librats 2.3.2 → 2.3.4

package/native-src/src/librats/bittorrent/mse.h

@@ -0,0 +1,218 @@
+#pragma once
+
+/**
+ * @file mse.h
+ * @brief MSE/PE — Message Stream Encryption, the BitTorrent connection
+ *        obfuscation protocol.
+ *
+ * Why it exists: a lot of the swarm is configured to *require* an obfuscated
+ * connection. Such a peer accepts our TCP connection, reads a plaintext
+ * "\x13BitTorrent protocol" handshake and closes without answering a byte — which
+ * is exactly what the log this was written for shows. Without MSE those peers are
+ * unreachable no matter how many times we dial them.
+ *
+ * What it is NOT: security. MSE hides *what* protocol is on the wire from a
+ * passive observer (and defeats naive traffic shaping); it is unauthenticated, so
+ * an active man in the middle can defeat it. It is implemented because the swarm
+ * expects it, not because it protects anything. The real transport security in
+ * this project is the Noise mesh in `src/librats/security` — unrelated code.
+ *
+ * The protocol (A dials, B accepts):
+ *
+ *   1. A->B  Ya                      96-byte DH public key, then 0..512 random pad
+ *   2. B->A  Yb                      96-byte DH public key, then 0..512 random pad
+ *   3. A->B  HASH('req1', S)                                            (20, plain)
+ *            HASH('req2', SKEY) xor HASH('req3', S)                     (20, plain)
+ *            RC4( VC | crypto_provide | len(PadC) | PadC | len(IA) | IA )
+ *   4. B->A  RC4( VC | crypto_select | len(PadD) | PadD )
+ *   5. both  the payload stream, RC4 or plaintext per crypto_select
+ *
+ * S is the DH shared secret, SKEY the torrent's info-hash, VC eight zero bytes and
+ * IA the initiator's first payload (for us: the 68-byte BitTorrent handshake).
+ * RC4 keys are HASH('keyA', S, SKEY) for A->B and HASH('keyB', S, SKEY) for B->A,
+ * each with the first 1024 keystream bytes discarded.
+ *
+ * Two consequences shape the code below:
+ *
+ *   - **Both pads have unknown length**, so a reader cannot simply count bytes: B
+ *     has to *scan* for HASH('req1', S) and A has to scan for the encrypted VC.
+ *     Everything before the marker is pad and is thrown away.
+ *   - **B does not learn which torrent it is until step 3.** It cannot: SKEY is
+ *     never sent in the clear. It recovers it by XOR-ing the obfuscated hash with
+ *     HASH('req3', S) and comparing against HASH('req2', ih) for each torrent it
+ *     holds — hence the SkeyResolver callback.
+ *
+ * Everything here is plain computation over byte buffers: no sockets, no reactor,
+ * no torrent. Handshake is a pure state machine driven by consume(), which is what
+ * makes it testable end to end against itself.
+ */
+
+#include "librats/bittorrent/types.h"
+#include "librats/core/bytes.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <string>
+
+namespace librats::bittorrent::mse {
+
+constexpr std::size_t kKeyLen = 96;   ///< DH public key / shared secret, 768 bits
+constexpr std::size_t kMaxPad = 512;  ///< spec ceiling on every pad field
+constexpr std::size_t kVcLen  = 8;    ///< verification constant: eight zero bytes
+
+/// crypto_provide / crypto_select bitmask.
+enum Method : std::uint32_t {
+    kPlaintext = 0x01,  ///< obfuscated handshake, then the payload in the clear
+    kRc4       = 0x02,  ///< obfuscated handshake, then RC4 all the way
+    kBoth      = 0x03,
+};
+
+/// RC4 keystream cipher. Symmetric: process() both encrypts and decrypts, and the
+/// caller must apply it to the stream's bytes in order, exactly once each.
+/// Copyable on purpose — the initiator clones its receive cipher to work out what
+/// the encrypted VC will look like without disturbing the real stream position.
+class Rc4Cipher {
+public:
+    Rc4Cipher() = default;
+    /// Key the cipher and discard the first 1024 keystream bytes, per the spec.
+    void init(const std::uint8_t* key, std::size_t key_len);
+    /// XOR `len` bytes of keystream over `data`, in place.
+    void process(std::uint8_t* data, std::size_t len);
+    bool ready() const noexcept { return ready_; }
+
+private:
+    std::uint8_t s_[256]{};
+    std::uint8_t i_     = 0;
+    std::uint8_t j_     = 0;
+    bool         ready_ = false;
+};
+
+/// Diffie-Hellman over the fixed 768-bit MODP group the MSE spec mandates
+/// (generator 2). Exposed separately so it can be tested on its own.
+class DhKeyExchange {
+public:
+    /// Draws a fresh 160-bit private exponent and computes Ya = 2^x mod P.
+    DhKeyExchange();
+
+    const std::array<std::uint8_t, kKeyLen>& public_key() const noexcept { return public_; }
+
+    /// Compute S = remote^x mod P. Returns false for a degenerate public key
+    /// (outside [2, P-2]): those force the shared secret into a tiny subgroup, so
+    /// anyone could predict it. libtorrent rejects the same range.
+    bool compute_secret(const std::uint8_t* remote_public);
+
+    /// Valid only after a successful compute_secret().
+    const std::array<std::uint8_t, kKeyLen>& secret() const noexcept { return secret_; }
+
+private:
+    std::array<std::uint8_t, kKeyLen> public_{};
+    std::array<std::uint8_t, kKeyLen> secret_{};
+    std::array<std::uint8_t, 20>      private_{};
+};
+
+/// Does @p candidate explain the obfuscated stream key a peer sent?
+///
+/// The receiver never learns SKEY directly: the peer sends
+/// `HASH('req2', SKEY) xor HASH('req3', S)`, and the only way back is to guess
+/// SKEY and check. A node holding N torrents does N of these per inbound
+/// connection, which is why it is a cheap standalone predicate rather than
+/// something that rebuilds state.
+bool skey_matches(const std::uint8_t* obfuscated, const std::uint8_t* req3_hash,
+                  const InfoHash& candidate);
+
+/// One side of an MSE handshake, as a state machine over the byte stream.
+///
+/// Drive it by feeding everything that arrives to consume() and writing whatever
+/// take_output() hands back. On Done, result() carries the two ciphers (already
+/// advanced past the handshake, so payload encryption just continues them) and
+/// leftover() the bytes that arrived after the handshake and still belong to the
+/// caller — raw and *not* decrypted, because whether they should be decrypted at
+/// all depends on the negotiated method.
+class Handshake {
+public:
+    enum class Status { NeedMore, Done, Failed };
+
+    /// Recover the torrent behind an obfuscated stream key. Called with the peer's
+    /// 20-byte `HASH('req2', SKEY) xor HASH('req3', S)` and our own 20-byte
+    /// `HASH('req3', S)`; XOR them to get `HASH('req2', SKEY)` and compare against
+    /// each torrent's. Returns false if none match (we do not hold that torrent).
+    using SkeyResolver = std::function<bool(const std::uint8_t* obfuscated,
+                                            const std::uint8_t* req3_hash,
+                                            InfoHash& out)>;
+
+    struct Result {
+        Rc4Cipher send_cipher;         ///< positioned right after our handshake bytes
+        Rc4Cipher recv_cipher;         ///< positioned right after the peer's
+        bool      rc4_payload = false; ///< false => crypto_select was plaintext
+        InfoHash  info_hash{};         ///< receiver only: the torrent SKEY named
+        Bytes     initial_payload;     ///< receiver only: the decrypted IA
+    };
+
+    /// Initiator. @p ia is the payload to embed in step 3 — the BitTorrent
+    /// handshake. @p provide is the crypto_provide bitmask we offer.
+    Handshake(const InfoHash& info_hash, Bytes ia, std::uint32_t provide);
+    /// Receiver. @p allowed bounds what we will agree to in crypto_select.
+    Handshake(SkeyResolver resolver, std::uint32_t allowed);
+
+    /// Absorb received bytes and advance. Everything offered is taken.
+    Status consume(const std::uint8_t* data, std::size_t len);
+
+    /// Bytes to write to the socket, moved out (empty if there are none pending).
+    Bytes take_output();
+
+    /// Post-handshake bytes already received. Valid once consume() returns Done.
+    ByteView leftover() const;
+
+    const std::string& error()  const noexcept { return error_; }
+    Result&            result() noexcept { return result_; }
+
+    /// Largest IA we will accept from a peer. The only legitimate IA is the
+    /// 68-byte BitTorrent handshake; the slack covers a client that pipelines a
+    /// message or two behind it, and the cap stops a peer naming a huge length.
+    static constexpr std::size_t kMaxIa = 4096;
+
+private:
+    enum class State {
+        ReadYb, SyncVc, ReadVcBody, ReadPadD,                       // initiator
+        ReadYa, SyncHash, ReadSkey, ReadVcCrypto, ReadPadC, ReadIa, // receiver
+        Done, Failed,
+    };
+
+    Status advance();                       ///< run the state machine until it blocks
+    Status fail(const std::string& why);
+    void   derive_ciphers(const InfoHash& skey, bool outgoing);
+    /// Search buf_ from pos_ for `pattern`, giving up once `limit` bytes of the
+    /// stream have been scanned without a hit. Returns the absolute offset, or
+    /// npos while still searching (scanned_ carries the give-up budget).
+    std::size_t find_sync(const std::uint8_t* pattern, std::size_t len, std::size_t limit);
+    std::size_t available() const noexcept { return buf_.size() - pos_; }
+    /// Decrypt the next @p n buffered bytes in place, advance pos_ past them and
+    /// return where they start. Only ever called with a length the protocol has
+    /// already pinned down, so the receive cipher never runs past the end of the
+    /// encrypted region and into payload that may be plaintext.
+    const std::uint8_t* take_decrypted(std::size_t n);
+
+    bool          initiator_ = false;
+    State         state_     = State::ReadYb;
+    std::string   error_;
+    Result        result_;
+
+    DhKeyExchange dh_;
+    InfoHash      info_hash_{};      ///< initiator: known up front; receiver: resolved
+    Bytes         ia_;               ///< initiator: the payload for step 3
+    std::uint32_t crypto_mask_ = 0;  ///< provide (initiator) / allowed (receiver)
+    SkeyResolver  resolver_;
+
+    Bytes       buf_;                ///< everything received, raw
+    std::size_t pos_     = 0;        ///< how much of buf_ the state machine has eaten
+    std::size_t scanned_ = 0;        ///< bytes skipped so far by the current sync scan
+    std::size_t pad_len_ = 0;        ///< length of the pad field currently being read
+    std::size_t ia_len_  = 0;
+    Bytes       out_;                ///< pending bytes for the socket
+
+    std::array<std::uint8_t, kVcLen> expected_vc_{};  ///< initiator: RC4(8 zero bytes)
+};
+
+} // namespace librats::bittorrent::mse

package/native-src/src/librats/bittorrent/peer_connection.cpp

@@ -10,18 +10,16 @@ namespace librats::bittorrent {
 
 namespace {
 
-#ifdef _WIN32
-inline bool would_block() { return WSAGetLastError() == WSAEWOULDBLOCK; }
-#else
-inline bool would_block() { return errno == EAGAIN || errno == EWOULDBLOCK; }
-#endif
-
 /// Largest message we will accept. A bitfield for ~16M pieces fits; a piece
 /// message is ~16 KiB. Anything larger is treated as a protocol violation.
 constexpr std::uint32_t kMaxMessageLen = 2 * 1024 * 1024;
 
 constexpr std::size_t kRecvChunk = 64 * 1024;
 
+/// The fixed prefix of a plaintext handshake: the length byte plus the protocol
+/// string. Enough on its own to tell a plaintext peer from an obfuscated one.
+constexpr std::size_t kHandshakeHeaderSize = 1 + kProtocolStringLen;
+
 /// Ceiling on how far rx_ may be grown on the strength of a *declared* message length
 /// alone. Sizing the buffer for the whole message up front (as libtorrent does, growing
 /// straight to packet_size) turns a large message into one allocation instead of a
@@ -52,12 +50,13 @@ constexpr auto kTickInterval     = std::chrono::seconds(10);
 
 } // namespace
 
-PeerConnection::PeerConnection(Reactor& reactor, socket_t sock, bool outgoing,
+PeerConnection::PeerConnection(Reactor& reactor, std::unique_ptr<PeerLink> link, bool outgoing,
                                const InfoHash& info_hash, const PeerId& our_peer_id,
                                std::uint32_t num_pieces, Observer* observer,
-                               std::string remote_ip, std::uint16_t remote_port)
+                               std::string remote_ip, std::uint16_t remote_port,
+                               DialOptions opts)
     : reactor_(reactor)
-    , sock_(sock)
+    , link_(std::move(link))
     , outgoing_(outgoing)
     , info_hash_(info_hash)
     , our_peer_id_(our_peer_id)
@@ -66,12 +65,16 @@ PeerConnection::PeerConnection(Reactor& reactor, socket_t sock, bool outgoing,
     , bound_(true)
     , remote_ip_(std::move(remote_ip))
     , remote_port_(remote_port)
+    , want_mse_(opts.obfuscate)
+    , fast_reconnect_(opts.retry_other_form_on_failure)
     , peer_have_(num_pieces, false) {}
 
-PeerConnection::PeerConnection(Reactor& reactor, socket_t sock, const PeerId& our_peer_id,
-                               Resolver resolver, std::string remote_ip, std::uint16_t remote_port)
+PeerConnection::PeerConnection(Reactor& reactor, std::unique_ptr<PeerLink> link,
+                               const PeerId& our_peer_id,
+                               Resolver resolver, std::string remote_ip, std::uint16_t remote_port,
+                               EncPolicy enc_policy, mse::Handshake::SkeyResolver skey)
     : reactor_(reactor)
-    , sock_(sock)
+    , link_(std::move(link))
     , outgoing_(false)
     , info_hash_{}
     , our_peer_id_(our_peer_id)
@@ -80,24 +83,25 @@ PeerConnection::PeerConnection(Reactor& reactor, socket_t sock, const PeerId& ou
     , resolver_(std::move(resolver))
     , bound_(false)
     , remote_ip_(std::move(remote_ip))
-    , remote_port_(remote_port) {}
+    , remote_port_(remote_port)
+    , enc_policy_(enc_policy)
+    , skey_(std::move(skey))
+      // An inbound peer never says which of the two protocols it is opening, so
+      // unless policy has already settled the question we have to look at the
+      // first bytes before we can interpret any of them.
+    , detecting_(enc_policy != EncPolicy::Disabled && bool(skey_)) {}
 
 PeerConnection::~PeerConnection() {
     // Cancel the tick before we die so its captured `this` can never fire on freed
     // memory. Same reactor thread owns both the timer and this destructor.
     if (tick_timer_ != kInvalidTimerId) { reactor_.cancel(tick_timer_); tick_timer_ = kInvalidTimerId; }
-    if (!closed_ && is_valid_socket(sock_)) {
-        reactor_.remove(sock_);
-        close_socket(sock_);
-        sock_ = RATS_INVALID_SOCKET;
-    }
+    if (!closed_) link_->close();
 }
 
 void PeerConnection::start() {
     if (started_) return;
     started_ = true;
-    set_socket_nonblocking(sock_);
-    reactor_.add(sock_, PollIn, [this](std::uint32_t ev) { on_io(ev); });
+    link_->start(this);
 
     const auto now = std::chrono::steady_clock::now();
     created_ = last_recv_ = last_sent_ = now;
@@ -106,16 +110,26 @@ void PeerConnection::start() {
     // An outgoing peer sends its handshake immediately; an incoming one waits to
     // learn the info-hash, then replies (see parse_handshake()).
     if (outgoing_) {
-        LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " → handshake sent ("
-                             << short_hash(info_hash_) << ')');
-        send_handshake();
+        if (want_mse_) {
+            // Obfuscated dial: the BitTorrent handshake is not written directly,
+            // it rides inside step 3 of the MSE handshake as the initial payload.
+            handshake_sent_ = true;
+            mse_ = std::make_unique<mse::Handshake>(info_hash_, build_handshake(), mse::kBoth);
+            LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " → MSE handshake sent ("
+                                 << short_hash(info_hash_) << ')');
+            pump_mse(mse::Handshake::Status::NeedMore);
+        } else {
+            LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " → handshake sent ("
+                                 << short_hash(info_hash_) << ')');
+            send_handshake();
+        }
     }
 }
 
-void PeerConnection::send_handshake() {
-    std::uint8_t hs[kHandshakeSize];
+Bytes PeerConnection::build_handshake() {
+    Bytes hs(kHandshakeSize);
     hs[0] = std::uint8_t(kProtocolStringLen);
-    std::memcpy(hs + 1, kProtocolString, kProtocolStringLen);
+    std::memcpy(hs.data() + 1, kProtocolString, kProtocolStringLen);
     ReservedBytes reserved{};
     reserved::enable_dht(reserved);
     // NOTE: we deliberately do NOT advertise the Fast Extension (BEP 6). We do not
@@ -126,11 +140,15 @@ void PeerConnection::send_handshake() {
     // nothing, so we'd never download from them. Re-enable only once BEP 6 is
     // actually implemented in dispatch().
     reserved::enable_extensions(reserved);
-    std::memcpy(hs + 20, reserved.data(), 8);
-    std::memcpy(hs + 28, info_hash_.data(), 20);
-    std::memcpy(hs + 48, our_peer_id_.data(), 20);
+    std::memcpy(hs.data() + 20, reserved.data(), 8);
+    std::memcpy(hs.data() + 28, info_hash_.data(), 20);
+    std::memcpy(hs.data() + 48, our_peer_id_.data(), 20);
+    return hs;
+}
+
+void PeerConnection::send_handshake() {
     handshake_sent_ = true;
-    queue(ByteView(hs, kHandshakeSize));
+    queue(build_handshake());
     flush();
 }
 
@@ -141,11 +159,7 @@ void PeerConnection::close(const std::string& reason) {
     // consumer, remote close, torrent stop): one greppable line per disconnect.
     LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " disconnect: " << reason);
     if (tick_timer_ != kInvalidTimerId) { reactor_.cancel(tick_timer_); tick_timer_ = kInvalidTimerId; }
-    if (is_valid_socket(sock_)) {
-        reactor_.remove(sock_);
-        close_socket(sock_);
-        sock_ = RATS_INVALID_SOCKET;
-    }
+    link_->close();
     // Drop the send backlog; rx_ is deliberately left alone — close() can be called
     // from inside a message handler that still holds a ByteView into it.
     tx_.clear();
@@ -154,13 +168,16 @@ void PeerConnection::close(const std::string& reason) {
 
 // ---- I/O ----
 
-void PeerConnection::on_io(std::uint32_t events) {
-    if (closed_) return;
-    if (events & PollOut) flush();
-    if (closed_) return;
-    if (events & PollIn) do_read();
-    if (closed_) return;
-    if (events & (PollErr | PollHup)) close("socket error");
+void PeerConnection::on_link_readable() {
+    if (!closed_) do_read();
+}
+
+void PeerConnection::on_link_writable() {
+    if (!closed_) flush();
+}
+
+void PeerConnection::on_link_error(const std::string& reason) {
+    if (!closed_) close(reason);
 }
 
 void PeerConnection::do_read() {
@@ -175,22 +192,30 @@ void PeerConnection::do_read() {
     for (;;) {
         const ByteSpan into = rx_.prepare(read_size());
 
-        const int n = ::recv(sock_, reinterpret_cast<char*>(into.data()),
-                             static_cast<int>(into.size()), 0);
-        if (n == 0) { close("peer closed connection"); return; }
-        if (n < 0) {
-            if (would_block()) return;
-            close("recv error");
-            return;
-        }
+        const PeerLink::IoResult r = link_->read(into);
+        if (r.status == PeerLink::Status::WouldBlock) return;
+        if (r.status == PeerLink::Status::Closed) { close("peer closed connection"); return; }
+        if (r.status == PeerLink::Status::Error)  { close("recv error"); return; }
+        const std::size_t n = r.bytes;
 
         last_recv_ = std::chrono::steady_clock::now();
-        rx_.commit(std::size_t(n));
 
-        parse();
+        if (mse_) {
+            // The obfuscated handshake owns the stream while it runs: these bytes
+            // are its business, not rx_'s, and they are landed in rx_'s spare tail
+            // only because that is where the recv() had to go. Nothing is committed.
+            pump_mse(mse_->consume(into.data(), n));
+        } else {
+            // Past the handshake the payload cipher is a plain XOR over the stream,
+            // so decrypting each arrival in place — before anything else looks at
+            // it — is all it takes to make the rest of the class cipher-agnostic.
+            if (rc4_active_) rc4_recv_.process(into.data(), n);
+            rx_.commit(n);
+            parse();
+        }
         if (closed_) return;
 
-        if (std::size_t(n) < into.size()) return;  // kernel buffer drained
+        if (n < into.size()) return;  // the link has nothing more ready
     }
 }
 
@@ -211,9 +236,85 @@ std::size_t PeerConnection::read_size() const {
     return kRecvChunk;
 }
 
+// ---- MSE / PE ----
+
+bool PeerConnection::detect_inbound_encryption() {
+    // A plaintext peer opens with the 20-byte protocol header; an MSE peer opens
+    // with 96 bytes of DH public key, which is a uniformly random number. Twenty
+    // bytes is therefore both necessary and more than sufficient to tell them
+    // apart — the odds of a key beginning with this exact literal are 2^-160.
+    if (rx_.size() < kHandshakeHeaderSize) { rx_need_ = kHandshakeHeaderSize; return false; }
+
+    const bool plaintext = rx_.data()[0] == kProtocolStringLen &&
+                           std::memcmp(rx_.data() + 1, kProtocolString, kProtocolStringLen) == 0;
+    detecting_ = false;
+
+    if (plaintext) {
+        if (enc_policy_ == EncPolicy::Forced) {
+            close("plaintext peer refused: encryption required");
+            return false;
+        }
+        return true;  // fall through to the ordinary handshake path
+    }
+
+    // Obfuscated. Hand the state machine everything received so far and take the
+    // bytes out of rx_ — from here until finish_mse() the stream is entirely its.
+    mse_ = std::make_unique<mse::Handshake>(skey_, mse::kBoth);
+    LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " ← MSE handshake");
+    const auto status = mse_->consume(rx_.data(), rx_.size());
+    rx_.consume(rx_.size());
+    pump_mse(status);
+    return false;  // parse() resumes from finish_mse(), not from here
+}
+
+void PeerConnection::pump_mse(mse::Handshake::Status status) {
+    if (status == mse::Handshake::Status::Failed) {
+        close("MSE handshake failed: " + mse_->error());
+        return;
+    }
+    // Output first, and always: on the receiving side the same advance() that
+    // reaches Done is the one that produced step 4, and the peer is waiting for it.
+    if (Bytes out = mse_->take_output(); !out.empty()) {
+        queue_raw(std::move(out));
+        flush();
+        if (closed_) return;
+    }
+    if (status == mse::Handshake::Status::Done) finish_mse();
+}
+
+void PeerConnection::finish_mse() {
+    mse::Handshake::Result& r = mse_->result();
+    rc4_send_   = r.send_cipher;
+    rc4_recv_   = r.recv_cipher;
+    rc4_active_ = r.rc4_payload;
+    encrypted_  = true;
+    mse_skey_   = r.info_hash;
+
+    // The receiver's initial payload came out of the encrypted region already
+    // decrypted; whatever arrived behind it is raw, and only ciphertext if
+    // crypto_select actually chose RC4.
+    Bytes ia   = std::move(r.initial_payload);
+    Bytes rest = mse_->leftover().to_bytes();
+    mse_.reset();
+    if (rc4_active_ && !rest.empty()) rc4_recv_.process(rest.data(), rest.size());
+
+    LOG_DEBUG("bt.peer", remote_ip_ << ':' << remote_port_ << " MSE established ("
+                         << (rc4_active_ ? "rc4" : "plaintext payload") << ')');
+
+    for (const Bytes* b : {&ia, &rest}) {
+        if (b->empty()) continue;
+        const ByteSpan into = rx_.prepare(b->size());
+        std::memcpy(into.data(), b->data(), b->size());
+        rx_.commit(b->size());
+    }
+    parse();
+}
+
 void PeerConnection::parse() {
     rx_need_ = 0;  // recomputed below: 0 == no message is mid-flight
 
+    if (detecting_ && !detect_inbound_encryption()) return;
+
     if (!handshake_received_) {
         if (rx_.size() < kHandshakeSize) { rx_need_ = kHandshakeSize; return; }
         if (!parse_handshake()) return;  // consumed 68 bytes (or closed)
@@ -248,6 +349,15 @@ bool PeerConnection::parse_handshake() {
     InfoHash their_info{};
     std::memcpy(their_info.data(), d + 28, 20);
 
+    // On an obfuscated inbound connection the torrent was already named once, by
+    // the stream key in MSE step 3. The handshake must agree with it: a peer that
+    // unlocks the RC4 keys with one info-hash and then asks for a different torrent
+    // is either broken or probing, and the two must not be allowed to diverge.
+    if (encrypted_ && !outgoing_ && their_info != mse_skey_) {
+        close("handshake info-hash does not match the MSE stream key");
+        return false;
+    }
+
     if (bound_) {
         // Outgoing: the info-hash must be the one we dialed for.
         if (their_info != info_hash_) { close("info-hash mismatch"); return false; }
@@ -440,6 +550,23 @@ void PeerConnection::send_extended(std::uint8_t ext_id, ByteView payload) {
     flush();
 }
 
+void PeerConnection::queue(ByteView bytes) {
+    if (closed_ || bytes.empty()) return;
+    if (!rc4_active_) { tx_.append(bytes); return; }
+    // The source is not ours to modify (a message header on the stack, a bitfield
+    // owned by the picker), so encrypt through a scratch buffer. assign() reuses
+    // its capacity, so this costs no allocation after the first message.
+    enc_scratch_.assign(bytes.begin(), bytes.end());
+    rc4_send_.process(enc_scratch_.data(), enc_scratch_.size());
+    tx_.append(ByteView(enc_scratch_.data(), enc_scratch_.size()));
+}
+
+void PeerConnection::queue(Bytes bytes) {
+    if (closed_ || bytes.empty()) return;
+    if (rc4_active_) rc4_send_.process(bytes.data(), bytes.size());  // ours: encrypt in place
+    tx_.append(std::move(bytes));
+}
+
 void PeerConnection::flush() {
     if (closed_) return;
 
@@ -448,14 +575,15 @@ void PeerConnection::flush() {
         ByteView slices[kMaxSendSlices];
         const std::size_t count = tx_.gather(slices, kMaxSendSlices);
 
-        const std::ptrdiff_t n = send_vectored(sock_, slices, count);
-        if (n > 0) {
+        const PeerLink::IoResult r = link_->write(slices, count);
+        if (r.status == PeerLink::Status::Ok && r.bytes > 0) {
             last_sent_ = std::chrono::steady_clock::now();
-            tx_.pop_front(std::size_t(n));
+            tx_.pop_front(r.bytes);
             continue;
         }
-        if (n == 0) break;                 // nothing accepted; retry on PollOut
-        if (would_block()) break;          // congested; the backlog waits for PollOut
+        // Nothing accepted: the link is congested and the backlog waits to be told
+        // it may write again.
+        if (r.status != PeerLink::Status::Error) break;
         close("send error");
         return;
     }
@@ -471,7 +599,7 @@ void PeerConnection::flush() {
 void PeerConnection::want_write(bool on) {
     if (on == want_write_ || closed_) return;
     want_write_ = on;
-    reactor_.modify(sock_, PollIn | (on ? PollOut : PollNone));
+    link_->want_write(on);
 }
 
 void PeerConnection::tick() {