diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md index 4a33cd8..137820f 100644 --- a/.planning/REQUIREMENTS.md +++ b/.planning/REQUIREMENTS.md @@ -13,14 +13,14 @@ Requirements for extended protocol coverage milestone. Each maps to roadmap phas ### Protocol Coverage -- [ ] **PROTO-01**: Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587) -- [ ] **PROTO-02**: Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69) -- [ ] **PROTO-03**: Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900) -- [ ] **PROTO-04**: Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) -- [ ] **PROTO-05**: Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162) -- [ ] **PROTO-06**: Add VoIP family: SIP (5060/5061) -- [ ] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443) -- [ ] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514) +- [x] **PROTO-01**: Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587) +- [x] **PROTO-02**: Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69) +- [x] **PROTO-03**: Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900) +- [x] **PROTO-04**: Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) +- [x] **PROTO-05**: Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162) +- [x] **PROTO-06**: Add VoIP family: SIP (5060/5061) +- [x] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443) +- [x] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514) - [ ] **PROTO-09**: Existing 10 protocol classifications remain unchanged — no regression in rule matching behavior ### Frequency Design @@ -74,14 +74,14 @@ Which phases cover which requirements. Updated during roadmap creation. | FREQ-04 | Phase 9 | Complete | | GRP-01 | Phase 9 | Pending | | GRP-04 | Phase 9 | Pending | -| PROTO-01 | Phase 10 | Pending | -| PROTO-02 | Phase 10 | Pending | -| PROTO-03 | Phase 10 | Pending | -| PROTO-04 | Phase 10 | Pending | -| PROTO-05 | Phase 10 | Pending | -| PROTO-06 | Phase 10 | Pending | -| PROTO-07 | Phase 10 | Pending | -| PROTO-08 | Phase 10 | Pending | +| PROTO-01 | Phase 10 | Complete | +| PROTO-02 | Phase 10 | Complete | +| PROTO-03 | Phase 10 | Complete | +| PROTO-04 | Phase 10 | Complete | +| PROTO-05 | Phase 10 | Complete | +| PROTO-06 | Phase 10 | Complete | +| PROTO-07 | Phase 10 | Complete | +| PROTO-08 | Phase 10 | Complete | | PROTO-09 | Phase 10 | Pending | | GRP-02 | Phase 11 | Pending | | GRP-03 | Phase 11 | Pending | diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index fc497b9..9424ed0 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -77,9 +77,9 @@ Plans: 2. All existing 10 protocol classifications continue to match as before — no regression in rule order or port assignments 3. Multiple ports mapping to the same family class (e.g., IMAP port 143 and IMAPS port 993 both classify as the same Mail-IMAP class) behave identically in the classifier output 4. `go test ./classify/...` passes with no new test failures -**Plans:** 2 plans +**Plans:** 1/2 plans executed Plans: -- [ ] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules +- [x] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules - [ ] 10-02-PLAN.md — Add 28 classification subtests and update TestAllClassesCount ### Phase 11: Synthesis and Config Layer @@ -106,5 +106,5 @@ Plans: | 7. Custom Rules and Print-Config | v1.1 | 2/2 | Complete | 2026-03-26 | | 8. Test and Constant Cleanup | v1.2 | 1/1 | Complete | 2026-03-27 | | 9. Frequency Design and Group Architecture | v1.2 | 1/2 | In Progress| | -| 10. Classification Layer | v1.2 | 0/2 | Not started | - | +| 10. Classification Layer | v1.2 | 1/2 | In Progress| | | 11. Synthesis and Config Layer | v1.2 | 0/? | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 4b9f9e8..3b91051 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -3,14 +3,14 @@ gsd_state_version: 1.0 milestone: v1.2 milestone_name: Extended Protocol Coverage status: executing -stopped_at: Phase 10 context gathered -last_updated: "2026-03-27T14:36:12.229Z" +stopped_at: Completed 10-01-PLAN.md — added 21 TrafficClass constants and 30 port rules +last_updated: "2026-03-27T14:55:45.981Z" last_activity: 2026-03-27 progress: total_phases: 4 completed_phases: 2 - total_plans: 3 - completed_plans: 3 + total_plans: 5 + completed_plans: 4 percent: 0 --- @@ -51,6 +51,7 @@ Progress: [░░░░░░░░░░] 0% **Recent Trend:** Stable | Phase 08 P01 | 1 | 2 tasks | 2 files | | Phase 09 P02 | 3 | 2 tasks | 2 files | +| Phase 10 P01 | 3 | 2 tasks | 2 files | ## Accumulated Context @@ -65,6 +66,9 @@ Progress: [░░░░░░░░░░] 0% - [Phase 08]: NumLayers and GainPerLayer deleted — dead code since NewBank computes gain dynamically as 1/N - [Phase 08]: TestFrequenciesInRange now validates against Nyquist (22050 Hz) — any new BaseHz in (0, 22050) is accepted without test surgery - [Phase 09]: autoAssignFreq range moved to [2500, 4000] Hz with numSteps=31 to guarantee no collision with built-in frequencies (max 2449 Hz) +- [Phase 10]: LDAP/Kerberos/Syslog excluded from AllClasses() until Phase 11 — no ClassFreqConfigs entries yet, keeps TestAllClassesHaveConfig green +- [Phase 10]: Plain/TLS variants share one class constant (D-03) — IMAP 143/993, POP3 110/995, LDAP 389/636, SIP both ports and both protocols +- [Phase 10]: QUIC mapped to udp/443 to distinguish from HTTPS at tcp/443 — protocol field is the discriminator ### Pending Todos @@ -77,6 +81,6 @@ Progress: [░░░░░░░░░░] 0% ## Session Continuity -Last session: 2026-03-27T14:36:12.222Z -Stopped at: Phase 10 context gathered -Resume file: .planning/phases/10-classification-layer/10-CONTEXT.md +Last session: 2026-03-27T14:55:45.974Z +Stopped at: Completed 10-01-PLAN.md — added 21 TrafficClass constants and 30 port rules +Resume file: None diff --git a/.planning/phases/10-classification-layer/10-01-SUMMARY.md b/.planning/phases/10-classification-layer/10-01-SUMMARY.md new file mode 100644 index 0000000..611e75e --- /dev/null +++ b/.planning/phases/10-classification-layer/10-01-SUMMARY.md @@ -0,0 +1,98 @@ +--- +phase: 10-classification-layer +plan: 01 +subsystem: classify +tags: [classification, protocols, constants, rules, v1.2] +dependency_graph: + requires: [phase-09-frequency-design] + provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses] + affects: [classify/types.go, classify/rules.go] +tech_stack: + added: [] + patterns: [first-match-wins ordered rules, family-grouped constants] +key_files: + created: [] + modified: + - classify/types.go + - classify/rules.go +decisions: + - LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green + - Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP) + - SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04 + - QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443) + - All 30 new specific-port rules placed before catch-alls per D-06 +metrics: + duration: "3 min" + completed: "2026-03-27" + tasks_completed: 2 + files_modified: 2 +requirements_satisfied: + - PROTO-01 + - PROTO-02 + - PROTO-03 + - PROTO-04 + - PROTO-05 + - PROTO-06 + - PROTO-07 + - PROTO-08 +--- + +# Phase 10 Plan 1: Classification Layer — Constants and Rules Summary + +Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11). + +## Tasks Completed + +| Task | Name | Commit | Files | +|------|------|--------|-------| +| 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go | +| 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go | + +## What Was Done + +**Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments: +- Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub` +- File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP` +- Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC` +- Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB` +- Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP` +- VoIP: `ClassSIP` +- Web extension: `ClassQUIC` +- Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog` + +`AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11. + +**Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors: +- Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21) +- QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443` +- Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries + +## Verification Results + +- `go build ./classify/...` — clean compilation, no errors +- `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode) +- `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries) +- `TestClassFreqConfigsMatchAllClasses` — PASS +- `TestFrequenciesInRange` — PASS +- `TestGroupFieldPopulated` — PASS + +Final counts: +- Total TrafficClass constants: 35 (14 existing + 21 new) +- AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded) +- DefaultRules entries: 42 (12 existing + 30 new) + +## Deviations from Plan + +None — plan executed exactly as written. + +## Known Stubs + +None. + +## Self-Check: PASSED + +- classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog +- classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB +- AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog +- Commits 50e0474 and cd8593e exist +- `go test -count=1 ./...` all green