libp2p 0.35.9-rc.1 → 0.36.1

package/src/index.js

@@ -29,8 +29,9 @@ const Upgrader = require('./upgrader')
 const PeerStore = require('./peer-store')
 const PubsubAdapter = require('./pubsub-adapter')
 const Registrar = require('./registrar')
-const ping = require('./ping')
 const IdentifyService = require('./identify')
+const FetchService = require('./fetch')
+const PingService = require('./ping')
 const NatManager = require('./nat-manager')
 const { updateSelfPeerRecord } = require('./record/utils')
 
@@ -47,6 +48,7 @@ const { updateSelfPeerRecord } = require('./record/utils')
  * @typedef {import('libp2p-interfaces/src/pubsub').PubsubOptions} PubsubOptions
  * @typedef {import('interface-datastore').Datastore} Datastore
  * @typedef {import('./pnet')} Protector
+ * @typedef {import('./types').ConnectionGater} ConnectionGater
  * @typedef {Object} PersistentPeerStoreOptions
  * @property {number} [threshold]
  */
@@ -105,6 +107,7 @@ const { updateSelfPeerRecord } = require('./record/utils')
  * @property {Libp2pModules} modules libp2p modules to use
  * @property {import('./address-manager').AddressManagerOptions} [addresses]
  * @property {import('./connection-manager').ConnectionManagerOptions} [connectionManager]
+ * @property {Partial<import('./types').ConnectionGater>} [connectionGater]
  * @property {Datastore} [datastore]
  * @property {import('./dialer').DialerOptions} [dialer]
  * @property {import('./identify/index').HostProperties} [host] libp2p host
@@ -171,10 +174,25 @@ class Libp2p extends EventEmitter {
       this.metrics = metrics
     }
 
+    /** @type {ConnectionGater} */
+    this.connectionGater = {
+      denyDialPeer: async () => Promise.resolve(false),
+      denyDialMultiaddr: async () => Promise.resolve(false),
+      denyInboundConnection: async () => Promise.resolve(false),
+      denyOutboundConnection: async () => Promise.resolve(false),
+      denyInboundEncryptedConnection: async () => Promise.resolve(false),
+      denyOutboundEncryptedConnection: async () => Promise.resolve(false),
+      denyInboundUpgradedConnection: async () => Promise.resolve(false),
+      denyOutboundUpgradedConnection: async () => Promise.resolve(false),
+      filterMultiaddrForPeer: async () => Promise.resolve(true),
+      ...this._options.connectionGater
+    }
+
     /** @type {import('./peer-store/types').PeerStore} */
     this.peerStore = new PeerStore({
       peerId: this.peerId,
-      datastore: (this.datastore && this._options.peerStore.persistence) ? this.datastore : new MemoryDatastore()
+      datastore: (this.datastore && this._options.peerStore.persistence) ? this.datastore : new MemoryDatastore(),
+      addressFilter: this.connectionGater.filterMultiaddrForPeer
     })
 
     // Addresses {listen, announce, noAnnounce}
@@ -219,6 +237,7 @@ class Libp2p extends EventEmitter {
 
     // Setup the Upgrader
     this.upgrader = new Upgrader({
+      connectionGater: this.connectionGater,
       localPeer: this.peerId,
       metrics: this.metrics,
       onConnection: (connection) => this.connectionManager.onConnect(connection),
@@ -261,6 +280,7 @@ class Libp2p extends EventEmitter {
 
     this.dialer = new Dialer({
       transportManager: this.transportManager,
+      connectionGater: this.connectionGater,
       peerStore: this.peerStore,
       metrics: this.metrics,
       ...this._options.dialer
@@ -319,10 +339,10 @@ class Libp2p extends EventEmitter {
     this.peerRouting = new PeerRouting(this)
     this.contentRouting = new ContentRouting(this)
 
-    // Mount default protocols
-    ping.mount(this)
-
     this._onDiscoveryPeer = this._onDiscoveryPeer.bind(this)
+
+    this.fetchService = new FetchService(this)
+    this.pingService = new PingService(this)
   }
 
   /**
@@ -356,6 +376,14 @@ class Libp2p extends EventEmitter {
       await this.handle(Object.values(IdentifyService.getProtocolStr(this)), this.identifyService.handleMessage)
     }
 
+    if (this.fetchService) {
+      await this.handle(FetchService.PROTOCOL, this.fetchService.handleMessage)
+    }
+
+    if (this.pingService) {
+      await this.handle(PingService.getProtocolStr(this), this.pingService.handleMessage)
+    }
+
     try {
       await this._onStarting()
       await this._onDidStart()
@@ -407,7 +435,9 @@ class Libp2p extends EventEmitter {
       await this.natManager.stop()
       await this.transportManager.close()
 
-      ping.unmount(this)
+      await this.unhandle(FetchService.PROTOCOL)
+      await this.unhandle(PingService.getProtocolStr(this))
+
       this.dialer.destroy()
     } catch (/** @type {any} */ err) {
       if (err) {
@@ -559,6 +589,17 @@ class Libp2p extends EventEmitter {
     )
   }
 
+  /**
+   * Sends a request to fetch the value associated with the given key from the given peer.
+   *
+   * @param {PeerId|Multiaddr} peer
+   * @param {string} key
+   * @returns {Promise<Uint8Array | null>}
+   */
+  fetch (peer, key) {
+    return this.fetchService.fetch(peer, key)
+  }
+
   /**
    * Pings the given peer in order to obtain the operation latency.
    *
@@ -570,10 +611,10 @@ class Libp2p extends EventEmitter {
 
     // If received multiaddr, ping it
     if (multiaddrs) {
-      return ping(this, multiaddrs[0])
+      return this.pingService.ping(multiaddrs[0])
     }
 
-    return ping(this, id)
+    return this.pingService.ping(id)
   }
 
   /**

package/src/peer-store/address-book.js

@@ -7,6 +7,11 @@ const PeerId = require('peer-id')
 const { codes } = require('../errors')
 const PeerRecord = require('../record/peer-record')
 const Envelope = require('../record/envelope')
+const { pipe } = require('it-pipe')
+const all = require('it-all')
+const filter = require('it-filter')
+const map = require('it-map')
+const each = require('it-foreach')
 
 /**
  * @typedef {import('./types').PeerStore} PeerStore
@@ -27,10 +32,12 @@ class PeerStoreAddressBook {
   /**
    * @param {PeerStore["emit"]} emit
    * @param {import('./types').Store} store
+   * @param {(peerId: PeerId, multiaddr: Multiaddr) => Promise<boolean>} addressFilter
    */
-  constructor (emit, store) {
+  constructor (emit, store, addressFilter) {
     this._emit = emit
     this._store = store
+    this._addressFilter = addressFilter
   }
 
   /**
@@ -88,7 +95,7 @@ class PeerStoreAddressBook {
       // Replace unsigned addresses by the new ones from the record
       // TODO: Once we have ttls for the addresses, we should merge these in
       updatedPeer = await this._store.patchOrCreate(peerId, {
-        addresses: convertMultiaddrsToAddresses(multiaddrs, true),
+        addresses: await filterMultiaddrs(peerId, multiaddrs, this._addressFilter, true),
         peerRecordEnvelope: envelope.marshal()
       })
 
@@ -180,6 +187,11 @@ class PeerStoreAddressBook {
       throw errcode(new Error('peerId must be an instance of peer-id'), codes.ERR_INVALID_PARAMETERS)
     }
 
+    if (!Array.isArray(multiaddrs)) {
+      log.error('multiaddrs must be an array of Multiaddrs')
+      throw errcode(new Error('multiaddrs must be an array of Multiaddrs'), codes.ERR_INVALID_PARAMETERS)
+    }
+
     log('set await write lock')
     const release = await this._store.lock.writeLock()
     log('set got write lock')
@@ -188,7 +200,7 @@ class PeerStoreAddressBook {
     let updatedPeer
 
     try {
-      const addresses = convertMultiaddrsToAddresses(multiaddrs)
+      const addresses = await filterMultiaddrs(peerId, multiaddrs, this._addressFilter)
 
       // No valid addresses found
       if (!addresses.length) {
@@ -238,6 +250,11 @@ class PeerStoreAddressBook {
       throw errcode(new Error('peerId must be an instance of peer-id'), codes.ERR_INVALID_PARAMETERS)
     }
 
+    if (!Array.isArray(multiaddrs)) {
+      log.error('multiaddrs must be an array of Multiaddrs')
+      throw errcode(new Error('multiaddrs must be an array of Multiaddrs'), codes.ERR_INVALID_PARAMETERS)
+    }
+
     log('add await write lock')
     const release = await this._store.lock.writeLock()
     log('add got write lock')
@@ -246,7 +263,7 @@ class PeerStoreAddressBook {
     let updatedPeer
 
     try {
-      const addresses = convertMultiaddrsToAddresses(multiaddrs)
+      const addresses = await filterMultiaddrs(peerId, multiaddrs, this._addressFilter)
 
       // No valid addresses found
       if (!addresses.length) {
@@ -337,33 +354,29 @@ class PeerStoreAddressBook {
 }
 
 /**
- * Transforms received multiaddrs into Address.
- *
- * @private
+ * @param {PeerId} peerId
  * @param {Multiaddr[]} multiaddrs
- * @param {boolean} [isCertified]
- * @returns {Address[]}
+ * @param {(peerId: PeerId, multiaddr: Multiaddr) => Promise<boolean>} addressFilter
+ * @param {boolean} isCertified
  */
-function convertMultiaddrsToAddresses (multiaddrs, isCertified = false) {
-  if (!multiaddrs) {
-    log.error('multiaddrs must be provided to store data')
-    throw errcode(new Error('multiaddrs must be provided'), codes.ERR_INVALID_PARAMETERS)
-  }
-
-  // create Address for each address with no duplicates
-  return Array.from(
-    new Set(multiaddrs.map(ma => ma.toString()))
-  )
-    .map(addr => {
-      try {
-        return {
-          multiaddr: new Multiaddr(addr),
-          isCertified
-        }
-      } catch (err) {
-        throw errcode(err, codes.ERR_INVALID_PARAMETERS)
+function filterMultiaddrs (peerId, multiaddrs, addressFilter, isCertified = false) {
+  return pipe(
+    multiaddrs,
+    (source) => each(source, (multiaddr) => {
+      if (!Multiaddr.isMultiaddr(multiaddr)) {
+        log.error('multiaddr must be an instance of Multiaddr')
+        throw errcode(new Error('multiaddr must be an instance of Multiaddr'), codes.ERR_INVALID_PARAMETERS)
       }
-    })
+    }),
+    (source) => filter(source, (multiaddr) => addressFilter(peerId, multiaddr)),
+    (source) => map(source, (multiaddr) => {
+      return {
+        multiaddr: new Multiaddr(multiaddr.toString()),
+        isCertified
+      }
+    }),
+    (source) => all(source)
+  )
 }
 
 module.exports = PeerStoreAddressBook

package/src/peer-store/index.js

@@ -12,6 +12,7 @@ const Store = require('./store')
  * @typedef {import('./types').PeerStore} PeerStore
  * @typedef {import('./types').Peer} Peer
  * @typedef {import('peer-id')} PeerId
+ * @typedef {import('multiaddr').Multiaddr} Multiaddr
  */
 
 const log = Object.assign(debug('libp2p:peer-store'), {
@@ -28,14 +29,15 @@ class DefaultPeerStore extends EventEmitter {
    * @param {object} properties
    * @param {PeerId} properties.peerId
    * @param {import('interface-datastore').Datastore} properties.datastore
+   * @param {(peerId: PeerId, multiaddr: Multiaddr) => Promise<boolean>} properties.addressFilter
    */
-  constructor ({ peerId, datastore }) {
+  constructor ({ peerId, datastore, addressFilter }) {
     super()
 
     this._peerId = peerId
     this._store = new Store(datastore)
 
-    this.addressBook = new AddressBook(this.emit.bind(this), this._store)
+    this.addressBook = new AddressBook(this.emit.bind(this), this._store, addressFilter)
     this.keyBook = new KeyBook(this.emit.bind(this), this._store)
     this.metadataBook = new MetadataBook(this.emit.bind(this), this._store)
     this.protoBook = new ProtoBook(this.emit.bind(this), this._store)

package/src/peer-store/store.js

@@ -100,13 +100,26 @@ class PersistentStore {
       throw errcode(new Error('publicKey bytes do not match peer id publicKey bytes'), codes.ERR_INVALID_PARAMETERS)
     }
 
+    // dedupe addresses
+    const addressSet = new Set()
+
     const buf = PeerPB.encode({
-      addresses: peer.addresses.sort((a, b) => {
-        return a.multiaddr.toString().localeCompare(b.multiaddr.toString())
-      }).map(({ multiaddr, isCertified }) => ({
-        multiaddr: multiaddr.bytes,
-        isCertified
-      })),
+      addresses: peer.addresses
+        .filter(address => {
+          if (addressSet.has(address.multiaddr.toString())) {
+            return false
+          }
+
+          addressSet.add(address.multiaddr.toString())
+          return true
+        })
+        .sort((a, b) => {
+          return a.multiaddr.toString().localeCompare(b.multiaddr.toString())
+        })
+        .map(({ multiaddr, isCertified }) => ({
+          multiaddr: multiaddr.bytes,
+          isCertified
+        })),
       protocols: peer.protocols.sort(),
       pubKey: peer.pubKey ? marshalPublicKey(peer.pubKey) : undefined,
       metadata: [...peer.metadata.keys()].sort().map(key => ({ key, value: peer.metadata.get(key) })),

package/src/ping/index.js

@@ -22,64 +22,63 @@ const { PROTOCOL_NAME, PING_LENGTH, PROTOCOL_VERSION } = require('./constants')
  * @typedef {import('libp2p-interfaces/src/stream-muxer/types').MuxedStream} MuxedStream
  */
 
-/**
- * Ping a given peer and wait for its response, getting the operation latency.
- *
- * @param {Libp2p} node
- * @param {PeerId|Multiaddr} peer
- * @returns {Promise<number>}
- */
-async function ping (node, peer) {
-  const protocol = `/${node._config.protocolPrefix}/${PROTOCOL_NAME}/${PROTOCOL_VERSION}`
-  // @ts-ignore multiaddr might not have toB58String
-  log('dialing %s to %s', protocol, peer.toB58String ? peer.toB58String() : peer)
+class PingService {
+  /**
+   * @param {import('../')} libp2p
+   */
+  static getProtocolStr (libp2p) {
+    return `/${libp2p._config.protocolPrefix}/${PROTOCOL_NAME}/${PROTOCOL_VERSION}`
+  }
 
-  const connection = await node.dial(peer)
-  const { stream } = await connection.newStream(protocol)
+  /**
+   * @param {Libp2p} libp2p
+   */
+  constructor (libp2p) {
+    this._libp2p = libp2p
+  }
 
-  const start = Date.now()
-  const data = crypto.randomBytes(PING_LENGTH)
+  /**
+   * A handler to register with Libp2p to process ping messages
+   *
+   * @param {Object} options
+   * @param {MuxedStream} options.stream
+   */
+  handleMessage ({ stream }) {
+    return pipe(stream, stream)
+  }
 
-  const [result] = await pipe(
-    [data],
-    stream,
-    (/** @type {MuxedStream} */ stream) => take(1, stream),
-    toBuffer,
-    collect
-  )
-  const end = Date.now()
+  /**
+   * Ping a given peer and wait for its response, getting the operation latency.
+   *
+   * @param {PeerId|Multiaddr} peer
+   * @returns {Promise<number>}
+   */
+  async ping (peer) {
+    const protocol = `/${this._libp2p._config.protocolPrefix}/${PROTOCOL_NAME}/${PROTOCOL_VERSION}`
+    // @ts-ignore multiaddr might not have toB58String
+    log('dialing %s to %s', protocol, peer.toB58String ? peer.toB58String() : peer)
 
-  if (!equals(data, result)) {
-    throw errCode(new Error('Received wrong ping ack'), codes.ERR_WRONG_PING_ACK)
-  }
+    const connection = await this._libp2p.dial(peer)
+    const { stream } = await connection.newStream(protocol)
 
-  return end - start
-}
+    const start = Date.now()
+    const data = crypto.randomBytes(PING_LENGTH)
 
-/**
- * Subscribe ping protocol handler.
- *
- * @param {Libp2p} node
- */
-function mount (node) {
-  node.handle(`/${node._config.protocolPrefix}/${PROTOCOL_NAME}/${PROTOCOL_VERSION}`, ({ stream }) => pipe(stream, stream))
-    .catch(err => {
-      log.error(err)
-    })
-}
+    const [result] = await pipe(
+      [data],
+      stream,
+      (/** @type {MuxedStream} */ stream) => take(1, stream),
+      toBuffer,
+      collect
+    )
+    const end = Date.now()
 
-/**
- * Unsubscribe ping protocol handler.
- *
- * @param {Libp2p} node
- */
-function unmount (node) {
-  node.unhandle(`/${node._config.protocolPrefix}/${PROTOCOL_NAME}/${PROTOCOL_VERSION}`)
-    .catch(err => {
-      log.error(err)
-    })
+    if (!equals(data, result)) {
+      throw errCode(new Error('Received wrong ping ack'), codes.ERR_WRONG_PING_ACK)
+    }
+
+    return end - start
+  }
 }
 
-exports = module.exports = ping
-exports.mount = mount
-exports.unmount = unmount
+module.exports = PingService

package/src/types.ts

@@ -0,0 +1,98 @@
+import type PeerId from 'peer-id'
+import type { Multiaddr } from 'multiaddr'
+import type { MultiaddrConnection } from 'libp2p-interfaces/src/transport/types'
+
+export interface ConnectionGater {
+  /**
+   * denyDialMultiaddr tests whether we're permitted to Dial the
+   * specified peer.
+   *
+   * This is called by the dialer.connectToPeer implementation before
+   * dialling a peer.
+   *
+   * Return true to prevent dialing the passed peer.
+   */
+  denyDialPeer: (peerId: PeerId) => Promise<boolean>
+
+  /**
+   * denyDialMultiaddr tests whether we're permitted to dial the specified
+   * multiaddr for the given peer.
+   *
+   * This is called by the dialer.connectToPeer implementation after it has
+   * resolved the peer's addrs, and prior to dialling each.
+   *
+   * Return true to prevent dialing the passed peer on the passed multiaddr.
+   */
+  denyDialMultiaddr: (peerId: PeerId, multiaddr: Multiaddr) => Promise<boolean>
+
+  /**
+   * denyInboundConnection tests whether an incipient inbound connection is allowed.
+   *
+   * This is called by the upgrader, or by the transport directly (e.g. QUIC,
+   * Bluetooth), straight after it has accepted a connection from its socket.
+   *
+   * Return true to deny the incoming passed connection.
+   */
+  denyInboundConnection: (maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * denyOutboundConnection tests whether an incipient outbound connection is allowed.
+   *
+   * This is called by the upgrader, or by the transport directly (e.g. QUIC,
+   * Bluetooth), straight after it has created a connection with its socket.
+   *
+   * Return true to deny the incoming passed connection.
+   */
+  denyOutboundConnection: (peerId: PeerId, maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * denyInboundEncryptedConnection tests whether a given connection, now encrypted,
+   * is allowed.
+   *
+   * This is called by the upgrader, after it has performed the security
+   * handshake, and before it negotiates the muxer, or by the directly by the
+   * transport, at the exact same checkpoint.
+   *
+   * Return true to deny the passed secured connection.
+   */
+  denyInboundEncryptedConnection: (peerId: PeerId, maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * denyOutboundEncryptedConnection tests whether a given connection, now encrypted,
+   * is allowed.
+   *
+   * This is called by the upgrader, after it has performed the security
+   * handshake, and before it negotiates the muxer, or by the directly by the
+   * transport, at the exact same checkpoint.
+   *
+   * Return true to deny the passed secured connection.
+   */
+  denyOutboundEncryptedConnection: (peerId: PeerId, maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * denyInboundUpgradedConnection tests whether a fully capable connection is allowed.
+   *
+   * This is called after encryption has been negotiated and the connection has been
+   * multiplexed, if a multiplexer is configured.
+   *
+   * Return true to deny the passed upgraded connection.
+   */
+  denyInboundUpgradedConnection: (peerId: PeerId, maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * denyOutboundUpgradedConnection tests whether a fully capable connection is allowed.
+   *
+   * This is called after encryption has been negotiated and the connection has been
+   * multiplexed, if a multiplexer is configured.
+   *
+   * Return true to deny the passed upgraded connection.
+   */
+  denyOutboundUpgradedConnection: (peerId: PeerId, maConn: MultiaddrConnection) => Promise<boolean>
+
+  /**
+   * Used by the address book to filter passed addresses.
+   *
+   * Return true to allow storing the passed multiaddr for the passed peer.
+   */
+  filterMultiaddrForPeer: (peer: PeerId, multiaddr: Multiaddr) => Promise<boolean>
+}

package/src/upgrader.js

@@ -5,7 +5,6 @@ const log = Object.assign(debug('libp2p:upgrader'), {
   error: debug('libp2p:upgrader:err')
 })
 const errCode = require('err-code')
-// @ts-ignore multistream-select does not export types
 const Multistream = require('multistream-select')
 const { Connection } = require('libp2p-interfaces/src/connection')
 const PeerId = require('peer-id')
@@ -23,6 +22,7 @@ const { codes } = require('./errors')
  * @typedef {import('libp2p-interfaces/src/crypto/types').Crypto} Crypto
  * @typedef {import('libp2p-interfaces/src/connection').Connection} Connection
  * @typedef {import('multiaddr').Multiaddr} Multiaddr
+ * @typedef {import('./types').ConnectionGater} ConnectionGater
  */
 
 /**
@@ -36,6 +36,8 @@ class Upgrader {
   /**
    * @param {object} options
    * @param {PeerId} options.localPeer
+   * @param {ConnectionGater} options.connectionGater
+   *
    * @param {import('./metrics')} [options.metrics]
    * @param {Map<string, Crypto>} [options.cryptos]
    * @param {Map<string, MuxerFactory>} [options.muxers]
@@ -45,11 +47,13 @@ class Upgrader {
   constructor ({
     localPeer,
     metrics,
+    connectionGater,
     cryptos = new Map(),
     muxers = new Map(),
     onConnectionEnd = () => {},
     onConnection = () => {}
   }) {
+    this.connectionGater = connectionGater
     this.localPeer = localPeer
     this.metrics = metrics
     this.cryptos = cryptos
@@ -77,6 +81,10 @@ class Upgrader {
     let setPeer
     let proxyPeer
 
+    if (await this.connectionGater.denyInboundConnection(maConn)) {
+      throw errCode(new Error('The multiaddr connection is blocked by gater.acceptConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+    }
+
     if (this.metrics) {
       ({ setTarget: setPeer, proxy: proxyPeer } = mutableProxy())
       const idString = (Math.random() * 1e9).toString(36) + Date.now()
@@ -100,6 +108,10 @@ class Upgrader {
         protocol: cryptoProtocol
       } = await this._encryptInbound(this.localPeer, protectedConn, this.cryptos))
 
+      if (await this.connectionGater.denyInboundEncryptedConnection(remotePeer, encryptedConn)) {
+        throw errCode(new Error('The multiaddr connection is blocked by gater.acceptEncryptedConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+      }
+
       // Multiplex the connection
       if (this.muxers.size) {
         ({ stream: upgradedConn, Muxer } = await this._multiplexInbound(encryptedConn, this.muxers))
@@ -112,6 +124,10 @@ class Upgrader {
       throw err
     }
 
+    if (await this.connectionGater.denyInboundUpgradedConnection(remotePeer, encryptedConn)) {
+      throw errCode(new Error('The multiaddr connection is blocked by gater.acceptEncryptedConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+    }
+
     if (this.metrics) {
       this.metrics.updatePlaceholder(proxyPeer, remotePeer)
       setPeer(remotePeer)
@@ -144,6 +160,10 @@ class Upgrader {
 
     const remotePeerId = PeerId.createFromB58String(idStr)
 
+    if (await this.connectionGater.denyOutboundConnection(remotePeerId, maConn)) {
+      throw errCode(new Error('The multiaddr connection is blocked by connectionGater.denyOutboundConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+    }
+
     let encryptedConn
     let remotePeer
     let upgradedConn
@@ -175,6 +195,10 @@ class Upgrader {
         protocol: cryptoProtocol
       } = await this._encryptOutbound(this.localPeer, protectedConn, remotePeerId, this.cryptos))
 
+      if (await this.connectionGater.denyOutboundEncryptedConnection(remotePeer, encryptedConn)) {
+        throw errCode(new Error('The multiaddr connection is blocked by gater.acceptEncryptedConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+      }
+
       // Multiplex the connection
       if (this.muxers.size) {
         ({ stream: upgradedConn, Muxer } = await this._multiplexOutbound(encryptedConn, this.muxers))
@@ -187,6 +211,10 @@ class Upgrader {
       throw err
     }
 
+    if (await this.connectionGater.denyOutboundUpgradedConnection(remotePeer, encryptedConn)) {
+      throw errCode(new Error('The multiaddr connection is blocked by gater.acceptEncryptedConnection'), codes.ERR_CONNECTION_INTERCEPTED)
+    }
+
     if (this.metrics) {
       this.metrics.updatePlaceholder(proxyPeer, remotePeer)
       setPeer(remotePeer)