From 1d976b860a7e92de2e4f7afe3d745bedf1d96286 Mon Sep 17 00:00:00 2001 From: Erik Hortsch Date: Mon, 12 Oct 2026 14:33:39 -0700 Subject: [PATCH] Add OSS Scanner build image and threat model (#4995) Co-authored-by: Claude Opus 5.5 --- .oss-scanner/Dockerfile | 40 +++++++++++++++++ .oss-scanner/threat_model.md | 84 ++++++++++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 .oss-scanner/Dockerfile create mode 100644 .oss-scanner/threat_model.md diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile new file mode 100644 index 000000000..d62476856 --- /dev/null +++ b/.oss-scanner/Dockerfile @@ -0,0 +1,40 @@ +# Copyright 2026 LiveKit, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Build image for Anthropic's OSS Scanner. Keep the Go version at or above go.mod's: GOTOOLCHAIN=local won't fetch one. +FROM golang:1.26-bookworm + +ENV DEBIAN_FRONTEND=noninteractive \ + GOTOOLCHAIN=local + +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential ca-certificates git redis-server \ + && rm -rf /var/lib/apt/lists/* + +WORKDIR /src +COPY . /src + +RUN go mod download && go mod verify +RUN go build ./... && go build -o /usr/local/bin/livekit-server ./cmd/server + +# Tests use a local redis on :6379; pkg/service also wants a docker daemon unless -docker=false. +RUN redis-server --daemonize yes \ + && go test -count=1 -timeout 20m $(go list ./... | grep -v '/pkg/service$') \ + && go test -count=1 -timeout 10m ./pkg/service -docker=false \ + || echo 'WARNING: baseline tests failed' + +ENV GOPROXY=off \ + GOSUMDB=off + +CMD ["bash"] diff --git a/.oss-scanner/threat_model.md b/.oss-scanner/threat_model.md new file mode 100644 index 000000000..0302c7337 --- /dev/null +++ b/.oss-scanner/threat_model.md @@ -0,0 +1,84 @@ +# LiveKit server threat model + +LiveKit server is a WebRTC SFU written in Go. Clients join rooms with a signed +access token, publish and subscribe to audio, video, and data tracks, and exchange +signalling over WebSocket or HTTP. Operators manage rooms, participants, egress, +ingress, SIP, and agent dispatch through a Twirp API authenticated by API +key/secret. The server also embeds a TURN server. + +## Scope and trust boundaries + +Audit the server on `master`: signalling (`pkg/service`, `pkg/rtc/signalling`), +room and participant state (`pkg/rtc`), media forwarding (`pkg/sfu`), routing +(`pkg/routing`), the agent endpoint (`pkg/agent`), WHIP, WebTransport, and TURN. + +Untrusted parties: + +- Unauthenticated network clients, against every HTTP, WebSocket, WebTransport, + TURN, and UDP/TCP media port. +- Participants holding a valid token for one room. Their signalling messages, + SDP, ICE candidates, RTP/RTCP, data-channel packets, metadata, and attributes + are untrusted. +- Holders of tokens with restricted grants (subscribe-only, no data publish, + hidden, limited `canPublishSources`, and similar). + +Trusted: the operator, the server config file, the API secret, and redis. +Treat a compromised redis or a leaked API secret as out of scope. + +`pion/dtls` is enrolled separately. Report DTLS bugs there, unless LiveKit +misuses the library. + +## Security properties + +- **Token and grant enforcement:** a token for one room must not reach another + room. Grants must be enforced on every signalling path, including permission + updates pushed after join. A participant must not impersonate another identity + or act on another participant's tracks. +- **Media and data isolation:** a participant must not receive tracks or data + packets they are not subscribed to or permitted to see. Data packets with + destination identities must reach only those identities. +- **TURN:** relay allocations must not reach arbitrary hosts or ports beyond the + configured relay policy. +- **Parsing:** SDP, RTP header extensions, RTCP, codec payload munging, and + protobuf signalling must not panic, corrupt state, or read out of bounds on + malformed input. +- **Resource use:** one participant or unauthenticated client must not exhaust + memory, goroutines, or CPU for the whole process. + +## Severity guidance + +- **Critical:** unauthenticated remote code execution, or an authentication or + room-isolation bypass that needs no valid token. +- **High:** cross-room or cross-participant access to media or data, privilege + escalation beyond the token's grants, or a remote crash of the whole process + that needs at most an ordinary participant token. +- **Medium:** denial of service that takes significant traffic, or affects only + the attacker's own room. Information leaks of metadata. +- **Low / not a finding:** a participant degrading their own session; behavior + needing the API secret, operator config, or redis access; bandwidth estimation + or quality tuning; packet loss and reordering handled as designed. + +## Testing + +The checkout is at `/src`. The server binary is at `/usr/local/bin/livekit-server`. +Go dependencies are cached. `GOPROXY=off` and `GOSUMDB=off` prevent downloads. +Tests expect redis on `localhost:6379`. Start it first. No docker daemon is +available, so pass `-docker=false` to `pkg/service`. + +```sh +cd /src +redis-server --daemonize yes +go test -count=1 $(go list ./... | grep -v '/pkg/service$') +go test -count=1 ./pkg/service -docker=false +go test -race -count=1 ./pkg/rtc/... ./pkg/sfu/... +``` + +`test/` holds end-to-end tests that run real server instances against local +clients. Use them for signalling or permission reproducers. Use unit tests in +the affected package for parsing bugs. + +## Reports + +State the attacker's required access (none, any valid token, or a specific +grant), the entry point, and the demonstrated impact. Provide a minimal +reproducer, preferably a Go test.