werift 0.24.1 → 0.24.2

package/lib/dtls/src/context/transport.d.ts

@@ -1,6 +1,6 @@
-import type { Transport } from "../imports/common";
+import type { Address, Transport } from "../imports/common";
 export declare class TransportContext {
     socket: Transport;
     constructor(socket: Transport);
-    readonly send: (buf: Buffer) => Promise<void>;
+    readonly send: (buf: Buffer, addr?: Address) => Promise<void>;
 }

package/lib/dtls/src/context/transport.js

@@ -13,8 +13,8 @@ class TransportContext {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: (buf) => {
-                return this.socket.send(buf);
+            value: (buf, addr) => {
+                return this.socket.send(buf, addr);
             }
         });
     }

package/lib/dtls/src/context/transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../../../dtls/src/context/transport.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAC3B,YAAmB,MAAiB;QAAxB;;;;mBAAO,MAAM;WAAW;QAE3B;;;;mBAAO,CAAC,GAAW,EAAE,EAAE;gBAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;WAAC;IAJqC,CAAC;CAKzC;AAND,4CAMC","sourcesContent":["import type { Transport } from \"../imports/common\";\n\nexport class TransportContext {\n  constructor(public socket: Transport) {}\n\n  readonly send = (buf: Buffer) => {\n    return this.socket.send(buf);\n  };\n}\n"]}
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../../../dtls/src/context/transport.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAC3B,YAAmB,MAAiB;QAAxB;;;;mBAAO,MAAM;WAAW;QAE3B;;;;mBAAO,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE;gBAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;WAAC;IAJqC,CAAC;CAKzC;AAND,4CAMC","sourcesContent":["import type { Address, Transport } from \"../imports/common\";\n\nexport class TransportContext {\n  constructor(public socket: Transport) {}\n\n  readonly send = (buf: Buffer, addr?: Address) => {\n    return this.socket.send(buf, addr);\n  };\n}\n"]}

package/lib/dtls/src/socket.d.ts

@@ -1,4 +1,5 @@
-import { Event, type Transport } from "./imports/common";
+import { Event } from "./imports/common";
+import type { Address, Transport } from "./imports/common";
 import { type SignatureHash } from "./cipher/const";
 import { type SessionTypes } from "./cipher/suites/abstract";
 import { CipherContext } from "./context/cipher";
@@ -30,7 +31,7 @@ export declare class DtlsSocket {
     protected waitForReady: (condition: () => boolean) => Promise<void>;
     handleFragmentHandshake(messages: FragmentedHandshake[]): FragmentedHandshake[];
     /**send application data */
-    send: (buf: Buffer) => Promise<void>;
+    send: (buf: Buffer, addr?: Address) => Promise<void>;
     close(): void;
     extractSessionKeys(keyLength: number, saltLength: number): {
         localKey: any;

package/lib/dtls/src/socket.js

@@ -176,9 +176,9 @@ class DtlsSocket {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: async (buf) => {
+            value: async (buf, addr) => {
                 const pkt = (0, builder_1.createPlaintext)(this.dtls)([{ type: const_2.ContentType.applicationData, fragment: buf }], ++this.dtls.recordSequenceNumber)[0];
-                await this.transport.send(this.cipher.encryptPacket(pkt).serialize());
+                await this.transport.send(this.cipher.encryptPacket(pkt).serialize(), addr);
             }
         });
         this.dtls = new dtls_1.DtlsContext(this.options, this.sessionType);

package/lib/dtls/src/socket.js.map

@@ -1 +1 @@
-{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../../../dtls/src/socket.ts"],"names":[],"mappings":";;;AAAA,2DAA0D;AAE1D,8CAA6C;AAC7C,6CAAgE;AAEhE,0CAIwB;AACxB,sCAAoD;AACpD,uDAA0E;AAC1E,6CAAiD;AACjD,yCAA6C;AAC7C,yCAA6C;AAC7C,mDAAuD;AACvD,0EAAuE;AACvE,sFAAmF;AACnF,4FAAyF;AACzF,gEAA6D;AAC7D,4DAAyD;AAEzD,8CAAmD;AACnD,0CAA6C;AAC7C,wDAAgE;AAChE,8CAA+D;AAG/D,MAAM,GAAG,GAAG,IAAA,cAAK,EAAC,iDAAiD,CAAC,CAAC;AACrE,MAAM,GAAG,GAAG,IAAA,cAAK,EAAC,iDAAiD,CAAC,CAAC;AAErE,MAAa,UAAU;IAgBrB,YACS,OAAgB,EAChB,WAAyB;QADhC;;;;mBAAO,OAAO;WAAS;QACvB;;;;mBAAO,WAAW;WAAc;QAjBzB;;;;mBAAY,IAAI,cAAK,EAAE;WAAC;QACxB;;;;mBAAS,IAAI,cAAK,EAAY;WAAC;QAC/B;;;;mBAAU,IAAI,cAAK,EAAW;WAAC;QAC/B;;;;mBAAU,IAAI,cAAK,EAAE;WAAC;QACtB;;;;;WAA4B;QACrC;;;;;WAAsB;QACtB;;;;;WAAkB;QAClB;;;;mBAAoB,IAAI,kBAAW,EAAE;WAAC;QAEtC;;;;mBAAY,KAAK;WAAC;QAClB;;;;mBAA0B,EAAE;WAAC;QAC7B;;;;;WAAyE;QAEjE;;;;mBAAoD,EAAE;WAAC;QAiCvD;;;;mBAAe,CAAC,IAAY,EAAE,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,IAAA,wBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;wBAChE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;4BAC/B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gCACrB,KAAK,mBAAW,CAAC,SAAS;oCACxB,CAAC;wCACC,MAAM,SAAS,GAAG,OAAO,CAAC,IAA2B,CAAC;wCACtD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;wCAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,UAAU,CAAC,MAAM,CACf,CAAC,GAA8C,EAAE,GAAG,EAAE,EAAE;4CACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;gDAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;4CAC/C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4CAC5B,OAAO,GAAG,CAAC;wCACb,CAAC,EACD,EAAE,CACH,CACF;6CACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;6CAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;wCAE3C,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;4CACjD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;4CAC5D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;wCAC9B,CAAC,CAAC,CAAC;oCACL,CAAC;oCACD,MAAM;gCACR,KAAK,mBAAW,CAAC,eAAe;oCAC9B,CAAC;wCACC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAc,CAAC,CAAC;oCAC9C,CAAC;oCACD,MAAM;gCACR,KAAK,mBAAW,CAAC,KAAK;oCACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oCACvB,MAAM;4BACV,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;WAAC;QAqCQ;;;;mBAAe,CAAC,SAAwB,EAAE,EAAE,CACpD,IAAI,OAAO,CAAO,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5B,IAAI,SAAS,EAAE,EAAE,CAAC;wBAChB,CAAC,EAAE,CAAC;wBACJ,MAAM;oBACR,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAA,qBAAU,EAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBACD,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC5B,CAAC,CAAC;WAAC;QAsBL,2BAA2B;QAC3B;;;;mBAAO,KAAK,EAAE,GAAW,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,IAAI,CAAC,CACpC,CAAC,EAAE,IAAI,EAAE,mBAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EACtD,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CACjC,CAAC,CAAC,CAAC,CAAC;gBACL,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;WAAC;QArJA,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,sBAAa,CAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,4BAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACnD,CAAC;IAED,aAAa;QACX,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,sBAAa,CAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC;IACvC,CAAC;IAiDO,eAAe;QACrB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,iBAAO,CAAC,MAAM,CAC5B,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,CAAC;YACC,MAAM,KAAK,GAAG,+BAAc,CAAC,WAAW,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,GAAG,+BAAuB,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,CAAC;YACC,MAAM,SAAS,GAAG,qBAAS,CAAC,WAAW,EAAE,CAAC;YAC1C,oDAAoD;YACpD,SAAS,CAAC,IAAI,GAAG,kBAAU,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,2CAAoB,CAAC,IAAI;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACtB,CAAC,CAAC;QACL,CAAC;QAED,CAAC;YACC,MAAM,uBAAuB,GAAG,iDAAuB,CAAC,WAAW,EAAE,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAeD,uBAAuB,CAAC,QAA+B;QACrD,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,kBAAkB;YAClB,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChE,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,0BAA0B,EAAE,GAAG,UAAU,CAAC,CAAC;gBACjE,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,kCAAkC;IACvD,CAAC;IAWD,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAC9C,qBAAqB,EACrB,SAAS,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,CAC/B,CAAC;QAEF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAA,oBAAM,EAC7D,cAAc,EACd;YACE,SAAS,EAAE,mBAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAClC,SAAS,EAAE,mBAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAClC,UAAU,EAAE,mBAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YACpC,UAAU,EAAE,mBAAK,CAAC,MAAM,CAAC,UAAU,CAAC;SACrC,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,KAAK,sBAAW,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,UAAU;aACvB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,UAAU;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,KAAa,EAAE,MAAc;QAChD,OAAO,IAAA,0BAAoB,EACzB,KAAK,EACL,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,YAAY,EACxB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,EACnC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EACpC,IAAI,CAAC,WAAW,KAAK,sBAAW,CAAC,MAAM,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACvC,CAAC;CACF;AA9ND,gCA8NC","sourcesContent":["import { decode, types } from \"@shinyoshiaki/binary-data\";\n\nimport { setTimeout } from \"timers/promises\";\nimport { Event, type Transport, debug } from \"./imports/common\";\n\nimport {\n  NamedCurveAlgorithmList,\n  type SignatureHash,\n  signatures,\n} from \"./cipher/const\";\nimport { exportKeyingMaterial } from \"./cipher/prf\";\nimport { SessionType, type SessionTypes } from \"./cipher/suites/abstract\";\nimport { CipherContext } from \"./context/cipher\";\nimport { DtlsContext } from \"./context/dtls\";\nimport { SrtpContext } from \"./context/srtp\";\nimport { TransportContext } from \"./context/transport\";\nimport { EllipticCurves } from \"./handshake/extensions/ellipticCurves\";\nimport { ExtendedMasterSecret } from \"./handshake/extensions/extendedMasterSecret\";\nimport { RenegotiationIndication } from \"./handshake/extensions/renegotiationIndication\";\nimport { Signature } from \"./handshake/extensions/signature\";\nimport { UseSRTP } from \"./handshake/extensions/useSrtp\";\nimport type { SrtpProfile } from \"./imports/rtp\";\nimport { createPlaintext } from \"./record/builder\";\nimport { ContentType } from \"./record/const\";\nimport { FragmentedHandshake } from \"./record/message/fragment\";\nimport { parsePacket, parsePlainText } from \"./record/receive\";\nimport type { Extension } from \"./typings/domain\";\n\nconst log = debug(\"werift-dtls : packages/dtls/src/socket.ts : log\");\nconst err = debug(\"werift-dtls : packages/dtls/src/socket.ts : err\");\n\nexport class DtlsSocket {\n  readonly onConnect = new Event();\n  readonly onData = new Event<[Buffer]>();\n  readonly onError = new Event<[Error]>();\n  readonly onClose = new Event();\n  readonly transport: TransportContext;\n  cipher: CipherContext;\n  dtls: DtlsContext;\n  srtp: SrtpContext = new SrtpContext();\n\n  connected = false;\n  extensions: Extension[] = [];\n  onHandleHandshakes!: (assembled: FragmentedHandshake[]) => Promise<void>;\n\n  private bufferFragmentedHandshakes: FragmentedHandshake[] = [];\n\n  constructor(\n    public options: Options,\n    public sessionType: SessionTypes,\n  ) {\n    this.dtls = new DtlsContext(this.options, this.sessionType);\n    this.cipher = new CipherContext(\n      this.sessionType,\n      this.options.cert,\n      this.options.key,\n      this.options.signatureHash,\n    );\n    this.transport = new TransportContext(this.options.transport);\n    this.setupExtensions();\n    this.transport.socket.onData = this.udpOnMessage;\n  }\n\n  renegotiation() {\n    log(\"renegotiation\", this.sessionType);\n    this.connected = false;\n    this.cipher = new CipherContext(\n      this.sessionType,\n      this.options.cert,\n      this.options.key,\n      this.options.signatureHash,\n    );\n    this.dtls = new DtlsContext(this.options, this.sessionType);\n    this.srtp = new SrtpContext();\n    this.extensions = [];\n    this.bufferFragmentedHandshakes = [];\n  }\n\n  private udpOnMessage = (data: Buffer) => {\n    const packets = parsePacket(data);\n\n    for (const packet of packets) {\n      try {\n        const messages = parsePlainText(this.dtls, this.cipher)(packet);\n        for (const message of messages) {\n          switch (message.type) {\n            case ContentType.handshake:\n              {\n                const handshake = message.data as FragmentedHandshake;\n                const handshakes = this.handleFragmentHandshake([handshake]);\n                const assembled = Object.values(\n                  handshakes.reduce(\n                    (acc: { [type: string]: FragmentedHandshake[] }, cur) => {\n                      if (!acc[cur.msg_type]) acc[cur.msg_type] = [];\n                      acc[cur.msg_type].push(cur);\n                      return acc;\n                    },\n                    {},\n                  ),\n                )\n                  .map((v) => FragmentedHandshake.assemble(v))\n                  .sort((a, b) => a.msg_type - b.msg_type);\n\n                this.onHandleHandshakes(assembled).catch((error) => {\n                  err(this.dtls.sessionId, \"onHandleHandshakes error\", error);\n                  this.onError.execute(error);\n                });\n              }\n              break;\n            case ContentType.applicationData:\n              {\n                this.onData.execute(message.data as Buffer);\n              }\n              break;\n            case ContentType.alert:\n              this.onClose.execute();\n              break;\n          }\n        }\n      } catch (error) {\n        err(this.dtls.sessionId, \"catch udpOnMessage error\", error);\n      }\n    }\n  };\n\n  private setupExtensions() {\n    log(this.dtls.sessionId, \"support srtpProfiles\", this.options.srtpProfiles);\n    if (this.options.srtpProfiles && this.options.srtpProfiles.length > 0) {\n      const useSrtp = UseSRTP.create(\n        this.options.srtpProfiles,\n        Buffer.from([0x00]),\n      );\n      this.extensions.push(useSrtp.extension);\n    }\n\n    {\n      const curve = EllipticCurves.createEmpty();\n      curve.data = NamedCurveAlgorithmList;\n      this.extensions.push(curve.extension);\n    }\n\n    {\n      const signature = Signature.createEmpty();\n      // libwebrtc/OpenSSL require 4=1 , 4=3 signatureHash\n      signature.data = signatures;\n      this.extensions.push(signature.extension);\n    }\n    if (this.options.extendedMasterSecret) {\n      this.extensions.push({\n        type: ExtendedMasterSecret.type,\n        data: Buffer.alloc(0),\n      });\n    }\n\n    {\n      const renegotiationIndication = RenegotiationIndication.createEmpty();\n      this.extensions.push(renegotiationIndication.extension);\n    }\n  }\n\n  protected waitForReady = (condition: () => boolean) =>\n    new Promise<void>(async (r, f) => {\n      for (let i = 0; i < 10; i++) {\n        if (condition()) {\n          r();\n          break;\n        } else {\n          await setTimeout(100 * i);\n        }\n      }\n      f(\"waitForReady timeout\");\n    });\n\n  handleFragmentHandshake(messages: FragmentedHandshake[]) {\n    let handshakes = messages.filter((v) => {\n      // find fragmented\n      if (v.fragment_length !== v.length) {\n        this.bufferFragmentedHandshakes.push(v);\n        return false;\n      }\n      return true;\n    });\n\n    if (this.bufferFragmentedHandshakes.length > 1) {\n      const [last] = this.bufferFragmentedHandshakes.slice(-1);\n      if (last.fragment_offset + last.fragment_length === last.length) {\n        handshakes = [...this.bufferFragmentedHandshakes, ...handshakes];\n        this.bufferFragmentedHandshakes = [];\n      }\n    }\n    return handshakes; // return un fragmented handshakes\n  }\n\n  /**send application data */\n  send = async (buf: Buffer) => {\n    const pkt = createPlaintext(this.dtls)(\n      [{ type: ContentType.applicationData, fragment: buf }],\n      ++this.dtls.recordSequenceNumber,\n    )[0];\n    await this.transport.send(this.cipher.encryptPacket(pkt).serialize());\n  };\n\n  close() {\n    this.transport.socket.close();\n  }\n\n  extractSessionKeys(keyLength: number, saltLength: number) {\n    const keyingMaterial = this.exportKeyingMaterial(\n      \"EXTRACTOR-dtls_srtp\",\n      keyLength * 2 + saltLength * 2,\n    );\n\n    const { clientKey, serverKey, clientSalt, serverSalt } = decode(\n      keyingMaterial,\n      {\n        clientKey: types.buffer(keyLength),\n        serverKey: types.buffer(keyLength),\n        clientSalt: types.buffer(saltLength),\n        serverSalt: types.buffer(saltLength),\n      },\n    );\n\n    if (this.sessionType === SessionType.CLIENT) {\n      return {\n        localKey: clientKey,\n        localSalt: clientSalt,\n        remoteKey: serverKey,\n        remoteSalt: serverSalt,\n      };\n    } else {\n      return {\n        localKey: serverKey,\n        localSalt: serverSalt,\n        remoteKey: clientKey,\n        remoteSalt: clientSalt,\n      };\n    }\n  }\n\n  exportKeyingMaterial(label: string, length: number) {\n    return exportKeyingMaterial(\n      label,\n      length,\n      this.cipher.masterSecret,\n      this.cipher.localRandom.serialize(),\n      this.cipher.remoteRandom.serialize(),\n      this.sessionType === SessionType.CLIENT,\n    );\n  }\n\n  get remoteCertificate() {\n    return this.cipher.remoteCertificate;\n  }\n}\n\nexport interface Options {\n  transport: Transport;\n  srtpProfiles?: SrtpProfile[];\n  cert?: string;\n  key?: string;\n  signatureHash?: SignatureHash;\n  certificateRequest?: boolean;\n  extendedMasterSecret?: boolean;\n}\n"]}
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../../../dtls/src/socket.ts"],"names":[],"mappings":";;;AAAA,2DAA0D;AAE1D,8CAA6C;AAC7C,6CAAgD;AAGhD,0CAIwB;AACxB,sCAAoD;AACpD,uDAA0E;AAC1E,6CAAiD;AACjD,yCAA6C;AAC7C,yCAA6C;AAC7C,mDAAuD;AACvD,0EAAuE;AACvE,sFAAmF;AACnF,4FAAyF;AACzF,gEAA6D;AAC7D,4DAAyD;AAEzD,8CAAmD;AACnD,0CAA6C;AAC7C,wDAAgE;AAChE,8CAA+D;AAG/D,MAAM,GAAG,GAAG,IAAA,cAAK,EAAC,iDAAiD,CAAC,CAAC;AACrE,MAAM,GAAG,GAAG,IAAA,cAAK,EAAC,iDAAiD,CAAC,CAAC;AAErE,MAAa,UAAU;IAgBrB,YACS,OAAgB,EAChB,WAAyB;QADhC;;;;mBAAO,OAAO;WAAS;QACvB;;;;mBAAO,WAAW;WAAc;QAjBzB;;;;mBAAY,IAAI,cAAK,EAAE;WAAC;QACxB;;;;mBAAS,IAAI,cAAK,EAAY;WAAC;QAC/B;;;;mBAAU,IAAI,cAAK,EAAW;WAAC;QAC/B;;;;mBAAU,IAAI,cAAK,EAAE;WAAC;QACtB;;;;;WAA4B;QACrC;;;;;WAAsB;QACtB;;;;;WAAkB;QAClB;;;;mBAAoB,IAAI,kBAAW,EAAE;WAAC;QAEtC;;;;mBAAY,KAAK;WAAC;QAClB;;;;mBAA0B,EAAE;WAAC;QAC7B;;;;;WAAyE;QAEjE;;;;mBAAoD,EAAE;WAAC;QAiCvD;;;;mBAAe,CAAC,IAAY,EAAE,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,IAAA,wBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;wBAChE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;4BAC/B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gCACrB,KAAK,mBAAW,CAAC,SAAS;oCACxB,CAAC;wCACC,MAAM,SAAS,GAAG,OAAO,CAAC,IAA2B,CAAC;wCACtD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;wCAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,UAAU,CAAC,MAAM,CACf,CAAC,GAA8C,EAAE,GAAG,EAAE,EAAE;4CACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;gDAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;4CAC/C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4CAC5B,OAAO,GAAG,CAAC;wCACb,CAAC,EACD,EAAE,CACH,CACF;6CACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;6CAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;wCAE3C,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;4CACjD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;4CAC5D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;wCAC9B,CAAC,CAAC,CAAC;oCACL,CAAC;oCACD,MAAM;gCACR,KAAK,mBAAW,CAAC,eAAe;oCAC9B,CAAC;wCACC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAc,CAAC,CAAC;oCAC9C,CAAC;oCACD,MAAM;gCACR,KAAK,mBAAW,CAAC,KAAK;oCACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oCACvB,MAAM;4BACV,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;WAAC;QAqCQ;;;;mBAAe,CAAC,SAAwB,EAAE,EAAE,CACpD,IAAI,OAAO,CAAO,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5B,IAAI,SAAS,EAAE,EAAE,CAAC;wBAChB,CAAC,EAAE,CAAC;wBACJ,MAAM;oBACR,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAA,qBAAU,EAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBACD,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC5B,CAAC,CAAC;WAAC;QAsBL,2BAA2B;QAC3B;;;;mBAAO,KAAK,EAAE,GAAW,EAAE,IAAc,EAAE,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,IAAI,CAAC,CACpC,CAAC,EAAE,IAAI,EAAE,mBAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EACtD,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CACjC,CAAC,CAAC,CAAC,CAAC;gBACL,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9E,CAAC;WAAC;QArJA,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,sBAAa,CAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,4BAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACnD,CAAC;IAED,aAAa;QACX,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,sBAAa,CAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,IAAI,kBAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC;IACvC,CAAC;IAiDO,eAAe;QACrB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,iBAAO,CAAC,MAAM,CAC5B,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,CAAC;YACC,MAAM,KAAK,GAAG,+BAAc,CAAC,WAAW,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,GAAG,+BAAuB,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,CAAC;YACC,MAAM,SAAS,GAAG,qBAAS,CAAC,WAAW,EAAE,CAAC;YAC1C,oDAAoD;YACpD,SAAS,CAAC,IAAI,GAAG,kBAAU,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,2CAAoB,CAAC,IAAI;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACtB,CAAC,CAAC;QACL,CAAC;QAED,CAAC;YACC,MAAM,uBAAuB,GAAG,iDAAuB,CAAC,WAAW,EAAE,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAeD,uBAAuB,CAAC,QAA+B;QACrD,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,kBAAkB;YAClB,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChE,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,0BAA0B,EAAE,GAAG,UAAU,CAAC,CAAC;gBACjE,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,kCAAkC;IACvD,CAAC;IAWD,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAC9C,qBAAqB,EACrB,SAAS,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,CAC/B,CAAC;QAEF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAA,oBAAM,EAC7D,cAAc,EACd;YACE,SAAS,EAAE,mBAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAClC,SAAS,EAAE,mBAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAClC,UAAU,EAAE,mBAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YACpC,UAAU,EAAE,mBAAK,CAAC,MAAM,CAAC,UAAU,CAAC;SACrC,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,KAAK,sBAAW,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,UAAU;aACvB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,UAAU;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,KAAa,EAAE,MAAc;QAChD,OAAO,IAAA,0BAAoB,EACzB,KAAK,EACL,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,YAAY,EACxB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,EACnC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EACpC,IAAI,CAAC,WAAW,KAAK,sBAAW,CAAC,MAAM,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACvC,CAAC;CACF;AA9ND,gCA8NC","sourcesContent":["import { decode, types } from \"@shinyoshiaki/binary-data\";\n\nimport { setTimeout } from \"timers/promises\";\nimport { Event, debug } from \"./imports/common\";\nimport type { Address, Transport } from \"./imports/common\";\n\nimport {\n  NamedCurveAlgorithmList,\n  type SignatureHash,\n  signatures,\n} from \"./cipher/const\";\nimport { exportKeyingMaterial } from \"./cipher/prf\";\nimport { SessionType, type SessionTypes } from \"./cipher/suites/abstract\";\nimport { CipherContext } from \"./context/cipher\";\nimport { DtlsContext } from \"./context/dtls\";\nimport { SrtpContext } from \"./context/srtp\";\nimport { TransportContext } from \"./context/transport\";\nimport { EllipticCurves } from \"./handshake/extensions/ellipticCurves\";\nimport { ExtendedMasterSecret } from \"./handshake/extensions/extendedMasterSecret\";\nimport { RenegotiationIndication } from \"./handshake/extensions/renegotiationIndication\";\nimport { Signature } from \"./handshake/extensions/signature\";\nimport { UseSRTP } from \"./handshake/extensions/useSrtp\";\nimport type { SrtpProfile } from \"./imports/rtp\";\nimport { createPlaintext } from \"./record/builder\";\nimport { ContentType } from \"./record/const\";\nimport { FragmentedHandshake } from \"./record/message/fragment\";\nimport { parsePacket, parsePlainText } from \"./record/receive\";\nimport type { Extension } from \"./typings/domain\";\n\nconst log = debug(\"werift-dtls : packages/dtls/src/socket.ts : log\");\nconst err = debug(\"werift-dtls : packages/dtls/src/socket.ts : err\");\n\nexport class DtlsSocket {\n  readonly onConnect = new Event();\n  readonly onData = new Event<[Buffer]>();\n  readonly onError = new Event<[Error]>();\n  readonly onClose = new Event();\n  readonly transport: TransportContext;\n  cipher: CipherContext;\n  dtls: DtlsContext;\n  srtp: SrtpContext = new SrtpContext();\n\n  connected = false;\n  extensions: Extension[] = [];\n  onHandleHandshakes!: (assembled: FragmentedHandshake[]) => Promise<void>;\n\n  private bufferFragmentedHandshakes: FragmentedHandshake[] = [];\n\n  constructor(\n    public options: Options,\n    public sessionType: SessionTypes,\n  ) {\n    this.dtls = new DtlsContext(this.options, this.sessionType);\n    this.cipher = new CipherContext(\n      this.sessionType,\n      this.options.cert,\n      this.options.key,\n      this.options.signatureHash,\n    );\n    this.transport = new TransportContext(this.options.transport);\n    this.setupExtensions();\n    this.transport.socket.onData = this.udpOnMessage;\n  }\n\n  renegotiation() {\n    log(\"renegotiation\", this.sessionType);\n    this.connected = false;\n    this.cipher = new CipherContext(\n      this.sessionType,\n      this.options.cert,\n      this.options.key,\n      this.options.signatureHash,\n    );\n    this.dtls = new DtlsContext(this.options, this.sessionType);\n    this.srtp = new SrtpContext();\n    this.extensions = [];\n    this.bufferFragmentedHandshakes = [];\n  }\n\n  private udpOnMessage = (data: Buffer) => {\n    const packets = parsePacket(data);\n\n    for (const packet of packets) {\n      try {\n        const messages = parsePlainText(this.dtls, this.cipher)(packet);\n        for (const message of messages) {\n          switch (message.type) {\n            case ContentType.handshake:\n              {\n                const handshake = message.data as FragmentedHandshake;\n                const handshakes = this.handleFragmentHandshake([handshake]);\n                const assembled = Object.values(\n                  handshakes.reduce(\n                    (acc: { [type: string]: FragmentedHandshake[] }, cur) => {\n                      if (!acc[cur.msg_type]) acc[cur.msg_type] = [];\n                      acc[cur.msg_type].push(cur);\n                      return acc;\n                    },\n                    {},\n                  ),\n                )\n                  .map((v) => FragmentedHandshake.assemble(v))\n                  .sort((a, b) => a.msg_type - b.msg_type);\n\n                this.onHandleHandshakes(assembled).catch((error) => {\n                  err(this.dtls.sessionId, \"onHandleHandshakes error\", error);\n                  this.onError.execute(error);\n                });\n              }\n              break;\n            case ContentType.applicationData:\n              {\n                this.onData.execute(message.data as Buffer);\n              }\n              break;\n            case ContentType.alert:\n              this.onClose.execute();\n              break;\n          }\n        }\n      } catch (error) {\n        err(this.dtls.sessionId, \"catch udpOnMessage error\", error);\n      }\n    }\n  };\n\n  private setupExtensions() {\n    log(this.dtls.sessionId, \"support srtpProfiles\", this.options.srtpProfiles);\n    if (this.options.srtpProfiles && this.options.srtpProfiles.length > 0) {\n      const useSrtp = UseSRTP.create(\n        this.options.srtpProfiles,\n        Buffer.from([0x00]),\n      );\n      this.extensions.push(useSrtp.extension);\n    }\n\n    {\n      const curve = EllipticCurves.createEmpty();\n      curve.data = NamedCurveAlgorithmList;\n      this.extensions.push(curve.extension);\n    }\n\n    {\n      const signature = Signature.createEmpty();\n      // libwebrtc/OpenSSL require 4=1 , 4=3 signatureHash\n      signature.data = signatures;\n      this.extensions.push(signature.extension);\n    }\n    if (this.options.extendedMasterSecret) {\n      this.extensions.push({\n        type: ExtendedMasterSecret.type,\n        data: Buffer.alloc(0),\n      });\n    }\n\n    {\n      const renegotiationIndication = RenegotiationIndication.createEmpty();\n      this.extensions.push(renegotiationIndication.extension);\n    }\n  }\n\n  protected waitForReady = (condition: () => boolean) =>\n    new Promise<void>(async (r, f) => {\n      for (let i = 0; i < 10; i++) {\n        if (condition()) {\n          r();\n          break;\n        } else {\n          await setTimeout(100 * i);\n        }\n      }\n      f(\"waitForReady timeout\");\n    });\n\n  handleFragmentHandshake(messages: FragmentedHandshake[]) {\n    let handshakes = messages.filter((v) => {\n      // find fragmented\n      if (v.fragment_length !== v.length) {\n        this.bufferFragmentedHandshakes.push(v);\n        return false;\n      }\n      return true;\n    });\n\n    if (this.bufferFragmentedHandshakes.length > 1) {\n      const [last] = this.bufferFragmentedHandshakes.slice(-1);\n      if (last.fragment_offset + last.fragment_length === last.length) {\n        handshakes = [...this.bufferFragmentedHandshakes, ...handshakes];\n        this.bufferFragmentedHandshakes = [];\n      }\n    }\n    return handshakes; // return un fragmented handshakes\n  }\n\n  /**send application data */\n  send = async (buf: Buffer, addr?: Address) => {\n    const pkt = createPlaintext(this.dtls)(\n      [{ type: ContentType.applicationData, fragment: buf }],\n      ++this.dtls.recordSequenceNumber,\n    )[0];\n    await this.transport.send(this.cipher.encryptPacket(pkt).serialize(), addr);\n  };\n\n  close() {\n    this.transport.socket.close();\n  }\n\n  extractSessionKeys(keyLength: number, saltLength: number) {\n    const keyingMaterial = this.exportKeyingMaterial(\n      \"EXTRACTOR-dtls_srtp\",\n      keyLength * 2 + saltLength * 2,\n    );\n\n    const { clientKey, serverKey, clientSalt, serverSalt } = decode(\n      keyingMaterial,\n      {\n        clientKey: types.buffer(keyLength),\n        serverKey: types.buffer(keyLength),\n        clientSalt: types.buffer(saltLength),\n        serverSalt: types.buffer(saltLength),\n      },\n    );\n\n    if (this.sessionType === SessionType.CLIENT) {\n      return {\n        localKey: clientKey,\n        localSalt: clientSalt,\n        remoteKey: serverKey,\n        remoteSalt: serverSalt,\n      };\n    } else {\n      return {\n        localKey: serverKey,\n        localSalt: serverSalt,\n        remoteKey: clientKey,\n        remoteSalt: clientSalt,\n      };\n    }\n  }\n\n  exportKeyingMaterial(label: string, length: number) {\n    return exportKeyingMaterial(\n      label,\n      length,\n      this.cipher.masterSecret,\n      this.cipher.localRandom.serialize(),\n      this.cipher.remoteRandom.serialize(),\n      this.sessionType === SessionType.CLIENT,\n    );\n  }\n\n  get remoteCertificate() {\n    return this.cipher.remoteCertificate;\n  }\n}\n\nexport interface Options {\n  transport: Transport;\n  srtpProfiles?: SrtpProfile[];\n  cert?: string;\n  key?: string;\n  signatureHash?: SignatureHash;\n  certificateRequest?: boolean;\n  extendedMasterSecret?: boolean;\n}\n"]}

package/lib/ice/src/ice.d.ts

@@ -35,6 +35,12 @@ export declare class Connection implements IceConnection {
     private localCandidatesStart;
     private protocols;
     private queryConsentHandle?;
+    /** RFC 7675 consent-to-send: application data may use the selected pair. */
+    private consentFresh;
+    /** Invalidates in-flight consent callbacks on restart / close / replace / expire. */
+    private consentSessionId;
+    private consentExpiryTimer?;
+    private consentRequestAbort?;
     readonly onData: Event<[Buffer<ArrayBufferLike>]>;
     readonly stateChanged: Event<[IceState]>;
     readonly onIceCandidate: Event<[Candidate]>;
@@ -56,6 +62,19 @@ export declare class Connection implements IceConnection {
     connect(): Promise<void>;
     private unfreezeInitial;
     private schedulingChecks;
+    /**
+     * Stop consent request cadence, expiry timer, and outstanding transactions.
+     * Does not change ICE state by itself.
+     */
+    private stopConsentLifecycle;
+    /**
+     * ICE-lite interop only (not required by RFC 7675): mirror libwebrtc
+     * semi-aggressive nomination — attach USE-CANDIDATE when we are controlling,
+     * the remote is ICE-lite, and the target is the current selected pair.
+     */
+    private shouldNominateConsentRequest;
+    private canSendApplicationData;
+    private abortableDelay;
     private queryConsent;
     close(): Promise<void>;
     private setState;
@@ -67,6 +86,7 @@ export declare class Connection implements IceConnection {
     get candidatePairs(): CandidatePair[];
     private sortCheckList;
     private findPair;
+    private applyIceControlling;
     private switchRole;
     private checkComplete;
     checkStart: (pair: CandidatePair) => {

package/lib/ice/src/ice.js

@@ -220,6 +220,32 @@ class Connection {
             writable: true,
             value: void 0
         });
+        /** RFC 7675 consent-to-send: application data may use the selected pair. */
+        Object.defineProperty(this, "consentFresh", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        /** Invalidates in-flight consent callbacks on restart / close / replace / expire. */
+        Object.defineProperty(this, "consentSessionId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "consentExpiryTimer", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "consentRequestAbort", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "onData", {
             enumerable: true,
             configurable: true,
@@ -238,7 +264,7 @@ class Connection {
             writable: true,
             value: new common_1.Event()
         });
-        // 4.1.1.4 ? 生存確認 life check
+        // RFC 7675 consent freshness
         Object.defineProperty(this, "queryConsent", {
             enumerable: true,
             configurable: true,
@@ -247,70 +273,164 @@ class Connection {
                 if (this.iceLite) {
                     return;
                 }
-                if (this.queryConsentHandle) {
-                    this.queryConsentHandle.resolve();
-                }
-                this.queryConsentHandle = (0, helper_1.cancelable)(async (_, __, onCancel) => {
-                    let failures = 0;
+                // Invalidate any previous consent session before starting a new one.
+                this.stopConsentLifecycle();
+                const sessionId = this.consentSessionId;
+                this.consentFresh = true;
+                const handle = (0, helper_1.cancelable)(async (_, __, onCancel) => {
                     let canceled = false;
                     const cancelEvent = new AbortController();
+                    const clearConsentExpiry = () => {
+                        if (this.consentExpiryTimer === undefined) {
+                            return;
+                        }
+                        clearTimeout(this.consentExpiryTimer);
+                        this.consentExpiryTimer = undefined;
+                    };
+                    const refreshConsentExpiry = () => {
+                        // Only the active session may refresh the shared expiry timer.
+                        if (canceled || sessionId !== this.consentSessionId) {
+                            return;
+                        }
+                        clearConsentExpiry();
+                        this.consentExpiryTimer = setTimeout(() => {
+                            this.consentExpiryTimer = undefined;
+                            if (canceled || sessionId !== this.consentSessionId) {
+                                return;
+                            }
+                            if (this.state === "closed" || this.state === "failed") {
+                                return;
+                            }
+                            log("Consent to send expired");
+                            // Expire independently of request cadence / failure count (RFC 7675).
+                            this.consentFresh = false;
+                            this.consentSessionId++;
+                            this.consentRequestAbort?.abort();
+                            this.consentRequestAbort = undefined;
+                            if (this.queryConsentHandle === handle) {
+                                this.queryConsentHandle = undefined;
+                            }
+                            canceled = true;
+                            cancelEvent.abort();
+                            // Transport stays available for ICE restart; explicit close() uses "closed".
+                            this.setState("failed");
+                        }, iceBase_1.CONSENT_TIMEOUT * 1000);
+                    };
                     onCancel.once(() => {
                         canceled = true;
-                        failures += iceBase_1.CONSENT_FAILURES;
+                        // Avoid clearing a replacement session's timer/handle.
+                        if (sessionId === this.consentSessionId) {
+                            clearConsentExpiry();
+                            this.consentRequestAbort?.abort();
+                            this.consentRequestAbort = undefined;
+                        }
                         cancelEvent.abort();
-                        this.queryConsentHandle = undefined;
+                        if (this.queryConsentHandle === handle) {
+                            this.queryConsentHandle = undefined;
+                        }
                     });
-                    const { localUsername, remoteUsername, iceControlling } = this;
-                    // """
-                    // Periodically check consent (RFC 7675).
-                    // """
+                    // Initial ICE check success is the first valid consent response.
+                    refreshConsentExpiry();
+                    const randomizedConsentInterval = () => iceBase_1.CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1000;
+                    // Cadence is measured between request *starts*, not response completions.
+                    let nextConsentAt = Date.now() + randomizedConsentInterval();
+                    const isTerminalState = () => this.state === "closed" || this.state === "failed";
                     try {
-                        while (this.state !== "closed" && !canceled) {
-                            // # randomize between 0.8 and 1.2 times CONSENT_INTERVAL
-                            await timers.setTimeout(iceBase_1.CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1000, undefined, { signal: cancelEvent.signal });
+                        while (!isTerminalState() &&
+                            !canceled &&
+                            sessionId === this.consentSessionId) {
+                            await this.abortableDelay(Math.max(0, nextConsentAt - Date.now()), cancelEvent.signal);
+                            if (canceled ||
+                                isTerminalState() ||
+                                sessionId !== this.consentSessionId) {
+                                break;
+                            }
+                            // Fix next start time before awaiting any response (independent timers).
+                            nextConsentAt = Date.now() + randomizedConsentInterval();
                             const nominated = this.nominated;
-                            if (!nominated || canceled) {
+                            if (!nominated) {
                                 break;
                             }
+                            const pairId = nominated.id;
+                            const generation = this.generation;
+                            const remotePassword = this.remotePassword;
+                            const { localUsername, remoteUsername, iceControlling } = this;
                             const request = this.buildRequest({
-                                nominate: false,
+                                nominate: this.shouldNominateConsentRequest(nominated),
                                 localUsername,
                                 remoteUsername,
                                 iceControlling,
                                 localCandidate: nominated.localCandidate,
                             });
-                            try {
-                                nominated.consentRequestsSent++;
-                                nominated.requestsSent++;
-                                await nominated.protocol.request(request, nominated.remoteAddr, Buffer.from(this.remotePassword, "utf8"), 0, (attempt) => {
+                            this.consentRequestAbort?.abort();
+                            const requestAbort = new AbortController();
+                            this.consentRequestAbort = requestAbort;
+                            nominated.consentRequestsSent++;
+                            nominated.requestsSent++;
+                            // RTT-aware wait (floor 500ms); independent of retransmissions: 0.
+                            const responseTimeout = (0, iceBase_1.consentResponseTimeoutMs)(nominated.rtt);
+                            const requestStartedAt = performance.now();
+                            // Do not await here: response wait must not stretch the 4–6s cadence.
+                            nominated.protocol
+                                .request(request, nominated.remoteAddr, Buffer.from(remotePassword, "utf8"), {
+                                retransmissions: 0,
+                                responseTimeout,
+                                signal: requestAbort.signal,
+                                onRequestSent: (attempt) => {
                                     if (attempt > 0) {
                                         nominated.retransmissionsSent++;
                                     }
-                                });
+                                },
+                            })
+                                .then(() => {
+                                // Accept only responses for the current pair / generation / session.
+                                // Address / MESSAGE-INTEGRITY / response class are enforced in Transaction + protocol.
+                                if (sessionId !== this.consentSessionId || canceled) {
+                                    return;
+                                }
+                                const state = this.state;
+                                if (state === "closed" || state === "failed") {
+                                    return;
+                                }
+                                if (this.nominated?.id !== pairId) {
+                                    return;
+                                }
+                                if (this.generation !== generation) {
+                                    return;
+                                }
+                                if (this.remotePassword !== remotePassword) {
+                                    return;
+                                }
+                                const rtt = (performance.now() - requestStartedAt) / 1000; // seconds
+                                nominated.rtt = rtt;
+                                nominated.totalRoundTripTime += rtt;
+                                nominated.roundTripTimeMeasurements++;
                                 nominated.responsesReceived++;
-                                failures = 0;
-                                if (this.state === "disconnected") {
+                                this.consentFresh = true;
+                                refreshConsentExpiry();
+                                if (state === "disconnected") {
                                     this.setState("connected");
                                 }
-                            }
-                            catch (error) {
-                                if (nominated.id === this.nominated?.id) {
-                                    log("no stun response");
-                                    failures++;
-                                    this.setState("disconnected");
-                                    break;
+                            })
+                                .catch((error) => {
+                                // Individual request loss is expected; keep monitoring (RFC 7675).
+                                if (sessionId === this.consentSessionId &&
+                                    this.nominated?.id === pairId) {
+                                    log("no stun response", error);
                                 }
-                            }
-                            if (failures >= iceBase_1.CONSENT_FAILURES) {
-                                log("Consent to send expired");
-                                this.queryConsentHandle = undefined;
-                                this.setState("closed");
-                                break;
-                            }
+                            });
+                        }
+                    }
+                    catch (error) {
+                        // Abort during delay is normal on cancel / expire.
+                    }
+                    finally {
+                        if (sessionId === this.consentSessionId) {
+                            clearConsentExpiry();
                         }
                     }
-                    catch (error) { }
                 });
+                this.queryConsentHandle = handle;
             }
         });
         Object.defineProperty(this, "send", {
@@ -318,17 +438,15 @@ class Connection {
             configurable: true,
             writable: true,
             value: async (data) => {
-                const activePair = this.nominated;
-                if (activePair) {
-                    await activePair.protocol.sendData(data, activePair.remoteAddr);
-                    // Update statistics
-                    activePair.packetsSent++;
-                    activePair.bytesSent += data.length;
-                }
-                else {
-                    // log("Cannot send data, ice not connected");
+                // RFC 7675: after consent expiry, do not send application data on the 5-tuple.
+                if (!this.canSendApplicationData()) {
                     return;
                 }
+                const activePair = this.nominated;
+                await activePair.protocol.sendData(data, activePair.remoteAddr);
+                // Update statistics
+                activePair.packetsSent++;
+                activePair.bytesSent += data.length;
             }
         });
         // 3.  Terminology : Check
@@ -492,13 +610,13 @@ class Connection {
         if (this.iceLite) {
             value = false;
         }
-        if (this.generation > 0 || this.nominated) {
+        // While a pair is selected, keep the negotiated role. ICE restart clears
+        // `nominated`, so offer/answer role and RFC 8445 role-conflict repair can
+        // reassign controlling/controlled for the new generation.
+        if (this.nominated) {
             return;
         }
-        this._iceControlling = value;
-        for (const pair of this.checkList) {
-            pair.iceControlling = value;
-        }
+        this.applyIceControlling(value);
     }
     get iceLite() {
         return this.options.iceLite;
@@ -538,13 +656,15 @@ class Connection {
                 protocol.localCandidate.ufrag = this.localUsername;
             }
         }
-        this.queryConsentHandle?.resolve?.();
-        this.queryConsentHandle = undefined;
+        // Tear down consent timers/transactions; new credentials require a new session.
+        this.stopConsentLifecycle();
     }
     resetNominatedPair() {
         log("resetNominatedPair");
         this.nominated = undefined;
         this.nominating = false;
+        // Drop old pair's consent timers/transactions; restarted when a new pair is nominated.
+        this.stopConsentLifecycle();
     }
     setRemoteParams({ iceLite, usernameFragment, password, }) {
         log("setRemoteParams", { iceLite, usernameFragment, password });
@@ -556,6 +676,15 @@ class Connection {
     async gatherCandidates() {
         if (!this.localCandidatesStart) {
             this.localCandidatesStart = true;
+            // ICE restart keeps transport protocols; re-advertise their host candidates
+            // with the new generation / ufrag before gathering additional addresses.
+            for (const protocol of this.protocols) {
+                if (protocol.localCandidate) {
+                    protocol.localCandidate.generation = this.generation;
+                    protocol.localCandidate.ufrag = this.localUsername;
+                    this.appendLocalCandidate(protocol.localCandidate);
+                }
+            }
             let address = (0, utils_1.getHostAddresses)(this.options.useIpv4, this.options.useIpv6, {
                 useLinkLocalAddress: this.options.useLinkLocalAddress,
             });
@@ -917,13 +1046,69 @@ class Connection {
         }
         return false;
     }
+    /**
+     * Stop consent request cadence, expiry timer, and outstanding transactions.
+     * Does not change ICE state by itself.
+     */
+    stopConsentLifecycle() {
+        this.consentSessionId++;
+        this.consentFresh = false;
+        if (this.consentExpiryTimer !== undefined) {
+            clearTimeout(this.consentExpiryTimer);
+            this.consentExpiryTimer = undefined;
+        }
+        this.consentRequestAbort?.abort();
+        this.consentRequestAbort = undefined;
+        const handle = this.queryConsentHandle;
+        this.queryConsentHandle = undefined;
+        // Resolve after clearing the field so a stale onCancel cannot wipe a replacement.
+        handle?.resolve?.();
+    }
+    /**
+     * ICE-lite interop only (not required by RFC 7675): mirror libwebrtc
+     * semi-aggressive nomination — attach USE-CANDIDATE when we are controlling,
+     * the remote is ICE-lite, and the target is the current selected pair.
+     */
+    shouldNominateConsentRequest(pair) {
+        return (this.iceControlling && this.remoteIsLite && this.nominated?.id === pair.id);
+    }
+    canSendApplicationData() {
+        if (!this.nominated) {
+            return false;
+        }
+        if (this.state === "closed" || this.state === "failed") {
+            return false;
+        }
+        // Local ICE-lite does not run consent checks; full agents need fresh consent.
+        if (this.iceLite) {
+            return true;
+        }
+        return this.consentFresh;
+    }
+    abortableDelay(ms, signal) {
+        return new Promise((resolve, reject) => {
+            if (signal.aborted) {
+                reject(new DOMException("The operation was aborted", "AbortError"));
+                return;
+            }
+            const timer = setTimeout(() => {
+                signal.removeEventListener("abort", onAbort);
+                resolve();
+            }, ms);
+            const onAbort = () => {
+                clearTimeout(timer);
+                reject(new DOMException("The operation was aborted", "AbortError"));
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+        });
+    }
     async close() {
         // """
         // Close the connection.
         // """
         this.setState("closed");
         // # stop consent freshness tests
-        this.queryConsentHandle?.resolve?.();
+        this.stopConsentLifecycle();
         // # stop check list
         if (this.checkList && !this.checkListDone) {
             this.checkListState.put(new Promise((r) => {
@@ -1012,9 +1197,20 @@ class Connection {
         const pair = this.checkList.find((pair) => pair.protocol === protocol && pair.remoteCandidate === remoteCandidate);
         return pair;
     }
+    applyIceControlling(iceControlling) {
+        this._iceControlling = iceControlling;
+        for (const pair of this.checkList) {
+            pair.iceControlling = iceControlling;
+        }
+    }
     switchRole(iceControlling) {
         log("switch role", iceControlling);
-        this.iceControlling = iceControlling;
+        // Role conflicts must be repaired even after a prior generation or while
+        // connectivity checks are in flight (RFC 8445 §7.2.5.1 / §7.3.1.1).
+        if (this.iceLite) {
+            iceControlling = false;
+        }
+        this.applyIceControlling(iceControlling);
         this.sortCheckList();
     }
     checkComplete(pair) {
@@ -1035,6 +1231,12 @@ class Connection {
                 this.nominated = pair;
                 this.nominating = false;
                 this.pruneTcpConnections(pair);
+                // After resetNominatedPair / renomination while already connected,
+                // restart consent freshness on the new selected pair.
+                if (!this.iceLite &&
+                    (this.state === "connected" || this.state === "completed")) {
+                    this.queryConsent();
+                }
                 // 8.1.2.  Updating States
                 // The agent MUST remove all Waiting and Frozen pairs in the check
                 // list and triggered check queue for the same component as the