drjones/PROXY_GOD_MAC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

harden macOS networking port

Browse Source
This commit is contained in:
drjones
2026-05-23 22:09:43 -07:00
parent 1f5e63ca1f
commit 35899ba1d1
24 changed files with 581 additions and 742 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
proxy_chain_manager/webrtc_check.py
View File

@@ -13,6 +13,7 @@ from __future__ import annotations
import logging
import socket
import subprocess
import sys
import winreg
from dataclasses import dataclass, field
from pathlib import Path
@@ -78,6 +79,8 @@ def check_chromium_webrtc_policy() -> tuple[bool, str]:
Accepts either the legacy DWORD DefaultWebRtcIpHandlingPolicy==3
OR the modern REG_SZ WebRtcIPHandling=="disable_non_proxied_udp".
"""
if sys.platform != "win32":
return True, "Chrome/Edge registry policy not applicable on macOS"
found: list[str] = []
missing: list[str] = []
for path in _CHROMIUM_POLICY_PATHS:
@@ -207,7 +210,8 @@ def run_webrtc_check(profile_dir: Path | None = None) -> WebRtcCheckResult:
policy_ok, policy_detail = check_chromium_webrtc_policy()
res.chrome_edge_policy_set = policy_ok
res.chrome_edge_policy_detail = policy_detail
res.add("Chrome/Edge WebRTC policy (HKLM)", policy_ok, policy_detail)
if sys.platform == "win32":
res.add("Chrome/Edge WebRTC policy (HKLM)", policy_ok, policy_detail)
# 2. Firefox profile prefs
if profile_dir is not None:
@@ -223,8 +227,14 @@ def run_webrtc_check(profile_dir: Path | None = None) -> WebRtcCheckResult:
stun_reachable, stun_detail = check_stun_reachability()
res.stun_reachable = stun_reachable
res.stun_detail = stun_detail
# STUN reachable = risk; NOT reachable = good (firewall is blocking it)
res.add("STUN UDP reachability", not stun_reachable, stun_detail)
# STUN reachable is only a leak risk when the active browser profile has
# not disabled WebRTC. On macOS the clean port is Firefox-profile based,
# not OS registry based.
stun_ok = (not stun_reachable) or (sys.platform != "win32" and res.firefox_prefs_ok)
detail = stun_detail
if stun_reachable and stun_ok:
detail += " — browser profile disables WebRTC, so UDP reachability is informational"
res.add("STUN UDP reachability", stun_ok, detail)
# Overall verdict
res.any_leak_risk = bool(res.issues)