Function isEntryAllowed

pkg/cli/firewall_policy.go:236–255

isEntryAllowed determines the observed outcome of a request. This mirrors the classification logic used by the firewall log parser.

(entry AuditLogEntry)

// isEntryAllowed determines the observed outcome of a request.
// This mirrors the classification logic used by the firewall log parser.
func isEntryAllowed(entry AuditLogEntry) bool {
	status := entry.Status
	if status == http.StatusOK || status == http.StatusPartialContent || status == http.StatusNotModified {
		return true
	}
	if status == http.StatusForbidden || status == http.StatusProxyAuthRequired {
		return false
	}
	decision := entry.Decision
	if strings.Contains(decision, "TCP_TUNNEL") ||
		strings.Contains(decision, "TCP_HIT") ||
		strings.Contains(decision, "TCP_MISS") {
		return true
	}
	if strings.Contains(decision, "NONE_NONE") ||
		strings.Contains(decision, "TCP_DENIED") {
		return false
	}
	return false
}

// protocolMatches checks if a rule's protocol constraint matches the request.
// "both" matches everything; "https" matches only HTTPS; "http" matches only HTTP.