#1734 closed Bug (fixed)
encrypted peers' outgoing RC4 stream can be corrupted by sending protocol messages out-of-order
| Reported by: | charles | Owned by: | charles |
|---|---|---|---|
| Priority: | Normal | Milestone: | 1.50 |
| Component: | libtransmission | Version: | 1.42 |
| Severity: | Blocker | Keywords: | |
| Cc: |
Description (last modified by charles)
Beginning back with the "performance patch" submitted by Aloisus via the forums, Transmission has made a practice of buffering up non-critical BitTorrent? protocol messages (such as `have' and periodic pex messages) and sending them in a batch to reduce socket-level packet overhead.
The bug is that these protocol messages are encrypted as they're written into the batch buffer. If that is done, and then we encrypt and send piece data before the protocol messages batch is flushed, then the order of the messages' encryption and transmission are reversed and the RC4 stream becomes corrupt.
Special thanks goes to denisx and especially merlyn3d for helping track down this bug.
Change History (8)
comment:1 Changed 12 years ago by charles
- Owner set to charles
- Status changed from new to assigned
comment:2 Changed 12 years ago by charles
- Description modified (diff)
comment:3 Changed 12 years ago by charles
- Description modified (diff)
comment:4 Changed 12 years ago by charles
As described in this forum post, Aloisus' performance patch was committed to svn in r6259, shortly after Transmission 1.22's release (r6191).
comment:5 Changed 12 years ago by charles
The link in comment #4 is incorrect. The forum thread describing Aloisius' patch and when it went into svn is at http://forum.transmissionbt.com/viewtopic.php?f=2&t=5205&p=25339
comment:6 Changed 12 years ago by charles
- Resolution set to fixed
- Status changed from assigned to closed
backported to the 1.5x branch in r7771
comment:7 Changed 12 years ago by charles
- Component changed from Transmission to libtransmission
comment:8 Changed 12 years ago by charles
- Priority changed from High to Normal
test fix committed to trunk in r7770