WebRTC. Does server or another peer see my internal IP address? - webrtc

Question

Is it possible to get user internal IP address by using WebRTC in browser.
Here browserleaks webrtc I can see my Local IP address but this address was extracted on client side via JS script.
Here is minimal JS example how to achieve this
window.RTCPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection; //compatibility for firefox and chrome
var pc = new RTCPeerConnection({iceServers:[]}), noop = function(){};
pc.createDataChannel(""); //create a bogus data channel
pc.createOffer(pc.setLocalDescription.bind(pc), noop); // create offer and set local description
pc.onicecandidate = function(ice){ //listen for candidate events
if(!ice || !ice.candidate || !ice.candidate.candidate) return;
var myIP = /([0-9]{1,3}(\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/.exec(ice.candidate.candidate)[1];
document.querySelector('#output').innerHTML=myIP
//console.log('my IP: ', myIP);
pc.onicecandidate = noop;
};
<div id="output">
</div>
As we can see in code we extract ip from onicecandidate event.
If we will look at WebRTC connection flow we can see that ICE candidates exchanges between peers via signal Channel
So is this possible for STUN/TURN server to get information of internal IP address? (I doubt this is possible, but just to check)
Does specially crafted peer client able to get internal IP address of another peer during connection phase or when it exchange ICE candidates with another peer ?
The question is mostly about security concern

Answer 1

Your flow looks right and secure under certain assumptions:
The browser supports Trickle ICE mechanism (all modern browsers do support)
You don't wait for ice gathering to be complete before sending the SDP
You send the SDP from createOffer/createAnswer method, instead of RTCPeerConnection.localDescription.
If the browser does not support ICE trickle, it's disabled by the code or if you wait for ice gathering to be completed. The candidates will be added also to the local SDP which might still expose your internal IP.
Here is the working snippet for current chrome (v73):
const canvas = document.createElement('canvas');
const track = canvas.captureStream(1).getTracks()[0];
const pc = new RTCPeerConnection();
pc.addTrack(track);
pc.createOffer().then(offer => pc.setLocalDescription(offer))
pc.onicecandidate = () => {};
pc.onicegatheringstatechange = () => {
if(pc.iceGatheringState === 'complete') {
const sdp = pc.localDescription.sdp;
const sdpRows = sdp.split('\n')
const candidates = sdpRows.filter(row => row.indexOf('a=candidate') === 0);
console.log(candidates)
}
}