Function parseFirewallLogLine

pkg/cli/firewall_log.go:196–240

parseFirewallLogLine parses a single firewall log line Format: timestamp client_ip:port domain dest_ip:port proto method status decision url user_agent Returns nil if the line is invalid or should be skipped

(line string)

// Format: timestamp client_ip:port domain dest_ip:port proto method status decision url user_agent
// Returns nil if the line is invalid or should be skipped
func parseFirewallLogLine(line string) *FirewallLogEntry {
	trimmed := strings.TrimSpace(line)
	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
		return nil
	}

	// Split by whitespace but preserve quoted strings
	// This regex matches non-whitespace sequences or quoted strings
	fields := firewallLogFieldSplitter.FindAllString(trimmed, -1)

	if len(fields) < 10 {
		return nil
	}

	// Only validate timestamp (essential for log format detection)
	// This matches the JavaScript parser behavior which only validates timestamp
	timestamp := fields[0]
	if matched, _ := regexp.MatchString(`^\d+(\.\d+)?$`, timestamp); !matched {
		return nil
	}

	// Extract fields without validation (matches JavaScript parser)
	clientIPPort := fields[1]
	domain := fields[2]
	destIPPort := fields[3]
	status := fields[6]
	decision := fields[7]

	// Remove quotes from user agent
	userAgent := fields[9]
	userAgent = strings.Trim(userAgent, `"`)

	return &FirewallLogEntry{
		Timestamp:    timestamp,
		ClientIPPort: clientIPPort,
		Domain:       domain,
		DestIPPort:   destIPPort,
		Proto:        fields[4],
		Method:       fields[5],
		Status:       status,
		Decision:     decision,
		URL:          fields[8],
		UserAgent:    userAgent,
	}
}

// isRequestAllowed determines if a request was allowed based on decision and status
// This mirrors the logic from the JavaScript parser