fix: improve CryptSetup and UDP receive logging

- Suppress 'incomplete fields' log spam after crypto is initialized
  (server sends partial CryptSetup for key rotation)
- Log 'CryptSetup updated' at debug when keys are refreshed
- Add warning log when UDP decryption fails (OCB auth error)
- Add debug log for UDP packets from unknown sessions
- Add debug log for UDP packets before crypto is ready

gumble/gumble/crypt.go

@@ -290,12 +290,18 @@ func (c *Client) handleCryptSetup(buffer []byte) error {
 	defer c.volatile.Unlock()
 
 	if packet.Key != nil && packet.ClientNonce != nil && packet.ServerNonce != nil {
-		log.Info("received CryptSetup: key_len=%d client_nonce_len=%d server_nonce_len=%d",
+		wasInit := c.cryptOut.initialized
-			len(packet.Key), len(packet.ClientNonce), len(packet.ServerNonce))
 		c.cryptOut.setup(packet.Key, packet.ClientNonce)
 		c.cryptIn.setup(packet.Key, packet.ServerNonce)
-	} else {
+		if wasInit {
-		log.Debug("received CryptSetup with incomplete fields")
+			log.Debug("CryptSetup updated (key rotation)")
+		} else {
+			log.Info("received CryptSetup: key_len=%d client_nonce_len=%d server_nonce_len=%d",
+				len(packet.Key), len(packet.ClientNonce), len(packet.ServerNonce))
+		}
+	} else if !c.cryptOut.initialized {
+		// Only log incomplete once before crypto is set up
+		log.Debug("received CryptSetup with incomplete fields, waiting for full key exchange")
 	}
 
 	if c.cryptOut.initialized && c.udpConn != nil && !c.udpActive {

gumble/gumble/udp.go

@@ -206,6 +206,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 
 	user := c.Users[uint32(session)]
 	if user == nil {
+		log.Debug("UDP packet from unknown session %d", session)
 		return
 	}
 
@@ -214,6 +215,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 	encrypted := packet[headerLen:]
 
 	if !c.cryptIn.initialized {
+		log.Debug("UDP packet arrived before crypto initialized")
 		return
 	}
 
@@ -224,6 +226,7 @@ func (c *Client) handleUDPPacket(packet []byte) {
 
 	plaintext, err := c.cryptIn.decrypt(counter, encrypted)
 	if err != nil {
+		log.Warn("UDP decrypt failed for %s (counter=%d): %v", user.Name, counter, err)
 		return
 	}