From 16371c587927b32ed654971441624a88cb450647 Mon Sep 17 00:00:00 2001 From: DanS Date: Wed, 14 Oct 2026 07:21:07 -0500 Subject: [PATCH] fix(rpc): bypass the env proxy for loopback RPC and local stats Loopback HTTP was still subject to the process environment's proxy settings (http_proxy / all_proxy). That routed the local daemon's basic-auth credentials and wallet data - and the miner's 127.0.0.1 stats API - through whatever proxy the user's shell happened to export, and could break the connection outright. - Local daemon RPC now sets curl's no-proxy to "*" when the host is loopback, so it always connects directly. This also overrides a no_proxy list. Remote daemons keep full proxy support unchanged. - The xmrig stats fetch against the local miner API does the same. Co-Authored-By: Claude Opus 4.8 --- src/daemon/xmrig_manager.cpp | 1 + src/rpc/rpc_client.cpp | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/src/daemon/xmrig_manager.cpp b/src/daemon/xmrig_manager.cpp index f35a160..dc40db8 100644 --- a/src/daemon/xmrig_manager.cpp +++ b/src/daemon/xmrig_manager.cpp @@ -739,6 +739,7 @@ void XmrigManager::fetchStatsHttp() { headers = curl_slist_append(headers, authHeader.c_str()); curl_easy_setopt(curl, CURLOPT_URL, url); + curl_easy_setopt(curl, CURLOPT_NOPROXY, "*"); // 127.0.0.1 miner API: never via an env proxy curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curlWriteCb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseData); diff --git a/src/rpc/rpc_client.cpp b/src/rpc/rpc_client.cpp index 2481f42..9add4db 100644 --- a/src/rpc/rpc_client.cpp +++ b/src/rpc/rpc_client.cpp @@ -225,6 +225,10 @@ bool RPCClient::open(const std::string& host, const std::string& port, // budget for the TCP + TLS handshake over real network latency (1s would spuriously fail). const long connectTimeout = Connection::isLocalHost(host) ? 2L : 10L; curl_easy_setopt(impl_->curl, CURLOPT_CONNECTTIMEOUT, connectTimeout); + // Loopback RPC carries basic-auth creds + wallet data: never route it through an env proxy + // (http_proxy / all_proxy). Remote daemons keep proxy support. NOPROXY also overrides no_proxy. + if (Connection::isLocalHost(host)) + curl_easy_setopt(impl_->curl, CURLOPT_NOPROXY, "*"); // Enforce TLS certificate + hostname verification explicitly rather than relying on libcurl's // build defaults. Harmless on the localhost http:// case; essential for a remote https daemon. curl_easy_setopt(impl_->curl, CURLOPT_SSL_VERIFYPEER, 1L);