web-dc-api 0.0.58 → 0.0.60

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/rsa/utils.js

@@ -0,0 +1,121 @@
+import { InvalidPublicKeyError, InvalidParametersError } from '@libp2p/interface';
+import { sha256 } from '../../../../../../@noble/hashes/esm/sha256.js';
+import { create } from '../../../../../../multiformats/dist/src/hashes/digest.js';
+import { fromString } from '../../../../../../uint8arrays/dist/src/from-string.js';
+import { toString } from '../../../../../../uint8arrays/dist/src/to-string.js';
+import { PublicKey, KeyType } from '../keys.js';
+import { decodeDer, encodeSequence, encodeBitString, encodeInteger } from './der.js';
+import { RSAPublicKey, RSAPrivateKey } from './rsa.js';
+import { rsaKeySize } from './index.browser.js';
+
+const MAX_RSA_KEY_SIZE = 8192;
+const SHA2_256_CODE = 0x12;
+const MAX_RSA_JWK_SIZE = 1062;
+const RSA_ALGORITHM_IDENTIFIER = Uint8Array.from([0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00]);
+/**
+ * Convert a PKCS#1 in ASN1 DER format to a JWK private key
+ */
+function pkcs1MessageToJwk(message) {
+  return {
+    n: toString(message[1], 'base64url'),
+    e: toString(message[2], 'base64url'),
+    d: toString(message[3], 'base64url'),
+    p: toString(message[4], 'base64url'),
+    q: toString(message[5], 'base64url'),
+    dp: toString(message[6], 'base64url'),
+    dq: toString(message[7], 'base64url'),
+    qi: toString(message[8], 'base64url'),
+    kty: 'RSA'
+  };
+}
+/**
+ * Convert a JWK private key into PKCS#1 in ASN1 DER format
+ */
+function jwkToPkcs1(jwk) {
+  if (jwk.n == null || jwk.e == null || jwk.d == null || jwk.p == null || jwk.q == null || jwk.dp == null || jwk.dq == null || jwk.qi == null) {
+    throw new InvalidParametersError('JWK was missing components');
+  }
+  return encodeSequence([encodeInteger(Uint8Array.from([0])), encodeInteger(fromString(jwk.n, 'base64url')), encodeInteger(fromString(jwk.e, 'base64url')), encodeInteger(fromString(jwk.d, 'base64url')), encodeInteger(fromString(jwk.p, 'base64url')), encodeInteger(fromString(jwk.q, 'base64url')), encodeInteger(fromString(jwk.dp, 'base64url')), encodeInteger(fromString(jwk.dq, 'base64url')), encodeInteger(fromString(jwk.qi, 'base64url'))]).subarray();
+}
+function pkixMessageToJwk(message) {
+  const keys = decodeDer(message[1], {
+    offset: 0
+  });
+  // this looks fragile but DER is a canonical format so we are safe to have
+  // deeply property chains like this
+  return {
+    kty: 'RSA',
+    n: toString(keys[0], 'base64url'),
+    e: toString(keys[1], 'base64url')
+  };
+}
+/**
+ * Convert a JWK public key to PKIX in ASN1 DER format
+ */
+function jwkToPkix(jwk) {
+  if (jwk.n == null || jwk.e == null) {
+    throw new InvalidParametersError('JWK was missing components');
+  }
+  const subjectPublicKeyInfo = encodeSequence([RSA_ALGORITHM_IDENTIFIER, encodeBitString(encodeSequence([encodeInteger(fromString(jwk.n, 'base64url')), encodeInteger(fromString(jwk.e, 'base64url'))]))]);
+  return subjectPublicKeyInfo.subarray();
+}
+/**
+ * Turn PKCS#1 DER bytes into a PrivateKey
+ */
+function pkcs1MessageToRSAPrivateKey(message) {
+  const jwk = pkcs1MessageToJwk(message);
+  return jwkToRSAPrivateKey(jwk);
+}
+/**
+ * Turn a PKIX message into a PublicKey
+ */
+function pkixToRSAPublicKey(bytes, digest) {
+  if (bytes.byteLength >= MAX_RSA_JWK_SIZE) {
+    throw new InvalidPublicKeyError('Key size is too large');
+  }
+  const message = decodeDer(bytes, {
+    offset: 0
+  });
+  return pkixMessageToRSAPublicKey(message, bytes, digest);
+}
+function pkixMessageToRSAPublicKey(message, bytes, digest) {
+  const jwk = pkixMessageToJwk(message);
+  if (digest == null) {
+    const hash = sha256(PublicKey.encode({
+      Type: KeyType.RSA,
+      Data: bytes
+    }));
+    digest = create(SHA2_256_CODE, hash);
+  }
+  return new RSAPublicKey(jwk, digest);
+}
+function jwkToRSAPrivateKey(jwk) {
+  if (rsaKeySize(jwk) > MAX_RSA_KEY_SIZE) {
+    throw new InvalidParametersError('Key size is too large');
+  }
+  const keys = jwkToJWKKeyPair(jwk);
+  const hash = sha256(PublicKey.encode({
+    Type: KeyType.RSA,
+    Data: jwkToPkix(keys.publicKey)
+  }));
+  const digest = create(SHA2_256_CODE, hash);
+  return new RSAPrivateKey(keys.privateKey, new RSAPublicKey(keys.publicKey, digest));
+}
+/**
+ * Takes a jwk key and returns a JWK KeyPair
+ */
+function jwkToJWKKeyPair(key) {
+  if (key == null) {
+    throw new InvalidParametersError('Missing key parameter');
+  }
+  return {
+    privateKey: key,
+    publicKey: {
+      kty: key.kty,
+      n: key.n,
+      e: key.e
+    }
+  };
+}
+
+export { MAX_RSA_KEY_SIZE, jwkToJWKKeyPair, jwkToPkcs1, jwkToPkix, jwkToRSAPrivateKey, pkcs1MessageToJwk, pkcs1MessageToRSAPrivateKey, pkixMessageToJwk, pkixMessageToRSAPublicKey, pkixToRSAPublicKey };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/secp256k1/index.browser.js

@@ -0,0 +1,51 @@
+import { secp256k1 } from '../../../../../../@noble/curves/esm/secp256k1.js';
+import { sha256 } from '../../../../../../multiformats/dist/src/hashes/sha2-browser.js';
+import { VerificationError, SigningError } from '../../errors.js';
+import { isPromise } from '../../util.js';
+
+const PUBLIC_KEY_BYTE_LENGTH = 33;
+const PRIVATE_KEY_BYTE_LENGTH = 32;
+/**
+ * Hash and sign message with private key
+ */
+function hashAndSign(key, msg) {
+  const p = sha256.digest(msg instanceof Uint8Array ? msg : msg.subarray());
+  if (isPromise(p)) {
+    return p.then(_ref => {
+      let {
+        digest
+      } = _ref;
+      return secp256k1.sign(digest, key).toDERRawBytes();
+    }).catch(err => {
+      throw new SigningError(String(err));
+    });
+  }
+  try {
+    return secp256k1.sign(p.digest, key).toDERRawBytes();
+  } catch (err) {
+    throw new SigningError(String(err));
+  }
+}
+/**
+ * Hash message and verify signature with public key
+ */
+function hashAndVerify(key, sig, msg) {
+  const p = sha256.digest(msg instanceof Uint8Array ? msg : msg.subarray());
+  if (isPromise(p)) {
+    return p.then(_ref2 => {
+      let {
+        digest
+      } = _ref2;
+      return secp256k1.verify(sig, digest, key);
+    }).catch(err => {
+      throw new VerificationError(String(err));
+    });
+  }
+  try {
+    return secp256k1.verify(sig, p.digest, key);
+  } catch (err) {
+    throw new VerificationError(String(err));
+  }
+}
+
+export { hashAndSign, hashAndVerify, PRIVATE_KEY_BYTE_LENGTH as privateKeyLength, PUBLIC_KEY_BYTE_LENGTH as publicKeyLength };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/secp256k1/secp256k1.js

@@ -0,0 +1,55 @@
+import { base58btc } from '../../../../../../multiformats/dist/src/bases/base58.js';
+import { CID } from '../../../../../../multiformats/dist/src/cid.js';
+import { identity } from '../../../../../../multiformats/dist/src/hashes/identity.js';
+import { equals } from '../../../../../../uint8arrays/dist/src/equals.js';
+import { publicKeyToProtobuf } from '../index.js';
+import { validateSecp256k1PublicKey, compressSecp256k1PublicKey, validateSecp256k1PrivateKey, computeSecp256k1PublicKey } from './utils.js';
+import { hashAndVerify, hashAndSign } from './index.browser.js';
+
+class Secp256k1PublicKey {
+  type = 'secp256k1';
+  raw;
+  _key;
+  constructor(key) {
+    this._key = validateSecp256k1PublicKey(key);
+    this.raw = compressSecp256k1PublicKey(this._key);
+  }
+  toMultihash() {
+    return identity.digest(publicKeyToProtobuf(this));
+  }
+  toCID() {
+    return CID.createV1(114, this.toMultihash());
+  }
+  toString() {
+    return base58btc.encode(this.toMultihash().bytes).substring(1);
+  }
+  equals(key) {
+    if (key == null || !(key.raw instanceof Uint8Array)) {
+      return false;
+    }
+    return equals(this.raw, key.raw);
+  }
+  verify(data, sig) {
+    return hashAndVerify(this._key, sig, data);
+  }
+}
+class Secp256k1PrivateKey {
+  type = 'secp256k1';
+  raw;
+  publicKey;
+  constructor(key, publicKey) {
+    this.raw = validateSecp256k1PrivateKey(key);
+    this.publicKey = new Secp256k1PublicKey(publicKey ?? computeSecp256k1PublicKey(key));
+  }
+  equals(key) {
+    if (key == null || !(key.raw instanceof Uint8Array)) {
+      return false;
+    }
+    return equals(this.raw, key.raw);
+  }
+  sign(message) {
+    return hashAndSign(this.raw, message);
+  }
+}
+
+export { Secp256k1PrivateKey, Secp256k1PublicKey };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/secp256k1/utils.js

@@ -0,0 +1,39 @@
+import { InvalidPublicKeyError, InvalidPrivateKeyError } from '@libp2p/interface';
+import { secp256k1 } from '../../../../../../@noble/curves/esm/secp256k1.js';
+import { Secp256k1PublicKey, Secp256k1PrivateKey } from './secp256k1.js';
+
+function unmarshalSecp256k1PrivateKey(bytes) {
+  return new Secp256k1PrivateKey(bytes);
+}
+function unmarshalSecp256k1PublicKey(bytes) {
+  return new Secp256k1PublicKey(bytes);
+}
+function compressSecp256k1PublicKey(key) {
+  const point = secp256k1.ProjectivePoint.fromHex(key).toRawBytes(true);
+  return point;
+}
+function validateSecp256k1PrivateKey(key) {
+  try {
+    secp256k1.getPublicKey(key, true);
+    return key;
+  } catch (err) {
+    throw new InvalidPrivateKeyError(String(err));
+  }
+}
+function validateSecp256k1PublicKey(key) {
+  try {
+    secp256k1.ProjectivePoint.fromHex(key);
+    return key;
+  } catch (err) {
+    throw new InvalidPublicKeyError(String(err));
+  }
+}
+function computeSecp256k1PublicKey(privateKey) {
+  try {
+    return secp256k1.getPublicKey(privateKey, true);
+  } catch (err) {
+    throw new InvalidPrivateKeyError(String(err));
+  }
+}
+
+export { compressSecp256k1PublicKey, computeSecp256k1PublicKey, unmarshalSecp256k1PrivateKey, unmarshalSecp256k1PublicKey, validateSecp256k1PrivateKey, validateSecp256k1PublicKey };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/util.js

@@ -0,0 +1,21 @@
+import '../../../../multiformats/dist/src/bases/base10.js';
+import '../../../../multiformats/dist/src/bases/base16.js';
+import '../../../../multiformats/dist/src/bases/base2.js';
+import '../../../../multiformats/dist/src/bases/base256emoji.js';
+import '../../../../multiformats/dist/src/bases/base32.js';
+import '../../../../multiformats/dist/src/bases/base36.js';
+import '../../../../multiformats/dist/src/bases/base58.js';
+import '../../../../multiformats/dist/src/bases/base64.js';
+import '../../../../multiformats/dist/src/bases/base8.js';
+import '../../../../multiformats/dist/src/bases/identity.js';
+import '../../../../multiformats/dist/src/codecs/json.js';
+import '../../../../multiformats/dist/src/hashes/sha2-browser.js';
+
+function isPromise(thing) {
+  if (thing == null) {
+    return false;
+  }
+  return typeof thing.then === 'function' && typeof thing.catch === 'function' && typeof thing.finally === 'function';
+}
+
+export { isPromise };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/webcrypto/index.js

@@ -0,0 +1,5 @@
+import webcrypto from './webcrypto.browser.js';
+
+
+
+export { webcrypto as default };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/webcrypto/webcrypto.browser.js

@@ -0,0 +1,17 @@
+import { WebCryptoMissingError } from '../errors.js';
+
+/* eslint-env browser */
+// Check native crypto exists and is enabled (In insecure context `self.crypto`
+// exists but `self.crypto.subtle` does not).
+var webcrypto = {
+  get() {
+    let win = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : globalThis;
+    const nativeCrypto = win.crypto;
+    if (nativeCrypto?.subtle == null) {
+      throw new WebCryptoMissingError('Missing Web Crypto API. ' + 'The most likely cause of this error is that this page is being accessed ' + 'from an insecure context (i.e. not HTTPS). For more information and ' + 'possible resolutions see ' + 'https://github.com/libp2p/js-libp2p/blob/main/packages/crypto/README.md#web-crypto-api');
+    }
+    return nativeCrypto;
+  }
+};
+
+export { webcrypto as default };

package/dist/esm/node_modules/@libp2p/dcutr/dist/src/dcutr.js

@@ -0,0 +1,310 @@
+import { serviceDependencies, InvalidMessageError } from '@libp2p/interface';
+import { multiaddr } from '@multiformats/multiaddr';
+import { Circuit } from '../../../../@multiformats/multiaddr-matcher/dist/src/index.js';
+import delay from '../../../../delay/index.js';
+import { pbStream } from '../../../../it-protobuf-stream/dist/src/index.js';
+import { HolePunch } from './pb/message.js';
+import { isPublicAndDialable } from './utils.js';
+import { multicodec } from './index.js';
+
+// https://github.com/libp2p/specs/blob/master/relay/DCUtR.md#rpc-messages
+const MAX_DCUTR_MESSAGE_SIZE = 1024 * 4;
+// ensure the dial has a high priority to jump to the head of the dial queue
+const DCUTR_DIAL_PRIORITY = 100;
+const defaultValues = {
+  // https://github.com/libp2p/go-libp2p/blob/8d2e54e1637041d5cf4fac1e531287560bd1f4ac/p2p/protocol/holepunch/holepuncher.go#L27
+  timeout: 5000,
+  // https://github.com/libp2p/go-libp2p/blob/8d2e54e1637041d5cf4fac1e531287560bd1f4ac/p2p/protocol/holepunch/holepuncher.go#L28
+  retries: 3,
+  maxInboundStreams: 1,
+  maxOutboundStreams: 1
+};
+class DefaultDCUtRService {
+  started;
+  timeout;
+  retries;
+  maxInboundStreams;
+  maxOutboundStreams;
+  peerStore;
+  registrar;
+  connectionManager;
+  addressManager;
+  transportManager;
+  topologyId;
+  log;
+  constructor(components, init) {
+    this.log = components.logger.forComponent('libp2p:dcutr');
+    this.started = false;
+    this.peerStore = components.peerStore;
+    this.registrar = components.registrar;
+    this.addressManager = components.addressManager;
+    this.connectionManager = components.connectionManager;
+    this.transportManager = components.transportManager;
+    this.timeout = init.timeout ?? defaultValues.timeout;
+    this.retries = init.retries ?? defaultValues.retries;
+    this.maxInboundStreams = init.maxInboundStreams ?? defaultValues.maxInboundStreams;
+    this.maxOutboundStreams = init.maxOutboundStreams ?? defaultValues.maxOutboundStreams;
+  }
+  [Symbol.toStringTag] = '@libp2p/dcutr';
+  [serviceDependencies] = ['@libp2p/identify'];
+  isStarted() {
+    return this.started;
+  }
+  async start() {
+    if (this.started) {
+      return;
+    }
+    // register for notifications of when peers that support DCUtR connect
+    // nb. requires the identify service to be enabled
+    this.topologyId = await this.registrar.register(multicodec, {
+      notifyOnLimitedConnection: true,
+      onConnect: (peerId, connection) => {
+        if (!Circuit.exactMatch(connection.remoteAddr)) {
+          // the connection is already direct, no upgrade is required
+          return;
+        }
+        // the inbound peer starts the connection upgrade
+        if (connection.direction !== 'inbound') {
+          return;
+        }
+        this.upgradeInbound(connection).catch(err => {
+          this.log.error('error during outgoing DCUtR attempt', err);
+        });
+      }
+    });
+    await this.registrar.handle(multicodec, data => {
+      void this.handleIncomingUpgrade(data.stream, data.connection).catch(err => {
+        this.log.error('error during incoming DCUtR attempt', err);
+        data.stream.abort(err);
+      });
+    }, {
+      maxInboundStreams: this.maxInboundStreams,
+      maxOutboundStreams: this.maxOutboundStreams,
+      runOnLimitedConnection: true
+    });
+    this.started = true;
+  }
+  async stop() {
+    await this.registrar.unhandle(multicodec);
+    if (this.topologyId != null) {
+      this.registrar.unregister(this.topologyId);
+    }
+    this.started = false;
+  }
+  /**
+   * Perform the inbound connection upgrade as B
+   *
+   * @see https://github.com/libp2p/specs/blob/master/relay/DCUtR.md#the-protocol
+   */
+  async upgradeInbound(relayedConnection) {
+    // Upon observing the new connection, the inbound peer (here B) checks the
+    // addresses advertised by A via identify.
+    //
+    // If that set includes public addresses, then A may be reachable by a direct
+    // connection, in which case B attempts a unilateral connection upgrade by
+    // initiating a direct connection to A.
+    if (await this.attemptUnilateralConnectionUpgrade(relayedConnection)) {
+      return;
+    }
+    let stream;
+    for (let i = 0; i < this.retries; i++) {
+      const options = {
+        signal: AbortSignal.timeout(this.timeout)
+      };
+      try {
+        // 1. B opens a stream to A using the /libp2p/dcutr protocol.
+        stream = await relayedConnection.newStream([multicodec], {
+          signal: options.signal,
+          runOnLimitedConnection: true
+        });
+        const pb = pbStream(stream, {
+          maxDataLength: MAX_DCUTR_MESSAGE_SIZE
+        }).pb(HolePunch);
+        // 2. B sends to A a Connect message containing its observed (and
+        // possibly predicted) addresses from identify and starts a timer
+        // to measure RTT of the relay connection.
+        this.log('B sending connect to %p', relayedConnection.remotePeer);
+        const connectTimer = Date.now();
+        await pb.write({
+          type: HolePunch.Type.CONNECT,
+          observedAddresses: this.addressManager.getAddresses().map(ma => ma.bytes)
+        }, options);
+        this.log('B receiving connect from %p', relayedConnection.remotePeer);
+        // 4. Upon receiving the Connect, B sends a Sync message
+        const connect = await pb.read(options);
+        if (connect.type !== HolePunch.Type.CONNECT) {
+          this.log('A sent wrong message type');
+          throw new InvalidMessageError('DCUtR message type was incorrect');
+        }
+        const multiaddrs = this.getDialableMultiaddrs(connect.observedAddresses);
+        if (multiaddrs.length === 0) {
+          this.log('A did not have any dialable multiaddrs');
+          throw new InvalidMessageError('DCUtR connect message had no multiaddrs');
+        }
+        const rtt = Date.now() - connectTimer;
+        this.log('A sending sync, rtt %dms', rtt);
+        await pb.write({
+          type: HolePunch.Type.SYNC,
+          observedAddresses: []
+        }, options);
+        this.log('A waiting for half RTT');
+        // ..and starts a timer for half the RTT measured from the time between
+        // sending the initial Connect and receiving the response
+        await delay(rtt / 2);
+        // TODO: when we have a QUIC transport, the dial step is different - for
+        // now we only have tcp support
+        // https://github.com/libp2p/specs/blob/master/relay/DCUtR.md#the-protocol
+        this.log('B dialing', multiaddrs);
+        // Upon expiry of the timer, B dials the address to A and acts as the
+        // multistream-select server
+        const conn = await this.connectionManager.openConnection(multiaddrs, {
+          signal: options.signal,
+          priority: DCUTR_DIAL_PRIORITY,
+          force: true,
+          initiator: false
+        });
+        this.log('DCUtR to %p succeeded to address %a, closing relayed connection', relayedConnection.remotePeer, conn.remoteAddr);
+        await relayedConnection.close(options);
+        break;
+      } catch (err) {
+        this.log.error('error while attempting DCUtR on attempt %d of %d', i + 1, this.retries, err);
+        stream?.abort(err);
+        if (i === this.retries) {
+          throw err;
+        }
+      } finally {
+        if (stream != null) {
+          await stream.close(options);
+        }
+      }
+    }
+  }
+  /**
+   * This is performed when A has dialed B via a relay but A also has a public
+   * address that B can dial directly
+   */
+  async attemptUnilateralConnectionUpgrade(relayedConnection) {
+    // Upon observing the new connection, the inbound peer (here B) checks the
+    // addresses advertised by A via identify.
+    const peerInfo = await this.peerStore.get(relayedConnection.remotePeer);
+    // If that set includes public addresses, then A may be reachable by a direct
+    // connection, in which case B attempts a unilateral connection upgrade by
+    // initiating a direct connection to A.
+    const publicAddresses = peerInfo.addresses.map(address => {
+      const ma = address.multiaddr;
+      // ensure all multiaddrs have the peer id
+      if (ma.getPeerId() == null) {
+        return ma.encapsulate(`/p2p/${relayedConnection.remotePeer}`);
+      }
+      return ma;
+    }).filter(ma => {
+      return isPublicAndDialable(ma, this.transportManager);
+    });
+    if (publicAddresses.length > 0) {
+      const signal = AbortSignal.timeout(this.timeout);
+      try {
+        this.log('attempting unilateral connection upgrade to %a', publicAddresses);
+        // force-dial the multiaddr(s), otherwise `connectionManager.openConnection`
+        // will return the existing relayed connection
+        const connection = await this.connectionManager.openConnection(publicAddresses, {
+          signal,
+          force: true
+        });
+        if (Circuit.exactMatch(connection.remoteAddr)) {
+          throw new Error('Could not open a new, non-limited, connection');
+        }
+        this.log('unilateral connection upgrade to %p succeeded via %a, closing relayed connection', relayedConnection.remotePeer, connection.remoteAddr);
+        await relayedConnection.close({
+          signal
+        });
+        return true;
+      } catch (err) {
+        this.log.error('unilateral connection upgrade to %p on addresses %a failed', relayedConnection.remotePeer, publicAddresses, err);
+      }
+    } else {
+      this.log('peer %p has no public addresses, not attempting unilateral connection upgrade', relayedConnection.remotePeer);
+    }
+    // no public addresses or failed to dial public addresses
+    return false;
+  }
+  /**
+   * Perform the connection upgrade as A
+   *
+   * @see https://github.com/libp2p/specs/blob/master/relay/DCUtR.md#the-protocol
+   */
+  async handleIncomingUpgrade(stream, relayedConnection) {
+    const options = {
+      signal: AbortSignal.timeout(this.timeout)
+    };
+    try {
+      const pb = pbStream(stream, {
+        maxDataLength: MAX_DCUTR_MESSAGE_SIZE
+      }).pb(HolePunch);
+      this.log('A receiving connect');
+      // 3. Upon receiving the Connect, A responds back with a Connect message
+      // containing its observed (and possibly predicted) addresses.
+      const connect = await pb.read(options);
+      if (connect.type !== HolePunch.Type.CONNECT) {
+        this.log('B sent wrong message type');
+        throw new InvalidMessageError('DCUtR message type was incorrect');
+      }
+      if (connect.observedAddresses.length === 0) {
+        this.log('B sent no multiaddrs');
+        throw new InvalidMessageError('DCUtR connect message had no multiaddrs');
+      }
+      const multiaddrs = this.getDialableMultiaddrs(connect.observedAddresses);
+      if (multiaddrs.length === 0) {
+        this.log('B had no dialable multiaddrs');
+        throw new InvalidMessageError('DCUtR connect message had no dialable multiaddrs');
+      }
+      this.log('A sending connect');
+      await pb.write({
+        type: HolePunch.Type.CONNECT,
+        observedAddresses: this.addressManager.getAddresses().map(ma => ma.bytes)
+      });
+      this.log('A receiving sync');
+      const sync = await pb.read(options);
+      if (sync.type !== HolePunch.Type.SYNC) {
+        throw new InvalidMessageError('DCUtR message type was incorrect');
+      }
+      // TODO: when we have a QUIC transport, the dial step is different - for
+      // now we only have tcp support
+      // https://github.com/libp2p/specs/blob/master/relay/DCUtR.md#the-protocol
+      // Upon receiving the Sync, A immediately dials the address to B
+      this.log('A dialing', multiaddrs);
+      const connection = await this.connectionManager.openConnection(multiaddrs, {
+        signal: options.signal,
+        priority: DCUTR_DIAL_PRIORITY,
+        force: true
+      });
+      this.log('DCUtR to %p succeeded via %a, closing relayed connection', relayedConnection.remotePeer, connection.remoteAddr);
+      await relayedConnection.close(options);
+    } catch (err) {
+      this.log.error('incoming DCUtR from %p failed', relayedConnection.remotePeer, err);
+      stream.abort(err);
+    } finally {
+      await stream.close(options);
+    }
+  }
+  /**
+   * Takes the `addr` and converts it to a Multiaddr if possible
+   */
+  getDialableMultiaddrs(addrs) {
+    const output = [];
+    for (const addr of addrs) {
+      if (addr == null || addr.length === 0) {
+        continue;
+      }
+      try {
+        const ma = multiaddr(addr);
+        if (!isPublicAndDialable(ma, this.transportManager)) {
+          continue;
+        }
+        output.push(ma);
+      } catch {}
+    }
+    return output;
+  }
+}
+
+export { DefaultDCUtRService };