commit 9204c77be8100f9327468e6e072923b96d17b377 Author: Damian Johnson atagar@torproject.org Date: Thu Jan 3 13:58:47 2019 -0800

More strictly scrub connections as private

Teor made a great point that even if we aren't configured to receive client traffic (ie, not a bridge or guard) we can still receive sensitive connections...

https://trac.torproject.org/projects/tor/ticket/27475 https://lists.torproject.org/pipermail/tor-relays/2018-September/016153.html

No longer checking our bridge/guard status and simply censoring connections if they don't belong to a relay in the consensus. --- nyx/panel/connection.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nyx/panel/connection.py b/nyx/panel/connection.py index 40fce88..f306278 100644 --- a/nyx/panel/connection.py +++ b/nyx/panel/connection.py @@ -232,10 +232,7 @@ class ConnectionEntry(Entry): return True

if self.get_type() == Category.INBOUND: - controller = tor_controller() - - if controller.is_user_traffic_allowed().inbound: - return len(nyx.tracker.get_consensus_tracker().get_relay_fingerprints(self._connection.remote_address)) == 0 + return len(nyx.tracker.get_consensus_tracker().get_relay_fingerprints(self._connection.remote_address)) == 0 elif self.get_type() == Category.EXIT: # DNS connections exiting us aren't private (since they're hitting our # resolvers). Everything else is.