99 lines
4.2 KiB
Markdown
99 lines
4.2 KiB
Markdown
|
---
|
||
|
|
phase: 10-classification-layer
|
||
|
|
plan: 01
|
||
|
|
subsystem: classify
|
||
|
|
tags: [classification, protocols, constants, rules, v1.2]
|
||
|
|
dependency_graph:
|
||
|
|
requires: [phase-09-frequency-design]
|
||
|
|
provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses]
|
||
|
|
affects: [classify/types.go, classify/rules.go]
|
||
|
|
tech_stack:
|
||
|
|
added: []
|
||
|
|
patterns: [first-match-wins ordered rules, family-grouped constants]
|
||
|
|
key_files:
|
||
|
|
created: []
|
||
|
|
modified:
|
||
|
|
- classify/types.go
|
||
|
|
- classify/rules.go
|
||
|
|
decisions:
|
||
|
|
- LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green
|
||
|
|
- Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP)
|
||
|
|
- SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04
|
||
|
|
- QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443)
|
||
|
|
- All 30 new specific-port rules placed before catch-alls per D-06
|
||
|
|
metrics:
|
||
|
|
duration: "3 min"
|
||
|
|
completed: "2026-03-27"
|
||
|
|
tasks_completed: 2
|
||
|
|
files_modified: 2
|
||
|
|
requirements_satisfied:
|
||
|
|
- PROTO-01
|
||
|
|
- PROTO-02
|
||
|
|
- PROTO-03
|
||
|
|
- PROTO-04
|
||
|
|
- PROTO-05
|
||
|
|
- PROTO-06
|
||
|
|
- PROTO-07
|
||
|
|
- PROTO-08
|
||
|
|
---
|
||
|
|
|
||
|
|
# Phase 10 Plan 1: Classification Layer — Constants and Rules Summary
|
||
|
|
|
||
|
|
Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11).
|
||
|
|
|
||
|
|
## Tasks Completed
|
||
|
|
|
||
|
|
| Task | Name | Commit | Files |
|
||
|
|
|------|------|--------|-------|
|
||
|
|
| 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go |
|
||
|
|
| 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go |
|
||
|
|
|
||
|
|
## What Was Done
|
||
|
|
|
||
|
|
**Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments:
|
||
|
|
- Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub`
|
||
|
|
- File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP`
|
||
|
|
- Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC`
|
||
|
|
- Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB`
|
||
|
|
- Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP`
|
||
|
|
- VoIP: `ClassSIP`
|
||
|
|
- Web extension: `ClassQUIC`
|
||
|
|
- Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog`
|
||
|
|
|
||
|
|
`AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11.
|
||
|
|
|
||
|
|
**Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors:
|
||
|
|
- Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21)
|
||
|
|
- QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443`
|
||
|
|
- Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries
|
||
|
|
|
||
|
|
## Verification Results
|
||
|
|
|
||
|
|
- `go build ./classify/...` — clean compilation, no errors
|
||
|
|
- `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode)
|
||
|
|
- `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries)
|
||
|
|
- `TestClassFreqConfigsMatchAllClasses` — PASS
|
||
|
|
- `TestFrequenciesInRange` — PASS
|
||
|
|
- `TestGroupFieldPopulated` — PASS
|
||
|
|
|
||
|
|
Final counts:
|
||
|
|
- Total TrafficClass constants: 35 (14 existing + 21 new)
|
||
|
|
- AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded)
|
||
|
|
- DefaultRules entries: 42 (12 existing + 30 new)
|
||
|
|
|
||
|
|
## Deviations from Plan
|
||
|
|
|
||
|
|
None — plan executed exactly as written.
|
||
|
|
|
||
|
|
## Known Stubs
|
||
|
|
|
||
|
|
None.
|
||
|
|
|
||
|
|
## Self-Check: PASSED
|
||
|
|
|
||
|
|
- classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog
|
||
|
|
- classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB
|
||
|
|
- AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog
|
||
|
|
- Commits 50e0474 and cd8593e exist
|
||
|
|
- `go test -count=1 ./...` all green
|