From 50e047438d065ba43476b4ab388f63318a4f38b1 Mon Sep 17 00:00:00 2001
From: Markus Graf <info@markusgraf.ch>
Date: Fri, 27 Mar 2026 15:52:17 +0100
Subject: [PATCH] feat(10-01): add 21 new TrafficClass constants and update
 AllClasses()

- Add constants for Mail (IMAP, POP3, SMTP-sub), File Transfer (FTP, SMB, TFTP)
- Add constants for Remote Access (RDP, Telnet, VNC), Database (MySQL, PostgreSQL, Redis, MongoDB)
- Add constants for Discovery (mDNS, SSDP, SNMP), VoIP (SIP), Web (QUIC)
- Add constants for Infrastructure extension (LDAP, Kerberos, Syslog)
- Update AllClasses() to return 32 classes (LDAP/Kerberos/Syslog excluded per D-01)
---
 classify/types.go | 59 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 57 insertions(+), 2 deletions(-)

diff --git a/classify/types.go b/classify/types.go
index b9f0e06..65e15f3 100644
--- a/classify/types.go
+++ b/classify/types.go
@@ -21,14 +21,69 @@ const (
 	ClassUnknown2 TrafficClass = "unknown-2"
 	ClassUnknown3 TrafficClass = "unknown-3"
 	ClassUnknown4 TrafficClass = "unknown-4"
+
+	// --- Mail (PROTO-01) ---
+	ClassIMAP    TrafficClass = "IMAP"
+	ClassPOP3    TrafficClass = "POP3"
+	ClassSMTPSub TrafficClass = "SMTP-sub" // D-04: separate from ClassSMTP (port 25)
+
+	// --- File Transfer (PROTO-02) ---
+	ClassFTP  TrafficClass = "FTP"
+	ClassSMB  TrafficClass = "SMB"
+	ClassTFTP TrafficClass = "TFTP"
+
+	// --- Remote Access (PROTO-03) ---
+	ClassRDP    TrafficClass = "RDP"
+	ClassTelnet TrafficClass = "Telnet"
+	ClassVNC    TrafficClass = "VNC"
+
+	// --- Database (PROTO-04) ---
+	ClassMySQL      TrafficClass = "MySQL"
+	ClassPostgreSQL TrafficClass = "PostgreSQL"
+	ClassRedis      TrafficClass = "Redis"
+	ClassMongoDB    TrafficClass = "MongoDB"
+
+	// --- Discovery (PROTO-05) ---
+	ClassMDNS TrafficClass = "mDNS"
+	ClassSSDP TrafficClass = "SSDP"
+	ClassSNMP TrafficClass = "SNMP"
+
+	// --- VoIP (PROTO-06) ---
+	ClassSIP TrafficClass = "SIP"
+
+	// --- Web extension (PROTO-07) ---
+	ClassQUIC TrafficClass = "QUIC"
+
+	// --- Infrastructure extension (PROTO-08, D-01: no ClassFreqConfigs until Phase 11) ---
+	ClassLDAP     TrafficClass = "LDAP"
+	ClassKerberos TrafficClass = "Kerberos"
+	ClassSyslog   TrafficClass = "Syslog"
 )
 
 // AllClasses returns all known traffic classes in display order.
+// Excludes ClassLDAP, ClassKerberos, and ClassSyslog — these have constants and rules
+// but no ClassFreqConfigs entries until Phase 11, so they must not appear here
+// (TestAllClassesHaveConfig in synth/config_test.go enforces the invariant).
 func AllClasses() []TrafficClass {
 	return []TrafficClass{
-		ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
-		ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
+		// Infrastructure
+		ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
+		ClassMDNS, ClassSSDP, ClassSNMP,
+		// Web
+		ClassHTTPS, ClassHTTP, ClassQUIC,
+		// Mail
+		ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
+		// Remote Access
+		ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
+		// File Transfer
+		ClassFTP, ClassSMB, ClassTFTP,
+		// Database
+		ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
+		// VoIP
+		ClassSIP,
+		// Unknown / catch-all
 		ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
+		ClassOtherTCP, ClassOtherUDP,
 	}
 }