Changes to server browser packets in latest Steam client

Hello!

The Steam client released today includes changes to the client intended to address a gameserver reflection attack vulnerability in the server browser protocol. It also includes several experimental features that can be enabled on gameservers to further harden the server against attack.

When a client queries a server, it will begin by sending an A2S_INFO packet, formatted exactly as before. If the server desires (see below for how to opt in), the server may reply with a S2C_CHALLENGE challenge request, instead of replying with the S2A_INFO_SRC data packet. The new client understands this reply, and can resubmit the A2S_INFO request, authenticated with the server's challenge, thus proving that it is not spoofing the source IP address.

The binaries released with the client today also include changes relevant to how the gameserver handles these packets. First, challenge generation was hardened against attacks designed to fill the challenge table and crowd out legitimate challenge requests.
Additional experimental improvements are available by setting environment variables, but are not enabled by default:

STEAM_GAMESERVER_A2S_INFO_REQUIRE_CHALLENGE=1. This will opt into the new handshake for A2S_INFO packets to address the reflection attack. At this time, it is primarily intended for testing 3rd party query clients. Since not all players may have an updated Steam client and understand this handshake, it is not recommend to enable this at this time, except for testing. We will post again when the vast majority of users are running clients that understand the new protocol, and enabling the new protocol is safe.

STEAM_GAMESERVER_RATE_LIMIT_200MS=N. This will drop any connectionless packets (A2S_INFO, A2S_RULES, A2S_PLAYERS) from a given IP after more than N are received in a 200ms window. By default, rate limiting is disabled, but a reasonable value might be somewhere around 25-75.

STEAM_GAMESERVER_PACKET_HANDLER_NO_IPC. If this variable is set, then the Steamworks packet handling calls will use a “fast path”. In the Steamworks SDK, most API calls are serialized over an IPC, and in fact execute in the steam client process. A dedicated server does not communicate with a steam client (there usually isn’t one running), but the same basic design is used – there are two threads, and all API calls are serialized and executed in the Steam thread. Turning on this environment variable will bypass this serialization and thread context switch, which makes these calls, much, much faster. Note that this only affects a server in “shared socket mode” – meaning the game port and the query port are the same.

Gameserver operators can obtain binaries for all platforms, including older linux distributions, here:
http://media.steampowered.com/apps/steamworks/steam_bins_6246211.zip

These changes were previously discussed in this post: https://steamcommunity.com/discussions/forum/14/2989789048633291344/.

const udp = require('dgram');

// Create udp socket
const client = udp.createSocket('udp4');

const ip = '';
const port = 0;

let sent = 0;
let received = 0;
let bytes = 0;


// TSource Engine Query
const hex = Buffer.from('ffffffff54536f7572636520456e67696e6520517565727900', 'hex')

// emits on new datagram msg
client.on('message', (msg) => {
bytes = bytes + parseInt(msg.length);
received++;
});


const statusPrint = () =>{
console.log('%s requests to gameserver. ', sent);
console.log('%s responses from gameserver with %s bytes. ', received, bytes);
}

// Run test for 1 minute
const runFor1muinuteInterval = setInterval(() =>{

    // Socket function to send Buffer object
    client.send(hex, port, ip, (error) =>{

        // Check if packet is sent?
        if(!error){

            // Increment sent status
            sent++;
        } 
    });

})

// Clear interval after 1 minute
setTimeout(()=>{clearInterval(runFor1muinuteInterval), statusPrint(); }, 60000);

const udp = require('dgram');

// Create udp socket
const client = udp.createSocket('udp4');

const ip = '';
const port = 0;

// TSource Engine Query - normal query 
const hex = Buffer.from('ffffffff54536f7572636520456e67696e6520517565727900', 'hex')

// Socket send
client.send(hex, port, ip, (error) =>{

    // Check if a packet is sent?
    if(!error){
        console.log('Normal TSource Engine Query packet have been sent.'); 
    } 
});

// Emits on new datagram msg
client.on('message', (msg) => {

    // Get buffer value at position 4 in buffer object and check if its equal to challenge response (0x41 === 65)
    if(msg[4] === 65){

        // If yes craft new A2S_INFO packet with challenge response
        const A2S_INFO_REQUEST = Buffer.concat([Buffer.from('ffffffff', 'hex'), Buffer.from('54536f7572636520456e67696e6520517565727900', 'hex'), Buffer.from(msg.toString('hex', 5), 'hex')]);

        // Send new packet with challenge response
        client.send(A2S_INFO_REQUEST, port, ip, (error) =>{
        // Check if packet is sent?
            if(!error){
                console.log('Modified TSource Engine Query packet have been sent. Packet (hex): %s', A2S_INFO_REQUEST); 
            } 
    });
    }

    // Check if response is actually A2S_INFO response 0X49 === 73 int
    if(msg[4] === 73){
        console.log('Received A2S_INFO from gameserver.')
        console.log(msg.toString('ascii'));
    }

});