
3536

36-
37+
{/* prettier-ignore */}
38+
<table>
39+
<thead>
40+
<tr>
41+
<th>Name</th>
42+
<th>Description</th>
43+
<th>Constraints</th>
44+
</tr>
45+
</thead>
46+
<tbody>
47+
<tr>
48+
<td>
49+
<code>id</code><br />
50+
<Type text="String" />
51+
</td>
52+
<td>A UUIDv4 identifier generated by Cloudflare.</td>
53+
<td>
54+
<p>Unique, read only</p>
55+
<p>Length: 32 characters</p>
56+
</td>
57+
</tr>
58+
<tr>
59+
<td>
60+
<code>filter</code><br />
61+
<Type text="Object" />
62+
</td>
63+
<td>
64+
A <a href="/firewall/api/cf-filters/json-object/">Cloudflare Filter object</a> that contains an expression for evaluating this rule.
65+
</td>
66+
<td></td>
67+
</tr>
68+
<tr>
69+
<td>
70+
<code>action</code><br />
71+
<Type text="String" />
72+
</td>
73+
<td>
74+
The action to take when a request satisfies the filter expression for this rule.
75+
</td>
76+
<td>
77+
Refer to <a href="/firewall/cf-firewall-rules/actions/">Firewall rules actions</a> for a list of supported values.
78+
</td>
79+
</tr>
80+
<tr>
81+
<td>
82+
<code>priority</code><br />
83+
<Type text="Number" />
84+
</td>
85+
<td>
86+
Determines the order of evaluation for the rule relative to others. Lower values indicate greater priority. Rules without a value are evaluated last. For guidance, refer to <a href="#avoiding-priority-conflicts">Avoiding priority conflicts</a>.
87+
</td>
88+
<td>
89+
<p>Read only</p>
90+
<p>Maximum length: 32</p>
91+
</td>
92+
</tr>
93+
<tr>
94+
<td>
95+
<code>paused</code><br />
96+
<Type text="Boolean" />
97+
</td>
98+
<td>
99+
Returns <code>true</code> when the rule is not active. Use <code>ref</code> to enable/disable the rule.
100+
</td>
101+
<td>
102+
Default: <code>false</code>
103+
</td>
104+
</tr>
105+
<tr>
106+
<td>
107+
<code>description</code><br />
108+
<Type text="String" />
109+
</td>
110+
<td>An informative summary of the rule.</td>
111+
<td>Maximum length: 500 characters</td>
112+
</tr>
113+
<tr>
114+
<td>
115+
<code>ref</code><br />
116+
<Type text="String" />
117+
</td>
118+
<td>A short string for tagging rules.</td>
119+
<td>Maximum length: 50 characters</td>
120+
</tr>
121+
</tbody>
122+
</table>
37123

38124
## Avoiding priority conflicts
39125

40126
Priority plays a key role in configuring firewall rules. With Cloudflare Filters, it is possible to construct conflicting rules such as:
41127

42-
* Allow requests from the office IP range, and
43-
* Block requests with a specific user agent.
128+
- Allow requests from the office IP range, and
129+
- Block requests with a specific user agent.
44130

45131
Requests from the office IP range using the user agent to block would trigger both rules, but we cannot both allow and block the request. To solve this problem, firewall rules follows a strict ordering depending on action and priority.
46132

47-
Cloudflare prioritizes rules in descending order, such that priority 1 is first and rules with no priority are last. For rules of equal priority, Cloudflare orders them by action according to their [order of precedence](/firewall/cf-firewall-rules/actions/#supported-actions). In the example above, if no priority is set, the rule `allow request from the office IP range` would apply because the *allow* action has a higher precedence than *block*.
133+
Cloudflare prioritizes rules in descending order, such that priority 1 is first and rules with no priority are last. For rules of equal priority, Cloudflare orders them by action according to their [order of precedence](/firewall/cf-firewall-rules/actions/#supported-actions). In the example above, if no priority is set, the rule `allow request from the office IP range` would apply because the _allow_ action has a higher precedence than _block_.
48134

49135
To reduce the risk of unintended behavior, it is best to explicitly specify the desired priority for potentially conflicting rules.

0 commit comments

Comments
 (0)