docs(10-01): complete classification-layer constants and rules plan
- 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) - 30 new port-matching rules in DefaultRules (42 total, catch-alls last) - AllClasses() returns 32 classes (LDAP/Kerberos/Syslog deferred to Phase 11) - PROTO-01 through PROTO-08 requirements marked complete
This commit is contained in:
+16
-16
@@ -13,14 +13,14 @@ Requirements for extended protocol coverage milestone. Each maps to roadmap phas
|
||||
|
||||
### Protocol Coverage
|
||||
|
||||
- [ ] **PROTO-01**: Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587)
|
||||
- [ ] **PROTO-02**: Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69)
|
||||
- [ ] **PROTO-03**: Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900)
|
||||
- [ ] **PROTO-04**: Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017)
|
||||
- [ ] **PROTO-05**: Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162)
|
||||
- [ ] **PROTO-06**: Add VoIP family: SIP (5060/5061)
|
||||
- [ ] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443)
|
||||
- [ ] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514)
|
||||
- [x] **PROTO-01**: Add Mail family protocols: IMAP (143/993), POP3 (110/995), SMTP-submission (587)
|
||||
- [x] **PROTO-02**: Add File Transfer family protocols: FTP (20-21), SMB/CIFS (445), TFTP (69)
|
||||
- [x] **PROTO-03**: Add Remote Access family protocols: RDP (3389), Telnet (23), VNC (5900)
|
||||
- [x] **PROTO-04**: Add Database family protocols: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017)
|
||||
- [x] **PROTO-05**: Add Discovery family protocols: mDNS (5353), SSDP/UPnP (1900), SNMP (161-162)
|
||||
- [x] **PROTO-06**: Add VoIP family: SIP (5060/5061)
|
||||
- [x] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443)
|
||||
- [x] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514)
|
||||
- [ ] **PROTO-09**: Existing 10 protocol classifications remain unchanged — no regression in rule matching behavior
|
||||
|
||||
### Frequency Design
|
||||
@@ -74,14 +74,14 @@ Which phases cover which requirements. Updated during roadmap creation.
|
||||
| FREQ-04 | Phase 9 | Complete |
|
||||
| GRP-01 | Phase 9 | Pending |
|
||||
| GRP-04 | Phase 9 | Pending |
|
||||
| PROTO-01 | Phase 10 | Pending |
|
||||
| PROTO-02 | Phase 10 | Pending |
|
||||
| PROTO-03 | Phase 10 | Pending |
|
||||
| PROTO-04 | Phase 10 | Pending |
|
||||
| PROTO-05 | Phase 10 | Pending |
|
||||
| PROTO-06 | Phase 10 | Pending |
|
||||
| PROTO-07 | Phase 10 | Pending |
|
||||
| PROTO-08 | Phase 10 | Pending |
|
||||
| PROTO-01 | Phase 10 | Complete |
|
||||
| PROTO-02 | Phase 10 | Complete |
|
||||
| PROTO-03 | Phase 10 | Complete |
|
||||
| PROTO-04 | Phase 10 | Complete |
|
||||
| PROTO-05 | Phase 10 | Complete |
|
||||
| PROTO-06 | Phase 10 | Complete |
|
||||
| PROTO-07 | Phase 10 | Complete |
|
||||
| PROTO-08 | Phase 10 | Complete |
|
||||
| PROTO-09 | Phase 10 | Pending |
|
||||
| GRP-02 | Phase 11 | Pending |
|
||||
| GRP-03 | Phase 11 | Pending |
|
||||
|
||||
@@ -77,9 +77,9 @@ Plans:
|
||||
2. All existing 10 protocol classifications continue to match as before — no regression in rule order or port assignments
|
||||
3. Multiple ports mapping to the same family class (e.g., IMAP port 143 and IMAPS port 993 both classify as the same Mail-IMAP class) behave identically in the classifier output
|
||||
4. `go test ./classify/...` passes with no new test failures
|
||||
**Plans:** 2 plans
|
||||
**Plans:** 1/2 plans executed
|
||||
Plans:
|
||||
- [ ] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules
|
||||
- [x] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules
|
||||
- [ ] 10-02-PLAN.md — Add 28 classification subtests and update TestAllClassesCount
|
||||
|
||||
### Phase 11: Synthesis and Config Layer
|
||||
@@ -106,5 +106,5 @@ Plans:
|
||||
| 7. Custom Rules and Print-Config | v1.1 | 2/2 | Complete | 2026-03-26 |
|
||||
| 8. Test and Constant Cleanup | v1.2 | 1/1 | Complete | 2026-03-27 |
|
||||
| 9. Frequency Design and Group Architecture | v1.2 | 1/2 | In Progress| |
|
||||
| 10. Classification Layer | v1.2 | 0/2 | Not started | - |
|
||||
| 10. Classification Layer | v1.2 | 1/2 | In Progress| |
|
||||
| 11. Synthesis and Config Layer | v1.2 | 0/? | Not started | - |
|
||||
|
||||
+11
-7
@@ -3,14 +3,14 @@ gsd_state_version: 1.0
|
||||
milestone: v1.2
|
||||
milestone_name: Extended Protocol Coverage
|
||||
status: executing
|
||||
stopped_at: Phase 10 context gathered
|
||||
last_updated: "2026-03-27T14:36:12.229Z"
|
||||
stopped_at: Completed 10-01-PLAN.md — added 21 TrafficClass constants and 30 port rules
|
||||
last_updated: "2026-03-27T14:55:45.981Z"
|
||||
last_activity: 2026-03-27
|
||||
progress:
|
||||
total_phases: 4
|
||||
completed_phases: 2
|
||||
total_plans: 3
|
||||
completed_plans: 3
|
||||
total_plans: 5
|
||||
completed_plans: 4
|
||||
percent: 0
|
||||
---
|
||||
|
||||
@@ -51,6 +51,7 @@ Progress: [░░░░░░░░░░] 0%
|
||||
**Recent Trend:** Stable
|
||||
| Phase 08 P01 | 1 | 2 tasks | 2 files |
|
||||
| Phase 09 P02 | 3 | 2 tasks | 2 files |
|
||||
| Phase 10 P01 | 3 | 2 tasks | 2 files |
|
||||
|
||||
## Accumulated Context
|
||||
|
||||
@@ -65,6 +66,9 @@ Progress: [░░░░░░░░░░] 0%
|
||||
- [Phase 08]: NumLayers and GainPerLayer deleted — dead code since NewBank computes gain dynamically as 1/N
|
||||
- [Phase 08]: TestFrequenciesInRange now validates against Nyquist (22050 Hz) — any new BaseHz in (0, 22050) is accepted without test surgery
|
||||
- [Phase 09]: autoAssignFreq range moved to [2500, 4000] Hz with numSteps=31 to guarantee no collision with built-in frequencies (max 2449 Hz)
|
||||
- [Phase 10]: LDAP/Kerberos/Syslog excluded from AllClasses() until Phase 11 — no ClassFreqConfigs entries yet, keeps TestAllClassesHaveConfig green
|
||||
- [Phase 10]: Plain/TLS variants share one class constant (D-03) — IMAP 143/993, POP3 110/995, LDAP 389/636, SIP both ports and both protocols
|
||||
- [Phase 10]: QUIC mapped to udp/443 to distinguish from HTTPS at tcp/443 — protocol field is the discriminator
|
||||
|
||||
### Pending Todos
|
||||
|
||||
@@ -77,6 +81,6 @@ Progress: [░░░░░░░░░░] 0%
|
||||
|
||||
## Session Continuity
|
||||
|
||||
Last session: 2026-03-27T14:36:12.222Z
|
||||
Stopped at: Phase 10 context gathered
|
||||
Resume file: .planning/phases/10-classification-layer/10-CONTEXT.md
|
||||
Last session: 2026-03-27T14:55:45.974Z
|
||||
Stopped at: Completed 10-01-PLAN.md — added 21 TrafficClass constants and 30 port rules
|
||||
Resume file: None
|
||||
|
||||
@@ -0,0 +1,98 @@
|
||||
---
|
||||
phase: 10-classification-layer
|
||||
plan: 01
|
||||
subsystem: classify
|
||||
tags: [classification, protocols, constants, rules, v1.2]
|
||||
dependency_graph:
|
||||
requires: [phase-09-frequency-design]
|
||||
provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses]
|
||||
affects: [classify/types.go, classify/rules.go]
|
||||
tech_stack:
|
||||
added: []
|
||||
patterns: [first-match-wins ordered rules, family-grouped constants]
|
||||
key_files:
|
||||
created: []
|
||||
modified:
|
||||
- classify/types.go
|
||||
- classify/rules.go
|
||||
decisions:
|
||||
- LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green
|
||||
- Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP)
|
||||
- SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04
|
||||
- QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443)
|
||||
- All 30 new specific-port rules placed before catch-alls per D-06
|
||||
metrics:
|
||||
duration: "3 min"
|
||||
completed: "2026-03-27"
|
||||
tasks_completed: 2
|
||||
files_modified: 2
|
||||
requirements_satisfied:
|
||||
- PROTO-01
|
||||
- PROTO-02
|
||||
- PROTO-03
|
||||
- PROTO-04
|
||||
- PROTO-05
|
||||
- PROTO-06
|
||||
- PROTO-07
|
||||
- PROTO-08
|
||||
---
|
||||
|
||||
# Phase 10 Plan 1: Classification Layer — Constants and Rules Summary
|
||||
|
||||
Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11).
|
||||
|
||||
## Tasks Completed
|
||||
|
||||
| Task | Name | Commit | Files |
|
||||
|------|------|--------|-------|
|
||||
| 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go |
|
||||
| 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go |
|
||||
|
||||
## What Was Done
|
||||
|
||||
**Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments:
|
||||
- Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub`
|
||||
- File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP`
|
||||
- Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC`
|
||||
- Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB`
|
||||
- Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP`
|
||||
- VoIP: `ClassSIP`
|
||||
- Web extension: `ClassQUIC`
|
||||
- Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog`
|
||||
|
||||
`AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11.
|
||||
|
||||
**Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors:
|
||||
- Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21)
|
||||
- QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443`
|
||||
- Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries
|
||||
|
||||
## Verification Results
|
||||
|
||||
- `go build ./classify/...` — clean compilation, no errors
|
||||
- `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode)
|
||||
- `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries)
|
||||
- `TestClassFreqConfigsMatchAllClasses` — PASS
|
||||
- `TestFrequenciesInRange` — PASS
|
||||
- `TestGroupFieldPopulated` — PASS
|
||||
|
||||
Final counts:
|
||||
- Total TrafficClass constants: 35 (14 existing + 21 new)
|
||||
- AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded)
|
||||
- DefaultRules entries: 42 (12 existing + 30 new)
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None — plan executed exactly as written.
|
||||
|
||||
## Known Stubs
|
||||
|
||||
None.
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
- classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog
|
||||
- classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB
|
||||
- AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog
|
||||
- Commits 50e0474 and cd8593e exist
|
||||
- `go test -count=1 ./...` all green
|
||||
Reference in New Issue
Block a user