cybersecurity
Penumbra
fwlint: an offline C++ static analyzer that finds shadowed, redundant, correlated, and generalized rules in real Cisco ACL / JSON firewall policies, with witness packets and SARIF output.
9/9
Sample packets correctly classified (original artifact)
125/125 (41 test cases)
Unit test assertions passing (Catch2)
5/5 (shadowing, collective shadowing, redundancy, correlation, generalization)
Anomaly types detected against hand-built 12-rule example ACL
~0.6s
Analysis time, 301-rule mostly-disjoint ACL
~1.5s, 15,926 findings
Analysis time, 301-rule pathological (heavily overlapping) ACL
Started as a small rule-based firewall packet simulator and was rebuilt into fwlint, a firewall ruleset anomaly analyzer. Parses a real (bounded-subset) Cisco IOS extended ACL or a canonical JSON policy into an exact 5-tuple packet-space representation (axis-aligned box decomposition -- a published alternative to BDD-based analysis), then detects the four canonical Al-Shaer/Hamed anomaly types (shadowing, redundancy, correlation, generalization) including whole-policy "collective shadowing" where several earlier rules jointly make a later rule unreachable even though no single one does alone. Every finding includes a concrete witness packet. Outputs human-readable text, structured JSON, or SARIF 2.1.0 (for CI/GitHub code-scanning integration). The original program is preserved unmodified under archive/original/.