Transparency: label blocked/allowed in traffic log; whitelist Cloudflare CDN (WI-6: #554, #561, #358)

[kasnder]

WI-6 — Transparency: blocked connections invisible / unlabelled

Fixes the visibility half of WI-6. References #554, #561, #358.

Problem

• Tracker Control does not make it obvious what's blocked and what's not in traffic log #561: In the raw traffic log (AdapterLog), blocked-vs-allowed was encoded only via a small tinted connection icon (AdapterLog.java ~173/181-182) — no text. The newer tracker Timeline (TimelineAdapter ~176-188) already labels this clearly.
• Reddit API domain is being blocked but not shown in TrackerContol #554 (partial): Legitimate Cloudflare-fronted content was over-blocked as a shared-IP tracker. The shared-CDN false-positive whitelist TrackerList.ignoreDomains (~61-63) covered cloudfront.net/fastly.net but not Cloudflare.
• Reddit API domain is being blocked but not shown in TrackerContol #554 / Invisible sites or domains are blocked without the possibility of unblocking #358: A blocked connection with no recognised-tracker mapping has no row in the per-app list, so "no way to unblock" (see Out of scope).

What changed

1. Traffic log now labels blocked/allowed (#561) — AdapterLog.java + res/layout/log.xml

• Added a per-row coloured text label (BLOCKED red / ALLOWED green), mirroring the TimelineAdapter idiom. Reuses existing resources R.string.blocked / R.string.allowed and R.color.timeline_blocked / R.color.timeline_allowed. Label is hidden when the allowed state is unknown (allowed < 0).

2. Whitelist Cloudflare's shared CDN (#554 partial) — TrackerList.java

• Added cloudflare.com to ignoreDomains. Verified the mechanism first: isIgnoredDomain() does an exact registrable-domain match against the domains listed in the blocklists. In the Disconnect list Cloudflare appears as cloudflare.com (the shared CDN fronting e.g. cdnjs.cloudflare.com), cloudflareinsights.com (its Web Analytics beacon), and cloudflarestream.com. cloudflare.com is the correct analogue of cloudfront.net/fastly.net; the analytics beacon cloudflareinsights.com is deliberately left blockable (exact match won't touch it).

Root cause (attribution half — see Out of scope)

updateAccess, which feeds the per-app tracker list, runs only when isTracker is true (ServiceSinkhole.java ~978), while the raw log is written whenever logging is on (~974). In addition, TrackerList.getAppTrackers() (~337-339) skips any access row where findTracker(host) == null. So a blocked-but-unrecognised connection has no toggleable per-app row.

Deliberately out of scope

• Surfacing blocked-but-unattributed connections as toggleable per-app rows (Reddit API domain is being blocked but not shown in TrackerContol #554/Invisible sites or domains are blocked without the possibility of unblocking #358 "no way to unblock"). A correct fix would require (a) changing the access-table population policy to write non-tracker rows — flooding a per-app table with every host each app contacts (battery/DB/philosophy regression), (b) redesigning getAppTrackers() to emit an "unknown" category, and (c) a new per-app/per-host block mechanism that does not exist. Crucially it would still be dishonest: the block decision is IP-based off the UID-global dns table (no uid column) — the deliberately-deferred attribution limitation documented in TODO.md and triage §C-3. Left for a dedicated attribution redesign rather than papered over here.
• Merge-friction note: kept edits away from the ServiceSinkhole.getDns region (~1330-1450) and the TrackerList.loadTrackers/JSON-parse region (~178/524) that concurrent PRs touch.

Testing

• ./gradlew :app:compileGithubDebugJavaWithJavac compiled cleanly (Java + resources) on first run. Only Java/resources were touched; no packet-path change.
• I could not capture screenshots. A maintainer should visually confirm the new BLOCKED/ALLOWED labels in the traffic log render correctly in light and dark themes.

🤖 Generated with Claude Code