79 lines
4.7 KiB
Markdown
79 lines
4.7 KiB
Markdown
# Native WebTransport security observation
|
||
|
||
The private HTTP relay is the release boundary. Observation does not inspect
|
||
WebTransport payloads and cannot replace native transport containment.
|
||
|
||
Electron webRequest does not observe the tested Chromium WebTransport path.
|
||
The browser now subscribes privately to native Created, Established and Closed
|
||
events through the existing clipboard security owner's CDP connection.
|
||
The [Electron debugger API](https://www.electronjs.org/docs/latest/api/debugger)
|
||
and [Chromium Network protocol](https://chromedevtools.github.io/devtools-protocol/tot/Network/)
|
||
describe this instrumentation. No debugger port or protocol dispatcher is
|
||
exposed to websites, UI JavaScript or local agents.
|
||
|
||
## Ownership and lifecycle
|
||
|
||
The clipboard guard owns the only debugger attachment. Its fixed transport
|
||
lease can enable network observation, attach related targets and resume startup
|
||
targets; it cannot submit arbitrary commands or detach clipboard protection.
|
||
Initial about:blank navigation completes before setup commands, which Chromium
|
||
can otherwise defer indefinitely. Setup finishes before real page navigation.
|
||
Worker observation is queued before startup resume, covering the tested worker's
|
||
first statement. Disposal unsubscribes observation, resumes waiting targets and
|
||
releases auto-attachment while preserving clipboard protection.
|
||
|
||
Commands, targets, pending attempts and audit queues are bounded. Unexpected
|
||
detach, command timeout, overflow or audit failure makes the browser remain
|
||
quarantined until restart. Unexpected native establishment also quarantines
|
||
synchronously in the native event handler, before entering the serialized audit
|
||
queue. A held Created-audit regression verifies this ordering. This is a containment alarm;
|
||
it is not proof that an observer could prevent already transmitted bytes.
|
||
|
||
## Security records
|
||
|
||
`transport.created`, `transport.closed` and `transport.established` carry an
|
||
application-generated UUID, protocol, phase, realm, associated native tab UUID,
|
||
connection-established flag and canonical destination hostname. Creation policy
|
||
and owner context survive subsequent navigation or policy changes. Native CDP
|
||
identifiers, URLs, query strings, initiators, certificates, headers and bodies
|
||
are absent. Backend validation rejects contradictory phases, extra fields and
|
||
noncanonical host data. Monitor failures accept only fixed reason identifiers.
|
||
|
||
Records use the protected durable event pipeline. ECS and CEF preserve the
|
||
lifecycle facts as observations with unknown outcome: a Closed event is not
|
||
automatically claimed as an inspected or blocked payload. Operational traces
|
||
use fixed browser.transport stages and correlate audit encryption, persistence
|
||
and delivery without destination or content attributes. The signed diagnostics
|
||
switch still controls operational exports independently of security auditing.
|
||
|
||
## Actual Windows evidence
|
||
|
||
The current shared-owner native fixture proves Window and first-statement
|
||
dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS
|
||
PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases
|
||
delivered zero packets or bytes, while three public HTTPS submissions worked.
|
||
Six Created and six Closed records reached the central backend; none Established.
|
||
All twelve exported phase traces have matching audit-stage parents. Ordinary
|
||
webRequest callbacks remain zero, so these are actual native observations.
|
||
|
||
Evidence: ignored `artifacts/fullmain-webtransport-native-proof.json`, source
|
||
hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additionally
|
||
checks real DevTools coexistence and verifies that observer disposal preserves
|
||
clipboard ownership. Earlier literal/restart and real local Gemma regressions
|
||
passed on the same source hashes. The later final-source literal/restart test
|
||
also passes. Historical semantic debug runs recorded three export timeouts and
|
||
one concurrency rejection. The latest semantic and audited transport runs now
|
||
pass with zero lifetime failures after bounded exports and policy continuity;
|
||
see [diagnostics evidence](diagnostics-backpressure.md). Historical failures
|
||
remain retained without retrospective causal claims. These scenarios do not prove every worker, iframe,
|
||
shared-worker attribution or future Chromium transport implementation.
|
||
|
||
## Measured limits
|
||
|
||
During concurrent native source checkout/build work, semantic paste took
|
||
2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync
|
||
reached 414 ms. These traces identify work to profile; they do not isolate an
|
||
observer regression or justify weakening scanning, isolation or persistence.
|
||
The separate initial-about:blank WebRTC engine crash remains unresolved until a
|
||
fixed native runtime is compiled and passes its paired receiver tests.
|