yoloyolo/classify/rules.go

package classify

// Rule defines a classification rule. Protocol is "tcp", "udp", or "icmp".
// DstPort 0 means match any port for this protocol.
// Rules are evaluated in order; first match wins.
type Rule struct {
	Protocol string
	DstPort  uint16
	Class    TrafficClass
}

// DefaultRules is the D-01 protocol map — ordered, first-match-wins.
// Per D-02: config-driven slice, not a switch statement.
// 42 rules total: 12 existing + 30 new (PROTO-01 through PROTO-08).
// Catch-all rules (DstPort: 0) MUST remain as the final two entries (D-06).
var DefaultRules = []Rule{
	// --- Infrastructure ---
	{Protocol: "icmp", DstPort: 0, Class: ClassICMP},
	{Protocol: "udp", DstPort: 53, Class: ClassDNS},
	{Protocol: "tcp", DstPort: 53, Class: ClassDNS},
	{Protocol: "udp", DstPort: 123, Class: ClassNTP},
	{Protocol: "udp", DstPort: 67, Class: ClassDHCP},
	{Protocol: "udp", DstPort: 68, Class: ClassDHCP},

	// --- Discovery (PROTO-05) ---
	{Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
	{Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
	{Protocol: "udp", DstPort: 161, Class: ClassSNMP},
	{Protocol: "udp", DstPort: 162, Class: ClassSNMP},

	// --- Web (existing + PROTO-07) ---
	{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
	{Protocol: "udp", DstPort: 443, Class: ClassQUIC}, // PROTO-07: must use "udp", NOT "tcp"
	{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},

	// --- Mail (existing SMTP + PROTO-01) ---
	{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
	{Protocol: "tcp", DstPort: 143, Class: ClassIMAP},    // D-03: IMAP plain
	{Protocol: "tcp", DstPort: 993, Class: ClassIMAP},    // D-03: IMAPS
	{Protocol: "tcp", DstPort: 110, Class: ClassPOP3},    // D-03: POP3 plain
	{Protocol: "tcp", DstPort: 995, Class: ClassPOP3},    // D-03: POP3S
	{Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP

	// --- Remote Access (existing SSH + PROTO-03) ---
	{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
	{Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
	{Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
	{Protocol: "tcp", DstPort: 5900, Class: ClassVNC},

	// --- File Transfer (PROTO-02) ---
	{Protocol: "tcp", DstPort: 20, Class: ClassFTP},  // D-03: FTP data
	{Protocol: "tcp", DstPort: 21, Class: ClassFTP},  // D-03: FTP control
	{Protocol: "tcp", DstPort: 445, Class: ClassSMB},
	{Protocol: "udp", DstPort: 69, Class: ClassTFTP},

	// --- Database (PROTO-04) ---
	{Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
	{Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
	{Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
	{Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},

	// --- VoIP (PROTO-06) ---
	{Protocol: "tcp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain TCP
	{Protocol: "tcp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS TCP
	{Protocol: "udp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain UDP
	{Protocol: "udp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS UDP

	// --- Infrastructure extension (PROTO-08, D-01) ---
	{Protocol: "tcp", DstPort: 389, Class: ClassLDAP},  // D-03: LDAP plain
	{Protocol: "tcp", DstPort: 636, Class: ClassLDAP},  // D-03: LDAPS
	{Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
	{Protocol: "udp", DstPort: 88, Class: ClassKerberos},
	{Protocol: "udp", DstPort: 514, Class: ClassSyslog},

	// Catch-alls (must be last — D-06):
	{Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
	{Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
}