Function findMatchingRule

pkg/cli/firewall_policy.go:279–314

findMatchingRule finds the first matching policy rule for a given audit entry. Rules are evaluated in order; the first matching rule wins. This ports the TS audit-enricher.ts logic: 1. aclName === "all" rules match any domain (used for default deny rules) 2. Protocol matching: HTTPS-only rules won'

(entry AuditLogEntry, rules []PolicyRule)

//  3. Observed-decision validation: a rule only "matches" if its action matches the
//     observed outcome (allow rule only credited for allowed traffic, deny for denied)
func findMatchingRule(entry AuditLogEntry, rules []PolicyRule) *PolicyRule {
	isHTTPS := isEntryHTTPS(entry)
	expectedAction := "deny"
	if isEntryAllowed(entry) {
		expectedAction = "allow"
	}
	firewallPolicyLog.Printf("Finding matching rule for host=%s, expected_action=%s, rules=%d", entry.Host, expectedAction, len(rules))

	for i := range rules {
		rule := &rules[i]

		// Protocol check
		if !protocolMatches(*rule, isHTTPS) {
			continue
		}

		// aclName "all" is a catch-all rule (typically the default deny)
		if rule.ACLName == "all" {
			if rule.Action == expectedAction {
				firewallPolicyLog.Printf("Matched catch-all rule (action=%s) for host=%s", rule.Action, entry.Host)
				return rule
			}
			continue
		}

		// Domain match
		if domainMatchesRule(entry.Host, *rule) {
			if rule.Action == expectedAction {
				firewallPolicyLog.Printf("Matched rule %s (action=%s) for host=%s", rule.ACLName, rule.Action, entry.Host)
				return rule
			}
		}
	}
	firewallPolicyLog.Printf("No matching rule found for host=%s", entry.Host)
	return nil
}

// enrichWithPolicyRules enriches audit log entries with policy rule attribution.
func enrichWithPolicyRules(entries []AuditLogEntry, manifest *PolicyManifest) *PolicyAnalysis {