From cd8593eef5843ad04691fbb914f53468641facac Mon Sep 17 00:00:00 2001 From: Markus Graf Date: Fri, 27 Mar 2026 15:53:22 +0100 Subject: [PATCH] feat(10-01): add 30 new port-matching rules to DefaultRules - Add Discovery rules: mDNS (5353), SSDP (1900), SNMP (161/162) - Add Mail rules: IMAP (143/993), POP3 (110/995), SMTP-sub (587) - Add Remote Access rules: RDP (3389), Telnet (23), VNC (5900) - Add File Transfer rules: FTP (20/21), SMB (445), TFTP (69) - Add Database rules: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) - Add VoIP rules: SIP (5060/5061 tcp+udp) - Add Infrastructure ext rules: LDAP (389/636), Kerberos (88 tcp+udp), Syslog (514) - Add Web ext rule: QUIC (udp 443) - Catch-all rules remain last; total 42 rules (12 existing + 30 new) --- classify/rules.go | 60 +++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 55 insertions(+), 5 deletions(-) diff --git a/classify/rules.go b/classify/rules.go index da7b919..a60061d 100644 --- a/classify/rules.go +++ b/classify/rules.go @@ -11,18 +11,68 @@ type Rule struct { // DefaultRules is the D-01 protocol map — ordered, first-match-wins. // Per D-02: config-driven slice, not a switch statement. +// 42 rules total: 12 existing + 30 new (PROTO-01 through PROTO-08). +// Catch-all rules (DstPort: 0) MUST remain as the final two entries (D-06). var DefaultRules = []Rule{ + // --- Infrastructure --- {Protocol: "icmp", DstPort: 0, Class: ClassICMP}, {Protocol: "udp", DstPort: 53, Class: ClassDNS}, {Protocol: "tcp", DstPort: 53, Class: ClassDNS}, - {Protocol: "tcp", DstPort: 443, Class: ClassHTTPS}, - {Protocol: "tcp", DstPort: 80, Class: ClassHTTP}, - {Protocol: "tcp", DstPort: 22, Class: ClassSSH}, - {Protocol: "tcp", DstPort: 25, Class: ClassSMTP}, {Protocol: "udp", DstPort: 123, Class: ClassNTP}, {Protocol: "udp", DstPort: 67, Class: ClassDHCP}, {Protocol: "udp", DstPort: 68, Class: ClassDHCP}, - // Catch-alls (must be last): + + // --- Discovery (PROTO-05) --- + {Protocol: "udp", DstPort: 5353, Class: ClassMDNS}, + {Protocol: "udp", DstPort: 1900, Class: ClassSSDP}, + {Protocol: "udp", DstPort: 161, Class: ClassSNMP}, + {Protocol: "udp", DstPort: 162, Class: ClassSNMP}, + + // --- Web (existing + PROTO-07) --- + {Protocol: "tcp", DstPort: 443, Class: ClassHTTPS}, + {Protocol: "udp", DstPort: 443, Class: ClassQUIC}, // PROTO-07: must use "udp", NOT "tcp" + {Protocol: "tcp", DstPort: 80, Class: ClassHTTP}, + + // --- Mail (existing SMTP + PROTO-01) --- + {Protocol: "tcp", DstPort: 25, Class: ClassSMTP}, + {Protocol: "tcp", DstPort: 143, Class: ClassIMAP}, // D-03: IMAP plain + {Protocol: "tcp", DstPort: 993, Class: ClassIMAP}, // D-03: IMAPS + {Protocol: "tcp", DstPort: 110, Class: ClassPOP3}, // D-03: POP3 plain + {Protocol: "tcp", DstPort: 995, Class: ClassPOP3}, // D-03: POP3S + {Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP + + // --- Remote Access (existing SSH + PROTO-03) --- + {Protocol: "tcp", DstPort: 22, Class: ClassSSH}, + {Protocol: "tcp", DstPort: 3389, Class: ClassRDP}, + {Protocol: "tcp", DstPort: 23, Class: ClassTelnet}, + {Protocol: "tcp", DstPort: 5900, Class: ClassVNC}, + + // --- File Transfer (PROTO-02) --- + {Protocol: "tcp", DstPort: 20, Class: ClassFTP}, // D-03: FTP data + {Protocol: "tcp", DstPort: 21, Class: ClassFTP}, // D-03: FTP control + {Protocol: "tcp", DstPort: 445, Class: ClassSMB}, + {Protocol: "udp", DstPort: 69, Class: ClassTFTP}, + + // --- Database (PROTO-04) --- + {Protocol: "tcp", DstPort: 3306, Class: ClassMySQL}, + {Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL}, + {Protocol: "tcp", DstPort: 6379, Class: ClassRedis}, + {Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB}, + + // --- VoIP (PROTO-06) --- + {Protocol: "tcp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain TCP + {Protocol: "tcp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS TCP + {Protocol: "udp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain UDP + {Protocol: "udp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS UDP + + // --- Infrastructure extension (PROTO-08, D-01) --- + {Protocol: "tcp", DstPort: 389, Class: ClassLDAP}, // D-03: LDAP plain + {Protocol: "tcp", DstPort: 636, Class: ClassLDAP}, // D-03: LDAPS + {Protocol: "tcp", DstPort: 88, Class: ClassKerberos}, + {Protocol: "udp", DstPort: 88, Class: ClassKerberos}, + {Protocol: "udp", DstPort: 514, Class: ClassSyslog}, + + // Catch-alls (must be last — D-06): {Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP}, {Protocol: "udp", DstPort: 0, Class: ClassOtherUDP}, }