fix: C-01 WebRTC policy value, C-02 scoped taskkill, C-04 preflight race, E-11 socket timeout, E-27 ban test dedup, full audit doc

proxy_chain_manager/webrtc_check.py

@@ -40,8 +40,10 @@ _CHROMIUM_POLICY_PATHS = (
     r"SOFTWARE\Policies\Microsoft\Edge",
     r"SOFTWARE\Policies\Chromium",
 )
-_WEBRTC_POLICY_VALUE = "DefaultWebRtcIpHandlingPolicy"
-_WEBRTC_BLOCK_VALUE  = 2          # "default_public_and_private_interfaces"
+_WEBRTC_POLICY_VALUE    = "DefaultWebRtcIpHandlingPolicy"
+_WEBRTC_BLOCK_VALUE     = 3       # disable_non_proxied_udp (was 2 = public+private only — wrong)
+_WEBRTC_POLICY_STR_KEY  = "WebRtcIPHandling"
+_WEBRTC_BLOCK_STR_VALUE = "disable_non_proxied_udp"
 
 
 @dataclass
@@ -71,21 +73,39 @@ class WebRtcCheckResult:
 # ─────────────────────────────────────────────────────────────────────────────
 
 def check_chromium_webrtc_policy() -> tuple[bool, str]:
-    """Return (policy_set, detail_string)."""
+    """Return (policy_set, detail_string).
+
+    Accepts either the legacy DWORD DefaultWebRtcIpHandlingPolicy==3
+    OR the modern REG_SZ WebRtcIPHandling=="disable_non_proxied_udp".
+    """
     found: list[str] = []
     missing: list[str] = []
     for path in _CHROMIUM_POLICY_PATHS:
         try:
             with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, path, 0, winreg.KEY_QUERY_VALUE) as k:
+                name = path.split("\\")[-1]
+                dword_ok = False
+                str_ok = False
+                # Check legacy DWORD
                 try:
                     val = int(winreg.QueryValueEx(k, _WEBRTC_POLICY_VALUE)[0])
-                    name = path.split("\\")[-1]
-                    if val == _WEBRTC_BLOCK_VALUE:
-                        found.append(name)
-                    else:
-                        missing.append(f"{name}={val} (need {_WEBRTC_BLOCK_VALUE})")
+                    dword_ok = val == _WEBRTC_BLOCK_VALUE
+                    if not dword_ok:
+                        missing.append(f"{name} DWORD={val} (need {_WEBRTC_BLOCK_VALUE})")
                 except OSError:
-                    missing.append(path.split("\\")[-1] + " key missing")
+                    pass
+                # Check modern REG_SZ
+                try:
+                    val_str = str(winreg.QueryValueEx(k, _WEBRTC_POLICY_STR_KEY)[0])
+                    str_ok = val_str == _WEBRTC_BLOCK_STR_VALUE
+                    if not str_ok:
+                        missing.append(f"{name} REG_SZ={val_str!r} (need {_WEBRTC_BLOCK_STR_VALUE!r})")
+                except OSError:
+                    pass
+                if dword_ok or str_ok:
+                    found.append(name)
+                elif not dword_ok and not str_ok:
+                    missing.append(f"{name}: no WebRTC policy keys present")
         except OSError:
             continue   # key not present at all — browser not installed or not policy-managed