Bug: Monero - server unreachable when rpc-login is ON

[mariodian]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When I try connecting to my own monero node, I'm prompted to confirm untrusted certificate. As soon as I click trust I get the server unreachable error. I'm a 100% sure I provide the correct login credentials since I have no issues connecting to my node in Cake Wallet under these circumstances.

I can connect to the node with Stack when rpc_login is NOT set.

Expected Behavior

After clicking trust I should be able to connect to the server because the app can obviously communicate with it since it shows me the certificate fingerprint.

Reproduce Steps

1. monerod.conf:
   set rpc-login=<user>:<password>
2. add new node to Stack with the correct login credentials
3. click "test connection"
4. click "trust" certificate

Error

Environment

Server:

• Operating system and version: Ubuntu 24.04 LTS
• Device platform and version: Intel NUC 13

Client:

• Operating system and version: iOS 17.6.1
• Device platform and version: iPhone 15 Pro, Stack 2.1.5

Logs

No response

Further Information

No response

[sneurlax]

Working on this, just still having issues with RPC digest authentication

[GhostDog98]

Here's a video demo, as well as a (seemingly related?) Issue where the app insists on adding http:// to a local IP address; https://youtu.be/T0Xy2B8h7ZQ

[mariodian]

Issue where the app insists on adding http:// to a local IP address; https://youtu.be/T0Xy2B8h7ZQ

That’s fine. The rpc calls are made over http.

[sneurlax]

I made this tool which should now be able to resolve this issue: https://pub.dev/packages/digest_auth when replacing the functionality in testMoneroNodeConnection here:

stack_wallet/lib/utilities/test_monero_node_connection.dart

Lines 42 to 87 in 2907f7d

	if (proxyInfo == null) {
	// If the host ends in .onion, we can't access it without Tor.
	return MoneroNodeConnectionResponse(null, null, null, false);
	}
	SOCKSSocket? socket;
	try {
	// An HttpClient cannot be used for onion nodes.
	//
	// The SOCKSSocket class from the tor_ffi_plugin package can be used to
	// connect to .onion addresses. We'll do the same things as above but
	// with SOCKSSocket instead of httpClient.
	socket = await SOCKSSocket.create(
	proxyHost: proxyInfo.host.address,
	proxyPort: proxyInfo.port,
	sslEnabled: false,
	);
	await socket.connect();
	await socket.connectTo(uri.host, uri.port);
	final body = jsonEncode({
	"jsonrpc": "2.0",
	"id": "0",
	"method": "get_info",
	});
	final request = 'POST /json_rpc HTTP/1.1\r\n'
	'Host: ${uri.host}\r\n'
	'Content-Type: application/json\r\n'
	'Content-Length: ${body.length}\r\n'
	'\r\n'
	'$body';
	socket.write(request);
	print("Request sent: $request");
	final buffer = StringBuffer();
	await for (var response in socket.inputStream) {
	buffer.write(utf8.decode(response));
	if (buffer.toString().contains("\r\n\r\n")) {
	break;
	}
	}
	final result = buffer.toString();
	print("Response received: $result");

or https://pub.dev/packages/monero_rpc might also be able to solve the issue and possibly a bit cleaner, your choice there

[Kreyren]

Reproducible via NiXium's Monero Node: https://github.com/Arcanyx-org/NiXium/tree/central?tab=readme-ov-file#monero-node

Still says server not reachable on version 2.1.9.

Tor connection provided via inviziblePro app that does system-wide Tor and for stack the app is set as excluded application since it has built-in Tor.

[GhostDog98]

Is there a timeline on a possible fix for this? I'm concerned about using stack wallet now due to the lack of being able to connect to my own node.
As has recently been discovered, a malicious node can undermine the effects of ring-CT, and we have evidence that malicious actors are running such nodes.

[GhostDog98]

Primary source (leaked original presentation) for ongoing de-anonymization attack through malicious nodes: http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/monero-chain.mp4

Secondary summary of the situation: dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/6de54b143e669e368af6

[Kreyren]

Considering the information provided by GhostDog98 above i would recommend removing the monero node that stack uses out of clearweb and make it Tor Only or ideally prompt users to deploy their own to have Dandelion++ protection as it currently makes stack kinda dangerous to use for Monero.

NiXium Node above has a reference configuration for a Tor-Only Node if needed.

Posted in #1066