← WebKit — 2026-W37
8eb608658b83025730ac1fccd25f19521d1bbd77 Add a flag to control whether allowing WebRTC to resolve DNS directly
severity medium
class PolicyBypass
confidence 0.55
signal score 9.42
Source/WTF/
Primitive: WebRTC DNS resolution was performed without a policy gate, allowing mDNS/relay-bypass behavior that can expose local IPs.
Triage note: Threads ScriptExecutionContextIdentifier into LibWebRTCResolver and adds canStart() which, under webRTCDNSResolutionBySocketEnabled with relay-bypass-disabled or mDNS candidates, refuses DNS resolution (and validates .local names as v4 UUIDs). A genuine WebRTC privacy/relay-bypass control, but much of the diff is plumbing and it is a policy/privacy gate rather than memory safety.
Triage note: Threads ScriptExecutionContextIdentifier into LibWebRTCResolver and adds canStart() which, under webRTCDNSResolutionBySocketEnabled with relay-bypass-disabled or mDNS candidates, refuses DNS resolution (and validates .local names as v4 UUIDs). A genuine WebRTC privacy/relay-bypass control, but much of the diff is plumbing and it is a policy/privacy gate rather than memory safety.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.95), area:Source/WTF/ (+1.0)
Commit message
Add a flag to control whether allowing WebRTC to resolve DNS directly
rdar://186852502
https://bugs.webkit.org/show_bug.cgi?id=323606
Reviewed by Alex Christensen.
We add a flag to disable DNS direct resolution triggered by WebRTC.
WebRTC DNS resolution is triggered for TURN/STUN servers.
By default, the flag disables the DNS resolution except for mDNS and if private relay is bypassed, say if page has access to camera or microphone.
To support this we have to pass the ScriptExecutionContextIdentifier to the LibWebRTCResolver.
We use it to get to the resolver's document, which allows to check for flags and know whether private relay is bypassed.
We add a test that validates that, even if DNS resolution fails, we can still allocate UDP and TCP TURN candidates.
There is no support for STUN candidates yet as private relay is not supporting UDP bind.
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCDnsResolverFactory.cpp:
(WebKit::LibWebRTCDnsResolverFactory::CreateAndResolve):
(WebKit::LibWebRTCDnsResolverFactory::Create):
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCDnsResolverFactory.h:
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.h:
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCProvider.cpp:
(WebKit::LibWebRTCProvider::createPeerConnection):
(WebKit::RTCSocketFactory::CreateAsyncDnsResolver):
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCResolver.cpp:
(WebKit::canStart):
(WebKit::LibWebRTCResolver::start):
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCResolver.h:
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCSocketFactory.cpp:
(WebKit::LibWebRTCSocketFactory::createAsyncDnsResolver):
* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCSocketFactory.h:
* Tools/TestWebKitAPI/Helpers/cocoa/MiniTURNServer.h: Copied from Source/WebKit/WebProcess/Network/webrtc/LibWebRTCDnsResolverFactory.h.
* Tools/TestWebKitAPI/Helpers/cocoa/MiniTURNServer.mm: Added.
(TestWebKitAPI::MiniTURNServerState::create):
(TestWebKitAPI::MiniTURNServerState::recordRequest):
(TestWebKitAPI::MiniTURNServerState::takeRequests):
(TestWebKitAPI::MiniTURNServerState::setUDPPort):
(TestWebKitAPI::MiniTURNServerState::setTCPPort):
(TestWebKitAPI::MiniTURNServerState::udpPort const):
(TestWebKitAPI::MiniTURNServerState::tcpPort const):
(TestWebKitAPI::extractStunMethod):
(TestWebKitAPI::makeStunSuccessMessageType):
(TestWebKitAPI::makeStunErrorMessageType):
(TestWebKitAPI::writeU16BE):
(TestWebKitAPI::writeU32BE):
(TestWebKitAPI::appendXorAddressAttributeV4):
(TestWebKitAPI::appendXorAddressAttributeV6):
(TestWebKitAPI::appendLifetimeAttribute):
(TestWebKitAPI::appendPadTo4):
(TestWebKitAPI::appendStringAttribute):
(TestWebKitAPI::appendErrorCodeAttribute):
(TestWebKitAPI::computeLongTermAuthKey):
(TestWebKitAPI::appendMessageIntegrityAttribute):
(TestWebKitAPI::hasMessageIntegrityAttribute):
(TestWebKitAPI::peerEndPointAddress):
(TestWebKitAPI::handleStunMessage):
(TestWebKitAPI::sendReply):
(TestWebKitAPI::receiveUDPDatagram):
(TestWebKitAPI::receiveTCPBytes):
(TestWebKitAPI::startListener):
(TestWebKitAPI::MiniTURNServer::MiniTURNServer):
(TestWebKitAPI::MiniTURNServer::~MiniTURNServer):
(TestWebKitAPI::MiniTURNServer::udpPort const):
(TestWebKitAPI::MiniTURNServer::tcpPort const):
(TestWebKitAPI::MiniTURNServer::takeRequests):
(TestWebKitAPI::MiniTURNServer::isStunMethodAllocate):
* Tools/TestWebKitAPI/PlatformCocoa.cmake:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebRTC.mm:
(TestWebKitAPI::TEST(WebKit2, WebRTCTurnAllocationWithDirectDNSDisabled)):
Canonical link: https://commits.webkit.org/320825@main
Before / after
Loading diff…
On This Page