feat: Tails+Whonix support #634

nabijaczleweli · 2025-10-20T01:34:26Z

See commit messages for detail and full comparison logs, but in short:

on whonix, all normal TCP traffic is routed through the Tor proxy (and there's no way to bypass this)
we can use the system Tor's SOCKS5 socket directly as well, so
in the settings GUI, force the "Use Tor" slider on, make it undisableable, and add a note about whonix
hide the "Route Monero traffic through Tor" subtoggle
in the TUI questionnaires, don't ask to enable the Tor hidden service, or what address to listen on
instead of starting arti, call the system Tor proxy's SOCKS5 address

In principle, we could start a hidden service, but (a) the user needs to manually edit the configuration of both whonix VMs, (b) this still means talking to the Tor daemon with the control protocol, so (c) that means implementing the whole of the control protocol, and (d) the implementations which are currently in the wild do not support unix-domain socket backends (I did implement them in 2025-06 but the uptake has been slow), so (e) the resulting implementation is humongous (#391), so (f) this has been removed on request: #391 (comment)

AFAICT there's two code paths that can start arti and both are pre-empted by this.

For future extensibility, there are two levels of detexion:

may_init_tor() should return false if standard TCP traffic is routed through Tor ‒ this disables starting arti
existing_tor_config() can then return Some(...) if there's a Tor-capable SOCKS5 proxy to connect to instead of arti (and preferentially to plain TCP)

(For other systems (Tails?) the latter will most likely either reduce to if is_whonix() || is_tails() or else if is_tails() { Some(SocksServerAddress::Ip(...)) } )

(Also some cleanups at the front.)

Cf. #391, #453, https://bounties.monero.social/posts/180/0-789m-make-unstoppable-swap-whonix-friendly

nabijaczleweli · 2025-10-20T01:43:50Z

@binarybaron's checklist:

Not use any external dependencies (except widely used low level networking libraries) ‒ this holds. The only new dependency is tokio-socks which has 14M alltime and like 20k/d downloads; that's widely-used to me
Create an internal adapter that wraps either an Arti client or a external Tor socks proxy ‒ this adapter is OrTransport, which means the SOCKS5 proxy doesn't touch the arti one at all, so this is a modularity win
Drop support for hidden services for non arti clients due to the huge amount of complexity involved ‒ 👍
Massively reduce the size of the diff ‒ a veritable butcher's cut from +10k-600 to +350-40, and a lot of that is trivial boilerplate

binarybaron · 2025-10-20T07:53:00Z

src-gui/src/renderer/components/pages/help/SettingsBox.tsx

 */
 function MoneroTorSettings() {
+  // Hide this setting if it's superseded by the global Tor connection
+  if (torForced) {


React hooks must never be called conditionally

You need to move this below the hook calls.

binarybaron · 2025-10-20T08:20:39Z

@binarybaron's checklist:

Not use any external dependencies (except widely used low level networking libraries) ‒ this holds. The only new dependency is tokio-socks which has 14M alltime and like 20k/d downloads; that's widely-used to me

Create an internal adapter that wraps either an Arti client or a external Tor socks proxy ‒ this adapter is OrTransport, which means the SOCKS5 proxy doesn't touch the arti one at all, so this is a modularity win

Drop support for hidden services for non arti clients due to the huge amount of complexity involved ‒ 👍

Massively reduce the size of the diff ‒ a veritable butcher's cut from +10k-600 to +350-40, and a lot of that is trivial boilerplate

I'm happy to see you take this on!

Create an internal adapter that wraps either an Arti client or a external Tor socks proxy ‒ this adapter is OrTransport, which means the SOCKS5 proxy doesn't touch the arti one at all, so this is a modularity win

The adapter should not be relying on libp2p as it will not only be used for libp2p but also for other things in the future (bdk, monero-rpc-pool). It should be more low level and expose an interface similar to arti-client (a subset)

Please also make sure to put as little business logic into the frontend as possible.

nabijaczleweli · 2025-10-22T03:36:50Z

Since last we spoke, I back-propagated this as I think you'd hoped: I replaced the open-coded Option<Arc<TorClient<TokioRustlsRuntime>>>> with a new TorBackend enum, which pulled all the new logic back from the more UI-related callers, and it naturally pulled out even more, so front-end code should be even thinner. monero-rpc-pool, thus, also uses TorBackend instead of its Option<TorClientArc>.

I also tested in Tails. Tails userland operates in torsocks mode (nc github.com 443 and nc cebulka7uxchnbpvmqapg5pfos4ngaxglsktzvha7a5rigndghvadeyd.onion 80 both work) with no way to call the underlying proxy. I detect Tails and add TorBackend::Torsocks that calls /onion3/cebulka7uxchnbpvmqapg5pfos4ngaxglsktzvha7a5rigndghvadeyd:80 address prefixes like /dns/cebulka7uxchnbpvmqapg5pfos4ngaxglsktzvha7a5rigndghvadeyd.onion/tcp/80. See the Tails commit for how easy it is to add another backend, should it be required.

...and actually, whonix also does this. Since we don't have hidden services, we don't really need to talk to the proxy directly anymore either, and can treat whonix like Tails. This would drop basically all SOCKS5 and socket-related code w.l.o.g., so if you're looking to reduce this as far as possible...

I also found a privacy leak that bypasses Tor in some configurations. Please see the second commit from the top ("fix(swap/network): remove DNS leak if using Tor").

binarybaron · 2025-10-23T20:39:50Z

Sound good! Let me know once this is ready for review.

nabijaczleweli · 2025-10-23T22:48:35Z

I also tested in Tails. Tails userland operates in torsocks mode (nc github.com 443 and nc cebulka7uxchnbpvmqapg5pfos4ngaxglsktzvha7a5rigndghvadeyd.onion 80 both work) with no way to call the underlying proxy.

This is not true. It's supposed to be but it doesn't work on Tails (it works on whonix), and, even if you manage to resolve the address (notably /etc/resolv.conf says nameserver 127.0.0.1 but no-one seems to be listening on 127.0.0.1:53. it does work sometimes though), then nc ipaddr 80|443 fails instantly, curl errors out with ECONNREFUSED, and eigenwallet errors out with "failed to check for updates: error sending request for url (https://cdn.crabnebula.app/...)".

However, since curl would be broken in basically 100% of cases, and vanilla curl won't resolve .onion addresses, curl is actually /usr/local/bin/curl:

Thus, the correct way to dial out on Tails is to connect to a SOCKS5 proxy at well-known address 127.0.0.1:9050, and not to use torsocks.

On whonix we can use torsocks instead of calling the tor daemon over SOCKS5 directly (which may reduce the TcpOrUnixStream cruft), or we may call over SOCKS5 instead of torsocks (thus dropping torsocks).

I'll re-evaluate which combination of features yields the best-reduced patchset.

nabijaczleweli · 2025-10-23T23:22:29Z

commit 7011e7fdcbb0d01a58836fb099f51b7026a2bf98 (HEAD -> another-bout)
Author: наб <[email protected]>
Date:   Fri Oct 24 01:19:58 2025 +0200

    Remove TorBackend::Socks5's unix-domain socket back-end

 swap-tor/src/lib.rs    | 121 +++++++++++--------------------------------------------------------------------------------------------------------------
 swap/src/common/tor.rs |  18 ++++++------------
 2 files changed, 17 insertions(+), 122 deletions(-)

vs

commit b7037ccda18790cabb103d1cbe969963c0b1b9b7
Author: наб <[email protected]>
Date:   Fri Oct 24 01:05:44 2025 +0200

    Remove TorBackend::Torsocks

 monero-rpc-pool/src/tor.rs |  6 ++----
 swap-tor/Cargo.toml        |  2 +-
 swap-tor/src/lib.rs        | 77 -----------------------------------------------------------------------------
 swap/src/common/tor.rs     | 44 +++++++++++++++-----------------------------
 4 files changed, 18 insertions(+), 111 deletions(-)

so -105 vs -93. I will be retaining SOCKS5 for Tails and Torsocks for whonix.

nabijaczleweli · 2025-10-24T21:23:22Z

Also, because the Tails userland can't call over TCP directly, we need to also tell the monero C++ backend to talk over SOCKS5 as well (thankfully it supports it, it's just a question of injecting that in the right place I think).

The same applies to the autoupdater in tauri:

but this originates in a plugin. I haven't yet evaluated if it can be coerced to talk over SOCKS5.

binarybaron · 2025-10-25T13:51:27Z

Also, because the Tails userland can't call over TCP directly, we need to also tell the monero C++ backend to talk over SOCKS5 as well (thankfully it supports it, it's just a question of injecting that in the right place I think).

The same applies to the autoupdater in tauri: but this originates in a plugin. I haven't yet evaluated if it can be coerced to talk over SOCKS5.

The init function in bridge.rs (exposed by wallet2_api.h) allows us to set a proxy address.

nabijaczleweli · 2025-10-25T16:45:50Z

yeah, I got to that, and I think all the other places that do network I/O, last night (it may even be part of the pushed WIP); this was mostly to prime future readers for why it Got Bigger again 😬

nabijaczleweli · 2025-10-25T19:37:34Z

Apparently the default resolver rejects .onion addresses instead of not doing that (hickory-dns/hickory-dns#3331), so the Torsocks back-end needs to use a different resolver.

nabijaczleweli · 2025-10-26T06:10:28Z

@binarybaron PTAL. https://foreign.nabijaczleweli.xyz/pub/eigenwallet_3.2.0-rc.4_amd64.AppImage for your testing convenience and assorted screenshots below

Functionally this ended up being relatively thin (with a lot of deduplication wins), in taht both whonix and Tails end up using just SocksTransport, which only needs to support TCP so we get about without any wrappers, with a lot of fiddly hook injections: on tails Tails we need to cram a SOCKS5 proxy into every(? should be every, wfm and I don't see any non-TLS-related errors, which I assume is why I don't see any /dns/... swappers in my screenshots? they appear sometimes. idk) source of outgoing TCP calls.

whonix:

tails:

binarybaron · 2025-10-26T11:39:40Z

@binarybaron PTAL. https://foreign.nabijaczleweli.xyz/pub/eigenwallet_3.2.0-rc.4_amd64.AppImage for your testing convenience and assorted screenshots below

Functionally this ended up being relatively thin (with a lot of deduplication wins), in taht both whonix and Tails end up using just SocksTransport, which only needs to support TCP so we get about without any wrappers, with a lot of fiddly hook injections: on tails Tails we need to cram a SOCKS5 proxy into every(? should be every, wfm and I don't see any non-TLS-related errors, which I assume is why I don't see any /dns/... swappers in my screenshots? they appear sometimes. idk) source of outgoing TCP calls.

whonix:

tails:

Awesome! Thank you for your work.

I'll review this as soon as I find the time. I'll also have to get a x86 machine to test this.

binarybaron · 2025-10-26T11:40:14Z

@Einliterflasche Please also give this a review.

nabijaczleweli · 2025-10-26T17:40:21Z

JS fetch() doesn't go through the proxy so there's no fiat rates on Tails. There's hopefully a tauri toggle to inject it somewhere (these look or this looks promising at first glance).

nabijaczleweli · 2025-10-26T19:32:43Z

adding

{
  "app": {
    "windows": [
      {
        "proxyUrl": "socks5://127.0.0.1:9050"

to tauri.conf.json fixes it. we can edit this at run-time as well:

fixed, convenience AppImage updated

binarybaron · 2025-10-27T14:33:47Z

adding
{
  "app": {
    "windows": [
      {
        "proxyUrl": "socks5://127.0.0.1:9050"
to tauri.conf.json fixes it. we can edit this at run-time as well:

fixed, convenience AppImage updated

Awesome progress, I'm confident we can merge this fairly soon!

Please consider joining our eigenwallet development Matrix room 💛

binarybaron · 2025-10-27T15:22:08Z

src-gui/src/renderer/components/modal/updater/UpdaterDialog.tsx

-    // Check for updates when component mounts
-    check()
+    // Check, CheckOptions for updates when component mounts
+    check({ proxy })


is it possible to avoid the rust (getUpdaterProxy) -> js -> rust (check) roundtrip and do this in rust directly? There may be a way to configure the updater in src-tauri/lib.rs.

Unfortunately no. The TS API is thus:

async function check(options?: CheckOptions): Promise<Update | null> { convertToRustHeaders(options) const metadata = await invoke<UpdateMetadata | null>('plugin:updater|check', { ...options }) return metadata ? new Update(metadata) : null }

And calls

#[tauri::command] pub(crate) async fn check<R: Runtime>( webview: Webview<R>, headers: Option<Vec<(String, String)>>, timeout: Option<u64>, proxy: Option<String>, target: Option<String>, allow_downgrades: Option<bool>, ) -> Result<Option<Metadata>> { let mut builder = webview.updater_builder(); if let Some(headers) = headers { for (k, v) in headers { builder = builder.header(k, v)?; } } if let Some(timeout) = timeout { builder = builder.timeout(Duration::from_millis(timeout)); } if let Some(ref proxy) = proxy { let url = Url::parse(proxy.as_str())?; builder = builder.proxy(url); }

so there's no other way to forward the proxy parameter (it doesn't look like it reads the proxy from the global tauri webview config either, and there's no plugin-global proxy config field).

You might be able to create a custom Tauri command that replicates the behaviour but I think that's too much effort for now.

binarybaron · 2025-11-02T18:44:05Z

Can you also run the formatter (just fmt) and add a changelog entry?

src-gui/src/renderer/components/pages/help/SettingsBox.tsx

binarybaron

Some comments, mostly nitpicks. I really like the approach and I am impressed how fast you got a hold of the codebase!

@Einliterflasche will give a review too

binarybaron · 2025-11-02T22:40:20Z

Let me know if you'd be interested in contributing to the project again! We'd love to have you

…arm.listen_on() normally

asb::network::transport::new() would use DNS(Tor or TCP), which will resolve DNS queries over plaintext first, before calling them over Tor Cf. cli::transport::new() which correctly does Tor or DNS(TCP) Fix the former to do the latter, delegating domain resolution over Tor as well

…a unified TorBackend

…user about listening on TCP/Onion if the environment doesn't support it (TUI questionnaire)

Bypassing Tor on TorBackend::Socks breaks everything, because /all/ traffic needs to go through the proxy (normal connect() is broken on Tails)

… made

nabijaczleweli · 2025-11-03T01:35:50Z

All applied. I'm not opposed to completing more bounties or similar.

binarybaron · 2025-11-03T11:12:45Z

All applied. I'm not opposed to completing more bounties or similar.

We have a ton of compatibility isuses on Linux which have been hard for us to debug. We are also interested in building a TUI as an alternative for the Web based GUI. If you're interested in working on either of this things, let me know :)

Einliterflasche · 2025-11-03T06:55:34Z

swap-tor/src/lib.rs

+    type Output = tokio_util::compat::Compat<TcpStream>;
+    type Error = tokio_socks::Error;
+    type ListenerUpgrade = std::future::Pending<Result<Self::Output, Self::Error>>;
+    type Dial = Pin<Box<dyn Future<Output = Result<Self::Output, Self::Error>> + Send + 'static>>;


This can be type Dial = impl Future<Output = ...> + Send + 'static;

Not yet:

error[E0658]: `impl Trait` in associated types is unstable --> swap-tor/src/lib.rs:79:17 | 79 | type Dial = impl Future<Output = Result<Self::Output, Self::Error>> + Send + 'static; | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = note: see issue #63063 <https://github.com/rust-lang/rust/issues/63063> for more information error: item does not constrain `<Socks5Transport as libp2p::Transport>::Dial::{opaque#0}` --> swap-tor/src/lib.rs:104:8 | 104 | fn dial_as_listener( | ^^^^^^^^^^^^^^^^ | = note: consider removing `#[define_opaque]` or adding an empty `#[define_opaque()]` note: this opaque type is supposed to be constrained --> swap-tor/src/lib.rs:79:17 | 79 | type Dial = impl Future<Output = Result<Self::Output, Self::Error>> + Send + 'static; | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ For more information about this error, try `rustc --explain E0658`. error: could not compile `swap-tor` (lib) due to 2 previous errors

But it can be type Dial = BoxFuture<'static, Result<Self::Output, Self::Error>>; which is already used in libp2p-tor for its type Dial. Applied that.

binarybaron · 2025-11-05T15:05:00Z

@Einliterflasche Please also test this on your x86 machine

Einliterflasche · 2025-11-05T21:42:26Z

Can confirm this works on the qubesos/whonix 17 workstatio.

nabijaczleweli mentioned this pull request Oct 20, 2025

feat(cli, asb): Whonix and Tails support #391

Closed

nabijaczleweli force-pushed the another-bout branch from fc53eab to 4cf1d18 Compare October 20, 2025 03:50

binarybaron reviewed Oct 20, 2025

View reviewed changes

nabijaczleweli force-pushed the another-bout branch 4 times, most recently from 673e9dc to 8f06edd Compare October 22, 2025 03:29

nabijaczleweli force-pushed the another-bout branch from 8f06edd to 3ca802b Compare October 25, 2025 03:18

nabijaczleweli force-pushed the another-bout branch 2 times, most recently from 9d80f95 to bc2854f Compare October 26, 2025 06:07

nabijaczleweli changed the title ~~Whonix support~~ Tails+Whonix support Oct 26, 2025

binarybaron changed the title ~~Tails+Whonix support~~ feat: Tails+Whonix support Oct 26, 2025

binarybaron reviewed Oct 27, 2025

View reviewed changes

binarybaron reviewed Nov 2, 2025

View reviewed changes

src-gui/src/renderer/components/pages/help/SettingsBox.tsx Outdated Show resolved Hide resolved

binarybaron reviewed Nov 2, 2025

View reviewed changes

nabijaczleweli added 19 commits November 3, 2025 00:05

refactor(swap/api): reduce open-coded Result::ok

5f6a446

refactor(asb): don't needlessly clone config.network.listen, spell sw…

9c2fb37

…arm.listen_on() normally

refactor(asb/network): lift onion_addresses collection

40ce4c3

refactor(swap/tor): reduce TOR_*_TIMEOUT to const

e74a93b

refactor(swap/cli): discard Result with let _ = instead of .ok()

f646ca8

refactor(swap): deduplicate upgrading maybe_tor_client to TorTransport

12498ee

refactor(swap): deduplicate upgrading TorBackend to final transport

e339c13

Add swap-tor crate to supersede swap and monero-rpc-pool open-coding …

0601914

…a unified TorBackend

Perfuse TorBackend through swap

7bc0a49

Perfuse TorBackend through monero-rpc-pool

36cefcc

Add TorBackend::Socks to connect to a Tor daemon over a TCP SOCKS5 proxy

bb5d524

Detect Whonix and Tails, connect to their Tors specially

e6149cb

Inform the user that (and why) Tor is forced-on (GUI). Don't ask the …

a09a95f

…user about listening on TCP/Onion if the environment doesn't support it (TUI questionnaire)

fix(monero-rpc-pool): only try to bypass unforced Tor

3df691b

Bypassing Tor on TorBackend::Socks breaks everything, because /all/ traffic needs to go through the proxy (normal connect() is broken on Tails)

Distribute required-on-Tails SOCKS5 proxy everywhere a TCP request is…

626e041

… made

Forward required proxy to tauri as well

2a2661c

CHANGELOG

0922bd5

refactor: keep updaterProxy and torForcedExcuse in redux RPC store

4265a5d

nabijaczleweli force-pushed the another-bout branch from 6489811 to 4265a5d Compare November 3, 2025 01:13

nabijaczleweli mentioned this pull request Nov 3, 2025

[Bounty: 0.5 XMR] orchestrator setup: monerod / bitcoind via tor #668

Open

Einliterflasche reviewed Nov 5, 2025

View reviewed changes

s: bb5d524

90df02c

feat: Tails+Whonix support #634

Are you sure you want to change the base?

feat: Tails+Whonix support #634

Uh oh!

Conversation

nabijaczleweli commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nabijaczleweli commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

binarybaron Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

binarybaron commented Oct 20, 2025

Uh oh!

nabijaczleweli commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

binarybaron commented Oct 23, 2025

Uh oh!

nabijaczleweli commented Oct 23, 2025

Uh oh!

nabijaczleweli commented Oct 23, 2025

Uh oh!

nabijaczleweli commented Oct 24, 2025

Uh oh!

binarybaron commented Oct 25, 2025

Uh oh!

nabijaczleweli commented Oct 25, 2025

Uh oh!

nabijaczleweli commented Oct 25, 2025

Uh oh!

nabijaczleweli commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

binarybaron commented Oct 26, 2025

Uh oh!

binarybaron commented Oct 26, 2025

Uh oh!

nabijaczleweli commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nabijaczleweli commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

binarybaron commented Oct 27, 2025

Uh oh!

binarybaron Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

nabijaczleweli Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

binarybaron Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

binarybaron commented Nov 2, 2025

Uh oh!

Uh oh!

binarybaron left a comment

Choose a reason for hiding this comment

Uh oh!

binarybaron commented Nov 2, 2025

Uh oh!

nabijaczleweli commented Nov 3, 2025

Uh oh!

binarybaron commented Nov 3, 2025

Uh oh!

Einliterflasche Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

nabijaczleweli Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

nabijaczleweli Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

binarybaron commented Nov 5, 2025

nabijaczleweli commented Oct 20, 2025 •

edited

Loading

nabijaczleweli commented Oct 20, 2025 •

edited

Loading

nabijaczleweli commented Oct 22, 2025 •

edited

Loading

nabijaczleweli commented Oct 26, 2025 •

edited

Loading

nabijaczleweli commented Oct 26, 2025 •

edited

Loading

nabijaczleweli commented Oct 26, 2025 •

edited

Loading

nabijaczleweli Oct 27, 2025 •

edited

Loading