Add support for specifying the source IP address

[glen-84]

We are using SteamBot and we'd like to try using multiple IP addresses, but SteamKit doesn't allow for this.

One example is the use of a WebClient in WebAPI.AsyncInterface. In order for this to work, we'd need to be able to pass an IPAddress to WebAPI.GetInterface(). AsyncInterface would then need to use an HttpWebRequest or a subclassed WebClient (see here).

Thoughts?

[Netshroud]

What's your use-case? Why do you need to bind to specific source IP addresses?

[glen-84]

http://www.reddit.com/r/SteamBot/comments/2f6d61/does_steam_do_any_rate_limiting_based_on_ip/

We want to try running some of the bots on different IP addresses to see if this helps.

[Netshroud]

You are limited to one hundred thousand (100,000) calls to the Steam Web API per day. Valve may approve higher daily call limits if you adhere to these API Terms of Use. - Source

Have you tried asking nicely, before going around their back to try circumvent security measures?

[glen-84]

As far as I know, SteamBot does not use an API key for trading, so it's unlikely that we hit the limit just from loading inventories, etc.

In addition to this, support from Valve is generally non-existent, and it's unclear what their views are with regard to bots.

[xPaw]

It's not using WebAPI for trading at all (besides trade offers), so your issue is not related to SteamKit directly.

[glen-84]

@xPaw ... How is it not related? SteamBot uses SteamKit to authenticate the bot, and SteamKit cannot be configured to use a specific IP address. This has nothing to do with Web API keys.

[xPaw]

You pointed to WebAPI in your initial report. Either way, you most likely can force the whole application to use a separate ip address.

[voided]

All interactions with a trade session should already be done by SteamBot through HttpWebRequests or similar. Have you tried specifying the bind IP address there?

[glen-84]

SteamBot uses WebAPI.GetInterface ("ISteamUserAuth")) (no API key required) in SteamWeb.Authenticate.

See http://www.reddit.com/r/SteamBot/comments/2kk3en/using_multiple_ip_addresses/

[voided]

That's for login to web, not for trade interactions. On Oct 29, 2014 1:11 PM, "glen-84" notifications@github.com wrote:

SteamBot uses WebAPI.GetInterface ("ISteamUserAuth")) (no API key required) in SteamWeb.Authenticate.

See http://www.reddit.com/r/SteamBot/comments/2kk3en/using_multiple_ip_addresses/

— Reply to this email directly or view it on GitHub https://github.com/SteamRE/SteamKit/issues/83#issuecomment-60975403.

[glen-84]

@VoiDeD I know, but the session is tied to the IP address (AFAIK), so if you authenticate using SteamKit with the default IP, and then you trade with another IP (using the same session), you get:

[x44 2014-10-28 11:35:00] WARN: Cookies are invalid. Need to re-authenticate.

[voided]

Can you provide more evidence? I don't know what "cookies are invalid" means, and it sounds like you're basing your claims on the guesswork of SteamBot. On Oct 29, 2014 1:27 PM, "glen-84" notifications@github.com wrote:

@VoiDeD https://github.com/VoiDeD I know, but the session is tied to the IP address (AFAIK), so if you authenticate using SteamKit with the default IP, and then you trade with another IP (using the same session), you get:

[x44 2014-10-28 11:35:00] WARN: Cookies are invalid. Need to re-authenticate.

— Reply to this email directly or view it on GitHub https://github.com/SteamRE/SteamKit/issues/83#issuecomment-60978527.

[glen-84]

SteamBot calls UserWebLogOn() which calls SteamWeb.Authenticate() which uses WebAPI.GetInterface ("ISteamUserAuth"). This returns a sessionId that is passed to the TradeManager and used for trading.

Cookies are verified in Bot.CheckCookies(), and I believe that the sessionid and/or steamLogin cookie is invalidated by a change in IP address.

@scholtzm Am I wrong here?

[voided]

The sessionid cookie is simply used as a CSRF token, have you tried simply requesting a new token for any subsequent requests on a new IP address? Additionally, you could very likely just provide whatever sessionid value you like, as long as the values in the cookie and the ajax request match.

This would all require modifications to SteamBot, however, as that project has made some poor assumptions on how steamcommunity web requests and such operate.

[scholtzm]

Since I have been mentioned, here's how SteamBot's cookie handling works right now:

• after initial launch, SteamBot uses SteamKit's WebAPI to authenticate
• we receive back sessionid, steamLogin and steamLoginSecure values and use these for any HTTP requests to steamcommunity.com in form of cookies (e.g. regular trading)
• at certain point, these cookies are no longer valid --> every HTTP request returns Set-Cookie header with deleted values
• this happens for example when you login from different IP address
• at this point, bot will once again call authentication method and we use the new set of values for all HTTP requests

This system is based on logging the HTTP traffic. It works although it might not be the "correct" way to do it.

[voided]

I think I'm going to close this issue unless there's some legitimate and pressing need to bind to a specific source address.

On the topic of the sessionid cookie, that's definitely only used as a CSRF token, and you can freely pass any values you like (as long as the cookie and request parameter match) so it's not tied to the local IP address of the client at all.