#18077 introduced support for NAT-PMP, but didn’t present any sort of deprecation plan for moving away from UPNP. This means we are supporting both. I don’t think Bitcoin Core should be actively supporting two different mechanisms (and thus two different dependencies) to essentially achieve the same outcome (NAT traversal); especially given our history with miniupnpc.
Using UPPp by default has been disabled since 0.11.1, which was released with an updated version of miniupnp, to fix a buffer overflow in its XML parsing. At the same time, using UPnP was disabled by default to prevent future vulnerabilities from potentially effecting the network at large. Note that even recent versions of miniupnpc contain (public) bugs that could be used to detrimentally effect a Bitcoin Core node.
miniupnp - implementation of UPnP (Universal Plug and Play)
- NAT traversal implemented via IGD (Internet Gateway Device Standardised Control Protocol)
- Not only does UPnP in have many issues in general, IGD has some issues of it’s own.
libnatpmp - implementation of NAT-PMP (alternative to IGD)
- NAT traversal
- Maintained by the same author as miniupnp.
NAT-PMP has been succeeded by PCP (Port Control Protocol). However the two protocols share similar semantics, and thus, devices that implement PCP are interoperable with devices using NAT-PMP. See NAT-PMP Transition.
It’s an unfortunate combination of how distros work, and the upstream maintainership of libnatpmp, that most distros are using a version of the source released in 2015, which is missing a number of bug fixes and improvements, and they may actually be using an even earlier version of the source, unknowingly, due to tarball mis-naming (see #21209).
