After every update the Windows Firewall promts on first call

[bessw]

Description

After every update of Element / Riot, when I'm receiving or starting the first voice call after the update, the Windows Firewall promts that a new application requested to open a port.

This probably happens because the path of the executable changes with every update (version number in its name).

Steps to reproduce

• restart after an update of Element
• start / receive a call

Describe how what happens differs from what you expected.

I would expect that calls still work after a update and you don't have to have your system administrator around when you want to answer a call after an update.

Logs being sent: no

Version information

• Platform: desktop

For the desktop app:

• OS: Windows
• Version: any until now (1.7.2)

[novocaine]

Related upstream issue: electron/electron#23756

I tested this on windows and I believe its the same thing - Windows Firewall logs relate to UDP packets sent to port 5353 with destination IP 224.0.0.251 as per https://en.wikipedia.org/wiki/Multicast_DNS. It is probably not due to the actual connection needed for the call!

Note that for me, the calls succeed (because mDNS isn't required for them to succeed), consistent with the upstream report.

The popup doesn't come back once I clicked cancel, but it probably would if I took an update and moved the exe to a different path, as the rule the firewall creates points at the version-specific path.

Interesting point from https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/7qVwleLiBwAJ is that

Currently, this feature is active for all sites except those that have getUserMedia permissions, which are presumed to have a higher degree of user trust.

Most recent Chromium issue: https://bugs.chromium.org/p/chromium/issues/detail?id=1000955

The Windows Firewall permission popup cannot be avoided if the installation program could not add the Windows Firewall exception rule for mDNS into the system.

On the other hand, If mDNS feature is disabled by chrome://flags/#enable-webrtc-hide-local-ips-with-mdns, there will be no Firewall permission popup but the real local IP addresses will be shown in WebRTC ICE candidates.

[novocaine]

Note that this bug refers to the firewall triggering on calls whereas #15973 seems to be about the firewall triggering in general.

[novocaine]

Our plan is to try building with enable-webrtc-hide-local-ips-with-mdns disabled to see if that prevents the firewall from prompting.

[t3chguy]

Close in favour of element-hq/element-desktop#666