Fix protected activation ordering and diagnostic review findings

1 files changed, 23 insertions, 16 deletions

diff --git a/src/xray.rs b/src/xray.rs
index 5ac8b62..c57147c 100644
--- a/src/xray.rs
+++ b/src/xray.rs
@@ -69,14 +69,11 @@ pub async fn preflight() -> Result<()> {
     Ok(())
 }
 
-pub fn configuration(connection: &Trojan, tun: bool, probe: Option<(u16, &str)>) -> Value {
+pub fn configuration(connection: &Trojan, tun: bool) -> Value {
     let mut inbounds = vec![];
     if tun {
         inbounds.push(json!({"tag":"host-tun","protocol":"tun","settings":{"name":"roentgen0","MTU":1500,"gateway":["198.18.0.1/30","fdfe:726f:656e::1/126"],"autoSystemRoutingTable":[],"autoOutboundsInterface":"","autoSystemDnsToGateway":false}}));
     }
-    if let Some((port, password)) = probe {
-        inbounds.push(json!({"tag":"probe","listen":"127.0.0.1","port":port,"protocol":"socks","settings":{"auth":"password","accounts":[{"user":"roentgen","pass":password}],"udp":false}}));
-    }
     let mut tls = json!({"serverName":connection.server_name,"allowInsecure":false});
     if !connection.alpn.is_empty() {
         tls["alpn"] = json!(connection.alpn);
@@ -121,6 +118,7 @@ pub struct Probe {
     unit: String,
     path: std::path::PathBuf,
     pub proxy: String,
+    pub certificate: String,
     active: bool,
 }
 impl Probe {
@@ -131,18 +129,33 @@ impl Probe {
         let token = uuid::Uuid::new_v4().simple().to_string();
         let unit = format!("roentgen-probe-{token}");
         let path = Path::new(RUNTIME_DIR).join(format!("{unit}.json"));
-        write_config(
-            &path,
-            &configuration(connection, false, Some((port, &token))),
-        )?;
+        let certified = rcgen::generate_simple_self_signed(vec!["127.0.0.1".into()])?;
+        let certificate = certified.cert.pem();
+        let key = certified.key_pair.serialize_pem();
+        let mut configuration = configuration(connection, false);
+        configuration["inbounds"] = json!([{
+            "tag":"probe", "listen":"127.0.0.1", "port":port, "protocol":"http",
+            "settings":{"accounts":[{"user":"roentgen","pass":token}]},
+            "streamSettings":{"network":"tcp","security":"tls","tlsSettings":{"certificates":[{
+                "certificate":certificate.lines().collect::<Vec<_>>(), "key":key.lines().collect::<Vec<_>>()
+            }]}}
+        }]);
+        write_config(&path, &configuration)?;
         drop(listener);
         let runtime_limit = format!("RuntimeMaxSec={}", duration.saturating_add(10));
+        let probe = Self {
+            unit,
+            path,
+            proxy: format!("https://roentgen:{token}@127.0.0.1:{port}"),
+            certificate,
+            active: true,
+        };
         let result = Command::new("/usr/bin/systemd-run")
             .args([
                 "--quiet",
                 "--collect",
                 "--unit",
-                &unit,
+                &probe.unit,
                 "--uid=roentgen-xray",
                 "--property=NoNewPrivileges=yes",
                 "--property=PrivateTmp=yes",
@@ -154,17 +167,11 @@ impl Probe {
                 "run",
                 "-config",
             ])
-            .arg(&path)
+            .arg(&probe.path)
             .stdout(Stdio::null())
             .stderr(Stdio::null())
             .status()
             .await;
-        let probe = Self {
-            unit,
-            path,
-            proxy: format!("socks5h://roentgen:{token}@127.0.0.1:{port}"),
-            active: true,
-        };
         if !result?.success() {
             probe.stop().await;
             anyhow::bail!("Could not launch protected Xray probe");