A2S_INFO Will be changed by Valve soon

[BrutalCSkakan]

https://steamcommunity.com/discussions/forum/14/2989789048633291344/

Could you get this change ready?
We are depending on this lib (the Java version), so we hope that you or someone else with the knowledge could do the appropriate changes for this.

[koraktor]

Thanks for the heads-up.

Development has been pretty dormant in the recent years, but this some kind of change I‘ll really try to implement in a timely fashion.

[koraktor]

I‘m planning to bring this to both the “current” development version and the 1.3.x branches.

[koraktor]

@BrutalCSkakan I already added patches to the Java repository. Please feel free to test.

[BrutalCSkakan]

Hello! I will test the Java version as soon as I can.
Just for info, they just released a public beta for this:

A steam client beta has been released:

https://steamcommunity.com/groups/SteamClientBeta/announcements/detail/2896341257765264787

It understands how to respond if the server issues a challenge in response to an A2S_INFO request. Importantly because of the existing filtering environment servers run in, the client will behave EXACTLY as it did before, until the server replies in the new method. (https://twitter.com/ZPostFacto/status/1334700095221104640)

The protocol is now as follows:

· Client will send the exact A2S_INFO packet that it has always sent, no more, no less.

· A new server will reply with a challenge, using the same S2C_CHALLENGE packet that’s used for the A2S_PLAYERS and A2S_RULES packets. (Indeed, if a client is quick enough, it can use the same challenge for multiple requests.)

· Now, a client will send a A2S_INFO with the challenge appended. Also: DO NOT ASSUME THAT ANY EXTRA BYTES AFTER THE CHALLENGE ARE INVALID. This is reserved for future expansion to the protocol! There are some more protocol changes in development right now designed to have the client obtain more information from the master server, thus reducing the amount of information that must come from the server. Those improvements won’t be possible if assumptions are made about packet sizes!

I’ll post again when there are server binaries available that can opt into the new behavior, fixing the reflection attack vulnerability. You will not want to opt in until all clients you care about are speaking the new protocol. For steam clients, that will probably at least a couple of weeks.

[SniperNoob95]

Hey, just wondering if you were able to add this to the java code and release it? The change from Valve went out yesterday and as expected this is breaking functionality. Would be hugely appreciated if you would be able to release a new version with the fix. :)

[SniperNoob95]

If you're not ready to release these changes on maven, could you explain how I could go about compiling/using the beta code in a project that currently utilizes the released maven version? @koraktor @BrutalCSkakan

[BrutalCSkakan]

Hello!
This is now live on Steam servers, are you able to release the new version? Currently, the current version is totally broken anyway.