@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/cjs/lib/peer/transport/dtls.d.ts

@@ -0,0 +1,95 @@
+import { Event } from '../imports/common.js';
+import { type DtlsSocket, type SignatureHash } from '../imports/dtls.js';
+import { type RtcpPacket, type RtpHeader, RtpPacket, SrtcpSession, type SrtpProfile, SrtpSession } from '../imports/rtp.js';
+import { type RTCStats } from '../media/stats.js';
+import { ReceiverTWCC } from '../media/receiver/receiverTwcc.js';
+import { SenderBandwidthEstimator } from '../media/sender/senderBWE.js';
+import type { DebugConfig } from '../peerConnection.js';
+import type { RTCIceTransport } from './ice.js';
+export interface DtlsTransportStats {
+    bytesSent: number;
+    bytesReceived: number;
+    packetsSent: number;
+    packetsReceived: number;
+}
+export declare class RTCDtlsTransport implements DtlsTransportStats {
+    #private;
+    readonly config: {
+        debug?: DebugConfig;
+    };
+    readonly iceTransport: RTCIceTransport;
+    localCertificate?: RTCCertificate | undefined;
+    private readonly srtpProfiles;
+    id: string;
+    state: DtlsState;
+    role: DtlsRole;
+    srtpStarted: boolean;
+    transportSequenceNumber: number;
+    /**The feedback of the packets received with a transport-wide sequence number (of all the streams)*/
+    readonly receiverTWCC: ReceiverTWCC;
+    /**The bandwidth estimated from the feedback of the packets sent with one*/
+    readonly senderBWE: SenderBandwidthEstimator;
+    bytesSent: number;
+    bytesReceived: number;
+    packetsSent: number;
+    packetsReceived: number;
+    dataReceiver: (buf: Buffer) => void;
+    dtls?: DtlsSocket;
+    srtp: SrtpSession;
+    srtcp: SrtcpSession;
+    readonly onStateChange: Event<["connected" | "failed" | "closed" | "connecting" | "new"]>;
+    readonly onRtcp: Event<[RtcpPacket]>;
+    readonly onRtp: Event<[RtpPacket]>;
+    private readonly events;
+    onstatechange?: () => void;
+    static localCertificate?: RTCCertificate;
+    static localCertificatePromise?: Promise<RTCCertificate>;
+    private remoteParameters?;
+    constructor(config: {
+        debug?: DebugConfig;
+    }, iceTransport: RTCIceTransport, localCertificate?: RTCCertificate | undefined, srtpProfiles?: SrtpProfile[]);
+    addEventListener: (type: string, listener: (...args: any[]) => void, options?: boolean | {
+        once?: boolean;
+    }) => void;
+    removeEventListener: (type: string, listener: (...args: any[]) => void) => void;
+    dispatchEvent: (event: globalThis.Event) => boolean;
+    get localParameters(): RTCDtlsParameters;
+    static SetupCertificate(): Promise<RTCCertificate>;
+    setRemoteParams(remoteParameters: RTCDtlsParameters): void;
+    start(): Promise<void>;
+    private verifyRemoteCertificateFingerprint;
+    updateSrtpSession(): void;
+    startSrtp(): void;
+    readonly sendData: (data: Buffer) => Promise<void>;
+    sendRtp(payload: Buffer, header: RtpHeader): Promise<number>;
+    sendRtcp(packets: RtcpPacket[]): Promise<number | undefined>;
+    private setState;
+    stop(): Promise<void>;
+    getStats(timestamp?: number): Promise<RTCStats[]>;
+}
+export declare const DtlsStates: readonly ["new", "connecting", "connected", "closed", "failed"];
+export type DtlsState = (typeof DtlsStates)[number];
+export type DtlsRole = 'auto' | 'server' | 'client';
+export declare class RTCCertificate {
+    certPem: string;
+    signatureHash: SignatureHash;
+    publicKey: string;
+    privateKey: string;
+    constructor(privateKeyPem: string, certPem: string, signatureHash: SignatureHash);
+    getFingerprints(): RTCDtlsFingerprint[];
+}
+export type DtlsKeys = {
+    certPem: string;
+    keyPem: string;
+    signatureHash: SignatureHash;
+};
+export declare class RTCDtlsFingerprint {
+    algorithm: string;
+    value: string;
+    constructor(algorithm: string, value: string);
+}
+export declare class RTCDtlsParameters {
+    fingerprints: RTCDtlsFingerprint[];
+    role: 'auto' | 'client' | 'server';
+    constructor(fingerprints: RTCDtlsFingerprint[] | undefined, role: 'auto' | 'client' | 'server');
+}

package/dist/cjs/lib/peer/transport/dtls.js

@@ -0,0 +1,571 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RTCDtlsParameters = exports.RTCDtlsFingerprint = exports.RTCCertificate = exports.DtlsStates = exports.RTCDtlsTransport = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_js_1 = require("../imports/common.js");
+const helper_js_1 = require("../helper.js");
+const dtls_js_1 = require("../imports/dtls.js");
+const rtp_js_1 = require("../imports/rtp.js");
+const stats_js_1 = require("../media/stats.js");
+const receiverTwcc_js_1 = require("../media/receiver/receiverTwcc.js");
+const senderBWE_js_1 = require("../media/sender/senderBWE.js");
+const utils_js_1 = require("../utils.js");
+const log = (0, rtp_js_1.debug)('webrtc/peer/transport/dtls');
+/**
+ * A packet not sent: lost as on the network (one function for all the packets)
+ */
+const ignoreSendFailure = () => undefined;
+function formatDtlsVersion(version) {
+    if (!version) {
+        return;
+    }
+    if (version.major === 0xfe && version.minor === 0xfd) {
+        return 'DTLS 1.2';
+    }
+    if (version.major === 0xfe && version.minor === 0xff) {
+        return 'DTLS 1.0';
+    }
+}
+function formatSrtpCipher(profile) {
+    switch (profile) {
+        case 0x0001:
+            return 'AES_CM_128_HMAC_SHA1_80';
+        case 0x0007:
+            return 'AEAD_AES_128_GCM';
+        default:
+            return;
+    }
+}
+class RTCDtlsTransport {
+    //Takes the DTLS records from ICE from the start, so that none is lost before the handshake begins
+    #iceAdapter;
+    //The handshake, once started
+    #starting;
+    constructor(config, iceTransport, localCertificate, srtpProfiles = []) {
+        this.config = config;
+        this.iceTransport = iceTransport;
+        this.localCertificate = localCertificate;
+        this.srtpProfiles = srtpProfiles;
+        this.id = (0, node_crypto_1.randomUUID)().toString();
+        this.state = 'new';
+        this.role = 'auto';
+        this.srtpStarted = false;
+        this.transportSequenceNumber = 0;
+        /**The feedback of the packets received with a transport-wide sequence number (of all the streams)*/
+        this.receiverTWCC = new receiverTwcc_js_1.ReceiverTWCC(this);
+        /**The bandwidth estimated from the feedback of the packets sent with one*/
+        this.senderBWE = new senderBWE_js_1.SenderBandwidthEstimator();
+        // Statistics tracking
+        this.bytesSent = 0;
+        this.bytesReceived = 0;
+        this.packetsSent = 0;
+        this.packetsReceived = 0;
+        this.dataReceiver = () => { };
+        this.onStateChange = new common_js_1.Event();
+        this.onRtcp = new common_js_1.Event();
+        this.onRtp = new common_js_1.Event();
+        this.events = new helper_js_1.EventTarget();
+        this.addEventListener = (type, listener, options) => {
+            this.events.addEventListener(type, listener, options);
+        };
+        this.removeEventListener = (type, listener) => {
+            this.events.removeEventListener(type, listener);
+        };
+        this.dispatchEvent = (event) => this.events.dispatchEvent(event);
+        this.sendData = async (data) => {
+            if (this.config.debug?.outboundPacketLoss &&
+                this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+                return;
+            }
+            if (!this.dtls) {
+                throw new Error('dtls not established');
+            }
+            await this.dtls.send(data);
+        };
+        this.localCertificate ??= RTCDtlsTransport.localCertificate;
+        this.#iceAdapter = createIceTransport(iceTransport.connection);
+    }
+    get localParameters() {
+        return new RTCDtlsParameters(this.localCertificate ? this.localCertificate.getFingerprints() : [], this.role);
+    }
+    static async SetupCertificate() {
+        if (this.localCertificate) {
+            return this.localCertificate;
+        }
+        if (this.localCertificatePromise) {
+            return this.localCertificatePromise;
+        }
+        this.localCertificatePromise = (async () => {
+            const { certPem, keyPem, signatureHash } = await dtls_js_1.CipherContext.createSelfSignedCertificateWithKey({
+                signature: dtls_js_1.SignatureAlgorithm.ecdsa_3,
+                hash: dtls_js_1.HashAlgorithm.sha256_4
+            }, dtls_js_1.NamedCurveAlgorithm.secp256r1_23);
+            this.localCertificate = new RTCCertificate(keyPem, certPem, signatureHash);
+            return this.localCertificate;
+        })();
+        return this.localCertificatePromise;
+    }
+    setRemoteParams(remoteParameters) {
+        const fingerprints = deduplicateFingerprints([
+            ...(this.remoteParameters?.fingerprints ?? []),
+            ...remoteParameters.fingerprints
+        ]);
+        const role = remoteParameters.role === 'auto' && this.remoteParameters?.role
+            ? this.remoteParameters.role
+            : remoteParameters.role;
+        this.remoteParameters = new RTCDtlsParameters(fingerprints, role);
+    }
+    async start() {
+        //Started already (a description applied again before DTLS connects): the same handshake
+        if (this.#starting) {
+            return await this.#starting;
+        }
+        if (this.state !== 'new') {
+            throw new Error('state must be new');
+        }
+        this.#starting = this.#start();
+        await this.#starting;
+    }
+    /**
+     * Run the handshake
+     */
+    async #start() {
+        if (!this.remoteParameters ||
+            this.remoteParameters.fingerprints.length === 0) {
+            throw new Error('remote fingerprint not exist');
+        }
+        if (this.role === 'auto') {
+            if (this.iceTransport.role === 'controlling') {
+                this.role = 'server';
+            }
+            else {
+                this.role = 'client';
+            }
+        }
+        this.setState('connecting');
+        await new Promise((r, f) => {
+            if (this.role === 'server') {
+                this.dtls = new dtls_js_1.DtlsServer({
+                    cert: this.localCertificate?.certPem,
+                    key: this.localCertificate?.privateKey,
+                    signatureHash: this.localCertificate?.signatureHash,
+                    transport: this.#iceAdapter,
+                    srtpProfiles: this.srtpProfiles,
+                    extendedMasterSecret: true,
+                    certificateRequest: true
+                });
+            }
+            else {
+                this.dtls = new dtls_js_1.DtlsClient({
+                    cert: this.localCertificate?.certPem,
+                    key: this.localCertificate?.privateKey,
+                    signatureHash: this.localCertificate?.signatureHash,
+                    transport: this.#iceAdapter,
+                    srtpProfiles: this.srtpProfiles,
+                    extendedMasterSecret: true
+                });
+            }
+            this.dtls.onData.subscribe((buf) => {
+                if (this.config.debug?.inboundPacketLoss &&
+                    this.config.debug?.inboundPacketLoss / 100 < Math.random()) {
+                    return;
+                }
+                this.dataReceiver(buf);
+            });
+            this.dtls.onClose.subscribe(() => {
+                if (this.state !== 'failed') {
+                    this.setState('closed');
+                }
+            });
+            this.dtls.onConnect.once(r);
+            this.dtls.onError.once((error) => {
+                this.setState('failed');
+                log('dtls failed', error);
+                f(error);
+            });
+            //The server keeps the records arriving early (IceTransport): the client starts at once
+            if (this.dtls instanceof dtls_js_1.DtlsClient) {
+                this.dtls.connect().catch((error) => {
+                    this.setState('failed');
+                    log('dtls connect failed', error);
+                    f(error);
+                });
+            }
+        });
+        try {
+            this.verifyRemoteCertificateFingerprint();
+        }
+        catch (error) {
+            this.setState('failed');
+            this.dtls?.close();
+            throw error;
+        }
+        if (this.srtpProfiles.length > 0) {
+            this.startSrtp();
+        }
+        this.setState('connected');
+        log('dtls connected');
+    }
+    verifyRemoteCertificateFingerprint() {
+        if (!this.remoteParameters ||
+            this.remoteParameters.fingerprints.length === 0) {
+            throw new Error('remote fingerprint not exist');
+        }
+        const remoteCertificate = this.dtls?.remoteCertificate;
+        if (!remoteCertificate) {
+            throw new Error('remote certificate not available');
+        }
+        const supportedFingerprints = this.remoteParameters.fingerprints.flatMap(({ algorithm, value }) => {
+            const normalizedAlgorithm = (0, utils_js_1.normalizeFingerprintAlgorithm)(algorithm);
+            if (!normalizedAlgorithm) {
+                return [];
+            }
+            const normalizedValue = (0, utils_js_1.normalizeFingerprintValue)(value);
+            if (!normalizedValue) {
+                throw new Error('remote fingerprint value is empty');
+            }
+            return [{ normalizedAlgorithm, normalizedValue }];
+        });
+        if (supportedFingerprints.length === 0) {
+            throw new Error('no supported remote fingerprint algorithms');
+        }
+        const preferredAlgorithm = selectPreferredFingerprintAlgorithm(supportedFingerprints);
+        const expectedFingerprints = supportedFingerprints.filter(({ normalizedAlgorithm }) => normalizedAlgorithm === preferredAlgorithm);
+        const actualFingerprints = expectedFingerprints.reduce((acc, { normalizedAlgorithm }) => {
+            if (!acc.has(normalizedAlgorithm)) {
+                acc.set(normalizedAlgorithm, (0, utils_js_1.normalizeFingerprintValue)((0, utils_js_1.fingerprint)(remoteCertificate, normalizedAlgorithm)));
+            }
+            return acc;
+        }, new Map());
+        const matched = expectedFingerprints.some(({ normalizedAlgorithm, normalizedValue }) => actualFingerprints.get(normalizedAlgorithm) === normalizedValue);
+        if (!matched) {
+            throw new Error('remote certificate fingerprint mismatch');
+        }
+    }
+    updateSrtpSession() {
+        if (!this.dtls)
+            throw new Error();
+        const profile = this.dtls.srtp.srtpProfile;
+        if (!profile) {
+            throw new Error('need srtpProfile');
+        }
+        log('selected SRTP Profile', profile);
+        const { localKey, localSalt, remoteKey, remoteSalt } = this.dtls.extractSessionKeys((0, rtp_js_1.keyLength)(profile), (0, rtp_js_1.saltLength)(profile));
+        const config = {
+            keys: {
+                localMasterKey: localKey,
+                localMasterSalt: localSalt,
+                remoteMasterKey: remoteKey,
+                remoteMasterSalt: remoteSalt
+            },
+            profile
+        };
+        this.srtp = new rtp_js_1.SrtpSession(config);
+        this.srtcp = new rtp_js_1.SrtcpSession(config);
+    }
+    startSrtp() {
+        if (this.srtpStarted)
+            return;
+        this.srtpStarted = true;
+        this.updateSrtpSession();
+        this.iceTransport.connection.onData.subscribe((data) => {
+            if (this.config.debug?.inboundPacketLoss &&
+                this.config.debug?.inboundPacketLoss / 100 < Math.random()) {
+                return;
+            }
+            if (!(0, rtp_js_1.isMedia)(data))
+                return;
+            // Track received data statistics
+            this.bytesReceived += data.length;
+            this.packetsReceived++;
+            if ((0, rtp_js_1.isRtcp)(data)) {
+                let dec;
+                try {
+                    dec = this.srtcp.decrypt(data);
+                }
+                catch (error) {
+                    if (error instanceof rtp_js_1.SrtpAuthenticationError) {
+                        log('dropping invalid SRTCP packet', error);
+                        return;
+                    }
+                    throw error;
+                }
+                let rtcpPackets;
+                try {
+                    rtcpPackets = rtp_js_1.RtcpPacketConverter.deSerialize(dec);
+                }
+                catch (error) {
+                    log('dropping malformed SRTCP packet', error);
+                    return;
+                }
+                for (const rtcp of rtcpPackets) {
+                    try {
+                        //The transport-wide feedback is the one of the packets of all the senders
+                        if (rtcp instanceof rtp_js_1.RtcpTransportLayerFeedback && rtcp.feedback instanceof rtp_js_1.TransportWideCC) {
+                            this.senderBWE.receiveTWCC(rtcp.feedback);
+                            continue;
+                        }
+                        this.onRtcp.execute(rtcp);
+                    }
+                    catch (error) {
+                        log('RTCP error', error);
+                    }
+                }
+            }
+            else {
+                let dec;
+                try {
+                    dec = this.srtp.decrypt(data);
+                }
+                catch (error) {
+                    if (error instanceof rtp_js_1.SrtpAuthenticationError) {
+                        log('dropping invalid SRTP packet', error);
+                        return;
+                    }
+                    throw error;
+                }
+                let rtp;
+                try {
+                    rtp = rtp_js_1.RtpPacket.deSerialize(dec);
+                }
+                catch (error) {
+                    log('dropping malformed SRTP packet', error);
+                    return;
+                }
+                try {
+                    this.onRtp.execute(rtp);
+                }
+                catch (error) {
+                    log('RTP error', error);
+                }
+            }
+        });
+    }
+    async sendRtp(payload, header) {
+        try {
+            const enc = this.srtp.encrypt(payload, header);
+            if (this.config.debug?.outboundPacketLoss &&
+                this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+                return enc.length;
+            }
+            // Track statistics
+            this.bytesSent += enc.length;
+            this.packetsSent++;
+            await this.iceTransport.connection.send(enc).catch(ignoreSendFailure);
+            return enc.length;
+        }
+        catch (error) {
+            log('failed to send', error);
+            return 0;
+        }
+    }
+    async sendRtcp(packets) {
+        //Before SRTP starts (a transport not connected yet, such as the one of a transceiver not bundled yet): as sendRtp
+        if (!this.srtcp) {
+            return;
+        }
+        const payload = Buffer.concat(packets.map((packet) => packet.serialize()));
+        const enc = this.srtcp.encrypt(payload);
+        if (this.config.debug?.outboundPacketLoss &&
+            this.config.debug?.outboundPacketLoss / 100 < Math.random()) {
+            return enc.length;
+        }
+        // Track statistics
+        this.bytesSent += enc.length;
+        this.packetsSent++;
+        await this.iceTransport.connection.send(enc).catch(() => { });
+    }
+    setState(state, emitEvent = true) {
+        if (state != this.state) {
+            this.state = state;
+            if (state === 'closed' || state === 'failed')
+                this.receiverTWCC.stop();
+            this.onStateChange.execute(state);
+            if (emitEvent) {
+                this.onstatechange?.();
+                this.events.emit('statechange');
+            }
+        }
+    }
+    async stop() {
+        this.setState('closed', false);
+        // todo impl send alert
+        //A handshake in progress stops sending its flights again
+        this.dtls?.close();
+        await this.iceTransport.stop();
+    }
+    async getStats(timestamp = (0, stats_js_1.getStatsTimestamp)()) {
+        const stats = [];
+        const transportId = (0, stats_js_1.generateStatsId)('transport', this.id);
+        // Transport stats
+        const transportStats = {
+            type: 'transport',
+            id: transportId,
+            timestamp,
+            bytesSent: this.bytesSent,
+            bytesReceived: this.bytesReceived,
+            packetsSent: this.packetsSent,
+            packetsReceived: this.packetsReceived,
+            dtlsState: this.state,
+            iceState: this.iceTransport.state,
+            iceRole: this.iceTransport.role === 'unknown'
+                ? undefined
+                : this.iceTransport.role,
+            iceLocalUsernameFragment: this.iceTransport.localParameters.usernameFragment,
+            selectedCandidatePairId: this.iceTransport.connection.nominated
+                ? (0, stats_js_1.generateStatsId)('candidate-pair', this.iceTransport.connection.nominated.id)
+                : undefined,
+            localCertificateId: this.localCertificate
+                ? (0, stats_js_1.generateStatsId)('certificate', this.id, 'local')
+                : undefined,
+            remoteCertificateId: this.dtls?.remoteCertificate
+                ? (0, stats_js_1.generateStatsId)('certificate', this.id, 'remote')
+                : undefined,
+            dtlsRole: this.role === 'auto' ? undefined : this.role,
+            tlsVersion: formatDtlsVersion(this.dtls?.dtls.version),
+            dtlsCipher: this.dtls?.cipher.cipher?.name,
+            srtpCipher: formatSrtpCipher(this.dtls?.srtp.srtpProfile),
+            iceRestarts: this.iceTransport.iceRestarts
+        };
+        stats.push(transportStats);
+        // Certificate stats
+        if (this.localCertificate) {
+            const fingerprints = this.localCertificate.getFingerprints();
+            if (fingerprints.length > 0) {
+                const certStats = {
+                    type: 'certificate',
+                    id: (0, stats_js_1.generateStatsId)('certificate', this.id, 'local'),
+                    timestamp,
+                    fingerprint: fingerprints[0].value,
+                    fingerprintAlgorithm: fingerprints[0].algorithm,
+                    base64Certificate: Buffer.from(this.localCertificate.certPem).toString('base64')
+                };
+                stats.push(certStats);
+            }
+        }
+        if (this.remoteParameters &&
+            this.remoteParameters.fingerprints.length > 0 &&
+            this.dtls?.remoteCertificate) {
+            const certStats = {
+                type: 'certificate',
+                id: (0, stats_js_1.generateStatsId)('certificate', this.id, 'remote'),
+                timestamp,
+                fingerprint: this.remoteParameters.fingerprints[0].value,
+                fingerprintAlgorithm: this.remoteParameters.fingerprints[0].algorithm,
+                base64Certificate: Buffer.from(this.dtls.remoteCertificate).toString('base64')
+            };
+            stats.push(certStats);
+        }
+        // Get ICE stats
+        const iceStats = await this.iceTransport.getStats(timestamp, transportId);
+        stats.push(...iceStats);
+        return stats;
+    }
+}
+exports.RTCDtlsTransport = RTCDtlsTransport;
+exports.DtlsStates = [
+    'new',
+    'connecting',
+    'connected',
+    'closed',
+    'failed'
+];
+class RTCCertificate {
+    constructor(privateKeyPem, certPem, signatureHash) {
+        this.certPem = certPem;
+        this.signatureHash = signatureHash;
+        this.publicKey = new node_crypto_1.X509Certificate(certPem).publicKey.export({ type: 'spki', format: 'pem' });
+        this.privateKey = (0, node_crypto_1.createPrivateKey)(privateKeyPem).export({ type: 'pkcs8', format: 'pem' });
+    }
+    getFingerprints() {
+        return [
+            new RTCDtlsFingerprint('sha-256', (0, utils_js_1.fingerprint)((0, dtls_js_1.certificateDer)(this.certPem), 'sha256'))
+        ];
+    }
+}
+exports.RTCCertificate = RTCCertificate;
+class RTCDtlsFingerprint {
+    constructor(algorithm, value) {
+        this.algorithm = algorithm;
+        this.value = value;
+    }
+}
+exports.RTCDtlsFingerprint = RTCDtlsFingerprint;
+class RTCDtlsParameters {
+    constructor(fingerprints = [], role) {
+        this.fingerprints = fingerprints;
+        this.role = role;
+    }
+}
+exports.RTCDtlsParameters = RTCDtlsParameters;
+const deduplicateFingerprints = (fingerprints) => {
+    const seen = new Set();
+    return fingerprints.filter(({ algorithm, value }) => {
+        const key = `${(0, utils_js_1.normalizeFingerprintAlgorithm)(algorithm) ?? algorithm.trim().toLowerCase()}:${(0, utils_js_1.normalizeFingerprintValue)(value)}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+};
+const preferredFingerprintAlgorithms = [
+    'sha512',
+    'sha384',
+    'sha256',
+    'sha224',
+    'sha1'
+];
+const selectPreferredFingerprintAlgorithm = (fingerprints) => {
+    return (preferredFingerprintAlgorithms.find((algorithm) => fingerprints.some(({ normalizedAlgorithm }) => normalizedAlgorithm === algorithm)) ?? fingerprints[0].normalizedAlgorithm);
+};
+class IceTransport {
+    //The DTLS records arriving before the DTLS socket takes them (the peer's ClientHello, sent as soon as its ICE
+    //connected) wait here, a few at most, and go to the socket when it sets its handler
+    #early;
+    #onData;
+    constructor(ice) {
+        this.ice = ice;
+        this.closed = false;
+        //The DTLS records arriving before the DTLS socket takes them (the peer's ClientHello, sent as soon as its ICE
+        //connected) wait here, a few at most, and go to the socket when it sets its handler
+        this.#early = [];
+        this.type = 'ice';
+        this.send = (data) => {
+            return this.ice.send(data);
+        };
+        ice.onData.subscribe((buf) => {
+            if (!(0, utils_js_1.isDtls)(buf))
+                return;
+            if (this.#onData)
+                this.#onData(buf);
+            else if (this.#early && this.#early.length < 16)
+                this.#early.push(buf);
+        });
+    }
+    get onData() {
+        return this.#onData ?? (() => undefined);
+    }
+    set onData(handler) {
+        const early = this.#early;
+        if (!early) {
+            this.#onData = handler;
+            return;
+        }
+        //The DTLS socket sets its handler in its constructor: the early records go to it once the construction ends
+        //(the records arriving meanwhile join them, in order)
+        queueMicrotask(() => {
+            this.#early = undefined;
+            this.#onData = handler;
+            early.forEach((buf) => handler(buf));
+        });
+    }
+    get address() {
+        return {};
+    }
+    async close() {
+        this.closed = true;
+        (0, common_js_1.runDetached)(() => this.ice.close(), (error) => log('close failed', error));
+    }
+}
+const createIceTransport = (ice) => new IceTransport(ice);