Makes the passive tap a defensible auditing instrument for the
"does this camera phone home to Flock?" question, while shrinking what it
retains about bystanders. Nothing here widens third-party capture.
- Unified verdict vocabulary. A single private _classify() folds flow-stat
and device-level signals into exactly one of CLOUD_CONNECTED /
LOCAL_STATION / INDETERMINATE. classify_device/classify_camera become thin
wrappers. Previously the two classifiers returned divergent sets
(OFFLINE_OR_UNMONITORED, NO_DATA, UNKNOWN) that fell out of every summary
bucket, so totals never reconciled.
- Report counts now reconcile. Summary buckets partition every tracked IP;
counts_reconcile asserts cloud+local+indeterminate == total_ips_tracked.
- Explainable cloud verdicts. Record known-Flock IPs a device contacted
(cloud_ip_contacts) and surface CLOUD_IP(...) evidence, plus a
TLS_CATEGORY(...) fallback, so a cloud verdict is never unexplained.
- Bounded captures. Per-device raw sample lists cap at max_samples
(default 500, --tap-max-samples). Exact integer counters increment
regardless, so verdict inputs and report totals stay precise past the cap.
- Bystander protection. FRP auth detection stores a non-content descriptor
(matched keyword + payload length) instead of 64 raw payload bytes.
Optional --tap-redact-ips salt-hashes non-Flock destination IPs in stored
samples; known-Flock IPs stay legible so cloud evidence is readable.
- Metadata-only destination_summary per cloud device (DNS names, TLS SNIs,
known-Flock IPs) — who it talks to, never payload contents.
Tests extend the merged suite with audit-integrity coverage (vocabulary
agreement, bucket reconciliation, indeterminate counting, CLOUD_IP evidence,
sample capping vs exact counters, FRP descriptor, IP redaction,
metadata-only summary). Stale-vocabulary assertions updated to INDETERMINATE.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds pytest coverage for flock_tap.py's parsing, classification, and
byte/FRP/cloud-IP accounting, plus a .gitignore for Python caches and
capture/scan output artifacts.
The packet-level tests double as regression guards for the recently fixed
detection bugs (FRP auth-payload firing on data segments not just SYN,
no bytes_up inflation, and known-Flock-IP correlation); they fail against
the pre-fix code and pass after it. scapy-dependent tests skip cleanly when
scapy is unavailable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt