Pages:
Author

Topic: Why is Miniupnpc in Bitcoin-Qt? (Read 2029 times)

legendary
Activity: 1708
Merit: 1020
July 16, 2013, 03:45:01 PM
#26
Personally I don't have libminiupnpc installed on my system and manually disable building with it each time I compile bitcoin, since I don't want my router to "automatically" open ports to me for security reasons.  Since I run bitcoin over Tor anyway, it wouldn't matter though even if I did open the port.  So I can understand the OPs ideas very well.  (Note that to help the network, I'm running a full node with 50-100 connections on my VPS.)

But I can also understand very well that probably without that most users wouldn't even know about opening their ports, so I think we can keep the current behaviour.

So why not always include the library and have an option in the preferences to deactivate UPNP?

That IS the case for official builds!? We have a Bitcoin-Qt option and take a look at the -upnp parameter.

Dia
Thanks for the info. Sorry for your time. Roll Eyes Everything is just fine. Smiley
hero member
Activity: 772
Merit: 500
July 16, 2013, 08:08:40 AM
#25
Personally I don't have libminiupnpc installed on my system and manually disable building with it each time I compile bitcoin, since I don't want my router to "automatically" open ports to me for security reasons.  Since I run bitcoin over Tor anyway, it wouldn't matter though even if I did open the port.  So I can understand the OPs ideas very well.  (Note that to help the network, I'm running a full node with 50-100 connections on my VPS.)

But I can also understand very well that probably without that most users wouldn't even know about opening their ports, so I think we can keep the current behaviour.

So why not always include the library and have an option in the preferences to deactivate UPNP?

That IS the case for official builds!? We have a Bitcoin-Qt option and take a look at the -upnp parameter.

Dia
legendary
Activity: 1135
Merit: 1166
July 16, 2013, 03:11:44 AM
#24
Personally I don't have libminiupnpc installed on my system and manually disable building with it each time I compile bitcoin, since I don't want my router to "automatically" open ports to me for security reasons.  Since I run bitcoin over Tor anyway, it wouldn't matter though even if I did open the port.  So I can understand the OPs ideas very well.  (Note that to help the network, I'm running a full node with 50-100 connections on my VPS.)

But I can also understand very well that probably without that most users wouldn't even know about opening their ports, so I think we can keep the current behaviour.

So why not always include the library and have an option in the preferences to deactivate UPNP?

That's a good suggestion (plus option in the bitcoin.conf file, since I don't use the UI version).  In my case, it is/was that way however simply because I didn't have libminiupnp installed and found it simpler to deactivate it in the build than to installing it.  (That's no argument that it should be that way, of course.)
legendary
Activity: 1708
Merit: 1020
July 16, 2013, 01:56:55 AM
#23
Personally I don't have libminiupnpc installed on my system and manually disable building with it each time I compile bitcoin, since I don't want my router to "automatically" open ports to me for security reasons.  Since I run bitcoin over Tor anyway, it wouldn't matter though even if I did open the port.  So I can understand the OPs ideas very well.  (Note that to help the network, I'm running a full node with 50-100 connections on my VPS.)

But I can also understand very well that probably without that most users wouldn't even know about opening their ports, so I think we can keep the current behaviour.

So why not always include the library and have an option in the preferences to deactivate UPNP?
staff
Activity: 4284
Merit: 8808
July 15, 2013, 09:38:17 PM
#22
Why the first 50 addresses with non-default port number are considered same as invalid?
To be honest, I have no idea. Just like I have no idea about a purpose of many things this s/w does, also spotted BTW.
But my personal experience advises me to not ask these kind of questions, because they don't like it.
It's a feature, not an issue - that's all you need to know.
The bitcoin elite is an actual elite, so if they made an effort to add a line of code - who are we to question it? Smiley
IIRC, You asked this previously and it was explained to you.  Bitcoin preferentially connects to the default port if it is able to in order to reduce the problem of a malicious party announcing other peoples addresses maliciously and creating connection DDOS attacks against random ports.  Its important that Bitcoin not act as a network nuisance and get itself banned from networks, so it doesn't use non-default ports unless the default ports aren't working.  I can't see into Satoshi's mind, but the rational seems clear enough for me.

Adding additional nodes on a single network is not of tremendous value to the network, though if you'd like to do so for local scaling reasons (instead of just increasing the accepted connections on a single node) you can simply load balance at the front end, iptables will do this happily, as will many commercial routers and firewalls. I've had multiple inbound nodes on a single IP this way without issue.  If there was evidence of a problem that could be solved by having more nodes on distinct ports treating a small range of high ports as equally preferred, which would also avoid the nuisance/DDOS risk. ... but I haven't seen a reason to even propose a BIP for it. If you have one, I'm all ears.

[Sorry for continuing the OT here,  but I'm somewhat concerned that piotr_n's misinformation— if unanswered— may adversely impact my personal reputation as well as the stability of the bitcoin ecosystem, e.g. if people who don't know better see his unanswered allegations that core developers never explain anything they may believe it]
legendary
Activity: 1708
Merit: 1020
July 15, 2013, 04:28:19 PM
#21
This is drifting too far off topic for my taste. I will lock this thread tomorrow so create a new thread and post a link to it here if you want to.
legendary
Activity: 2053
Merit: 1356
aka tonikt
July 15, 2013, 04:11:27 PM
#20
But I was right that it was not an issue - it's obviously a feature:
The obvious question now would be:
WTF? Why?
Why the first 50 addresses with non-default port number are considered same as invalid?
To be honest, I have no idea. Just like I have no idea about a purpose of many things this s/w does, also spotted BTW.
But my personal experience advises me to not ask these kind of questions, because they don't like it.
It's a feature, not an issue - that's all you need to know.
The bitcoin elite is an actual elite, so if they made an effort to add a line of code - who are we to question it? Smiley
hero member
Activity: 675
Merit: 514
July 15, 2013, 04:03:20 PM
#19
But I was right that it was not an issue - it's obviously a feature:
The obvious question now would be:
WTF? Why?
legendary
Activity: 2053
Merit: 1356
aka tonikt
July 15, 2013, 03:38:30 PM
#18
OK - I know already.

Maybe indeed I should not had said that it did not work with other port numbers than 8333, since it's not entirely true.

But I was right that it was not an issue - it's obviously a feature:
Code:
// do not allow non-default ports, unless after 50 invalid addresses selected already
if (addr.GetPort() != GetDefaultPort() && nTries < 50)                               
    continue;                                                                       

Even if it was an issue for someone, he does not need to change the source code to solve it - not at all.
He only needs to convince everyone else to setup a non-default TCP port in their clients - and then he should finally get some incoming satoshi connections... Smiley
legendary
Activity: 2053
Merit: 1356
aka tonikt
July 15, 2013, 02:25:27 PM
#17
Ok, I found one with Satoshi subver, but I guess that doesn't mean it's really a Satoshi client.
Especially with a banscore of 90 Smiley

As I said, I will re-check it and let you know again.
hero member
Activity: 675
Merit: 514
July 15, 2013, 02:16:19 PM
#16
Ok, I found one with Satoshi subver, but I guess that doesn't mean it's really a Satoshi client.

Code:
"addr" : "54.226.201.93:48905",
"services" : "00000001",
"lastsend" : 1373915589,
"lastrecv" : 1373915589,
"bytessent" : 1080771,
"bytesrecv" : 85632,
"conntime" : 1373914434,
"version" : 70001,
"subver" : "/Satoshi:0.8.1/",
"inbound" : true,
"startingheight" : 246738,
"banscore" : 90
hero member
Activity: 675
Merit: 514
July 15, 2013, 02:11:08 PM
#15
Hm. I didn't check that.
Ok, there's no "subver":
Code:
"addr" : "78.129.173.144:64907",
"services" : "00000001",
"lastsend" : 1373915264,
"lastrecv" : 1373915014,
"bytessent" : 25472,
"bytesrecv" : 243,
"conntime" : 1373914413,
"version" : 60000,
"subver" : "",
"inbound" : true,
"startingheight" : 246738,
"banscore" : 0
},
{
"addr" : "95.154.230.108:59716",
"services" : "00000001",
"lastsend" : 1373915277,
"lastrecv" : 1373915017,
"bytessent" : 24923,
"bytesrecv" : 243,
"conntime" : 1373914414,
"version" : 60000,
"subver" : "",
"inbound" : true,
"startingheight" : 246738,
"banscore" : 0
legendary
Activity: 2053
Merit: 1356
aka tonikt
July 15, 2013, 02:01:22 PM
#14
You mean version 0.8.3 ?
Lol, yeah, right.  Grin
Hmm.. OK, sorry - let me retest then.. last time I checked it wasn't working.
Are you sure that these are connections from an actual satoshi nodes?
They shouldn't connect twice, you know...
hero member
Activity: 675
Merit: 514
July 15, 2013, 02:00:00 PM
#13
No wonder that there was a lack of listening peers, since the satoshi client version 2013 still does not work with any TCP port except 8333.
It wont even connect to a different port, despite of the port number being an actual part of the protocol's addr structure - I guess it's to make the competition look equally bad Wink
You mean version 0.8.3 ?
Lol, yeah, right.  Grin
legendary
Activity: 2053
Merit: 1356
aka tonikt
July 15, 2013, 11:50:45 AM
#12
No wonder that there was a lack of listening peers, since the satoshi client version 2013 still does not work with any TCP port except 8333.
It wont even connect to a different port, despite of the port number being an actual part of the protocol's addr structure - I guess it's to make the competition look equally bad Wink

If you have a huge network behind NAT, only one PC is entitled to run a listening node, no matter how good you are in configuring your router, or how big was the upnp lib that you have liked it with.
Moreover, if you want to stop someone from using bitcoin, all you need to do is to block TCP port 8333 on your firewall and he won't be able to circumvent such a blockade, otherwise than by using Tor or VPN, which will be either slow or expensive.

But don't mind me - I'm always complaining about not an issues Smiley
legendary
Activity: 1232
Merit: 1094
July 15, 2013, 06:34:05 AM
#11
When the router has UPnP disabled you can't do anything about that.

There are NAT punching techniques that could help.  However, if most of the network has upnp, then it doesn't cause that much of a problem.  All connections have to be outbound.
hero member
Activity: 772
Merit: 500
July 15, 2013, 06:25:37 AM
#10
Well, I am currently on a Wireless connection, and I mean via a Nanostation that communicates to the main antenna of my ISP and this Nanostation M5 has a built-in router, but I have access neither to the router OR Nanostation control panel. Even UpnP does not forward my ports.

When the router has UPnP disabled you can't do anything about that.

Dia
legendary
Activity: 1862
Merit: 1011
Reverse engineer from time to time
July 15, 2013, 04:19:23 AM
#9
AFAIK the miniupnpc library that is included in the official Bitcoin-Qt versions tries to communicate to the router to automatically configure port forwarding.

Is that really necessary? Most people don't need this and for those who do it should be easy enough to either configure their routers manually or use a patched version.

Why would I like to remove it? In my opinion everything that is not necessary should be removed to keep complexity at a minimum.

There seem to have popped up a couple of security risks with Upnp router configuration so most people will have this deactivated in their routers anyway. Also I am not sure even the lousy windows firewall prevents this from working.

If you think otherwise, please explain.


Edit:
Answer that convinced me of the contrary:
Prior to UPNP being integrated and enabled by default the network was beginning to fail from a lack of listening peers, this was remedied by the deployment of UPNP. Your assumptions seem to have been previously proven incorrect.
OK. That is a strong argument.
Well, I am currently on a Wireless connection, and I mean via a Nanostation that communicates to the main antenna of my ISP and this Nanostation M5 has a built-in router, but I have access neither to the router OR Nanostation control panel. Even UpnP does not forward my ports.
legendary
Activity: 1135
Merit: 1166
July 15, 2013, 02:07:59 AM
#8
Personally I don't have libminiupnpc installed on my system and manually disable building with it each time I compile bitcoin, since I don't want my router to "automatically" open ports to me for security reasons.  Since I run bitcoin over Tor anyway, it wouldn't matter though even if I did open the port.  So I can understand the OPs ideas very well.  (Note that to help the network, I'm running a full node with 50-100 connections on my VPS.)

But I can also understand very well that probably without that most users wouldn't even know about opening their ports, so I think we can keep the current behaviour.
legendary
Activity: 1708
Merit: 1020
July 15, 2013, 01:44:21 AM
#7
Why would I like to remove it? In my opinion everything that is not necessary should be removed to keep complexity at a minimum.

That is to binary a choice.  The added complexity needs to be compared to to the benefit.
Yeah, of course.

Prior to UPNP being integrated and enabled by default the network was beginning to fail from a lack of listening peers, this was remedied by the deployment of UPNP. Your assumptions seem to have been previously proven incorrect.
OK. That is a strong argument.

Is that really necessary? Most people don't need this and for those who do it should be easy enough to either configure their routers manually or use a patched version.

Most people (as in 99.999% of the planet and rising) have absolutely no idea how to configure a router.  There is a reason why just about all networked software uses upnp.  Now if you are a power user, or want complete control just disable upnp and config port forwarding manually.

Quote
There seem to have popped up a couple of security risks with Upnp router configuration so most people will have this deactivated in their routers anyway.

Once again you massively overestimate the networking knowledge of "most people".  Most people if offered a $1,000 reward couldn't show you how to disable upnp on their own router.   When routers shipped with (paper weak security) WEP by default and WPA as an option the overwhelming majority of routers were never changed.  Hell most people wouldn't know how to configure a SSID or security key ("the wireless internet password") if it wasn't for wizards.  Most routers for home use now have windows install programs which find and configure the router because the concept of going to an IP address 192.168.0.1 results in too many tech support calls.
Hmm I assumed normal people would not have to configure anything.
Pages:
Jump to: