901810 - Add webrtc to permission table for PeerConnection and underlying UDP socket

Status: RESOLVED WONTFIX

(Core :: Networking, defect)

Description

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

We need a permission check for using UDP socket in WebRTC.

Comment 1

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

Attachment: WIP - add udp-socket in PermissionTable

Comment 2

[[:fabrice] Fabrice Desré]

Comment on attachment 786110 [details] [diff] [review]
WIP - add udp-socket in PermissionTable

Review of attachment 786110 [details] [diff] [review]:
-----------------------------------------------------------------

That's not clear to me why we need that as an independent permission. If we have a "webrtc" permission we should rather use an "additional" property like https://mxr.mozilla.org/mozilla-central/source/dom/apps/src/PermissionsTable.jsm#141

Comment 3

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

nsUDPSocket is not only been used by WebRTC but also for mozUDPSocket in bug 745283, do you suggest that we have two difference permission for WebRTC and mozUDPSocket?

Comment 4

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

Currently in bug 853356 only define the permission prompt for gUM, however, we should also have a permission prompt for PeerConnection since it will create sockets to an address user might not be aware. Depending on the permission check of gUM is not sufficient because a malicious script can get MediaStream from <audio>, add it to PeerConnection, and then create DataChannel to transmit arbitrary text/blob to an endpoint without getting noticed.

So, I suggest to add another permission prompt for WebRTC.

@fabrice and @ladamski, how do you think?

Comment 5

[Lucas Adamski [:ladamski]]

Prompts and permissions are not quite the same thing.  The problem with prompting the user for permission is that the user should be reasonably capable of understanding the question the permission prompt is asking.  

In the examples of camera or contacts, the user has some idea of what the content is asking for.  I don't think any user will understand the risks around UDP sockets.

Adding Jonas here for more insight.

Comment 6

[Eric Rescorla (:ekr)]

Aside from the question of the user's informed consent, we send STUN checks prior to sending any other data and we only send data once the STUN checks have completed. That's why IETF/W3C decided that it wasn't necessary to have a permissions prompt prior to use of a PeerConnection. The same analysis seems to apply here.

SC: I'm not following the threat you're describing. We're not generally trying to stop people from transmitting data. The intent is to avoid use of people's cameras and microphones as well as to stop transmission of data to unconsenting recipients. Does the example you suggest in c4 violate that?

Comment 7

[[:fabrice] Fabrice Desré]

(In reply to Eric Rescorla (:ekr) from comment #6)
> 
> SC: I'm not following the threat you're describing. We're not generally
> trying to stop people from transmitting data. The intent is to avoid use of
> people's cameras and microphones as well as to stop transmission of data to
> unconsenting recipients. Does the example you suggest in c4 violate that?

I agree. Can we get feedback from security people?

Comment 8

[Paul Theriault [:pauljt] (no longer reading bugmail)]

From a threats perspective there is already nothing stopping an app from sending arbitrary data to any origin via a number of ways (xhr, image, websockets etc). The logic in comment 6 sounds right to me - and given there is no prompt for this API on desktop, it doesn't seem like there should be one for Firefox OS.

I am assuming that we also prevent pages from making UDP connections to localhost (i.e. protect local UDP services, e.g. push message listener, from malicious web pages).

Comment 9

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

After discussing with @pauljt, WebRTC doesn't need permission for using UDP socket. The permission check is only need if we expose UDP socket to Web API, i.e. mozUDPSocket. So, I'm going to remove the permission check from the patch for bug 869869 and set this bug as WONTFIX.