过去三年，Tor 项目一直致力于改进用于监控 Tor 网络健康状况的工具、资源和协议。这项工作旨在增强 Tor 网络的韧性，抵御中继攻击。
作为这项工作的一部分， 7aSecurity于 2025 年 10 月对这些工具进行了代码审计。
代码审核重点关注以下项目：
- TagTor是一个 Flask Web 应用程序，用于显示有关 Tor 网络及其节点的指标。
- DescriptorParser是一个小型的独立 Java 应用程序，用于将 Tor 网络描述符导入 PostgreSQL 数据库和 VictoriaMetrics 时间序列。
- Margot是一个使用 Arti 的 Rust 命令行应用程序，它为网络健康团队提供了一系列命令。
- Exitmap是一个基于 Python 的快速模块化 Tor 出口中继扫描器。
- Tor_fusion使用 Rust 编程语言解析 Tor 网络文档。
- Simple Bandwidth Scanner是一款 Tor 带宽扫描器，它生成带宽文件供目录管理机构使用。
- Tor通过隐藏您的互联网地址与您使用的服务之间的连接来保护您的网络隐私。该软件运行在 Tor 网络的每个中继节点上。
- Arti是用 Rust 实现的 Tor 协议。本次审计的代码是本项目期间发生更改的部分。
此次审计发现了六个漏洞，并提出了十一条安全加固建议。所有发现均已由 Tor 项目审核，修复工作正在作为我们持续安全和维护流程的一部分进行跟踪。
阅读完整审计报告
如需了解详细的调查结果和建议，请点击此处查看完整的审计报告。
https://blog-torproject-org.translate.goog/code-audit-network-health-tools/?_x_tr_sl=en&_x_tr_tl=zh-CN&_x_tr_hl=zh-CN&_x_tr_pto=sc
For the past three years, the Tor Project has been working to improve the tools, resources, and protocols used to monitor the health of the Tor network. This work aims to strengthen the Tor network's resilience and resist relay attacks.
As part of this effort, in October 2025, 7aSecurity conducted a code audit of those tools.
The code audit focused on the following projects:
- TagTor is a Flask web app to display metrics about the Tor network and its nodes.
- DescriptorParser is a small, standalone Java app to import Tor network descriptors into a PostgreSQL DB and a VictoriaMetrics time series.
- Margot is a Rust command-line application using Arti that provides a series of commands for the network health team.
- Exitmap is a fast and modular Python-based scanner for Tor exit relays.
- Tor_fusion parses Tor network documents in the Rust programming language.
- Simple Bandwidth Scanner is a Tor bandwidth scanner that generates bandwidth files to be used by directory authorities.
- C Tor protects your privacy on the internet by hiding the connection between your Internet address and the services you use. This software is the one that runs on each relay of the Tor network.
- Arti is the implementation of Tor in Rust. The code to be audited is the one that changed during this project.
The audit found six vulnerabilities and highlighted eleven hardening recommendations. All findings have been reviewed by the Tor Project, and remediation work is being tracked as part of our ongoing security and maintenance processes.
Read the full audit report
For detailed findings and recommendations, please see the complete audit report here
