@libp2p/webrtc 6.0.27-e86b39e5d → 6.0.28

package/src/muxer.ts

@@ -1,8 +1,8 @@
 import { AbstractStreamMuxer } from '@libp2p/utils'
-import { MUXER_PROTOCOL } from './constants.ts'
+import { DEFAULT_MAX_EARLY_STREAMS, MAX_EARLY_DATA_CHANNEL_BYTES, MAX_EARLY_DATA_CHANNEL_MESSAGES, MUXER_PROTOCOL } from './constants.ts'
 import { createStream, WebRTCStream } from './stream.ts'
 import type { DataChannelOptions } from './index.ts'
-import type { ComponentLogger, CounterGroup, StreamMuxer, StreamMuxerFactory, CreateStreamOptions, MultiaddrConnection } from '@libp2p/interface'
+import type { ComponentLogger, CounterGroup, Logger, StreamMuxer, StreamMuxerFactory, CreateStreamOptions, MultiaddrConnection } from '@libp2p/interface'
 
 export interface DataChannelMuxerFactoryInit {
   /**
@@ -20,6 +20,18 @@ export interface DataChannelMuxerFactoryInit {
    */
   metrics?: CounterGroup
 
+  /**
+   * Optional logger, used to report early data channels that are dropped or
+   * rejected, and best-effort close errors
+   */
+  log?: Logger
+
+  /**
+   * Caps the early data channel buffer and the muxer's early streams from one
+   * value (see `DEFAULT_MAX_EARLY_STREAMS`)
+   */
+  maxEarlyStreams?: number
+
   /**
    * Options used to create data channels
    */
@@ -30,6 +42,41 @@ export interface DataChannelMuxerFactoryComponents {
   logger: ComponentLogger
 }
 
+interface EarlyDataChannel {
+  channel: RTCDataChannel
+
+  /**
+   * Messages buffered before the muxer adopted the channel; without these they
+   * would be dropped, since the stream's `message` listener is only attached
+   * when the muxer is created
+   */
+  messages: Array<MessageEvent<ArrayBuffer>>
+}
+
+/**
+ * Close a data channel. Closing is best-effort and wrapped so a synchronous
+ * throw from an already-closed or stale channel cannot escape and abort
+ * disposal of the remaining early channels.
+ */
+function closeChannel (channel: RTCDataChannel, log?: Logger): void {
+  try {
+    channel.close()
+  } catch (err) {
+    log?.trace('error closing early data channel - %e', err)
+  }
+}
+
+/**
+ * Detach the buffering handler, release the buffered messages and close the
+ * channel. Used both when disposing a single over-limit channel and when
+ * discarding the whole early buffer.
+ */
+function disposeEarlyDataChannel (early: EarlyDataChannel, log?: Logger): void {
+  early.channel.onmessage = null
+  early.messages.length = 0
+  closeChannel(early.channel, log)
+}
+
 export class DataChannelMuxerFactory implements StreamMuxerFactory {
   public readonly protocol: string
 
@@ -38,25 +85,90 @@ export class DataChannelMuxerFactory implements StreamMuxerFactory {
    */
   private readonly peerConnection: RTCPeerConnection
   private readonly metrics?: CounterGroup
+  private readonly log?: Logger
   private readonly dataChannelOptions?: DataChannelOptions
-  private readonly earlyDataChannels: RTCDataChannel[]
+  private readonly maxEarlyStreams: number
+  private readonly earlyDataChannels: EarlyDataChannel[]
+  private handedOff = false
 
   constructor (init: DataChannelMuxerFactoryInit) {
     this.onEarlyDataChannel = this.onEarlyDataChannel.bind(this)
 
     this.peerConnection = init.peerConnection
     this.metrics = init.metrics
+    this.log = init.log
     this.protocol = init.protocol ?? MUXER_PROTOCOL
     this.dataChannelOptions = init.dataChannelOptions ?? {}
+    this.maxEarlyStreams = init.maxEarlyStreams ?? DEFAULT_MAX_EARLY_STREAMS
     this.peerConnection.addEventListener('datachannel', this.onEarlyDataChannel)
     this.earlyDataChannels = []
   }
 
   private onEarlyDataChannel (evt: RTCDataChannelEvent): void {
-    this.earlyDataChannels.push(evt.channel)
+    const channel = evt.channel
+
+    // reject (don't buffer) channels beyond the count cap, keeping the connection
+    if (this.earlyDataChannels.length >= this.maxEarlyStreams) {
+      this.log?.('rejecting early data channel %d - too many early channels', channel.id)
+      this.metrics?.increment({ early_data_channel_count_exceeded: true })
+      closeChannel(channel, this.log)
+      return
+    }
+
+    // deliver binary as ArrayBuffer so it can be sized and replayed to the stream
+    channel.binaryType = 'arraybuffer'
+
+    const early: EarlyDataChannel = {
+      channel,
+      messages: []
+    }
+
+    // buffer until the muxer adopts the channel, bounded so a remote cannot hold
+    // unbounded data pre-admission. Must stay on `.onmessage` so `createStream`
+    // can overwrite it on adoption (see stream.ts)
+    channel.onmessage = (messageEvent) => {
+      const { data } = messageEvent
+
+      // text frames arrive as strings despite binaryType - can't size them, reject
+      if (!(data instanceof ArrayBuffer)) {
+        this.closeEarlyDataChannel(early, 'invalid_message')
+        return
+      }
+
+      // cap count too, else a flood of ~0-byte messages evades the byte cap
+      if (early.messages.length >= MAX_EARLY_DATA_CHANNEL_MESSAGES) {
+        this.closeEarlyDataChannel(early, 'message_count_exceeded')
+        return
+      }
+
+      const buffered = early.messages.reduce((total, m) => total + m.data.byteLength, 0)
+      if (buffered + data.byteLength > MAX_EARLY_DATA_CHANNEL_BYTES) {
+        this.closeEarlyDataChannel(early, 'byte_count_exceeded')
+        return
+      }
+
+      early.messages.push(messageEvent)
+    }
+
+    this.earlyDataChannels.push(early)
+  }
+
+  private closeEarlyDataChannel (early: EarlyDataChannel, reason: string): void {
+    this.log?.('closing early data channel %d - %s', early.channel.id, reason)
+    this.metrics?.increment({ [`early_data_channel_${reason}`]: true })
+
+    disposeEarlyDataChannel(early, this.log)
+
+    const index = this.earlyDataChannels.indexOf(early)
+    if (index !== -1) {
+      this.earlyDataChannels.splice(index, 1)
+    }
   }
 
   createStreamMuxer (maConn: MultiaddrConnection): StreamMuxer {
+    // ownership of the buffered early channels transfers to the muxer, so a
+    // later `close()` from the transport must not dispose them
+    this.handedOff = true
     this.peerConnection.removeEventListener('datachannel', this.onEarlyDataChannel)
 
     return new DataChannelMuxer(maConn, {
@@ -64,19 +176,41 @@ export class DataChannelMuxerFactory implements StreamMuxerFactory {
       dataChannelOptions: this.dataChannelOptions,
       metrics: this.metrics,
       protocol: this.protocol,
+      maxEarlyStreams: this.maxEarlyStreams,
       earlyDataChannels: this.earlyDataChannels
     })
   }
+
+  /**
+   * Discards any early data channels buffered before the muxer was created and
+   * detaches the `datachannel` listener. Called by the transport whenever
+   * connection establishment fails; it is a no-op once `createStreamMuxer` has
+   * handed the channels to the muxer, and otherwise ensures a peer whose
+   * connection is rejected cannot leave buffered data or listeners behind.
+   */
+  close (): void {
+    if (this.handedOff) {
+      return
+    }
+
+    this.peerConnection.removeEventListener('datachannel', this.onEarlyDataChannel)
+
+    for (const early of this.earlyDataChannels) {
+      disposeEarlyDataChannel(early, this.log)
+    }
+
+    this.earlyDataChannels.length = 0
+  }
 }
 
 export interface DataChannelMuxerInit extends DataChannelMuxerFactoryInit {
   protocol: string
 
   /**
-   * Incoming data channels that were opened by the remote before the peer
-   * connection was established
+   * Incoming data channels opened by the remote before the muxer was created,
+   * along with the messages that arrived on them in that window
    */
-  earlyDataChannels: RTCDataChannel[]
+  earlyDataChannels: EarlyDataChannel[]
 }
 
 export interface DataChannelMuxerComponents {
@@ -112,26 +246,32 @@ export class DataChannelMuxer extends AbstractStreamMuxer<WebRTCStream> implemen
 
     queueMicrotask(() => {
       if (this.status !== 'open') {
-        init.earlyDataChannels.forEach(channel => {
-          channel.close()
+        // the connection was torn down before we could adopt these channels -
+        // detach the buffer, release it, and close the channel
+        init.earlyDataChannels.forEach((early) => {
+          disposeEarlyDataChannel(early, this.log)
         })
         return
       }
 
-      init.earlyDataChannels.forEach(channel => {
-        this.onDataChannel(channel)
+      init.earlyDataChannels.forEach(({ channel, messages }) => {
+        try {
+          this.onDataChannel(channel, messages)
+        } catch (err) {
+          this.log.error('error adopting early data channel %d - %e', channel.id, err)
+        }
       })
     })
   }
 
-  private onDataChannel (channel: RTCDataChannel): void {
+  private onDataChannel (channel: RTCDataChannel, earlyMessages?: MessageEvent[]): void {
     this.log('incoming datachannel with channel id %d, protocol %s and status %s', channel.id, channel.protocol, channel.readyState)
 
     // 'init' channel is only used during connection establishment, it is
     // closed by the initiator
     if (channel.label === 'init') {
       this.log.trace('closing init channel %d', channel.id)
-      channel.close()
+      closeChannel(channel, this.log)
 
       return
     }
@@ -144,6 +284,13 @@ export class DataChannelMuxer extends AbstractStreamMuxer<WebRTCStream> implemen
       log: this.log
     })
 
+    // replay any messages that arrived before the muxer was created - the
+    // stream has just attached its `message` handler so this preserves
+    // ordering with any messages that arrive later
+    earlyMessages?.forEach(messageEvent => {
+      channel.onmessage?.(messageEvent)
+    })
+
     this.onRemoteStream(stream)
   }
 

package/src/private-to-private/initiate-connection.ts

@@ -23,6 +23,7 @@ export interface IncomingStreamOptions extends AbortOptions {
 export interface ConnectOptions extends LoggerOptions, ProgressOptions<WebRTCDialEvents> {
   rtcConfiguration?: RTCConfiguration
   dataChannel?: DataChannelOptions
+  maxEarlyStreams?: number
   multiaddr: Multiaddr
   connectionManager: ConnectionManager
   transportManager: TransportManager
@@ -32,7 +33,7 @@ export interface ConnectOptions extends LoggerOptions, ProgressOptions<WebRTCDia
   logger: ComponentLogger
 }
 
-export async function initiateConnection ({ rtcConfiguration, dataChannel, signal, metrics, multiaddr: ma, connectionManager, transportManager, log, logger, onProgress }: ConnectOptions): Promise<{ remoteAddress: Multiaddr, peerConnection: globalThis.RTCPeerConnection, muxerFactory: DataChannelMuxerFactory }> {
+export async function initiateConnection ({ rtcConfiguration, dataChannel, maxEarlyStreams, signal, metrics, multiaddr: ma, connectionManager, transportManager, log, logger, onProgress }: ConnectOptions): Promise<{ remoteAddress: Multiaddr, peerConnection: globalThis.RTCPeerConnection, muxerFactory: DataChannelMuxerFactory }> {
   const { circuitAddress, targetPeer } = splitAddr(ma)
 
   metrics?.dialerEvents.increment({ open: true })
@@ -83,7 +84,10 @@ export async function initiateConnection ({ rtcConfiguration, dataChannel, signa
   const muxerFactory = new DataChannelMuxerFactory({
     // @ts-expect-error https://github.com/murat-dogan/node-datachannel/pull/370
     peerConnection,
-    dataChannelOptions: dataChannel
+    dataChannelOptions: dataChannel,
+    maxEarlyStreams,
+    metrics: metrics?.dialerEvents,
+    log
   })
 
   try {
@@ -216,6 +220,7 @@ export async function initiateConnection ({ rtcConfiguration, dataChannel, signa
   } catch (err: any) {
     log.error('outgoing signaling error - %e', err)
 
+    muxerFactory.close()
     peerConnection.close()
     stream.abort(err)
     throw err

package/src/private-to-private/transport.ts

@@ -31,6 +31,14 @@ export interface WebRTCTransportInit {
    * Any options here will be applied to any RTCDataChannels that are opened.
    */
   dataChannel?: DataChannelOptions
+
+  /**
+   * Caps the inbound streams accepted before the connection surfaces them, and
+   * the data channels buffered before the muxer exists (excess are closed).
+   *
+   * @default 10
+   */
+  maxEarlyStreams?: number
 }
 
 export interface WebRTCTransportComponents {
@@ -163,11 +171,13 @@ export class WebRTCTransport implements Transport<WebRTCDialEvents>, Startable {
     const { remoteAddress, peerConnection, muxerFactory } = await initiateConnection({
       rtcConfiguration: await getRtcConfiguration(this.init.rtcConfiguration),
       dataChannel: this.init.dataChannel,
+      maxEarlyStreams: this.init.maxEarlyStreams,
       multiaddr: ma,
       dataChannelOptions: this.init.dataChannel,
       signal: options.signal,
       connectionManager: this.components.connectionManager,
       transportManager: this.components.transportManager,
+      metrics: this.metrics,
       log: this.log,
       logger: this.components.logger,
       onProgress: options.onProgress
@@ -181,14 +191,24 @@ export class WebRTCTransport implements Transport<WebRTCDialEvents>, Startable {
       log: this.components.logger.forComponent('libp2p:webrtc:connection')
     })
 
-    const connection = await options.upgrader.upgradeOutbound(webRTCConn, {
-      skipProtection: true,
-      skipEncryption: true,
-      remotePeer: getRemotePeer(ma),
-      muxerFactory,
-      onProgress: options.onProgress,
-      signal: options.signal
-    })
+    let connection: Connection
+
+    try {
+      connection = await options.upgrader.upgradeOutbound(webRTCConn, {
+        skipProtection: true,
+        skipEncryption: true,
+        remotePeer: getRemotePeer(ma),
+        muxerFactory,
+        onProgress: options.onProgress,
+        signal: options.signal
+      })
+    } catch (err) {
+      // discard any early data channels buffered before the upgrade failed and
+      // close the peer connection
+      muxerFactory.close()
+      peerConnection.close()
+      throw err
+    }
 
     // close the connection on shut down
     this._closeOnShutdown(peerConnection, webRTCConn)
@@ -213,7 +233,10 @@ export class WebRTCTransport implements Transport<WebRTCDialEvents>, Startable {
     const muxerFactory = new DataChannelMuxerFactory({
       // @ts-expect-error https://github.com/murat-dogan/node-datachannel/pull/370
       peerConnection,
-      dataChannelOptions: this.init.dataChannel
+      dataChannelOptions: this.init.dataChannel,
+      maxEarlyStreams: this.init.maxEarlyStreams,
+      metrics: this.metrics?.listenerEvents,
+      log: this.log
     })
 
     try {
@@ -251,6 +274,7 @@ export class WebRTCTransport implements Transport<WebRTCDialEvents>, Startable {
     } catch (err: any) {
       this.log.error('incoming signaling error - %e', err)
 
+      muxerFactory.close()
       peerConnection.close()
       stream.abort(err)
       throw err

package/src/private-to-public/listener.ts

@@ -34,6 +34,7 @@ export interface WebRTCDirectListenerInit {
   upgrader: Upgrader
   certificate: TransportCertificate
   maxInboundStreams?: number
+  maxEarlyStreams?: number
   dataChannel?: DataChannelOptions
   rtcConfiguration?: RTCConfiguration | (() => RTCConfiguration | Promise<RTCConfiguration>)
   emitter: TypedEventTarget<WebRTCDirectTransportCertificateEvents>
@@ -189,7 +190,9 @@ export class WebRTCDirectListener extends TypedEventEmitter<ListenerEvents> impl
       rtcConfiguration: this.init.rtcConfiguration,
       certificate: this.certificate,
       events: this.metrics?.listenerEvents,
-      dataChannel: this.init.dataChannel
+      log: this.log,
+      dataChannel: this.init.dataChannel,
+      maxEarlyStreams: this.init.maxEarlyStreams
     })
     peerConnection = results.peerConnection
 

package/src/private-to-public/transport.browser.ts

@@ -39,6 +39,14 @@ export interface WebRTCTransportDirectInit {
    * The default configuration used by all created RTCDataChannels
    */
   dataChannel?: DataChannelOptions
+
+  /**
+   * Caps the inbound streams accepted before the connection surfaces them, and
+   * the data channels buffered before the muxer exists (excess are closed).
+   *
+   * @default 10
+   */
+  maxEarlyStreams?: number
 }
 
 export class WebRTCDirectTransport implements Transport {
@@ -92,7 +100,10 @@ export class WebRTCDirectTransport implements Transport {
       muxerFactory
     } = await createDialerRTCPeerConnection('client', ufrag, {
       rtcConfiguration: typeof this.init.rtcConfiguration === 'function' ? await this.init.rtcConfiguration() : this.init.rtcConfiguration ?? {},
-      dataChannel: this.init.dataChannel
+      events: this.metrics?.dialerEvents,
+      log: this.log,
+      dataChannel: this.init.dataChannel,
+      maxEarlyStreams: this.init.maxEarlyStreams
     })
 
     try {

package/src/private-to-public/utils/connect.ts

@@ -193,6 +193,8 @@ export async function connect (peerConnection: RTCPeerConnection | DirectRTCPeer
       signal: options.signal
     })
   } catch (err) {
+    // discard any early data channels buffered before the upgrade failed
+    muxerFactory.close()
     handshakeDataChannel.close()
     peerConnection.close()
 

package/src/private-to-public/utils/get-rtcpeerconnection.browser.ts

@@ -29,7 +29,9 @@ export async function createDialerRTCPeerConnection (role: 'client' | 'server',
   const muxerFactory = new DataChannelMuxerFactory({
     peerConnection,
     metrics: options.events,
-    dataChannelOptions: options.dataChannel
+    log: options.log,
+    dataChannelOptions: options.dataChannel,
+    maxEarlyStreams: options.maxEarlyStreams
   })
 
   return {

package/src/private-to-public/utils/get-rtcpeerconnection.ts

@@ -1,11 +1,13 @@
+import { InvalidParametersError } from '@libp2p/interface'
 import { Crypto } from '@peculiar/webcrypto'
 import { PeerConnection } from 'node-datachannel'
 import { RTCPeerConnection } from 'node-datachannel/polyfill'
 import { DEFAULT_ICE_SERVERS, MAX_MESSAGE_SIZE } from '../../constants.ts'
 import { DataChannelMuxerFactory } from '../../muxer.ts'
+import { isValidUfrag } from '../../util.ts'
 import { generateTransportCertificate } from './generate-certificates.ts'
 import type { DataChannelOptions, TransportCertificate } from '../../index.ts'
-import type { CounterGroup } from '@libp2p/interface'
+import type { CounterGroup, Logger } from '@libp2p/interface'
 import type { CertificateFingerprint } from 'node-datachannel'
 
 const crypto = new Crypto()
@@ -40,28 +42,35 @@ export class DirectRTCPeerConnection extends RTCPeerConnection {
 
   async createOffer (): Promise<globalThis.RTCSessionDescriptionInit | any> {
     // have to set ufrag before creating offer
-    if (this.connectionState === 'new') {
-      this.peerConnection?.setLocalDescription('offer', {
-        iceUfrag: this.ufrag,
-        icePwd: this.ufrag
-      })
-    }
+    this.setLocalUfrag('offer')
 
     return super.createOffer()
   }
 
   async createAnswer (): Promise<globalThis.RTCSessionDescriptionInit | any> {
     // have to set ufrag before creating answer
-    if (this.connectionState === 'new') {
-      this.peerConnection?.setLocalDescription('answer', {
-        iceUfrag: this.ufrag,
-        icePwd: this.ufrag
-      })
-    }
+    this.setLocalUfrag('answer')
 
     return super.createAnswer()
   }
 
+  // this.ufrag is reused as the ICE password; an invalid value aborts the process
+  // inside the native ICE stack, so reject it with a recoverable error first
+  private setLocalUfrag (type: 'offer' | 'answer'): void {
+    if (this.connectionState !== 'new') {
+      return
+    }
+
+    if (!isValidUfrag(this.ufrag)) {
+      throw new InvalidParametersError('ufrag is not a valid ICE credential')
+    }
+
+    this.peerConnection?.setLocalDescription(type, {
+      iceUfrag: this.ufrag,
+      icePwd: this.ufrag
+    })
+  }
+
   remoteFingerprint (): CertificateFingerprint {
     if (this.peerConnection == null) {
       throw new Error('Invalid state: peer connection not set')
@@ -91,7 +100,9 @@ export interface CreateDialerRTCPeerConnectionOptions {
   rtcConfiguration?: RTCConfiguration | (() => RTCConfiguration | Promise<RTCConfiguration>)
   certificate?: TransportCertificate
   events?: CounterGroup
+  log?: Logger
   dataChannel?: DataChannelOptions
+  maxEarlyStreams?: number
 }
 
 export async function createDialerRTCPeerConnection (role: 'client', ufrag: string, options?: CreateDialerRTCPeerConnectionOptions): Promise<{ peerConnection: globalThis.RTCPeerConnection, muxerFactory: DataChannelMuxerFactory }>
@@ -132,7 +143,9 @@ export async function createDialerRTCPeerConnection (role: 'client' | 'server',
     // @ts-expect-error https://github.com/murat-dogan/node-datachannel/pull/370
     peerConnection,
     metrics: options.events,
-    dataChannelOptions: options.dataChannel
+    log: options.log,
+    dataChannelOptions: options.dataChannel,
+    maxEarlyStreams: options.maxEarlyStreams
   })
 
   return {

package/src/private-to-public/utils/stun-listener.ts

@@ -1,5 +1,6 @@
 import { isIPv4 } from '@chainsafe/is-ip'
 import { IceUdpMuxListener } from 'node-datachannel'
+import { handleStunRequest } from '../../util.ts'
 import type { Logger } from '@libp2p/interface'
 import type { AddressInfo } from 'node:net'
 
@@ -15,13 +16,7 @@ export interface Callback {
 export async function stunListener (host: string, port: number, log: Logger, cb: Callback): Promise<StunServer> {
   const listener = new IceUdpMuxListener(port, host)
   listener.onUnhandledStunRequest(request => {
-    if (request.ufrag == null) {
-      return
-    }
-
-    log.trace('incoming STUN packet from %s:%d %s', request.host, request.port, request.ufrag)
-
-    cb(request.ufrag, request.host, request.port)
+    handleStunRequest(request, log, cb)
   })
 
   return {

package/src/util.ts

@@ -1,9 +1,9 @@
 import pDefer from 'p-defer'
 import pTimeout from 'p-timeout'
 import { DATA_CHANNEL_DRAIN_TIMEOUT, DEFAULT_ICE_SERVERS, UFRAG_ALPHABET, UFRAG_PREFIX } from './constants.ts'
-import type { LoggerOptions } from '@libp2p/interface'
+import type { Logger, LoggerOptions } from '@libp2p/interface'
 import type { Duplex, Source } from 'it-stream-types'
-import type { PeerConnection } from 'node-datachannel'
+import type { IceUdpMuxRequest, PeerConnection } from 'node-datachannel'
 
 export const nopSource = async function * nop (): AsyncGenerator<Uint8Array, any, unknown> {}
 
@@ -105,3 +105,30 @@ export async function getRtcConfiguration (config?: RTCConfiguration | (() => RT
 export const genUfrag = (len: number = 32): string => {
   return UFRAG_PREFIX + [...Array(len)].map(() => UFRAG_ALPHABET.at(Math.floor(Math.random() * UFRAG_ALPHABET.length))).join('')
 }
+
+// WebRTC-direct reuses the ufrag as the ICE password, which RFC 8445 requires to
+// be 22-256 chars from the ice-char set [a-zA-Z0-9+/]; other values crash the
+// process during native ICE setup, so reject them beforehand.
+const ICE_CREDENTIAL_REGEX = /^[a-zA-Z0-9+/]{22,256}$/
+
+export const isValidUfrag = (ufrag: string): boolean => {
+  return ICE_CREDENTIAL_REGEX.test(ufrag)
+}
+
+// Validate and forward a STUN request received by the UDP mux listener. The ufrag
+// is attacker-controlled and reused as the ICE password in native setup, where an
+// invalid value aborts the process, so drop anything that is not a valid credential.
+export function handleStunRequest (request: IceUdpMuxRequest, log: Logger, cb: (ufrag: string, host: string, port: number) => void): void {
+  if (request.ufrag == null) {
+    return
+  }
+
+  if (!isValidUfrag(request.ufrag)) {
+    log.trace('dropping incoming STUN packet from %s:%d with invalid ufrag', request.host, request.port)
+    return
+  }
+
+  log.trace('incoming STUN packet from %s:%d %s', request.host, request.port, request.ufrag)
+
+  cb(request.ufrag, request.host, request.port)
+}