fix: C-01 WebRTC policy value, C-02 scoped taskkill, C-04 preflight race, E-11 socket timeout, E-27 ban test dedup, full audit doc

proxy_chain_manager/fingerprint.py

@@ -17,8 +17,12 @@ log = logging.getLogger(__name__)
 
 _WEBRTC_CHROME = r"SOFTWARE\Policies\Google\Chrome"
 _WEBRTC_EDGE = r"SOFTWARE\Policies\Microsoft\Edge"
+# Legacy DWORD key — value 3 = disable_non_proxied_udp (value 2 was wrong: public+private only)
 _WEBRTC_VALUE = "DefaultWebRtcIpHandlingPolicy"
-_WEBRTC_DISABLE = 2  # disable_non_proxied_udp
+_WEBRTC_DISABLE = 3  # disable_non_proxied_udp (correct Chrome/Edge DWORD)
+# Modern REG_SZ key required by Chrome 114+ Group Policy
+_WEBRTC_VALUE_STR = "WebRtcIPHandling"
+_WEBRTC_DISABLE_STR = "disable_non_proxied_udp"
 
 
 @dataclass
@@ -160,7 +164,12 @@ def enable_ipv6_on_adapters(adapters: list[str]) -> list[str]:
 
 
 def apply_webrtc_hardening(enable: bool) -> tuple[bool, str]:
-    """Chrome/Edge: disable WebRTC non-proxied UDP (Admin, HKLM policies)."""
+    """Chrome/Edge: disable WebRTC non-proxied UDP (Admin, HKLM policies).
+
+    Writes both the legacy DWORD key (DefaultWebRtcIpHandlingPolicy=3) and
+    the modern REG_SZ key (WebRtcIPHandling=disable_non_proxied_udp) so that
+    all Chrome/Edge versions are covered.
+    """
     if not is_admin():
         return False, "Administrator required for browser WebRTC policy."
     paths = [_WEBRTC_CHROME, _WEBRTC_EDGE]
@@ -175,15 +184,17 @@ def apply_webrtc_hardening(enable: bool) -> tuple[bool, str]:
                     continue
                 with key:
                     winreg.SetValueEx(key, _WEBRTC_VALUE, 0, winreg.REG_DWORD, _WEBRTC_DISABLE)
+                    winreg.SetValueEx(key, _WEBRTC_VALUE_STR, 0, winreg.REG_SZ, _WEBRTC_DISABLE_STR)
             else:
                 try:
                     with winreg.OpenKey(
                         winreg.HKEY_LOCAL_MACHINE, path, 0, winreg.KEY_SET_VALUE
                     ) as key:
-                        try:
-                            winreg.DeleteValue(key, _WEBRTC_VALUE)
-                        except OSError:
-                            pass
+                        for val_name in (_WEBRTC_VALUE, _WEBRTC_VALUE_STR):
+                            try:
+                                winreg.DeleteValue(key, val_name)
+                            except OSError:
+                                pass
                 except OSError:
                     pass
         return True, (
@@ -340,16 +351,28 @@ def audit_device() -> FingerprintAudit:
     ]
 
     # Quick consistency checks — WebRTC IP-handling policy (Chrome / Edge)
+    # Accept either: DWORD DefaultWebRtcIpHandlingPolicy==3
+    #             or REG_SZ WebRtcIPHandling=="disable_non_proxied_udp"
     webrtc_ok = False
     for hive_root in (_WEBRTC_CHROME, _WEBRTC_EDGE):
         try:
             with winreg.OpenKey(
                 winreg.HKEY_LOCAL_MACHINE, hive_root, 0, winreg.KEY_QUERY_VALUE
             ) as k:
-                v = int(winreg.QueryValueEx(k, _WEBRTC_VALUE)[0])
-                if v == _WEBRTC_DISABLE:
-                    webrtc_ok = True
-                    break
+                try:
+                    v = int(winreg.QueryValueEx(k, _WEBRTC_VALUE)[0])
+                    if v == _WEBRTC_DISABLE:
+                        webrtc_ok = True
+                        break
+                except OSError:
+                    pass
+                try:
+                    v_str = str(winreg.QueryValueEx(k, _WEBRTC_VALUE_STR)[0])
+                    if v_str == _WEBRTC_DISABLE_STR:
+                        webrtc_ok = True
+                        break
+                except OSError:
+                    pass
         except OSError:
             continue