GodotSteam 4.24 And MultiplayerPeer

Rolling out a small but important update to GodotSteam's MultiplayerPeer stuff thanks to bearlikelion and bitbutter. To direct quote the actual PR comment: "SteamMultiplayerPeer takes whatever peer ID a connection sends in its handshake and only checks that the packet is the right size. That means anyone in the lobby can claim peer ID 1 and Godot will treat them as the server, so their RPCs, spawns, and syncs pass the authority checks. On a host the peer 1 slot is empty so the claim just fills it, and on a client it replaces the real host. ENet already rejects bad peer IDs, but the Steam transport never did.

This patch checks the claimed ID before storing it and closes the connection if it's bad, using the same rule as ENet: the ID can't be less than 2 and can't already be in use. It also verifies that peer id 1's Steam ID matches who Steam says it the host.

Since the check runs before the ID is stored, any packets sent right behind a bad handshake get dropped too. Rejected peers are logged with their Steam ID."

The update was actually live as of yesterday, just a little slow on the news post!

Gramps