From 12dfa562d2d62eceaae57392ded2bc47a047fd6c Mon Sep 17 00:00:00 2001
From: "Brandon McGinty (chatgpt)" <git@bmcginty.us>
Date: Sun, 9 Aug 2026 14:20:42 -0400
Subject: [PATCH] Remove UDP crypto secrets from logs

---
 fix.txt                | 2 +-
 gumble/gumble/crypt.go | 7 +------
 gumble/gumble/udp15.go | 8 ++------
 3 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/fix.txt b/fix.txt
index a3a55c8..744e363 100644
--- a/fix.txt
+++ b/fix.txt
@@ -9,7 +9,7 @@ vendored Mumble C++ source were not treated as files to modify.
 Priority 0: security and crashers
 ---------------------------------
 
-1. UDP crypto secrets are logged
+[x] 1. UDP crypto secrets are logged
    Files: gumble/gumble/udp15.go, gumble/gumble/crypt.go
    Both crypto setup paths log the AES key and IV/nonce material at debug
    level. Anyone who obtains debug logs and a packet capture can decrypt
diff --git a/gumble/gumble/crypt.go b/gumble/gumble/crypt.go
index 9d74ea1..ce7d8e8 100644
--- a/gumble/gumble/crypt.go
+++ b/gumble/gumble/crypt.go
@@ -4,7 +4,6 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"encoding/binary"
-	"encoding/hex"
 	"errors"
 	"sync"
 
@@ -254,11 +253,7 @@ func (cs *cryptState) setup(key, iv []byte) error {
 	cs.initialized = true
 
 	if log.Enabled(log.LevelDebug) {
-		log.Debug("cryptState setup: key=%s iv=%s encIV=%s nonce_prefix=%s",
-			hex.EncodeToString(cs.key[:]),
-			hex.EncodeToString(iv),
-			hex.EncodeToString(encIV[:]),
-			hex.EncodeToString(cs.nonce[:]))
+		log.Debug("cryptState setup complete: key_len=%d iv_len=%d", len(key), len(iv))
 	}
 
 	return nil
diff --git a/gumble/gumble/udp15.go b/gumble/gumble/udp15.go
index dff68eb..61df239 100644
--- a/gumble/gumble/udp15.go
+++ b/gumble/gumble/udp15.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"crypto/aes"
 	"encoding/binary"
-	"encoding/hex"
 	"errors"
 	"math"
 	"sync"
@@ -219,10 +218,7 @@ func (cs *cryptState15) setup15(key, clientNonce, serverNonce []byte) error {
 	cs.initialized = true
 
 	if log.Enabled(log.LevelDebug) {
-		log.Debug("cryptState15 setup: key=%s encryptIV=%s decryptIV=%s",
-			hex.EncodeToString(cs.key[:]),
-			hex.EncodeToString(cs.encryptIV[:]),
-			hex.EncodeToString(cs.decryptIV[:]))
+		log.Debug("cryptState15 setup complete: key_len=%d nonce_len=%d", len(key), len(clientNonce))
 	}
 
 	return nil
@@ -648,7 +644,7 @@ func (c *Client) HandleUDPPacket15(packet []byte, pktNum uint64) {
 	}
 
 	if !c.udpFirstRecv.Swap(true) && log.Enabled(log.LevelDebug) {
-		log.Debug("UDP15 #%d: first packet received! hex=%s", pktNum, hex.EncodeToString(packet))
+		log.Debug("UDP15 #%d: first packet received (%d bytes)", pktNum, len(packet))
 	}
 
 	c.udpMu.RLock()