[wishlist] Make tracker exchange feature (lt_trackers) switchable

Bug #740005 reported by Ternia
82
This bug affects 18 people
Affects Status Importance Assigned to Milestone
libtorrent-rasterbar
Unknown
Unknown
qBittorrent
Fix Released
High
Christophe Dumez

Bug Description

Because it discovers passkeys on private trackers.

Revision history for this message
Christophe Dumez (hydr0g3n) wrote :

Ok, that's an easy-fix.

Changed in qbittorrent:
assignee: nobody → Christophe Dumez (hydr0g3n)
milestone: none → 2.7.1
status: New → Confirmed
Revision history for this message
ap0stol (x777ozon) wrote :
Changed in qbittorrent:
milestone: 2.7.1 → 2.8.0
Revision history for this message
ap0stol (x777ozon) wrote :

2.8.0 beta4 nothing changed

Revision history for this message
lamskoy (lamskoy) wrote :

I've made patch which fix this issue for qbittorrent-2.7.3
It adds checkbox for GUI (BitTorrent tab in preferences) and for webUI.

Please review it :)

Revision history for this message
Christophe Dumez (hydr0g3n) wrote :

@lamskoy: This is not the correct way to fix this. Here is why I think so:
1. This should be in advanced preferences not in regular ones.
2. Why only the tracker extension? users will wonder why they can disable the lt_tracker extension but not the other ones (qBittorrent supports a few others). Thus, a simple checkbox does not do the trick.
3. From a programming point of view, your patch is fine although I don't think it should be called LT (since LT means LibTorrent and the extension is called lt_trackers).

I will file a bug report against libtorrent itself. I believe the the best fix there is to disable this extension ONLY for private torrents. Similarly, DHT is already disabled for such torrents.

Revision history for this message
Christophe Dumez (hydr0g3n) wrote :

libtorrent v0.15.6 is likely to stop sharing private trackers with other peers. I also fixed qBittorrent so that it completly disables the lt_trackers extension if libtorrent <= 0.15.5 is detected because of this security issue.

v2.8.0 is going to be released withing 2 weeks (release candidate tomorrow).

Changed in qbittorrent:
importance: Undecided → High
status: Confirmed → Fix Committed
Revision history for this message
Christophe Dumez (hydr0g3n) wrote :

According to the libtorrent author, libtorrent is NOT sharing trackers for torrents that are private.
Has anyone of you actually experienced the problem and did you just assume it was unsafe?

If you really experience this problem with private torrents then this likely means that the torrent was not indicated as being private when created. In that case, the problem comes from the torrent creator. If the private flag is not set for such torrents, DHT is also be used (so tracker exchange is the least of your problems).

Changed in qbittorrent:
status: Fix Committed → Incomplete
Revision history for this message
Михаил Горбунов (mihan2591) wrote :

Many private trackers allow DHT, it does not affect the correct account of the rating and safety of passkey (But not when using some clients that are prohibited on these trackers, for example: BitComet and Azureus for rutracker.org).
In other words, the privacy of the torrent is not related to the private tracker. And if the torrent was not indicated as being private when created that does not mean that it created specifically for open tracker.

Changed in qbittorrent:
status: Incomplete → Fix Committed
Changed in qbittorrent:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.