fix(ipsec): экспортировать сертификат только по прямой привязке
This commit is contained in:
Denozordec committed
1 parent
9da5e55367
commit
08fcebd549
9 files changed
+542
-15
No files matched your search
@@ -0,0 +1,438 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.118",
|
||||
"deployment": {
|
||||
"date": "2026-10-10",
|
||||
"baseCommit": "9da5e55",
|
||||
"baseContext": "build-bound116",
|
||||
"context": "build-export118",
|
||||
"override": "backend/src/routes/ipsec.ts",
|
||||
"sourceSha256": "4060f956cf30e26db326248f5f6574c75ed29f8952aa2afa65f0b099bfadb825",
|
||||
"containers": {
|
||||
"backend": {
|
||||
"imageTag": "mmapp-test/backend:ux-export118",
|
||||
"imageId": "sha256:395f100600ec69ef27a539a3a2ebb074e59bb2e21072c6c58cb3b6ef6281e13b",
|
||||
"state": "running",
|
||||
"health": "healthy"
|
||||
},
|
||||
"frontend": {
|
||||
"imageTag": "mmapp-test/frontend:ux-bound116",
|
||||
"imageId": "sha256:d641b518fa35291e2c25dcabdef13b730c307a424d3b96bc9847df79022ead28",
|
||||
"state": "running",
|
||||
"health": null
|
||||
},
|
||||
"postgres": {
|
||||
"imageTag": "postgres:18-alpine",
|
||||
"imageId": "sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873",
|
||||
"state": "running",
|
||||
"health": "healthy"
|
||||
}
|
||||
},
|
||||
"compiledSha256": "1ec5eab50eb8383644c9bb17f190b222c07ce3f7ebb6b98e4c8f81053e6e32be"
|
||||
},
|
||||
"sourceByteHashMatches": true,
|
||||
"compiledRouteByteHashMatches": true,
|
||||
"before": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.118",
|
||||
"name": "mm-ipsec118-1791643362094",
|
||||
"cn": "mm-ipsec118-1791643362094",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec118-1791643362094",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.118.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec118-1791643362094",
|
||||
"commonName": "CN=mm-ipsec118-1791643362094",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094",
|
||||
"commonName": "mm-ipsec118-1791643362094",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791643362094",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.118.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec118-1791643362094",
|
||||
"common-name": "mm-ipsec118-1791643362094",
|
||||
"ca": "mm-ipsec118-1791643362094-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 17:42:43",
|
||||
"invalid-after": "2026-10-12 17:42:43",
|
||||
"common-name": "mm-ipsec118-1791643362094-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791643362094-ca",
|
||||
"invalid-before": "2026-10-10 17:42:44",
|
||||
"invalid-after": "2026-10-12 17:42:44",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec118-1791643362094",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791643362094-ca",
|
||||
"invalid-before": "2026-10-10 17:42:44",
|
||||
"invalid-after": "2026-10-12 17:42:44",
|
||||
"common-name": "mm-ipsec118-1791643362094"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec118-1791643362094-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791643362094-ca",
|
||||
"invalid-before": "2026-10-10 17:42:45",
|
||||
"invalid-after": "2026-10-12 17:42:45",
|
||||
"common-name": "CN=mm-ipsec118-1791643362094"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:42:44",
|
||||
"invalid-after": "2026-10-12 16:42:44",
|
||||
"common-name": "mm-ipsec118-1791643362094"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 16:42:43",
|
||||
"invalid-after": "2026-10-12 16:42:43",
|
||||
"common-name": "mm-ipsec118-1791643362094-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec118-1791643362094",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.118.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec118-1791643362094",
|
||||
"commonName": "CN=mm-ipsec118-1791643362094",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791643362094",
|
||||
"commonName": "mm-ipsec118-1791643362094",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791643362094",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.118.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec118-1791643362094.example",
|
||||
"nativeId": "mm-ipsec118-1791643362094.example",
|
||||
"assignedAddress": "198.18.118.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
},
|
||||
"export": {
|
||||
"status": 200,
|
||||
"identityAuth": "pre-shared-key",
|
||||
"remoteCertificateAbsent": true,
|
||||
"inferredCertificateName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
|
||||
"archiveReturned": true,
|
||||
"archiveFilename": "cert_export_ipsec-user-mm-ipsec118-1791643362094-decoy.p12"
|
||||
},
|
||||
"certificateNativeIdPreserved": true
|
||||
},
|
||||
"native": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.118",
|
||||
"name": "mm-ipsec118-1791645331520",
|
||||
"cn": "mm-ipsec118-1791645331520",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec118-1791645331520",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.118.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec118-1791645331520",
|
||||
"commonName": "CN=mm-ipsec118-1791645331520",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520",
|
||||
"commonName": "mm-ipsec118-1791645331520",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791645331520",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.118.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec118-1791645331520",
|
||||
"common-name": "mm-ipsec118-1791645331520",
|
||||
"ca": "mm-ipsec118-1791645331520-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 18:15:33",
|
||||
"invalid-after": "2026-10-12 18:15:33",
|
||||
"common-name": "mm-ipsec118-1791645331520-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791645331520-ca",
|
||||
"invalid-before": "2026-10-10 18:15:34",
|
||||
"invalid-after": "2026-10-12 18:15:34",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec118-1791645331520",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791645331520-ca",
|
||||
"invalid-before": "2026-10-10 18:15:35",
|
||||
"invalid-after": "2026-10-12 18:15:35",
|
||||
"common-name": "mm-ipsec118-1791645331520"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec118-1791645331520-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec118-1791645331520-ca",
|
||||
"invalid-before": "2026-10-10 18:15:39",
|
||||
"invalid-after": "2026-10-12 18:15:39",
|
||||
"common-name": "CN=mm-ipsec118-1791645331520"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 17:15:35",
|
||||
"invalid-after": "2026-10-12 17:15:35",
|
||||
"common-name": "mm-ipsec118-1791645331520"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 17:15:33",
|
||||
"invalid-after": "2026-10-12 17:15:33",
|
||||
"common-name": "mm-ipsec118-1791645331520-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec118-1791645331520",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.118.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec118-1791645331520",
|
||||
"commonName": "CN=mm-ipsec118-1791645331520",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec118-1791645331520",
|
||||
"commonName": "mm-ipsec118-1791645331520",
|
||||
"certName": "ipsec-user-mm-ipsec118-1791645331520",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.118.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec118-1791645331520.example",
|
||||
"nativeId": "mm-ipsec118-1791645331520.example",
|
||||
"assignedAddress": "198.18.118.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
},
|
||||
"export": {
|
||||
"status": 409,
|
||||
"identityAuth": "pre-shared-key",
|
||||
"remoteCertificateAbsent": true,
|
||||
"inferredCertificateName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
|
||||
"archiveReturned": false
|
||||
},
|
||||
"boundExport": {
|
||||
"status": 200,
|
||||
"displayLabelDifferentFromCertificateName": true,
|
||||
"explicitCertificateArchiveReturned": true
|
||||
},
|
||||
"certificateNativeIdPreserved": true
|
||||
},
|
||||
"local": {
|
||||
"profileScripts": 8,
|
||||
"stateChecks": 114,
|
||||
"backendBuildPassed": true,
|
||||
"eslintPassed": true,
|
||||
"initialPositiveMockFailure": "Mock missing getCertificates; completed fixture and reran accepted",
|
||||
"focusedHttpRerunPassed": true
|
||||
},
|
||||
"bounds": [
|
||||
"Legacy managed user export only; explicit certificate-by-name endpoint unchanged",
|
||||
"Archives/passphrases/instructions were inspected only in memory, never in report/Git",
|
||||
"Positive response/archive returned, no new client OS or crypto interoperability claim",
|
||||
"Frontend remains bound116; full UI regression117 historical, not rerun118",
|
||||
"Native certificate session stayed live; no new PSK established session"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user