SRL Authoring and Performance

Authoring workflow

1. Choose the narrowest correct execution scope and configuration section.
2. Confirm the normalized path and whether the rule runs once or per edit.
3. Write the smallest condition that distinguishes pass, fail, info, and skip.
4. Test missing fields, scalar/list variants, multiple VDOMs, and built-in objects.
5. Compare raw finding counts and subjects, not only the final overall result.
6. Run against a representative large configuration before publishing.

Avoid quadratic collection scans

A nested scan over the same large collection grows approximately with the square of the object count. Use array_group_by() when objects can be grouped by fields in one pass.

$fields = split("protocol,tcp-portrange,udp-portrange", ",");
$groups = array_group_by(config.firewall.service.custom, $fields);

foreach ($group in $groups) {
    if ($group.count > 1) {
        addInfoFinding(
            "Equivalent services: " + join($group.names, ", "),
            "Review and consolidate duplicates where safe."
        );
    }
}

Choosing generic and firewall-aware functions

• Use generic collection functions when the rule can describe grouping, sorting, slicing, or aggregation through ordinary fields.
• Use firewall expansion helpers when groups and references must be recursively resolved into effective addresses or ports.
• Use specialized helpers where their documented semantics and measured performance fit the rule.
• Do not reimplement interface classification heuristics in SRL; use appliance.interfaces.<name>.network_type.
• Collection functions are immutable. Keep original annotated members when a finding must link back to a configuration object.

Finding-quality checklist

• Details state the object, observed value, and why it matters.
• Remediation is specific enough for an engineer to act on.
• The finding subject is the original object or an explicit source path.
• Passes represent checks actually performed; unsupported configuration returns without a finding.
• Duplicate/group findings use stable configuration order so repeated audits remain comparable.
• Case-insensitive SRL equality is intentional for the values being compared.