76 lines
4.6 KiB
Markdown
76 lines
4.6 KiB
Markdown
|
# Native WebTransport security observation
|
|||
|
|
|
|||
|
|
The private HTTP relay is the release boundary. Observation does not inspect
|
|||
|
|
WebTransport payloads and cannot replace native transport containment.
|
|||
|
|
|
|||
|
|
Electron webRequest does not observe the tested Chromium WebTransport path.
|
|||
|
|
The browser now subscribes privately to native Created, Established and Closed
|
|||
|
|
events through the existing clipboard security owner's CDP connection.
|
|||
|
|
The [Electron debugger API](https://www.electronjs.org/docs/latest/api/debugger)
|
|||
|
|
and [Chromium Network protocol](https://chromedevtools.github.io/devtools-protocol/tot/Network/)
|
|||
|
|
describe this instrumentation. No debugger port or protocol dispatcher is
|
|||
|
|
exposed to websites, UI JavaScript or local agents.
|
|||
|
|
|
|||
|
|
## Ownership and lifecycle
|
|||
|
|
|
|||
|
|
The clipboard guard owns the only debugger attachment. Its fixed transport
|
|||
|
|
lease can enable network observation, attach related targets and resume startup
|
|||
|
|
targets; it cannot submit arbitrary commands or detach clipboard protection.
|
|||
|
|
Initial about:blank navigation completes before setup commands, which Chromium
|
|||
|
|
can otherwise defer indefinitely. Setup finishes before real page navigation.
|
|||
|
|
Worker observation is queued before startup resume, covering the tested worker's
|
|||
|
|
first statement. Disposal unsubscribes observation, resumes waiting targets and
|
|||
|
|
releases auto-attachment while preserving clipboard protection.
|
|||
|
|
|
|||
|
|
Commands, targets, pending attempts and audit queues are bounded. Unexpected
|
|||
|
|
detach, command timeout, overflow or audit failure makes the browser remain
|
|||
|
|
quarantined until restart. Unexpected native establishment also quarantines
|
|||
|
|
synchronously in the native event handler, before entering the serialized audit
|
|||
|
|
queue. A held Created-audit regression verifies this ordering. This is a containment alarm;
|
|||
|
|
it is not proof that an observer could prevent already transmitted bytes.
|
|||
|
|
|
|||
|
|
## Security records
|
|||
|
|
|
|||
|
|
`transport.created`, `transport.closed` and `transport.established` carry an
|
|||
|
|
application-generated UUID, protocol, phase, realm, associated native tab UUID,
|
|||
|
|
connection-established flag and canonical destination hostname. Creation policy
|
|||
|
|
and owner context survive subsequent navigation or policy changes. Native CDP
|
|||
|
|
identifiers, URLs, query strings, initiators, certificates, headers and bodies
|
|||
|
|
are absent. Backend validation rejects contradictory phases, extra fields and
|
|||
|
|
noncanonical host data. Monitor failures accept only fixed reason identifiers.
|
|||
|
|
|
|||
|
|
Records use the protected durable event pipeline. ECS and CEF preserve the
|
|||
|
|
lifecycle facts as observations with unknown outcome: a Closed event is not
|
|||
|
|
automatically claimed as an inspected or blocked payload. Operational traces
|
|||
|
|
use fixed browser.transport stages and correlate audit encryption, persistence
|
|||
|
|
and delivery without destination or content attributes. The signed diagnostics
|
|||
|
|
switch still controls operational exports independently of security auditing.
|
|||
|
|
|
|||
|
|
## Actual Windows evidence
|
|||
|
|
|
|||
|
|
The current shared-owner native fixture proves Window and first-statement
|
|||
|
|
dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS
|
|||
|
|
PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases
|
|||
|
|
delivered zero packets or bytes, while three public HTTPS submissions worked.
|
|||
|
|
Six Created and six Closed records reached the central backend; none Established.
|
|||
|
|
All twelve exported phase traces have matching audit-stage parents. Ordinary
|
|||
|
|
webRequest callbacks remain zero, so these are actual native observations.
|
|||
|
|
|
|||
|
|
Evidence: ignored `artifacts/fullmain-webtransport-native-proof.json`, source
|
|||
|
|
hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additionally
|
|||
|
|
checks real DevTools coexistence and verifies that observer disposal preserves
|
|||
|
|
clipboard ownership. Earlier literal/restart and real local Gemma regressions
|
|||
|
|
passed on the same source hashes. The later final-source literal/restart test
|
|||
|
|
also passes; the later semantic DLP checks pass but its debug acceptance records
|
|||
|
|
three export timeouts and one concurrency rejection. Those failures remain
|
|||
|
|
open and are separate from receiver containment. These scenarios do not prove every worker, iframe,
|
|||
|
|
shared-worker attribution or future Chromium transport implementation.
|
|||
|
|
|
|||
|
|
## Measured limits
|
|||
|
|
|
|||
|
|
During concurrent native source checkout/build work, semantic paste took
|
|||
|
|
2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync
|
|||
|
|
reached 414 ms. These traces identify work to profile; they do not isolate an
|
|||
|
|
observer regression or justify weakening scanning, isolation or persistence.
|
|||
|
|
The separate initial-about:blank WebRTC engine crash remains unresolved until a
|
|||
|
|
fixed native runtime is compiled and passes its paired receiver tests.
|