gurix
cd8593eef5
- Add Discovery rules: mDNS (5353), SSDP (1900), SNMP (161/162) - Add Mail rules: IMAP (143/993), POP3 (110/995), SMTP-sub (587) - Add Remote Access rules: RDP (3389), Telnet (23), VNC (5900) - Add File Transfer rules: FTP (20/21), SMB (445), TFTP (69) - Add Database rules: MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017) - Add VoIP rules: SIP (5060/5061 tcp+udp) - Add Infrastructure ext rules: LDAP (389/636), Kerberos (88 tcp+udp), Syslog (514) - Add Web ext rule: QUIC (udp 443) - Catch-all rules remain last; total 42 rules (12 existing + 30 new)
79 lines
3.4 KiB
Go
79 lines
3.4 KiB
Go
package classify
|
|
|
|
// Rule defines a classification rule. Protocol is "tcp", "udp", or "icmp".
|
|
// DstPort 0 means match any port for this protocol.
|
|
// Rules are evaluated in order; first match wins.
|
|
type Rule struct {
|
|
Protocol string
|
|
DstPort uint16
|
|
Class TrafficClass
|
|
}
|
|
|
|
// DefaultRules is the D-01 protocol map — ordered, first-match-wins.
|
|
// Per D-02: config-driven slice, not a switch statement.
|
|
// 42 rules total: 12 existing + 30 new (PROTO-01 through PROTO-08).
|
|
// Catch-all rules (DstPort: 0) MUST remain as the final two entries (D-06).
|
|
var DefaultRules = []Rule{
|
|
// --- Infrastructure ---
|
|
{Protocol: "icmp", DstPort: 0, Class: ClassICMP},
|
|
{Protocol: "udp", DstPort: 53, Class: ClassDNS},
|
|
{Protocol: "tcp", DstPort: 53, Class: ClassDNS},
|
|
{Protocol: "udp", DstPort: 123, Class: ClassNTP},
|
|
{Protocol: "udp", DstPort: 67, Class: ClassDHCP},
|
|
{Protocol: "udp", DstPort: 68, Class: ClassDHCP},
|
|
|
|
// --- Discovery (PROTO-05) ---
|
|
{Protocol: "udp", DstPort: 5353, Class: ClassMDNS},
|
|
{Protocol: "udp", DstPort: 1900, Class: ClassSSDP},
|
|
{Protocol: "udp", DstPort: 161, Class: ClassSNMP},
|
|
{Protocol: "udp", DstPort: 162, Class: ClassSNMP},
|
|
|
|
// --- Web (existing + PROTO-07) ---
|
|
{Protocol: "tcp", DstPort: 443, Class: ClassHTTPS},
|
|
{Protocol: "udp", DstPort: 443, Class: ClassQUIC}, // PROTO-07: must use "udp", NOT "tcp"
|
|
{Protocol: "tcp", DstPort: 80, Class: ClassHTTP},
|
|
|
|
// --- Mail (existing SMTP + PROTO-01) ---
|
|
{Protocol: "tcp", DstPort: 25, Class: ClassSMTP},
|
|
{Protocol: "tcp", DstPort: 143, Class: ClassIMAP}, // D-03: IMAP plain
|
|
{Protocol: "tcp", DstPort: 993, Class: ClassIMAP}, // D-03: IMAPS
|
|
{Protocol: "tcp", DstPort: 110, Class: ClassPOP3}, // D-03: POP3 plain
|
|
{Protocol: "tcp", DstPort: 995, Class: ClassPOP3}, // D-03: POP3S
|
|
{Protocol: "tcp", DstPort: 587, Class: ClassSMTPSub}, // D-04: separate from SMTP
|
|
|
|
// --- Remote Access (existing SSH + PROTO-03) ---
|
|
{Protocol: "tcp", DstPort: 22, Class: ClassSSH},
|
|
{Protocol: "tcp", DstPort: 3389, Class: ClassRDP},
|
|
{Protocol: "tcp", DstPort: 23, Class: ClassTelnet},
|
|
{Protocol: "tcp", DstPort: 5900, Class: ClassVNC},
|
|
|
|
// --- File Transfer (PROTO-02) ---
|
|
{Protocol: "tcp", DstPort: 20, Class: ClassFTP}, // D-03: FTP data
|
|
{Protocol: "tcp", DstPort: 21, Class: ClassFTP}, // D-03: FTP control
|
|
{Protocol: "tcp", DstPort: 445, Class: ClassSMB},
|
|
{Protocol: "udp", DstPort: 69, Class: ClassTFTP},
|
|
|
|
// --- Database (PROTO-04) ---
|
|
{Protocol: "tcp", DstPort: 3306, Class: ClassMySQL},
|
|
{Protocol: "tcp", DstPort: 5432, Class: ClassPostgreSQL},
|
|
{Protocol: "tcp", DstPort: 6379, Class: ClassRedis},
|
|
{Protocol: "tcp", DstPort: 27017, Class: ClassMongoDB},
|
|
|
|
// --- VoIP (PROTO-06) ---
|
|
{Protocol: "tcp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain TCP
|
|
{Protocol: "tcp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS TCP
|
|
{Protocol: "udp", DstPort: 5060, Class: ClassSIP}, // D-03: SIP plain UDP
|
|
{Protocol: "udp", DstPort: 5061, Class: ClassSIP}, // D-03: SIPS UDP
|
|
|
|
// --- Infrastructure extension (PROTO-08, D-01) ---
|
|
{Protocol: "tcp", DstPort: 389, Class: ClassLDAP}, // D-03: LDAP plain
|
|
{Protocol: "tcp", DstPort: 636, Class: ClassLDAP}, // D-03: LDAPS
|
|
{Protocol: "tcp", DstPort: 88, Class: ClassKerberos},
|
|
{Protocol: "udp", DstPort: 88, Class: ClassKerberos},
|
|
{Protocol: "udp", DstPort: 514, Class: ClassSyslog},
|
|
|
|
// Catch-alls (must be last — D-06):
|
|
{Protocol: "tcp", DstPort: 0, Class: ClassOtherTCP},
|
|
{Protocol: "udp", DstPort: 0, Class: ClassOtherUDP},
|
|
}
|