Skip to content

[Gateway/DLP] HTTP policy supported files #17579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 16, 2024
Merged

[Gateway/DLP] HTTP policy supported files #17579

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
494a547
Add supported HTTP policy files
maxvp Oct 15, 2024
ca42be9
Rename categories to match UI
maxvp Oct 15, 2024
e704e53
Add link in block-file-types policy partial
maxvp Oct 15, 2024
a4da3fc
Add individual file type callouts
maxvp Oct 16, 2024
c872ad2
Reword DLP
maxvp Oct 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ...s/cloudflare-one/policies/data-loss-prevention/dlp-policies/common-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,9 @@ sidebar:
head:
- tag: title
content: Common DLP policies

---

import { GlossaryTooltip, Render } from "~/components"
import { GlossaryTooltip, Render } from "~/components";

The following in-line DLP policies are commonly used to secure data in uploaded and downloaded files.

Expand All @@ -24,6 +23,8 @@ The **Allow** action functions as an implicit logger, providing visibility into

<Render file="gateway/policies/block-file-types" />

For more information on what file formats DLP can scan, refer to [Supported file types](/cloudflare-one/policies/data-loss-prevention/#supported-file-types).

## Block uploads/downloads for specific users

You can configure access on a per-user or group basis by adding [identity-based conditions](/cloudflare-one/policies/gateway/identity-selectors/) to your policies. The following example blocks only contractors from uploading/downloading Financial Information to file sharing apps.
Expand Down
7 changes: 4 additions & 3 deletions src/content/docs/cloudflare-one/policies/gateway/http-policies/common-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,9 @@ sidebar:
head:
- tag: title
content: Common HTTP policies

---

import { Render } from "~/components"
import { Render } from "~/components";

The following policies are commonly used to secure HTTP traffic.

Expand Down Expand Up @@ -53,7 +52,7 @@ Gateway [evaluates Do Not Inspect policies first](/cloudflare-one/policies/gatew

:::note

You can select either individual applications or the entire Do Not Inspect set, which will update as new applications are added.
You can select either individual applications or the entire Do Not Inspect set, which will update as new applications are added.
:::

## Check device posture
Expand Down Expand Up @@ -97,6 +96,8 @@ When accessing origin servers with certificates not signed by a public certifica

<Render file="gateway/policies/block-file-types" />

For more information on supported file types, refer to [Download and Upload File Types](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-file-types).

## Block Google services

To enable Gateway inspection for Google Drive traffic, you must [add the Cloudflare certificate to Google Drive](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#google-drive-for-desktop).
Expand Down
51 changes: 48 additions & 3 deletions src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,12 +460,57 @@ Use this selector to match against a domain and all subdomains -- for example, i
### Download and Upload File Types

:::caution[Deprecated selectors]

The **Download File Types** and **Upload File Types** selectors supersede the **Download File Type** and **Upload File Type** selectors. Gateway will still evaluate policies with the previous selectors. However, Cloudflare recommends migrating any policies with deprecated selectors to the new corresponding selectors.

:::

These selectors will scan file signatures in the HTTP body. You can select from file categories or specific file types, including executables, archives and compressed files, Microsoft 365/Office documents, and Adobe files.
These selectors will scan file signatures in the HTTP body. You can select from file categories or specific file types, such as executables, archives and compressed files, Microsoft 365/Office documents, and Adobe files:

<Details header="Supported file types">

**Compressed**

- 7-Zip archive (`.7z`)
- `bzip2` archive (`.bz2`)
- GNU Gzip archive (`.gz`)
- Microsoft Cabinet file (`.cab`)
- Microsoft Compiled HTML Help file (`.chm`)
- RAR archive (`.rar`)
- `xz` archive (`.xz`)
- ZIP archive (`.zip`)

**Documents**

- Microsoft Office/365 files
- Word document (`.doc`, `.docx`, `.docm`)
- Excel spreadsheet (`.xls`, `.xlsx`, `.xlsm`)
- PowerPoint presentation (`.ppt`, `.pptx`, `.pptm`)
- PDF document (`.pdf`)

**Executable**

- Dynamic-link library (DLL) file (`.dll`)
- Executable and Linkable Format (ELF) file (`.elf`)
- Java archive (JAR) package (`.jar`)
- Java class file (`.class`)
- Mach object (Mach-O) file (`.macho`)
- Microsoft Windows installer (`.msi`)
- Microsoft Windows executable (`.exe`)

**Image**
Copy link
Contributor

@ranbel ranbel Oct 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since "Documents" is plural, should Executable and Image be plural as well?

Copy link
Contributor Author

@maxvp maxvp Oct 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This follows the file type group names in the HTTP policy builder UI.


- Adobe Photoshop document (`.psd`)
- Bitmap image (`.bmp`)
- GIF image (`.gif`)
- Icon file (`.ico`)
- JPEG image (`.jpg`, `.jpeg`)
- PNG image (`.png`)
- WebP image (`.webp`)

**Other**

- BitTorrent file (`.torrent`)

</Details>

| UI name | API example |
| ------------------- | --------------------------------------------------- |
Expand Down
9 changes: 4 additions & 5 deletions src/content/partials/cloudflare-one/gateway/policies/block-file-types.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,12 @@
---
{}

---

## Block file types

Block the upload or download of files based on their type.

| Selector | Operator | Value | Logic | Action |
| ------------------ | -------- | ------------------------------------- | ----- | ------ |
| Upload File Type | in | Microsoft Office Word Document (docx) | And | Block |
| Download File Type | in | PDF (pdf) | | |
| Selector | Operator | Value | Logic | Action |
| ------------------ | -------- | --------------------------------------- | ----- | ------ |
| Upload File Type | in | _Microsoft Office Word Document (docx)_ | And | Block |
| Download File Type | in | _PDF (pdf)_ | | |
Loading