Function TestProtocolMatching

pkg/cli/firewall_policy_test.go:213–247

(t *testing.T)

}

func TestProtocolMatching(t *testing.T) {
	rules := []PolicyRule{
		{
			ID:       "allow-https-only",
			Order:    1,
			Action:   "allow",
			ACLName:  "https_domains",
			Protocol: "https",
			Domains:  []string{".github.com"},
		},
		{
			ID:       "deny-all",
			Order:    2,
			Action:   "deny",
			ACLName:  "all",
			Protocol: "both",
			Domains:  []string{},
		},
	}

	t.Run("HTTPS rule matches CONNECT request", func(t *testing.T) {
		entry := AuditLogEntry{Host: "api.github.com:443", Method: "CONNECT", Status: 200, Decision: "TCP_TUNNEL"}
		rule := findMatchingRule(entry, rules)
		require.NotNil(t, rule, "Should match HTTPS rule")
		assert.Equal(t, "allow-https-only", rule.ID, "HTTPS rule should match CONNECT request")
	})

	t.Run("HTTPS rule skipped for HTTP request", func(t *testing.T) {
		entry := AuditLogEntry{Host: "api.github.com:80", Method: "GET", Status: 403, Decision: "NONE_NONE"}
		rule := findMatchingRule(entry, rules)
		// HTTPS-only rule skipped for GET → falls through to deny-all
		require.NotNil(t, rule, "Should fall through to deny-all")
		assert.Equal(t, "deny-all", rule.ID, "HTTPS rule should not match HTTP GET request")
	})
}

func TestIsEntryHTTPS(t *testing.T) {
	assert.True(t, isEntryHTTPS(AuditLogEntry{Method: "CONNECT"}), "CONNECT should be HTTPS")