fix(ipsec): удалять сертификат только по явной привязке
This commit is contained in:
Denozordec committed
1 parent
d52c48e5ed
commit
057b530364
16 files changed
+644
-22
No files matched your search
@@ -0,0 +1,51 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"runtime": {
|
||||
"backend": "ux-bound116",
|
||||
"frontend": "ux-bound116"
|
||||
},
|
||||
"httpMocks": false,
|
||||
"cases": [
|
||||
{
|
||||
"theme": "dark",
|
||||
"width": 1280,
|
||||
"pskCertificatePreservationExplained": true,
|
||||
"scopeExplained": true,
|
||||
"noDialogOverflow": true,
|
||||
"confirmedDelete": false
|
||||
},
|
||||
{
|
||||
"theme": "dark",
|
||||
"width": 320,
|
||||
"pskCertificatePreservationExplained": true,
|
||||
"scopeExplained": true,
|
||||
"noDialogOverflow": true,
|
||||
"confirmedDelete": false
|
||||
},
|
||||
{
|
||||
"theme": "light",
|
||||
"width": 1280,
|
||||
"pskCertificatePreservationExplained": true,
|
||||
"scopeExplained": true,
|
||||
"noDialogOverflow": true,
|
||||
"confirmedDelete": false
|
||||
},
|
||||
{
|
||||
"theme": "light",
|
||||
"width": 320,
|
||||
"pskCertificatePreservationExplained": true,
|
||||
"scopeExplained": true,
|
||||
"noDialogOverflow": true,
|
||||
"confirmedDelete": true
|
||||
}
|
||||
],
|
||||
"pageErrors": [],
|
||||
"applicationWrites": [
|
||||
{
|
||||
"method": "DELETE",
|
||||
"path": "/api/ipsec/users/1/identity%3A*B",
|
||||
"query": ""
|
||||
}
|
||||
],
|
||||
"scope": "Four real PSK dialogs and one UI DELETE preserving unbound same-named certificate"
|
||||
}
|
||||
@@ -0,0 +1,449 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.116",
|
||||
"deployment": {
|
||||
"date": "2026-10-10",
|
||||
"baseCommit": "d52c48e",
|
||||
"backendBaseContext": "build-refs114",
|
||||
"frontendBaseContext": "build-keepcert115-front",
|
||||
"backendContext": "build-bound116",
|
||||
"frontendContext": "build-bound116-front",
|
||||
"sourceHashes": {
|
||||
"backend/src/routes/ipsec.ts": "83eef38ef796b08f9b9e2d5827fcbbdcb8799bad2f18ba52aeb6a33d94226290",
|
||||
"app/(main)/ipsec/page.tsx": "2d454336d6f0090c754e2f61c68a8d67c95b9fa5ec807996230861e0beb60092"
|
||||
},
|
||||
"compiledHashes": {
|
||||
"backend/dist/routes/ipsec.js": "3318fde98abc367bda3cd1d444c82d8c813b32aa05144a59ccca00f7887d1f53"
|
||||
},
|
||||
"containers": {
|
||||
"backend": {
|
||||
"imageTag": "mmapp-test/backend:ux-bound116",
|
||||
"imageId": "sha256:98a8f1c55c4dffc0eddd5b75a2ac7e420ec612d13b269e2631654409cfcf9f98",
|
||||
"state": "running",
|
||||
"health": "healthy"
|
||||
},
|
||||
"frontend": {
|
||||
"imageTag": "mmapp-test/frontend:ux-bound116",
|
||||
"imageId": "sha256:d641b518fa35291e2c25dcabdef13b730c307a424d3b96bc9847df79022ead28",
|
||||
"state": "running",
|
||||
"health": null
|
||||
},
|
||||
"postgres": {
|
||||
"imageTag": "postgres:18-alpine",
|
||||
"imageId": "sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873",
|
||||
"state": "running",
|
||||
"health": "healthy"
|
||||
}
|
||||
}
|
||||
},
|
||||
"sourceByteHashesMatch": true,
|
||||
"compiledBackendRouteHashMatches": true,
|
||||
"before": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.116",
|
||||
"name": "mm-ipsec116-1791641648556",
|
||||
"cn": "mm-ipsec116-1791641648556",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec116-1791641648556",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.116.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec116-1791641648556",
|
||||
"commonName": "CN=mm-ipsec116-1791641648556",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791641648556-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556",
|
||||
"commonName": "mm-ipsec116-1791641648556",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791641648556",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.116.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": "One successful API DELETE invokes history recording with deduplication",
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec116-1791641648556",
|
||||
"common-name": "mm-ipsec116-1791641648556",
|
||||
"ca": "mm-ipsec116-1791641648556-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 17:14:10",
|
||||
"invalid-after": "2026-10-12 17:14:10",
|
||||
"common-name": "mm-ipsec116-1791641648556-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791641648556-ca",
|
||||
"invalid-before": "2026-10-10 17:14:11",
|
||||
"invalid-after": "2026-10-12 17:14:11",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec116-1791641648556",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791641648556-ca",
|
||||
"invalid-before": "2026-10-10 17:14:11",
|
||||
"invalid-after": "2026-10-12 17:14:11",
|
||||
"common-name": "mm-ipsec116-1791641648556"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec116-1791641648556-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791641648556-ca",
|
||||
"invalid-before": "2026-10-10 17:14:13",
|
||||
"invalid-after": "2026-10-12 17:14:13",
|
||||
"common-name": "CN=mm-ipsec116-1791641648556"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:14:11",
|
||||
"invalid-after": "2026-10-12 16:14:11",
|
||||
"common-name": "mm-ipsec116-1791641648556"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:14:10",
|
||||
"invalid-after": "2026-10-12 16:14:10",
|
||||
"common-name": "mm-ipsec116-1791641648556-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec116-1791641648556",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.116.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec116-1791641648556",
|
||||
"commonName": "CN=mm-ipsec116-1791641648556",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791641648556-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791641648556",
|
||||
"commonName": "mm-ipsec116-1791641648556",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791641648556",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.116.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec116-1791641648556.example",
|
||||
"nativeId": "mm-ipsec116-1791641648556.example",
|
||||
"assignedAddress": "198.18.116.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
},
|
||||
"deletionReply": {
|
||||
"ok": true
|
||||
},
|
||||
"nameCollision": {
|
||||
"pskUserName": "mm-ipsec116-1791641648556-decoy",
|
||||
"unboundCertificateName": "ipsec-user-mm-ipsec116-1791641648556-decoy",
|
||||
"unboundCertificateNativeId": "*9D",
|
||||
"pskRemoved": true,
|
||||
"certificatePreserved": false
|
||||
},
|
||||
"originalSessionUnchanged": true
|
||||
},
|
||||
"native": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.116",
|
||||
"name": "mm-ipsec116-1791642066101",
|
||||
"cn": "mm-ipsec116-1791642066101",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec116-1791642066101",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.116.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec116-1791642066101",
|
||||
"commonName": "CN=mm-ipsec116-1791642066101",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791642066101-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101",
|
||||
"commonName": "mm-ipsec116-1791642066101",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791642066101",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.116.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": "One successful API DELETE invokes history recording with deduplication",
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec116-1791642066101",
|
||||
"common-name": "mm-ipsec116-1791642066101",
|
||||
"ca": "mm-ipsec116-1791642066101-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 17:21:07",
|
||||
"invalid-after": "2026-10-12 17:21:07",
|
||||
"common-name": "mm-ipsec116-1791642066101-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791642066101-ca",
|
||||
"invalid-before": "2026-10-10 17:21:08",
|
||||
"invalid-after": "2026-10-12 17:21:08",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec116-1791642066101",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791642066101-ca",
|
||||
"invalid-before": "2026-10-10 17:21:09",
|
||||
"invalid-after": "2026-10-12 17:21:09",
|
||||
"common-name": "mm-ipsec116-1791642066101"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec116-1791642066101-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec116-1791642066101-ca",
|
||||
"invalid-before": "2026-10-10 17:21:09",
|
||||
"invalid-after": "2026-10-12 17:21:09",
|
||||
"common-name": "CN=mm-ipsec116-1791642066101"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:21:09",
|
||||
"invalid-after": "2026-10-12 16:21:09",
|
||||
"common-name": "mm-ipsec116-1791642066101"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:21:07",
|
||||
"invalid-after": "2026-10-12 16:21:07",
|
||||
"common-name": "mm-ipsec116-1791642066101-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec116-1791642066101",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.116.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec116-1791642066101",
|
||||
"commonName": "CN=mm-ipsec116-1791642066101",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791642066101-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec116-1791642066101",
|
||||
"commonName": "mm-ipsec116-1791642066101",
|
||||
"certName": "ipsec-user-mm-ipsec116-1791642066101",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.116.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec116-1791642066101.example",
|
||||
"nativeId": "mm-ipsec116-1791642066101.example",
|
||||
"assignedAddress": "198.18.116.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
},
|
||||
"pskUserName": "mm-ipsec116-1791642066101-decoy",
|
||||
"deletionReply": {
|
||||
"triggeredBy": "live UI"
|
||||
},
|
||||
"nameCollision": {
|
||||
"pskUserName": "mm-ipsec116-1791642066101-decoy",
|
||||
"unboundCertificateName": "ipsec-user-mm-ipsec116-1791642066101-decoy",
|
||||
"unboundCertificateNativeId": "*A1",
|
||||
"pskRemoved": true,
|
||||
"certificatePreserved": true
|
||||
},
|
||||
"originalSessionUnchanged": true
|
||||
},
|
||||
"browserEvidence": "browser-ipsec-bound-2026-10-10.json",
|
||||
"local": {
|
||||
"profileScripts": 8,
|
||||
"stateChecks": 114,
|
||||
"backendBuildPassed": true,
|
||||
"frontendProductionBuildPassed": true,
|
||||
"sourceTypeScriptPassed": true,
|
||||
"eslintPassed": true,
|
||||
"e2eUnique": 28,
|
||||
"e2eSeconds": 39.6
|
||||
},
|
||||
"bounds": [
|
||||
"No certificate inference from managed user display name in DELETE; explicit remote-certificate/cert target only",
|
||||
"Before reproduction intentionally removed only own unbound decoy certificate",
|
||||
"After is one real mobile PSK UI DELETE; four confirmation dialogs",
|
||||
"Signed certificate IKE connection remained established; no new PSK connection/data-plane test",
|
||||
"History recording invoked with deduplication; inserted revision count not claimed",
|
||||
"Full UI regression running separately in117"
|
||||
]
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 207 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 214 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 72 KiB |
Reference in new issue
Block a user