How does bitcoin prevent DDoS amplification via the `addr` p2p message type?

Question

If I am not mistaken the mainline bitcoind will accept unsolicited addr messages, and upon receiving this message - the struct is deserialized, and then verify each address from the unsolicited sender. The addr struct allows for up to 1,000 arbitrary addresses:port tuples and there isn't a port restriction... so what exactly is preventing an attacker from flooding the 100k or so Bitciond nodes with the address to some target web servers on 80 and 443?

...To make things more abusable, the client knowingly accepts information drafted in the future, and will retry three times regardless of the error - even on a protocol mismatch. This means that flooding a control-plane service like sshd or a vpn or even an entire IP range of services could cause a lot of problems for a target entity with a large network footprint.

A similar issue to this was exploited on the DC++ network.

Answer 1

For a long time, there was a restriction to strongly prefer connecting to addresses with port 8333. This restriction was recently removed in PR 23542 and PR 23306, although a list of "bad ports" was introduced that bitcoin core nodes would still avoid to connect to.

If you send an address to a node, it will often save it in the new table of the AddrMan database (if there is no collision with an existing one), but it won't automatically connect to it. That might happen at some later point when they have less than the default 10 outbound connections and therefore need more, or when they make a periodic feeler connection. But since addresses are gossiped over the bitcoin network all the time, they will know about thousands of potential peers, so they would connect to a specific address of the victim only with a low probability.

So even if you send a victim's address to all bitcoin nodes, that doesn't mean that they would receive so many connections that it would qualify as a DoS attack. There has been a rough calculation in this post by vasild, which comes to the conclusion that even in the unrealistic scenario where nodes made new connections all the time, the number of connection attempts the victim would receive would be ~2 per second. In reality, it should be much less because nodes don't make connections all the time - the victim might get the occasional connection attempt from a bitcoin node, but nothing that would qualify as a DDoS attack.

Also note that your verification link from the OP is part of the AddrMan::Unserialize() function, only used to load saved addresses from the peers.dat file at startup, the function in AddrMan that is executed when receiving addresses from peers is AddrMan::Add().

Answer 2

This specific DDoS vulnerability was exploited in 2021, which lead to an emergency patch. PR #22387 is how Bitcoin prevents DDoS, clients running a version older than v22 may still be used to amplify attacks.