Add flock_tap test suite and .gitignore #2

2026-07-20T15:58:30Z

Trilltechnician commented

2026-07-20 15:58:30 +00:00

Adds a pytest suite for flock_tap.py plus a .gitignore.

Tests (tests/test_flock_tap.py, 31 cases):

Pure logic: SNI categorization, DNS/TCP/TLS callbacks, classify_device/classify_camera, tcpdump-line parsing.
Packet-level (scapy) regression guards for the bugs fixed in the FRP/byte-accounting PR: FRP auth-payload firing on data segments (not only SYN), no bytes_up inflation, and known-Flock-IP correlation. These fail against the pre-fix code and pass after it. scapy-dependent tests skip cleanly when scapy isn't installed.
Run: python3 -m pytest tests/ -q

.gitignore: Python caches (__pycache__/, *.pyc, .pytest_cache/) and capture/scan outputs (*.pcap, report.json, creds_*.txt, s3_urls_*.txt).

Note: this is stacked on the detection-fix PR (#1) — the tests assert the fixed behavior, so the branch includes that commit and its diff will show flock_tap.py until #1 lands. Once #1 merges, this rebases down to tests + .gitignore only. (Alternatively, merge this one and close #1 — it contains #1's fix.)

Adds a pytest suite for `flock_tap.py` plus a `.gitignore`. **Tests** (`tests/test_flock_tap.py`, 31 cases): - Pure logic: SNI categorization, DNS/TCP/TLS callbacks, `classify_device`/`classify_camera`, tcpdump-line parsing. - Packet-level (scapy) **regression guards** for the bugs fixed in the FRP/byte-accounting PR: FRP auth-payload firing on data segments (not only SYN), no `bytes_up` inflation, and known-Flock-IP correlation. These fail against the pre-fix code and pass after it. scapy-dependent tests skip cleanly when scapy isn't installed. - Run: `python3 -m pytest tests/ -q` **.gitignore**: Python caches (`__pycache__/`, `*.pyc`, `.pytest_cache/`) and capture/scan outputs (`*.pcap`, `report.json`, `creds_*.txt`, `s3_urls_*.txt`). --- **Note:** this is stacked on the detection-fix PR (#1) — the tests assert the *fixed* behavior, so the branch includes that commit and its diff will show `flock_tap.py` until #1 lands. Once #1 merges, this rebases down to tests + `.gitignore` only. (Alternatively, merge this one and close #1 — it contains #1's fix.)

Trilltechnician added 1 commit 2026-07-20 15:58:30 +00:00

Add flock_tap test suite and .gitignore 4081e55ba8

Adds pytest coverage for flock_tap.py's parsing, classification, and
byte/FRP/cloud-IP accounting, plus a .gitignore for Python caches and
capture/scan output artifacts.

The packet-level tests double as regression guards for the recently fixed
detection bugs (FRP auth-payload firing on data segments not just SYN,
no bytes_up inflation, and known-Flock-IP correlation); they fail against
the pre-fix code and pass after it. scapy-dependent tests skip cleanly when
scapy is unavailable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ek0ms savi0r merged commit 4c605b3093 into main

2026-07-21 21:08:21 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ek0mssavi0r/Flock_SCAN#2

Allow edits from maintainers