RuleForge 0.1.2 — two generator defects a count check could not see

A correctness and performance release. If you convert to Cisco ASA or FortiOS, replace v0.1.1: generated interface addresses were masked down to the network address, and generated ASA left interface configuration mode before the address line. Both produce configurations a device will not accept as written.

Two generator defects

1. Interface addresses were masked when generating ASA and FortiOS

v0.1.1 fixed this on the parser side. The generator side was never looked at, because round-trip verification counted objects rather than comparing them — and a masked address is still exactly one address.

Same source, same conversion:

	v0.1.1 (published)	v0.1.2
FortiOS	set ip 203.0.113.0 255.255.255.248	set ip 203.0.113.2 255.255.255.248
FortiOS	set ip 10.10.0.0 255.255.0.0	set ip 10.10.0.1 255.255.0.0
ASA	ip address 10.10.0.0 255.255.0.0	ip address 10.10.0.1 255.255.0.0

203.0.113.0/29 is the network address; neither platform accepts it on an interface. The generators split the CIDR with SplitCIDR, which returns the network address. Fixed with a new fwir.SplitIfaceCIDR that keeps the host octets. Subnet objects and static routes genuinely want the network address and are unchanged.

2. Generated ASA put ! comment lines inside interface blocks

Aggregate interfaces emitted ! member ... notes between interface Port-channel1 and its ip address line. ! ends sub-mode configuration on an ASA, so the device leaves interface configuration and never applies the address that follows. The notes now precede the block.

Round-trip verification now compares values, not just counts

The review already re-parsed the generated config and compared how many rules, NATs, routes, objects and interfaces came back. Counting can see loss; it cannot see corruption — which is exactly how both defects above shipped past their own check.

The review now also compares the values that must survive generation verbatim — interface addresses, static routes (destination and next hop), network object values and service object values — and names the specific values that went missing, so the report points at something you can go and look at. Values that appear only in the target are listed but never fail the check: helper objects and split tcp-udp services are expected. Rule and NAT bodies are deliberately excluded, because renaming and remapping there is the job.

What this does not prove. The check proves those four categories survived a parse -> generate -> re-parse cycle in RuleForge's own parser. It is not a device syntax validator, and a PASS is not a statement that the configuration is safe to deploy. Load the output on a lab device before you touch production.

Conversion is linear again

Three linear scans sat inside per-rule loops, which made a job quadratic in the size of the rulebase: namer.unique restarted its collision probe on every call, the PAN-OS parser rescanned its rule and address slices for every set line, and the generators resolved every rule reference with a scan. Each now keeps an index.

rules	v0.1.1	v0.1.2
1,000	0.7 s	0.02 s
10,000	24 s	0.23 s
20,000	86 s	0.48 s
100,000	~ 40 min	2.5 s

Measured end to end (parse -> generate -> re-parse -> review) on a 2 vCPU box. go test -bench BenchmarkPipeline ./engine/ reproduces the first three. Behaviour is unchanged: same names, same output, same reports.

Install

tar xzf ruleforge-free-0.1.2-linux-amd64.tar.gz
sha256sum -c SHA256SUMS
./ruleforge

89d2656cbaad83808db3ef277fc34795d613287c4b32993d51c224802df7f69e  ruleforge-free-0.1.2-linux-amd64.tar.gz

The banner should read RuleForge 0.1.2. Nothing else changes — same database, same licence file, same listen address on 127.0.0.1:8428.

This repository is the free edition — Apache-2.0, no time limit. Pro and Team are paid licences on Whop — whop.com/nizar-tuanku/ruleforge; nothing on Whop is free, so try it here first.

v0.1.1 — interface addresses fix

Superseded — do not use this build. The parser-side fix in this release did not reach the generators: converting to Cisco ASA or FortiOS still writes the network address onto interfaces (10.10.0.1/16 becomes ip address 10.10.0.0 255.255.0.0), and generated ASA puts ! comment lines inside interface blocks, which ends sub-mode before the address is applied. Both are fixed in v0.1.2, which also makes conversion linear again. Re-generate anything produced with this version.

A correctness fix. Anyone using v0.1.0 should replace it: generated configurations placed the network address on interfaces instead of the interface's own address, which makes them undeployable.

The bug

An ASA source line:

interface GigabitEthernet0/0
 ip address 198.51.100.2 255.255.255.240

produced, in v0.1.0:

set network interface ethernet ethernet1/1 layer3 ip 198.51.100.0/28

and in v0.1.1:

set network interface ethernet ethernet1/1 layer3 ip 198.51.100.2/28

Interface addresses were passed through the same helper used for subnet objects and static routes, which masks an address down to its network. That is right for a subnet object and wrong for an interface, which carries a host address inside a prefix.

Scope: all five generators read the same parsed interface list, so every one of the 20 vendor directions was affected wherever the source config expressed an interface address as address + mask — Cisco ASA, Cisco FTD, FortiGate, and the Check Point subnet-mask path. The Check Point mask-length path and PAN-OS sources were already correct.

Why the tests did not catch it: round-trip verification compares element counts, not values. A wrong address re-parses to the same wrong address, so the check passed. The bug surfaced only when the tool was run against a realistic config with a /28 WAN address.

The fix

fwir.IfaceCIDRFromIPMask keeps the host octets and is now used at the three interface-address parse sites. Static routes, subnet objects and NAT are untouched — masking is correct behaviour there.

Commits: 3e26a3d, 34ac67a.

Also in this release

Sample reports are now in the repository: docs/samples/ — both report documents from a 43-rule Cisco ASA to PAN-OS job, exported exactly as the tool produced them, with the source config included so the run can be reproduced.

Upgrading

Replace the binary. Nothing else changes: no database migration, no configuration change, no licence action.

sha256sum -c SHA256SUMS
tar xzf ruleforge-free-0.1.1-linux-amd64.tar.gz
sudo install -m 0755 ruleforge /usr/local/bin/ruleforge

Any configuration generated by v0.1.0 should be re-generated. If it was already deployed, check the interface addresses first — that is the only thing this fix changes.

Verification

go vet ./... and go test ./... clean on the release tree. The binary here was built from main at the commits above and checked end to end through its own dashboard API: v0.1.0 emits 198.51.100.0/28 and v0.1.1 emits 198.51.100.2/28 for the same input.

RuleForge 0.1.0 — free edition

Superseded — do not use this build. The binary in this release writes the network address onto interfaces instead of the interface's own address (198.51.100.2 255.255.255.240 becomes 198.51.100.0/28), which makes generated configurations undeployable. Fixed in v0.1.2 — v0.1.1 fixed only the parser side and is superseded too. Re-generate anything produced with this version.

First public release of the RuleForge free edition — multivendor firewall migration, any of five vendors to any other (20 directions), self-hosted and fully offline.

Parsers (source): Cisco ASA (incl. multi-context auto-split), Cisco FTD, Palo Alto PAN-OS set format (incl. Panorama device-groups/vsys), FortiGate (incl. VDOMs, VIP/ippool/central-SNAT), Check Point (Gaia clish + mgmt_cli JSON exports).

Generators (target): ASA CLI · FMC REST JSON bundle + interface worksheet · PAN-OS set commands + Panorama variant · FortiOS CLI (central NAT) · Check Point mgmt_cli + Gaia scripts.

Pipeline: Deep Analysis → editable Full Mapping (approval-gated) → Convert → Review with per-element outcomes. Nothing is ever silently dropped — VPN/certificate/dynamic-routing features are captured with their source lines and reported for manual rebuild. Every job produces a self-contained HTML Conversion Process Report. Honesty invariants are tested: golden configs convert in all 20 directions with per-element accounting.

Free edition limits: full deep analysis for all five vendors; conversion up to 50 rules/job, single-tenant, 1 stored job. The paid edition (unlimited rules, multi-context/Panorama/VDOM conversion, Final Migration Report, round-trip verification) is at whop.com/nizar-tuanku/ruleforge

Install: download the tarball below, verify with SHA256SUMS, tar xzf and run ./ruleforge — dashboard on http://127.0.0.1:8428. Or build from source: go build ./cmd/ruleforge