Check media permissions (mic/camera) before exposing local addresses to WebRTC.

content/renderer/media/webrtc/peer_connection_dependency_factory.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/location.h"
+#include "base/metrics/field_trial.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/waitable_event.h"
 #include "content/common/media/media_stream_messages.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/renderer_preferences.h"
 #include "content/renderer/media/media_stream.h"
 #include "content/renderer/media/media_stream_audio_processor.h"
 #include "content/renderer/media/media_stream_audio_processor_options.h"
 #include "content/renderer/media/media_stream_audio_source.h"
 #include "content/renderer/media/media_stream_video_source.h"
 #include "content/renderer/media/media_stream_video_track.h"
 #include "content/renderer/media/peer_connection_identity_store.h"
 #include "content/renderer/media/rtc_media_constraints.h"
 #include "content/renderer/media/rtc_peer_connection_handler.h"
 #include "content/renderer/media/rtc_video_decoder_factory.h"
 #include "content/renderer/media/rtc_video_encoder_factory.h"
 #include "content/renderer/media/webaudio_capturer_source.h"
 #include "content/renderer/media/webrtc/stun_field_trial.h"
 #include "content/renderer/media/webrtc/webrtc_local_audio_track_adapter.h"
 #include "content/renderer/media/webrtc/webrtc_video_capturer_adapter.h"
 #include "content/renderer/media/webrtc_audio_device_impl.h"
 #include "content/renderer/media/webrtc_local_audio_track.h"
 #include "content/renderer/media/webrtc_logging.h"
 #include "content/renderer/media/webrtc_uma_histograms.h"
+#include "content/renderer/p2p/empty_network_manager.h"
+#include "content/renderer/p2p/filtering_network_manager.h"
 #include "content/renderer/p2p/ipc_network_manager.h"
 #include "content/renderer/p2p/ipc_socket_factory.h"
 #include "content/renderer/p2p/port_allocator.h"
+#include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "jingle/glue/thread_wrapper.h"
+#include "media/base/media_permission.h"
 #include "media/renderers/gpu_video_accelerator_factories.h"
 #include "third_party/WebKit/public/platform/WebMediaConstraints.h"
 #include "third_party/WebKit/public/platform/WebMediaStream.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamSource.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamTrack.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "third_party/libjingle/source/talk/app/webrtc/mediaconstraintsinterface.h"
 
@@ skipping 48 matching lines @@
           constraints->AddOptional(kConstraintEffectMap[i].constraint,
               webrtc::MediaConstraintsInterface::kValueFalse, true);
         }
         DVLOG(1) << "Disabling constraint: "
                  << kConstraintEffectMap[i].constraint;
       }
     }
   }
 }
 
 class P2PPortAllocatorFactory : public webrtc::PortAllocatorFactoryInterface {

[Sergey Ulanov, 2015/09/25 18:19:19]

I thinks you can just change this to 'public
rtc::RefCountedObject<webrtc::PortAllocatorFactoryInterface>'.
This will allow to avoid the problem with RefCountedObject constructor.

  public:
-  P2PPortAllocatorFactory(P2PSocketDispatcher* socket_dispatcher,
-                          rtc::NetworkManager* network_manager,
-                          rtc::PacketSocketFactory* socket_factory,
-                          const GURL& origin,
-                          const P2PPortAllocator::Config& config)
-      : socket_dispatcher_(socket_dispatcher),
+  // |media_permission| has to be pass as ref to avoid an invocation of copy
+  // constructor inside rtc::RefCountedObject.

[Sergey Ulanov, 2015/09/25 00:45:31]

Not sure what's the problem here. Passing scoped_ptr<> by value doesn't require
copying the object that's pointed by scoped_ptr<>, so how does it cause copy
constructor being invoked?

[guoweis_left_chromium, 2015/09/25 03:42:20]

rtc::RefCountedObject is a template as
  RefCountedObject(P1 p1, P2 p2, P3 p3, P4 p4, P5 p5, P6 p6, P7 p7, P8 p8)
      : T(p1, p2, p3, p4, p5, p6, p7, p8), ref_count_(0) {
  }

So scoped_ptr<> will be passed to both T (i.e. P2PPortAllocatorFactory here) and
RefCountedObject. I guess that's where a copy ctro is invoked.

[Sergey Ulanov, 2015/09/25 18:19:19]

I see. So the problem is that rtc::RefCountedOject is not compatible with
non-copyable constructor parameters. 
In either case it's not right to pass scoped_ptr<> by reference like this. Style
guide explicitly prohibits non-const reference parameters:
https://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Reference_Ar...

See my comment above for suggestion to how this problem can be avoided. But if
that doesn't work pass media_permission here as raw pointer.

+  P2PPortAllocatorFactory(
+      scoped_ptr<media::MediaPermission>& media_permission,
+      const scoped_refptr<P2PSocketDispatcher>& socket_dispatcher,
+      rtc::NetworkManager* network_manager,
+      rtc::PacketSocketFactory* socket_factory,
+      const P2PPortAllocator::Config& config,
+      const GURL& origin,
+      const scoped_refptr<base::SingleThreadTaskRunner> task_runner)
+      : media_permission_(media_permission.Pass()),
+        socket_dispatcher_(socket_dispatcher),
         network_manager_(network_manager),
         socket_factory_(socket_factory),
+        config_(config),
         origin_(origin),
-        config_(config) {}
+        task_runner_(task_runner) {}
 
   cricket::PortAllocator* CreatePortAllocator(
       const std::vector<StunConfiguration>& stun_servers,
       const std::vector<TurnConfiguration>& turn_configurations) override {
     P2PPortAllocator::Config config = config_;
     for (size_t i = 0; i < stun_servers.size(); ++i) {
       config.stun_servers.insert(rtc::SocketAddress(
           stun_servers[i].server.hostname(),
           stun_servers[i].server.port()));
     }
     for (size_t i = 0; i < turn_configurations.size(); ++i) {
       P2PPortAllocator::Config::RelayServerConfig relay_config;
       relay_config.server_address = turn_configurations[i].server.hostname();
       relay_config.port = turn_configurations[i].server.port();
       relay_config.username = turn_configurations[i].username;
       relay_config.password = turn_configurations[i].password;
       relay_config.transport_type = turn_configurations[i].transport_type;
       relay_config.secure = turn_configurations[i].secure;
       config.relays.push_back(relay_config);
     }
 
-    return new P2PPortAllocator(
-        socket_dispatcher_.get(), network_manager_,
-        socket_factory_, config, origin_);
+    scoped_ptr<rtc::NetworkManager> network_manager;
+    if (config.enable_multiple_routes) {
+      network_manager.reset(new FilteringNetworkManager(
+          network_manager_, origin_, media_permission_.Pass()));
+      if (media_permission_) {
+        // Start permission check earlier to reduce any impact to call set up
+        // time.
+        task_runner_->PostTask(
+            FROM_HERE, base::Bind(&FilteringNetworkManager::CheckPermissions,
+                                  static_cast<FilteringNetworkManager*>(

[Sergey Ulanov, 2015/09/25 00:45:30]

Please don't use static_cast to downcast pointers unless it's necessary. You can
avoid it here by storing the origin FNM pointer:

FilteringNetworkManager* nm = new FilteringNetworkManager();
network_manager.reset(nm);
PostTask(base::Bind(..., base::Unretained(nm)));

[guoweis_left_chromium, 2015/09/25 03:42:20]

Done.

+                                      network_manager.get())
+                                      ->GetWeakPtr()));

[Sergey Ulanov, 2015/09/25 00:45:30]

You don't need weak_ptr here. The network manager will be destroyed on the same
thread, so CheckPermission() will always be called before destruction if you
call it here. I.e. you can use base::Unretained.

[guoweis_left_chromium, 2015/09/25 03:42:20]

Done.

+      }
+    } else {
+      network_manager.reset(new EmptyNetworkManager());
+    }
+
+    return new P2PPortAllocator(socket_dispatcher_, network_manager.Pass(),
+                                socket_factory_, config, origin_, task_runner_);
   }
 
  protected:
-  ~P2PPortAllocatorFactory() override {}
+  ~P2PPortAllocatorFactory() override {
+    if (media_permission_) {
+      task_runner_->DeleteSoon(FROM_HERE, media_permission_.release());
+    }
+  }
 
  private:
-  scoped_refptr<P2PSocketDispatcher> socket_dispatcher_;
-  // |network_manager_| and |socket_factory_| are a weak references, owned by
-  // PeerConnectionDependencyFactory.
+  // Ownership of |media_permission_| will be passed to FilteringNetworkManager
+  // during CreatePortAllocator.
+  scoped_ptr<media::MediaPermission> media_permission_;
+
+  const scoped_refptr<P2PSocketDispatcher>& socket_dispatcher_;
   rtc::NetworkManager* network_manager_;
   rtc::PacketSocketFactory* socket_factory_;
-  // The origin URL of the WebFrame that created the
-  // P2PPortAllocatorFactory.
-  GURL origin_;
+  const P2PPortAllocator::Config& config_;
+  const GURL& origin_;
 
-  // Keep track of configuration common to all PortAllocators created by this
-  // factory; additional, per-allocator configuration is passed into
-  // CreatePortAllocator.
-  P2PPortAllocator::Config config_;
+  // This is the worker thread where |media_permission_| and |network_manager_|
+  // live on.
+  const scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 };
 
 PeerConnectionDependencyFactory::PeerConnectionDependencyFactory(
     P2PSocketDispatcher* p2p_socket_dispatcher)
     : network_manager_(NULL),
       p2p_socket_dispatcher_(p2p_socket_dispatcher),
       signaling_thread_(NULL),
       worker_thread_(NULL),
       chrome_signaling_thread_("Chrome_libJingle_Signaling"),
       chrome_worker_thread_("Chrome_libJingle_WorkerThread") {
@@ skipping 221 matching lines @@
   CHECK(web_frame);
   CHECK(observer);
   if (!GetPcFactory().get())
     return NULL;
 
   rtc::scoped_ptr<PeerConnectionIdentityStore> identity_store(
       new PeerConnectionIdentityStore(
           GURL(web_frame->document().url()),
           GURL(web_frame->document().firstPartyForCookies())));
 
+  // |media_permission| will be called to check mic/camera permission. If at
+  // least one of them is granted, P2PPortAllocator is allowed to gather local
+  // host IP addresses as ICE candidates.
+  // If the experiment is not enabled, turn off the permission check by
+  // passing nullptr to FilteringNetworkManager constructor.
+  scoped_ptr<media::MediaPermission> media_permission;
+  if (base::FieldTrialList::FindFullName("WebRTC-LocalIPPermissionCheck") ==
+      "Enabled") {
+    RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(web_frame);
+    if (render_frame) {
+      media_permission = render_frame->CreateMediaPermissionProxy(
+          chrome_worker_thread_.task_runner());
+      DCHECK(media_permission);
+    }
+  }
+
   // Copy the flag from Preference associated with this WebFrame.
-  P2PPortAllocator::Config pref_config;
+  P2PPortAllocator::Config port_config;
   if (web_frame && web_frame->view()) {
     RenderViewImpl* renderer_view_impl =
         RenderViewImpl::FromWebView(web_frame->view());
     if (renderer_view_impl) {
-      pref_config.enable_multiple_routes =
+      // TODO(guoweis): |enable_multiple_routes| should be renamed to
+      // |request_multiple_routes|. Whether local IP addresses could be
+      // collected depends on if mic/camera permission is granted for this
+      // origin.
+      port_config.enable_multiple_routes =
           renderer_view_impl->renderer_preferences()
               .enable_webrtc_multiple_routes;
-      pref_config.enable_nonproxied_udp =
+      port_config.enable_nonproxied_udp =
           renderer_view_impl->renderer_preferences()
               .enable_webrtc_nonproxied_udp;
     }
   }
 
+  const GURL& requesting_origin =
+      GURL(web_frame->document().url().spec()).GetOrigin();
+
   scoped_refptr<P2PPortAllocatorFactory> pa_factory =
       new rtc::RefCountedObject<P2PPortAllocatorFactory>(

[Sergey Ulanov, 2015/09/25 18:19:19]

this can be 'new P2PPortAllocatorFactory' if P2PPortAllocatorFactory inherited
from RefCountedObject.

-          p2p_socket_dispatcher_.get(), network_manager_, socket_factory_.get(),
-          GURL(web_frame->document().url().spec()).GetOrigin(), pref_config);
+          media_permission.Pass(), p2p_socket_dispatcher_, network_manager_,
+          socket_factory_.get(), port_config, requesting_origin,
+          chrome_worker_thread_.task_runner());
 
   return GetPcFactory()->CreatePeerConnection(config,
                                               constraints,
                                               pa_factory.get(),
                                               identity_store.Pass(),
                                               observer).get();
 }
 
 scoped_refptr<webrtc::MediaStreamInterface>
 PeerConnectionDependencyFactory::CreateLocalMediaStream(
@@ skipping 247 matching lines @@
 }
 
 void PeerConnectionDependencyFactory::EnsureWebRtcAudioDeviceImpl() {
   if (audio_device_.get())
     return;
 
   audio_device_ = new WebRtcAudioDeviceImpl();
 }
 
 }  // namespace content