When info_cache_enabled is on, serversecure answers A2S_INFO from its cache in the recvfrom detour, before the packet reaches the engine. Because the cached path never validates an A2S challenge, it bypasses the engine's STEAM_GAMESERVER_A2S_INFO_REQUIRE_CHALLENGE handshake (the 2020 mitigation for UDP reflection/amplification).
For an operator who has enabled that engine setting, the result is that the protection silently does nothing for A2S_INFO: a spoofed-source request is answered from cache without completing the challenge handshake, so the server can still be used as a reflection/amplification target.
The length check (25/1200) doesn't mitigate this -> a spoofed packet can be padded to an accepted length.
Suggested fix -
when serving A2S_INFO from cache, honor the challenge. On a challenge-less request, reply with S2C_CHALLENGE and only serve the cached info once the client returns a valid challenge, mirroring what the engine does.
This preserves the cache's benefit (the challenge is a tiny extra round-trip, not a forward to the engine) while closing the reflection vector.
When info_cache_enabled is on, serversecure answers A2S_INFO from its cache in the recvfrom detour, before the packet reaches the engine. Because the cached path never validates an A2S challenge, it bypasses the engine's STEAM_GAMESERVER_A2S_INFO_REQUIRE_CHALLENGE handshake (the 2020 mitigation for UDP reflection/amplification).
For an operator who has enabled that engine setting, the result is that the protection silently does nothing for A2S_INFO: a spoofed-source request is answered from cache without completing the challenge handshake, so the server can still be used as a reflection/amplification target.
The length check (25/1200) doesn't mitigate this -> a spoofed packet can be padded to an accepted length.
Suggested fix -
when serving A2S_INFO from cache, honor the challenge. On a challenge-less request, reply with S2C_CHALLENGE and only serve the cached info once the client returns a valid challenge, mirroring what the engine does.
This preserves the cache's benefit (the challenge is a tiny extra round-trip, not a forward to the engine) while closing the reflection vector.