1702323 - TURN connection does not negotiate with TLS on Firefox 87+

Status: RESOLVED FIXED

(Core :: WebRTC: Networking, defect, P2)

Description

[tenge]

Attachment: ff87.pcap

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36

Steps to reproduce:

When creating a new WebRTC peerconnection with TURN URL/credential configuration, browser will create TURN allocations based on the config.

We provide a TURN URL/creds with "turns:[server]?transport=tcp", Firefox 87 will start to create TURN connections with TLS(turns).

Actual results:

Firefox does not create TLS connection, instead, TURN server side recognizes as plain TCP connection

Expected results:

Firefox is supposed to start TLS negotiation with sending ClientHello to the server.

Comment 1

[tenge]

In short, Firefox 87+ seems ignored the TURN SRV name: "turns"

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Byron Campen [:bwc]]

Yeah, I can verify this.

Comment 4

[tenge]

Thank you Byron. This is potentially a security risk for Firefox users when they use TLS for webrtc communications.
Is this have a clear path for fixing?

Comment 5

[Byron Campen [:bwc]]

This is an easy fix, yes.

Comment 6

[Byron Campen [:bwc]]

Attachment: Bug 1702323: Get this TURNS server code working again. r?ahal

Not that it helps us on CI, because of bug 1323439, but we can at
least run it locally.

Comment 7

[Byron Campen [:bwc]]

Attachment: Bug 1702323: Fix bug where the tls bit was being stomped by conversion functions. r?mjf

Also, some logging that was useful.

Depends on D110634

Comment 8

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9712760050f50a7f97ba76c0bedd82806072898b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e8a2bdafb0ddc6464c0b9c51fc3adfce3c0cd543

Comment 9

[Byron Campen [:bwc]]

Try looks about as good as we can expect right now.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d8d1c8964de0
Get this TURNS server code working again. r=ahal
https://hg.mozilla.org/integration/autoland/rev/27094688f995
Fix bug where the tls bit was being stomped by conversion functions. r=mjf

Comment 11

[tenge]

Thanks. I'm wondering when this patch will go to the release version?

Comment 12

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/d8d1c8964de0
https://hg.mozilla.org/mozilla-central/rev/27094688f995