1876865 - Difference in certificate fingerprint location in createOffer() output between Firefox and Chrome

Status: RESOLVED FIXED

(Core :: WebRTC, defect)

Description

[Ksenia Berezina [:ksenia]]

I came across this during investigation for Snapchat Web in bug1829758. They only support Chrome and not Firefox or Safari, so I've been testing site functionality to figure out what is required in order to support Firefox.

When comparing the output of createOffer(), the fingerprint attribute is defined on a session-level while Chrome has it on the media levels.
Snapchat seems to be relying on that and throwing an error:

const r = t.media[0];
if (!r.fingerprint?.type)
    throw Error("invalid SDP: missing DTLS fingerprint type");

The difference can be observed using this sample:
https://webrtc.github.io/samples/src/content/peerconnection/create-offer/

Comment 1

[Back Aug 24 [:jib]]

Byron, can you comment on whether SnapShat's SDP parsing here is legit or in the wrong?

Comment 2

[Byron Campen [:bwc]]

Definitely wrong:

https://www.rfc-editor.org/rfc/rfc4572#section-5

"The fingerprint attribute may be either a session-level or a media-
level SDP attribute. If it is a session-level attribute, it applies
to all TLS sessions for which no media-level fingerprint attribute is
defined."

Comment 3

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jib, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Back Aug 24 [:jib]]

Per comment 2 there is no bug in Firefox here.

Comment 5

[Sky Schubert [:skyschub]]

Well, even if the spec says that Firefox is right, too, this is still a difference between browsers - and it's clearly causing an issue for at least one development team that decided not to support Firefox because of many issues like this. That's especially concerning given we have a lot of WebRTC-based applications that don't support Firefox, citing "incompatibilities" as the reason.

I'll reopen this, but let's keep it in the WebCompat component. We can try reaching out to Snapchat, but that hasn't been successful in the past. At least, we should document this difference in our Knowledge Base so we can associate future breakage.

Comment 6

[Mike Kaply [:mkaply]]

How easy would this be to "fix" in Firefox?

While I understand they don't follow the spec, if Snapchat will simply never work on Firefox, making the change to Firefox seems like the logical thing to do.

We don't have the market share to take the high road.

Comment 7

[Byron Campen [:bwc]]

Probably not terribly hard.

Comment 8

[Back Aug 24 [:jib]]

It's not hard, but it's bloat.

SDP is a bunch of m= lines interspersed with attributes of each m= line, where ones above the first are global; rudimentary redundancy avoidance, hardly the hardest part of SDP.

In about:webrtc under "Show SDP" after my last 1-1 call in Meet I see one line in Firefox's Local Offer ahead of the first m=line:

a=fingerprint:sha-256 44:F0:55:DE:E6:B0:24:F8:1C:00:21:CE:3B:C0:8A:40:3F:C2:53:ED:FC:44:CC:DD:44:E9:5F:69:49:10:FC:C6

In contrast, the Remote Offer (from Meet's SFU) has their line repeated 7 times, all identical.

If the situation were reversed, it'd be a no-brainer. One way is clearly more efficient.

SDP-size is a real issue even Chrome folks have expressed concern over (e.g. in discussions over codecs). Depending on the application, SDP signaling messages may face real-world boundaries like (sms) message size or (in the case of WISH) URL length.

If we switch to duplicating this line 7 times, what happens if Chrome decides to fix it, and SnapChat updates? Do we chase?

If this is the lone thing preventing WebRTC from working in SnapChat it might be worth considering an intervention, more likely it's a rabbit hole. We did a try run intervention to bootstrap a different website, but instead of shipping it, we communicated it and they fixed it.

Comment 9

[Mike Kaply [:mkaply]]

If we switch to duplicating this line 7 times, what happens if Chrome decides to fix it, and SnapChat updates? Do we chase?

Isn't that what web compatibility is all about? :)

But seriously I don't know. It boils down to if we choose doing "the right thing" versus the thing that works.

I agree that we should chase down the other Snapchat issues first and see if this is a hold out.

We're also trying to get Snapchat contacts, but they aren't very helpful.

Comment 10

[Back Aug 24 [:jib]]

Attachment: Bug 1876865 - Add media.peerconnection.sdp.quirk.duplicate_fingerprint.allowlist. r?bwc

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cbe411e8ee43
Add media.peerconnection.sdp.quirk.duplicate_fingerprint.allowlist. r=bwc,webidl,smaug

Comment 12

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/cbe411e8ee43