Public commit record
28/100 · Opaque
What the developer wrote
Authored by tobtoht
daemon: remove miniupnp
✓ Subject identifies a change! No meaningful explanatory body
What changed, and why it matters
This commit removes the miniupnp library and all UPnP port-forwarding support from the Monero daemon. UPnP is a protocol that lets programs automatically open ports on home routers, but it has a long history of security bugs and can expose services to the internet unexpectedly. The change keeps the --igd command-line option for backward compatibility but makes it non-functional, and removes the --no-igd option because it is no longer needed. This is a defensive hardening change rather than a fix for a specific known Monero vulnerability.
Recommended action
Treat this as a hardening improvement. Users who previously relied on UPnP automatic port mapping will now need to forward ports manually. Review the unrelated tests/fuzz/CMakeLists.txt if(OSSFUZZ) change separately to ensure intended fuzz targets are still built when needed. No urgent patch action is required.
Security signals we found
01
Removal of third-party dependency with known security history (miniupnpc)
02
Disabling of UPnP/IGD port mapping feature that could expose listening ports
03
Backward-compatibility warning added for deprecated --igd option
04
No replacement UPnP implementation introduced
Evidence from the diff
The patch deletes the external/miniupnp submodule, removes CMake integration (FindMiniupnpc.cmake, external/CMakeLists.txt, src/p2p/CMakeLists.txt), strips all miniupnpc headers and API calls from src/p2p/net_node.inl, and removes the igd_t enum and related methods from src/p2p/net_node.h. The –igd argument now only accepts ‘disabled’ and warns if used; –no-igd is removed. Build and test scripts are updated accordingly. A side change wraps tests/fuzz/CMakeLists.txt fuzz targets in an if(OSSFUZZ) guard, which appears unrelated to the UPnP removal.
Changed components
src/p2p/net_node.cppsrc/p2p/net_node.hsrc/p2p/net_node.inlexternal/miniupnpCMakeLists.txtexternal/CMakeLists.txtsrc/p2p/CMakeLists.txttests/fuzz/CMakeLists.txtInspect captured patch +16 / −318
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6aeaae9..02568bc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,7 +15,7 @@ env:
REMOVE_BUNDLED_PACKAGES : sudo rm -rf /usr/local
# ARCH="default" (not "native") ensures, that a different execution host can execute binaries compiled elsewhere.
BUILD_DEFAULT_LINUX: 'cmake -S . -B build -D ARCH="default" -D BUILD_TESTS=ON -D ENABLE_FUZZ_TEST=ON -D CMAKE_BUILD_TYPE=Release && cmake --build build --target all && cmake --build build --target wallet_api'
- APT_INSTALL_LINUX: 'apt -y install build-essential cmake libboost-all-dev miniupnpc libunbound-dev graphviz doxygen libunwind8-dev pkg-config libssl-dev libzmq3-dev libsodium-dev libhidapi-dev libusb-1.0-0-dev libprotobuf-dev protobuf-compiler ccache curl git'
+ APT_INSTALL_LINUX: 'apt -y install build-essential cmake libboost-all-dev libunbound-dev graphviz doxygen libunwind8-dev pkg-config libssl-dev libzmq3-dev libsodium-dev libhidapi-dev libusb-1.0-0-dev libprotobuf-dev protobuf-compiler ccache curl git'
APT_SET_CONF: |
tee -a /etc/apt/apt.conf.d/80-custom << EOF
Acquire::Retries "3";
@@ -53,7 +53,7 @@ jobs:
run: |
brew uninstall cmake
brew update
- brew install --quiet cmake boost hidapi openssl zmq miniupnpc expat libunwind-headers protobuf ccache
+ brew install --quiet cmake boost hidapi openssl zmq expat libunwind-headers protobuf ccache
- name: build
run: |
${{env.CCACHE_SETTINGS}}
diff --git a/.gitignore b/.gitignore
index fd169aa..3d84fe0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,8 +20,6 @@ cscope.out
cscope.in.out
cscope.po.out
-external/miniupnpc/Makefile
-miniupnpcstrings.h
version/
ClangBuildAnalyzerSession.txt
diff --git a/.gitmodules b/.gitmodules
index f711a55..8091f82 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,3 @@
-[submodule "external/miniupnp"]
- path = external/miniupnp
- url = https://github.com/miniupnp/miniupnp
[submodule "external/rapidjson"]
path = external/rapidjson
url = https://github.com/Tencent/rapidjson
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2e58c1c..b20f24f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -378,7 +378,6 @@ if(NOT MANUAL_SUBMODULES)
endfunction ()
message(STATUS "Checking submodules")
- check_submodule(external/miniupnp)
check_submodule(external/rapidjson)
check_submodule(external/randomx)
check_submodule(external/supercop)
@@ -434,7 +433,6 @@ else()
endif()
message(STATUS "Building for a ${ARCH_WIDTH}-bit system")
-# Check if we're on FreeBSD so we can exclude the local miniupnpc (it should be installed from ports instead)
# CMAKE_SYSTEM_NAME checks are commonly known, but specifically taken from libsdl's CMakeLists
if(CMAKE_SYSTEM_NAME MATCHES "kFreeBSD.*|FreeBSD")
set(FREEBSD TRUE)
diff --git a/README.md b/README.md
index 480e7ae..48c9daf 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ sudo dnf install gcc gcc-c++ cmake pkgconf boost-devel openssl-devel zeromq-deve
Install all dependencies at once on openSUSE:
```
-sudo zypper ref && sudo zypper in cppzmq-devel libboost_chrono-devel libboost_date_time-devel libboost_filesystem-devel libboost_locale-devel libboost_program_options-devel libboost_regex-devel libboost_serialization-devel libboost_system-devel libboost_thread-devel libexpat-devel libminiupnpc-devel libsodium-devel libunwind-devel unbound-devel cmake doxygen ccache fdupes gcc-c++ libevent-devel libopenssl-devel pkgconf-pkg-config readline-devel xz-devel libqt5-qttools-devel patterns-devel-C-C++-devel_C_C++
+sudo zypper ref && sudo zypper in cppzmq-devel libboost_chrono-devel libboost_date_time-devel libboost_filesystem-devel libboost_locale-devel libboost_program_options-devel libboost_regex-devel libboost_serialization-devel libboost_system-devel libboost_thread-devel libexpat-devel libsodium-devel libunwind-devel unbound-devel cmake doxygen ccache fdupes gcc-c++ libevent-devel libopenssl-devel pkgconf-pkg-config readline-devel xz-devel libqt5-qttools-devel patterns-devel-C-C++-devel_C_C++
```
Install all dependencies at once on macOS with the provided Brewfile:
@@ -633,15 +633,13 @@ setting the following configuration parameters and environment variables:
* `--p2p-bind-ip 127.0.0.1` on the command line or `p2p-bind-ip=127.0.0.1` in
monerod.conf to disable listening for connections on external interfaces.
-* `--no-igd` on the command line or `no-igd=1` in monerod.conf to disable IGD
- (UPnP port forwarding negotiation), which is pointless with Tor.
* If you use the wallet with a Tor daemon via the loopback IP (eg, 127.0.0.1:9050),
then use `--untrusted-daemon` unless it is your own hidden service.
Example command line to start monerod through Tor:
```bash
-monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1 --no-igd
+monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1
```
A helper script is in contrib/tor/monero-over-tor.sh. It assumes Tor is installed
@@ -655,7 +653,7 @@ allow inbound connections. Full example:
```bash
sudo iptables -I OUTPUT 2 -p tcp -d 127.0.0.1 -m tcp --dport 18081 -j ACCEPT
-DNS_PUBLIC=tcp torsocks ./monerod --p2p-bind-ip 127.0.0.1 --no-igd --rpc-bind-ip 127.0.0.1 \
+DNS_PUBLIC=tcp torsocks ./monerod --p2p-bind-ip 127.0.0.1 --rpc-bind-ip 127.0.0.1 \
--data-dir /home/amnesia/Persistent/your/directory/to/the/blockchain
```
diff --git a/cmake/FindMiniupnpc.cmake b/cmake/FindMiniupnpc.cmake
deleted file mode 100644
index ad2004a..0000000
--- a/cmake/FindMiniupnpc.cmake
+++ /dev/null
@@ -1,59 +0,0 @@
-# --------------------------------- FindMiniupnpc Start ---------------------------------
-# Locate miniupnp library
-# This module defines
-# MINIUPNP_FOUND, if false, do not try to link to miniupnp
-# MINIUPNP_LIBRARY, the miniupnp variant
-# MINIUPNP_INCLUDE_DIR, where to find miniupnpc.h and family)
-# MINIUPNPC_VERSION_1_7_OR_HIGHER, set if we detect the version of miniupnpc is 1.7 or higher
-#
-# Note that the expected include convention is
-# #include "miniupnpc.h"
-# and not
-# #include <miniupnpc/miniupnpc.h>
-# This is because, the miniupnpc location is not standardized and may exist
-# in locations other than miniupnpc/
-
-if (MINIUPNP_INCLUDE_DIR AND MINIUPNP_LIBRARY)
- # Already in cache, be silent
- set(MINIUPNP_FIND_QUIETLY TRUE)
-endif ()
-
-find_path(MINIUPNP_INCLUDE_DIR miniupnpc.h
- HINTS $ENV{MINIUPNP_INCLUDE_DIR}
- PATH_SUFFIXES miniupnpc
-)
-
-find_library(MINIUPNP_LIBRARY miniupnpc
- HINTS $ENV{MINIUPNP_LIBRARY}
-)
-
-find_library(MINIUPNP_STATIC_LIBRARY libminiupnpc.a
- HINTS $ENV{MINIUPNP_STATIC_LIBRARY}
-)
-
-set(MINIUPNP_INCLUDE_DIRS ${MINIUPNP_INCLUDE_DIR})
-set(MINIUPNP_LIBRARIES ${MINIUPNP_LIBRARY})
-set(MINIUPNP_STATIC_LIBRARIES ${MINIUPNP_STATIC_LIBRARY})
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(
- MiniUPnPc DEFAULT_MSG
- MINIUPNP_INCLUDE_DIR
- MINIUPNP_LIBRARY
-)
-
-IF(MINIUPNPC_FOUND)
- file(STRINGS "${MINIUPNP_INCLUDE_DIR}/miniupnpc.h" MINIUPNPC_API_VERSION_STR REGEX "^#define[\t ]+MINIUPNPC_API_VERSION[\t ]+[0-9]+")
- if(MINIUPNPC_API_VERSION_STR MATCHES "^#define[\t ]+MINIUPNPC_API_VERSION[\t ]+([0-9]+)")
- set(MINIUPNPC_API_VERSION "${CMAKE_MATCH_1}")
- if (${MINIUPNPC_API_VERSION} GREATER "10" OR ${MINIUPNPC_API_VERSION} EQUAL "10")
- message(STATUS "Found miniupnpc API version " ${MINIUPNPC_API_VERSION})
- set(MINIUPNP_FOUND true)
- set(MINIUPNPC_VERSION_1_7_OR_HIGHER true)
- endif()
- endif()
-
-ENDIF()
-
-mark_as_advanced(MINIUPNP_INCLUDE_DIR MINIUPNP_LIBRARY MINIUPNP_STATIC_LIBRARY)
-# --------------------------------- FindMiniupnpc End ---------------------------------
diff --git a/contrib/brew/Brewfile b/contrib/brew/Brewfile
index 5d60174..2e4107f 100644
--- a/contrib/brew/Brewfile
+++ b/contrib/brew/Brewfile
@@ -19,7 +19,6 @@ brew "zmq"
brew "libpgm"
brew "unbound"
brew "libsodium"
-brew "miniupnpc"
brew "readline"
brew "expat"
brew "ccache"
diff --git a/docs/ANONYMITY_NETWORKS.md b/docs/ANONYMITY_NETWORKS.md
index 363dbfd..78f5e78 100644
--- a/docs/ANONYMITY_NETWORKS.md
+++ b/docs/ANONYMITY_NETWORKS.md
@@ -49,7 +49,7 @@ You may sync the blockchain using a SOCKS4 proxy. Monerod will connect to IPv4
nodes using this proxy to sync the blockchain.
```bash
-monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1 --no-igd
+monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1
```
You can also combine `--proxy` with `--tx-proxy` (see below).
@@ -213,7 +213,7 @@ connections. Your ISP will see that you are running Tor, but not Monerod.
```bash
sudo apt install tor # Or install Tor some other way
systemctl start tor # Or start Tor manually
-monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1 --no-igd
+monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1
```
### Connect to IPv4 Nodes Over Tor and Connect to Hidden Services
@@ -225,7 +225,6 @@ connections (including from Tor and I2P).
```bash
monerod --proxy 127.0.0.1:9050 \
--p2p-bind-ip 127.0.0.1 \
- --no-igd \
--tx-proxy tor,127.0.0.1:9050,10 \
--tx-proxy i2p,127.0.0.1:4447,10
```
@@ -237,7 +236,6 @@ You will need to configure [hidden services manually for Tor and I2P](https://do
```bash
monerod --proxy 127.0.0.1:9050 \
--p2p-bind-ip 127.0.0.1 \
- --no-igd \
--tx-proxy tor,127.0.0.1:9050,10 \
--tx-proxy i2p,127.0.0.1:4447,10 \
--anonymous-inbound=yourlongv3onionaddress.onion:18084,127.0.0.1:18084 \
diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
index dd65593..d3c9a9d 100644
--- a/external/CMakeLists.txt
+++ b/external/CMakeLists.txt
@@ -28,28 +28,6 @@
#
# Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers
-
-# This is broken up into two parts: first we check for miniupnp, compile it if we can't
-# find it, and thereafter we check for libunbound, and compile it if we can't find it.
-# We always compile if we are building statically to reduce static dependency issues...
-# ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
-# others.
-
-find_package(Miniupnpc REQUIRED)
-
-message(STATUS "Using in-tree miniupnpc")
-set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
-set(UPNPC_BUILD_SHARED OFF CACHE BOOL "Disable building shared library" FORCE)
-add_subdirectory(miniupnp/miniupnpc)
-set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
-set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
-set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
-if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
- set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
-endif()
-
-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
-
find_package(Unbound)
if(NOT UNBOUND_INCLUDE_DIR)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 6190b40..2bcc653 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -30,8 +30,6 @@
if (WIN32 OR STATIC)
add_definitions(-DSTATICLIB)
- # miniupnp changed their static define
- add_definitions(-DMINIUPNP_STATICLIB)
endif ()
function (monero_private_headers group)
diff --git a/src/p2p/CMakeLists.txt b/src/p2p/CMakeLists.txt
index 4764432..89a4ef8 100644
--- a/src/p2p/CMakeLists.txt
+++ b/src/p2p/CMakeLists.txt
@@ -38,7 +38,6 @@ target_link_libraries(p2p
version
cryptonote_core
net
- ${UPNP_LIBRARIES}
${Boost_CHRONO_LIBRARY}
${Boost_PROGRAM_OPTIONS_LIBRARY}
${Boost_FILESYSTEM_LIBRARY}
diff --git a/src/p2p/net_node.cpp b/src/p2p/net_node.cpp
index 87abcbe..c22eac5 100644
--- a/src/p2p/net_node.cpp
+++ b/src/p2p/net_node.cpp
@@ -162,7 +162,7 @@ namespace nodetool
const command_line::arg_descriptor<bool> arg_enable_dns_blocklist = {"enable-dns-blocklist", "Apply realtime blocklist from DNS", false};
const command_line::arg_descriptor<bool> arg_no_igd = {"no-igd", "Disable UPnP port mapping"};
- const command_line::arg_descriptor<std::string> arg_igd = {"igd", "UPnP port mapping (disabled, enabled, delayed)", "delayed"};
+ const command_line::arg_descriptor<std::string> arg_igd = {"igd", "UPnP port mapping (disabled)", "disabled"};
const command_line::arg_descriptor<bool> arg_p2p_use_ipv6 = {"p2p-use-ipv6", "Enable IPv6 for p2p", false};
const command_line::arg_descriptor<bool> arg_p2p_ignore_ipv4 = {"p2p-ignore-ipv4", "Ignore unsuccessful IPv4 bind for p2p", false};
const command_line::arg_descriptor<int64_t> arg_out_peers = {"out-peers", "set max number of out peers", P2P_DEFAULT_CONNECTIONS_COUNT};
diff --git a/src/p2p/net_node.h b/src/p2p/net_node.h
index 3052cca..b7c1e46 100644
--- a/src/p2p/net_node.h
+++ b/src/p2p/net_node.h
@@ -236,13 +236,6 @@ namespace nodetool
}
};
- enum igd_t
- {
- no_igd,
- igd,
- delayed_igd,
- };
-
public:
typedef t_payload_net_handler payload_net_handler;
@@ -253,7 +246,6 @@ namespace nodetool
m_rpc_credits_per_hash(0),
m_allow_local_ip(false),
m_hide_my_port(false),
- m_igd(no_igd),
m_offline(false),
is_closing(false),
m_network_id(),
@@ -381,14 +373,6 @@ namespace nodetool
bool is_peer_used(const peerlist_entry& peer);
bool is_peer_used(const anchor_peerlist_entry& peer);
bool is_addr_connected(const epee::net_utils::network_address& peer);
- void add_upnp_port_mapping_impl(uint32_t port, bool ipv6=false);
- void add_upnp_port_mapping_v4(uint32_t port);
- void add_upnp_port_mapping_v6(uint32_t port);
- void add_upnp_port_mapping(uint32_t port, bool ipv4=true, bool ipv6=false);
- void delete_upnp_port_mapping_impl(uint32_t port, bool ipv6=false);
- void delete_upnp_port_mapping_v4(uint32_t port);
- void delete_upnp_port_mapping_v6(uint32_t port);
- void delete_upnp_port_mapping(uint32_t port);
template<class t_callback>
bool try_ping(basic_node_data& node_data, p2p_connection_context& context, const t_callback &cb);
bool try_get_support_flags(const p2p_connection_context& context, std::function<void(p2p_connection_context&, const uint32_t&)> f);
@@ -461,7 +445,6 @@ namespace nodetool
uint32_t m_rpc_credits_per_hash;
bool m_allow_local_ip;
bool m_hide_my_port;
- igd_t m_igd;
bool m_offline;
bool m_use_ipv6;
bool m_require_ipv4;
diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
index ce2d534..30e32bb 100644
--- a/src/p2p/net_node.inl
+++ b/src/p2p/net_node.inl
@@ -59,10 +59,6 @@
#include "net/parse.h"
#include "p2p/net_node.h"
-#include <miniupnp/miniupnpc/miniupnpc.h>
-#include <miniupnp/miniupnpc/upnpcommands.h>
-#include <miniupnp/miniupnpc/upnperrors.h>
-
#undef MONERO_DEFAULT_LOG_CATEGORY
#define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
@@ -441,34 +437,9 @@ namespace nodetool
public_zone.m_can_pingback = true;
m_external_port = command_line::get_arg(vm, arg_p2p_external_port);
m_allow_local_ip = command_line::get_arg(vm, arg_p2p_allow_local_ip);
- const bool has_no_igd = command_line::get_arg(vm, arg_no_igd);
- const std::string sigd = command_line::get_arg(vm, arg_igd);
- if (sigd == "enabled")
+ if (!command_line::is_arg_defaulted(vm, arg_igd))
{
- if (has_no_igd)
- {
- MFATAL("Cannot have both --" << arg_no_igd.name << " and --" << arg_igd.name << " enabled");
- return false;
- }
- m_igd = igd;
- }
- else if (sigd == "disabled")
- {
- m_igd = no_igd;
- }
- else if (sigd == "delayed")
- {
- if (has_no_igd && !command_line::is_arg_defaulted(vm, arg_igd))
- {
- MFATAL("Cannot have both --" << arg_no_igd.name << " and --" << arg_igd.name << " delayed");
- return false;
- }
- m_igd = has_no_igd ? no_igd : delayed_igd;
- }
- else
- {
- MFATAL("Invalid value for --" << arg_igd.name << ", expected enabled, disabled or delayed");
- return false;
+ MWARNING("UPnP port mapping support was removed. The --igd option is currently non-functional.");
}
m_offline = command_line::get_arg(vm, cryptonote::arg_offline);
m_use_ipv6 = command_line::get_arg(vm, arg_p2p_use_ipv6);
@@ -1023,16 +994,6 @@ namespace nodetool
if(m_external_port)
MDEBUG("External port defined as " << m_external_port);
- // add UPnP port mapping
- if(m_igd == igd)
- {
- add_upnp_port_mapping_v4(m_listening_port);
- if (m_use_ipv6)
- {
- add_upnp_port_mapping_v6(m_listening_port_ipv6);
- }
- }
-
return res;
}
//-----------------------------------------------------------------------------------
@@ -1114,9 +1075,6 @@ namespace nodetool
{
for(auto& zone : m_network_zones)
zone.second.m_net_server.deinit_server();
- // remove UPnP port mapping
- if(m_igd == igd)
- delete_upnp_port_mapping(m_listening_port);
}
return store_config();
}
@@ -2211,17 +2169,8 @@ namespace nodetool
}
else
{
- if (m_igd == delayed_igd)
- {
- MWARNING("No incoming connections, trying to setup IGD");
- add_upnp_port_mapping(m_listening_port);
- m_igd = igd;
- }
- else
- {
- const el::Level level = el::Level::Warning;
- MCLOG_RED(level, "global", "No incoming connections - check firewalls/routers allow port " << get_this_peer_port());
- }
+ const el::Level level = el::Level::Warning;
+ MCLOG_RED(level, "global", "No incoming connections - check firewalls/routers allow port " << get_this_peer_port());
}
}
return true;
@@ -3080,139 +3029,6 @@ namespace nodetool
e.clear();
}
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::add_upnp_port_mapping_impl(uint32_t port, bool ipv6) // if ipv6 false, do ipv4
- {
- std::string ipversion = ipv6 ? "(IPv6)" : "(IPv4)";
- MDEBUG("Attempting to add IGD port mapping " << ipversion << ".");
- int result;
- const int ipv6_arg = ipv6 ? 1 : 0;
-
-#if MINIUPNPC_API_VERSION > 13
- // default according to miniupnpc.h
- unsigned char ttl = 2;
- UPNPDev* deviceList = upnpDiscover(1000, NULL, NULL, 0, ipv6_arg, ttl, &result);
-#else
- UPNPDev* deviceList = upnpDiscover(1000, NULL, NULL, 0, ipv6_arg, &result);
-#endif
- UPNPUrls urls;
- IGDdatas igdData;
- char lanAddress[64];
- result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
- freeUPNPDevlist(deviceList);
- if (result > 0) {
- if (result == 1) {
- std::ostringstream portString;
- portString << port;
-
- // Delete the port mapping before we create it, just in case we have dangling port mapping from the daemon not being shut down correctly
- UPNP_DeletePortMapping(urls.controlURL, igdData.first.servicetype, portString.str().c_str(), "TCP", 0);
-
- int portMappingResult;
- portMappingResult = UPNP_AddPortMapping(urls.controlURL, igdData.first.servicetype, portString.str().c_str(), portString.str().c_str(), lanAddress, CRYPTONOTE_NAME, "TCP", 0, "0");
- if (portMappingResult != 0) {
- LOG_ERROR("UPNP_AddPortMapping failed, error: " << strupnperror(portMappingResult));
- } else {
- MLOG_GREEN(el::Level::Info, "Added IGD port mapping.");
- }
- } else if (result == 2) {
- MWARNING("IGD was found but reported as not connected.");
- } else if (result == 3) {
- MWARNING("UPnP device was found but not recognized as IGD.");
- } else {
- MWARNING("UPNP_GetValidIGD returned an unknown result code.");
- }
-
- FreeUPNPUrls(&urls);
- } else {
- MINFO("No IGD was found.");
- }
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::add_upnp_port_mapping_v4(uint32_t port)
- {
- add_upnp_port_mapping_impl(port, false);
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::add_upnp_port_mapping_v6(uint32_t port)
- {
- add_upnp_port_mapping_impl(port, true);
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::add_upnp_port_mapping(uint32_t port, bool ipv4, bool ipv6)
- {
- if (ipv4) add_upnp_port_mapping_v4(port);
- if (ipv6) add_upnp_port_mapping_v6(port);
- }
-
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::delete_upnp_port_mapping_impl(uint32_t port, bool ipv6)
- {
- std::string ipversion = ipv6 ? "(IPv6)" : "(IPv4)";
- MDEBUG("Attempting to delete IGD port mapping " << ipversion << ".");
- int result;
- const int ipv6_arg = ipv6 ? 1 : 0;
-#if MINIUPNPC_API_VERSION > 13
- // default according to miniupnpc.h
- unsigned char ttl = 2;
- UPNPDev* deviceList = upnpDiscover(1000, NULL, NULL, 0, ipv6_arg, ttl, &result);
-#else
- UPNPDev* deviceList = upnpDiscover(1000, NULL, NULL, 0, ipv6_arg, &result);
-#endif
- UPNPUrls urls;
- IGDdatas igdData;
- char lanAddress[64];
- result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
- freeUPNPDevlist(deviceList);
- if (result > 0) {
- if (result == 1) {
- std::ostringstream portString;
- portString << port;
-
- int portMappingResult;
- portMappingResult = UPNP_DeletePortMapping(urls.controlURL, igdData.first.servicetype, portString.str().c_str(), "TCP", 0);
- if (portMappingResult != 0) {
- LOG_ERROR("UPNP_DeletePortMapping failed, error: " << strupnperror(portMappingResult));
- } else {
- MLOG_GREEN(el::Level::Info, "Deleted IGD port mapping.");
- }
- } else if (result == 2) {
- MWARNING("IGD was found but reported as not connected.");
- } else if (result == 3) {
- MWARNING("UPnP device was found but not recognized as IGD.");
- } else {
- MWARNING("UPNP_GetValidIGD returned an unknown result code.");
- }
-
- FreeUPNPUrls(&urls);
- } else {
- MINFO("No IGD was found.");
- }
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::delete_upnp_port_mapping_v4(uint32_t port)
- {
- delete_upnp_port_mapping_impl(port, false);
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::delete_upnp_port_mapping_v6(uint32_t port)
- {
- delete_upnp_port_mapping_impl(port, true);
- }
-
- template<class t_payload_net_handler>
- void node_server<t_payload_net_handler>::delete_upnp_port_mapping(uint32_t port)
- {
- delete_upnp_port_mapping_v4(port);
- delete_upnp_port_mapping_v6(port);
- }
-
template<typename t_payload_net_handler>
boost::optional<p2p_connection_context_t<typename t_payload_net_handler::connection_context>>
node_server<t_payload_net_handler>::socks_connect(network_zone& zone, const epee::net_utils::network_address& remote, epee::net_utils::ssl_support_t ssl_support)
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index d5bbb39..3897fa4 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -36,8 +36,6 @@ set(TEST_DATA_DIR "${CMAKE_CURRENT_BINARY_DIR}/data")
if (WIN32 AND STATIC)
add_definitions(-DSTATICLIB)
- # miniupnp changed their static define
- add_definitions(-DMINIUPNP_STATICLIB)
endif ()
set(BUILD_GMOCK OFF CACHE BOOL "Don't build GMock" FORCE)
diff --git a/tests/functional_tests/functional_tests_rpc.py b/tests/functional_tests/functional_tests_rpc.py
index 3881bf3..a630048 100755
--- a/tests/functional_tests/functional_tests_rpc.py
+++ b/tests/functional_tests/functional_tests_rpc.py
@@ -52,7 +52,8 @@ WALLET_DIRECTORY = builddir + "/functional-tests-directory"
FUNCTIONAL_TESTS_DIRECTORY = builddir + "/tests/functional_tests"
DIFFICULTY = 10
-monerod_base = [builddir + "/bin/monerod", "--regtest", "--fixed-difficulty", str(DIFFICULTY), "--no-igd", "--p2p-bind-port", "monerod_p2p_port", "--rpc-bind-port", "monerod_rpc_port", "--zmq-rpc-bind-port", "monerod_zmq_port", "--zmq-pub", "monerod_zmq_pub", "--non-interactive", "--disable-dns-checkpoints", "--check-updates", "disabled", "--rpc-ssl", "disabled", "--data-dir", "monerod_data_dir", "--log-level", "1", "--rpc-max-connections-per-private-ip", "100", "--rpc-max-connections", "100"]
+monerod_base = [builddir + "/bin/monerod", "--regtest", "--fixed-difficulty", str(DIFFICULTY), "--p2p-bind-port", "monerod_p2p_port", "--rpc-bind-port", "monerod_rpc_port", "--zmq-rpc-bind-port", "monerod_zmq_port", "--zmq-pub", "monerod_zmq_pub", "--non-interactive", "--disable-dns-checkpoints", "--check-updates", "disabled", "--rpc-ssl", "disabled", "--data-dir", "monerod_data_dir", "--log-level", "1", "--rpc-max-connections-per-private-ip", "100", "--rpc-max-connections", "100"]
+
monerod_extra = [
["--offline"],
["--rpc-payment-address", "44SKxxLQw929wRF6BA9paQ1EWFshNnKhXM3qz6Mo3JGDE2YG3xyzVutMStEicxbQGRfrYvAAYxH6Fe8rnD56EaNwUiqhcwR", "--rpc-payment-difficulty", str(DIFFICULTY), "--rpc-payment-credits", "5000", "--offline"],
diff --git a/tests/fuzz/CMakeLists.txt b/tests/fuzz/CMakeLists.txt
index 6009ead..938413a 100644
--- a/tests/fuzz/CMakeLists.txt
+++ b/tests/fuzz/CMakeLists.txt
@@ -26,6 +26,7 @@
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
# THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+if(OSSFUZZ)
# Add the include path for <fuzzer/FuzzedDataProvider.h>
include_directories(${CMAKE_SOURCE_DIR}/tests/fuzz/include)
@@ -94,6 +95,7 @@ target_link_libraries(fuzz_zmq
set_property(TARGET fuzz_zmq
PROPERTY
FOLDER "tests")
+endif()
monero_add_minimal_executable(block_fuzz_tests block.cpp fuzzer.cpp)
target_link_libraries(block_fuzz_tests
diff --git a/tests/trezor/daemon.cpp b/tests/trezor/daemon.cpp
index a6e1e17..9e6c127 100644
--- a/tests/trezor/daemon.cpp
+++ b/tests/trezor/daemon.cpp
@@ -56,7 +56,6 @@ void mock_daemon::default_options(boost::program_options::variables_map & vm)
tools::options::set_option(vm, nodetool::arg_p2p_add_exclusive_node, po::variable_value(exclusive_nodes, false));
tools::options::set_option(vm, nodetool::arg_p2p_bind_ip, po::variable_value(std::string("127.0.0.1"), false));
- tools::options::set_option(vm, nodetool::arg_no_igd, po::variable_value(true, false));
tools::options::set_option(vm, cryptonote::arg_offline, po::variable_value(true, false));
tools::options::set_option(vm, "disable-dns-checkpoints", po::variable_value(true, false));
diff --git a/tests/unit_tests/node_server.cpp b/tests/unit_tests/node_server.cpp
index a99ea2d..3372206 100644
--- a/tests/unit_tests/node_server.cpp
+++ b/tests/unit_tests/node_server.cpp
@@ -182,7 +182,6 @@ namespace
std::vector<std::string> args{
"--regtest",
"--p2p-bind-ip=127.0.0.1",
- "--no-igd",
"--out-peers=0",
"--in-peers=0",
"--data-dir",
@@ -1293,7 +1292,6 @@ TEST(node_server, race_condition)
"--out-peers=0",
"--data-dir",
dir.string(),
- "--no-igd",
"--add-exclusive-node=127.0.0.1:48080",
"--check-updates=disabled",
"--disable-dns-checkpoints",
diff --git a/utils/fish/monerod.fish b/utils/fish/monerod.fish
index 7d20347..2800bf1 100644
--- a/utils/fish/monerod.fish
+++ b/utils/fish/monerod.fish
@@ -72,8 +72,6 @@ complete -c monerod -l ban-list -r -F -d "Specify ban list file, one IP address
complete -c monerod -l hide-my-port -d "Do not announce yourself as peerlist candidate"
complete -c monerod -l no-sync -d "Don't synchronize the blockchain with other peers"
complete -c monerod -l enable-dns-blocklist -d "Apply realtime blocklist from DNS"
-complete -c monerod -l no-igd -d "Disable UPnP port mapping"
-complete -c monerod -l igd -r -a "Enabled disabled enabled" -d "UPnP port mapping. Default: delayed"
complete -c monerod -l out-peers -r -d "Set max number of out peers. Default: 12"
complete -c monerod -l in-peers -r -d "Set max number of in peers. Default: -1"
complete -c monerod -l tos-flag -r -d "Set TOS flag. Default: -1"
Risk score
Our methodology →Why this scored 35/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.