From fc3c1d51b1be9db6ba6ad286584fbc34bb305f38 Mon Sep 17 00:00:00 2001 From: Andrew Guschin Date: Fri, 30 Oct 2026 03:32:00 +0400 Subject: Fix protected activation ordering and diagnostic review findings --- src/diagnostics.rs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src/diagnostics.rs') diff --git a/src/diagnostics.rs b/src/diagnostics.rs index a2052ec..432a801 100644 --- a/src/diagnostics.rs +++ b/src/diagnostics.rs @@ -18,11 +18,12 @@ pub struct Observation { pub retry_after_seconds: Option, } -/// The caller supplies an authenticated, service-owned SOCKS endpoint. This client +/// The caller supplies an authenticated, service-owned HTTPS proxy endpoint. This client /// never inherits environment proxies or creates a direct route to the target. pub async fn measure( settings: &Settings, proxy: &str, + certificate: &str, id: String, generation: u64, speed: bool, @@ -42,11 +43,14 @@ pub async fn measure( }; let proxy = reqwest::Proxy::all(proxy).map_err(|_| anyhow!("Invalid protected probe endpoint"))?; + let certificate = reqwest::Certificate::from_pem(certificate.as_bytes()) + .map_err(|_| anyhow!("Invalid private probe certificate"))?; let client = reqwest::Client::builder() .no_proxy() .proxy(proxy) .redirect(reqwest::redirect::Policy::none()) - .timeout(Duration::from_secs(duration)) + .tls_certs_merge([certificate]) + .retry(reqwest::retry::never()) .user_agent(concat!("Roentgen/", env!("CARGO_PKG_VERSION"))) .build() .map_err(|_| anyhow!("Could not initialize diagnostic TLS client"))?; -- cgit v1.2.3