Magic Transit Gets Customer-Defined DDoS Filtering
Cloudflare has announced Programmable Flow Protection, a system that lets Magic Transit Enterprise customers write and deploy their own custom DDoS mitigation logic across Cloudflare's global network. The platform, currently in beta at an additional cost, is designed for stateful mitigation of proprietary UDP-based protocols. Customers interested in the beta should contact their account team.
The core problem this addresses is a gap in Cloudflare's existing DDoS protection. Systems like Advanced TCP Protection and Advanced DNS Protection rely on deep, protocol-specific knowledge to distinguish legitimate traffic from attacks. For well-known protocols—TCP, DNS, NTP, SIP—this works well. But for custom or proprietary UDP protocols, Cloudflare's systems lack the context needed to make intelligent pass or drop decisions.
UDP is a connectionless protocol with no handshake or state, which makes it attractive for real-time applications like gaming, VoIP, and streaming. However, that same statelessness makes it a challenge for mitigation. When an attacker floods a UDP destination with traffic that doesn't match any known pattern, Cloudflare's generic defenses have limited options: block the destination IP and port entirely, or apply a blanket rate limit. Both approaches fail to distinguish good traffic from bad, meaning legitimate clients suffer alongside attackers. The correct rate limit threshold also varies wildly—a customer expecting 1 Gbps of legitimate traffic needs different treatment than one expecting 25 Gbps.
How the Platform Works
Programmable Flow Protection merges two existing Cloudflare technologies: flowtrackd, the stateful DDoS mitigation system for Magic Transit, and the XDP/eBPF infrastructure used for high-scale packet processing. The novel piece is that customers now write the eBPF program themselves, defining arbitrary logic that determines whether each packet is passed, dropped, or challenged.
Once uploaded, Cloudflare executes the customer's program on every packet destined for their network. The programs run in userspace rather than kernel space, which lets the platform support a variety of customers and use cases without compromising security. Programmable Flow Protection programs execute after all of Cloudflare's standard DDoS mitigations, so existing protections remain in effect.
The platform's eBPF environment shares architectural characteristics with XDP programs: both compile to BPF bytecode, pass through a verifier to guarantee memory safety and termination, and run in an isolated VM. The key difference is the API surface. Instead of Linux-specific helper functions for kernel network stack integration, Programmable Flow Protection provides helpers tailored for DDoS mitigation, including functions to store client state between executions, perform cryptographic validation, and emit challenge packets.
A Concrete Example: Filtering on Application Headers
Consider a customer running an online game on UDP port 207. The game engine uses a proprietary application header that Cloudflare doesn't understand. Attack traffic arrives from randomized source IPs and ports with seemingly random payloads, overwhelming the origin.
Because the application header contains a validation token, the customer can write an eBPF program that checks the token's value and filters accordingly, passing only packets that match:
#include <linux/ip.h>
#include <linux/udp.h>
#include <arpa/inet.h>
#include "cf_ebpf_defs.h"
#include "cf_ebpf_helper.h"
// Custom application header
struct apphdr {
uint8_t version;
uint16_t length; // Length of the variable-length token
uint8_t token[0]; // Variable-length token
} __attribute__((packed));
uint64_t
cf_ebpf_main(void *state)
{
struct cf_ebpf_generic_ctx *ctx = state;
struct cf_ebpf_parsed_headers headers;
struct cf_ebpf_packet_data *p;
// Parse the packet headers with provided helper function
if (parse_packet_data(ctx, &p, &headers) != 0) {
return CF_EBPF_DROP;
}
// Drop packets not destined to port 207
struct udphdr *udp_hdr = (struct udphdr *)headers.udp;
if (ntohs(udp_hdr->dest) != 207) {
return CF_EBPF_DROP;
}
// Get application header from UDP payload
struct apphdr *app = (struct apphdr *)(udp_hdr + 1);
if ((uint8_t *)(app + 1) > headers.data_end) {
return CF_EBPF_DROP;
}
// Perform memory checks to satisfy the verifier
// and access the token safely
if ((uint8_t *)(app->token + token_len) > headers.data_end) {
return CF_EBPF_DROP;
}
// Check the last byte of the token against expected value
uint8_t *last_byte = app->token + token_len - 1;
if (*last_byte != 0xCF) {
return CF_EBPF_DROP;
}
return CF_EBPF_PASS;
}This approach is more surgical than a generic block or rate limit because it leverages application-specific knowledge that Cloudflare doesn't have. Customers combine their proprietary protocol intelligence with Cloudflare's network capacity to absorb attacks.
Stateful Tracking and Challenges
Simple pattern matching can often be replicated with a traditional firewall. The real advantage of a programmable platform is access to variables, conditionals, loops, and procedure calls. But the most distinctive capability is stateful flow tracking combined with client challenges, which is particularly effective against replay attacks.
In a replay attack, an attacker captures packets that were legitimate at some point and retransmits them at high volume. Because each packet conforms to expected patterns, static filtering won't stop them. A Programmable Flow Protection program can instead challenge suspicious clients:
#include <linux/ip.h>
#include <linux/udp.h>
#include <arpa/inet.h>
#include "cf_ebpf_defs.h"
#include "cf_ebpf_helper.h"
uint64_t
cf_ebpf_main(void *state)
{
// ...
// Get the status of this source IP (statefully tracked)
uint8_t status;
if (cf_ebpf_get_source_ip_status(&status) != 0) {
return CF_EBPF_DROP;
}
switch (status) {
case NONE:
// Issue a custom challenge to this source IP
issue_challenge();
cf_ebpf_set_source_ip_status(CHALLENGED);
return CF_EBPF_DROP;
case CHALLENGED:
// Check if this packet passes the challenge
// with custom logic
if (verify_challenge()) {
cf_ebpf_set_source_ip_status(VERIFIED);
return CF_EBPF_PASS;
} else {
cf_ebpf_set_source_ip_status(BLOCKED);
return CF_EBPF_DROP;
}
case VERIFIED:
// This source IP has passed the challenge
return CF_EBPF_PASS;
case BLOCKED:
// This source IP has been blocked
return CF_EBPF_DROP;
default:
return CF_EBPF_PASS;
}
return CF_EBPF_PASS;
}
The program tracks source IP addresses it has seen. Unknown clients receive a packet containing a cryptographic challenge. A legitimate client running the actual application can solve the challenge and respond with proof; a replay script cannot. The attacker's traffic is marked as blocked and dropped, while verified clients continue unimpeded.
The platform is under active development. Cloudflare notes that while the gaming protocol is a useful illustration, the technology applies broadly to any UDP-based protocol. Magic Transit Enterprise customers can contact their account manager for more information about enabling the feature.
