Function TestFindMatchingRule

pkg/cli/firewall_policy_test.go:139–211

(t *testing.T)

}

func TestFindMatchingRule(t *testing.T) {
	rules := []PolicyRule{
		{
			ID:       "allow-github",
			Order:    1,
			Action:   "allow",
			ACLName:  "allowed_domains",
			Protocol: "both",
			Domains:  []string{".github.com"},
		},
		{
			ID:       "allow-npm",
			Order:    2,
			Action:   "allow",
			ACLName:  "npm_domains",
			Protocol: "both",
			Domains:  []string{"registry.npmjs.org"},
		},
		{
			ID:       "deny-all",
			Order:    3,
			Action:   "deny",
			ACLName:  "all",
			Protocol: "both",
			Domains:  []string{},
		},
	}

	t.Run("matches first rule - allowed HTTPS", func(t *testing.T) {
		entry := AuditLogEntry{Host: "api.github.com:443", Method: "CONNECT", Status: 200, Decision: "TCP_TUNNEL"}
		rule := findMatchingRule(entry, rules)
		require.NotNil(t, rule, "Should find a matching rule")
		assert.Equal(t, "allow-github", rule.ID, "Should match allow-github rule")
	})

	t.Run("matches second rule", func(t *testing.T) {
		entry := AuditLogEntry{Host: "registry.npmjs.org:443", Method: "CONNECT", Status: 200, Decision: "TCP_TUNNEL"}
		rule := findMatchingRule(entry, rules)
		require.NotNil(t, rule, "Should find a matching rule")
		assert.Equal(t, "allow-npm", rule.ID, "Should match allow-npm rule")
	})

	t.Run("aclName all catches unmatched denied traffic", func(t *testing.T) {
		entry := AuditLogEntry{Host: "evil.com:443", Method: "CONNECT", Status: 403, Decision: "NONE_NONE"}
		rule := findMatchingRule(entry, rules)
		require.NotNil(t, rule, "Should find the catch-all deny rule")
		assert.Equal(t, "deny-all", rule.ID, "Should match deny-all rule via aclName 'all'")
	})

	t.Run("aclName all skipped for allowed traffic", func(t *testing.T) {
		// If a domain doesn't match specific rules but traffic was allowed,
		// the deny-all rule should NOT match (action mismatch)
		entry := AuditLogEntry{Host: "unknown.com:443", Method: "CONNECT", Status: 200, Decision: "TCP_TUNNEL"}
		rule := findMatchingRule(entry, rules)
		assert.Nil(t, rule, "deny-all rule should not match allowed traffic")
	})

	t.Run("first matching rule wins", func(t *testing.T) {