From 3ca57a847cd0da3321f7ba50b5857990cb640bb1 Mon Sep 17 00:00:00 2001
From: "Brandon McGinty (deepseek)" <git@bmcginty.us>
Date: Sat, 8 Aug 2026 22:50:12 -0400
Subject: [PATCH] fix: improve CryptSetup and UDP receive logging

- Suppress 'incomplete fields' log spam after crypto is initialized
  (server sends partial CryptSetup for key rotation)
- Log 'CryptSetup updated' at debug when keys are refreshed
- Add warning log when UDP decryption fails (OCB auth error)
- Add debug log for UDP packets from unknown sessions
- Add debug log for UDP packets before crypto is ready
---
 gumble/gumble/crypt.go | 14 ++++++++++----
 gumble/gumble/udp.go   |  3 +++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/gumble/gumble/crypt.go b/gumble/gumble/crypt.go
index 85658f8..58f8572 100644
--- a/gumble/gumble/crypt.go
+++ b/gumble/gumble/crypt.go
@@ -290,12 +290,18 @@ func (c *Client) handleCryptSetup(buffer []byte) error {
 	defer c.volatile.Unlock()
 
 	if packet.Key != nil && packet.ClientNonce != nil && packet.ServerNonce != nil {
-		log.Info("received CryptSetup: key_len=%d client_nonce_len=%d server_nonce_len=%d",
-			len(packet.Key), len(packet.ClientNonce), len(packet.ServerNonce))
+		wasInit := c.cryptOut.initialized
 		c.cryptOut.setup(packet.Key, packet.ClientNonce)
 		c.cryptIn.setup(packet.Key, packet.ServerNonce)
-	} else {
-		log.Debug("received CryptSetup with incomplete fields")
+		if wasInit {
+			log.Debug("CryptSetup updated (key rotation)")
+		} else {
+			log.Info("received CryptSetup: key_len=%d client_nonce_len=%d server_nonce_len=%d",
+				len(packet.Key), len(packet.ClientNonce), len(packet.ServerNonce))
+		}
+	} else if !c.cryptOut.initialized {
+		// Only log incomplete once before crypto is set up
+		log.Debug("received CryptSetup with incomplete fields, waiting for full key exchange")
 	}
 
 	if c.cryptOut.initialized && c.udpConn != nil && !c.udpActive {
diff --git a/gumble/gumble/udp.go b/gumble/gumble/udp.go
index 3413ed5..a035b04 100644
--- a/gumble/gumble/udp.go
+++ b/gumble/gumble/udp.go
@@ -206,6 +206,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 
 	user := c.Users[uint32(session)]
 	if user == nil {
+		log.Debug("UDP packet from unknown session %d", session)
 		return
 	}
 
@@ -214,6 +215,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 	encrypted := packet[headerLen:]
 
 	if !c.cryptIn.initialized {
+		log.Debug("UDP packet arrived before crypto initialized")
 		return
 	}
 
@@ -224,6 +226,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 
 	plaintext, err := c.cryptIn.decrypt(counter, encrypted)
 	if err != nil {
+		log.Warn("UDP decrypt failed for %s (counter=%d): %v", user.Name, counter, err)
 		return
 	}