fix(network): согласовать GRE PSK с FastPath и экспортом

lib/gre-export.test.ts

@@ -16,7 +16,7 @@ for (const unsupported of ["/ip ipsec peer add", "/ip/ipsec/peer/add", "proposal
 const noInner = generateGreRsc({ ...tunnel, localInnerIp: "", ipsec: null, localAddress: "192.0.2.10", keepaliveInterval: 0, dscp: 12, enabled: true }, {})
 assert.equal(noInner.split("\n").filter(line => line.startsWith("/")).length, 1)
 assert.ok(noInner.includes('local-address="192.0.2.10"'))
-assert.ok(noInner.includes("keepalive=0 dscp=12"))
+assert.ok(noInner.includes("keepalive=<KEEPALIVE_SECONDS>s,<KEEPALIVE_RETRIES> dscp=12"))
 assert.ok(!noInner.includes("ipsec-secret="))
 console.log("gre-export: escaped strings, observed GRE/PSK only, optional IP and no duplicate IPsec passed")
 const masked = generateGreRsc({ ...tunnel, ipsec: { secret: '' } }, {})
@@ -24,3 +24,7 @@ assert.ok(masked.includes('ipsec-secret="<IPSEC_PSK>"'))
 assert.ok(masked.includes('# Шаблон: ключ IPsec не раскрыт.'))
 assert.ok(!masked.includes('ipsec-secret=""'))
 console.log('gre-export: hidden configured PSK produces an explicitly labelled template, never an empty live key')
+
+const incompatible = generateGreRsc({ ...tunnel, allowFastPath: true }, {})
+assert.ok(incompatible.includes("allow-fast-path=<ALLOW_FAST_PATH>"))
+assert.ok(incompatible.includes("IPsec несовместим с FastPath"))

lib/gre-export.ts

@@ -2,6 +2,15 @@ import type { GreTunnel, Server } from "./data"
 import { quoteRosString } from "./vxlan-export"
 
 const commentLine = (value: string) => value.replace(/[\r\n\x00-\x1f\x7f]/g, " ")
+const validKeepalive = (t: GreTunnel) => [t.keepaliveInterval, t.keepaliveRetries].every(value => Number.isInteger(value) && value >= 1 && value <= 4294967295)
+
+export function greExportWarnings(t: GreTunnel): string[] {
+  return [
+    t.ipsec && !t.ipsec.secret ? "Шаблон: ключ IPsec скрыт. Укажите ключ перед применением." : "",
+    !validKeepalive(t) ? "Шаблон: задайте допустимый интервал keepalive и число попыток перед применением." : "",
+    t.ipsec && t.allowFastPath ? "Шаблон: IPsec несовместим с FastPath. Проверьте этот параметр перед применением." : "",
+  ].filter(Boolean)
+}
 
 /** GRE/PSK fragment: https://help.mikrotik.com/docs/spaces/ROS/pages/24805531/GRE */
 export function generateGreRsc(t: GreTunnel, servers: Record<string, Server>): string {
@@ -9,11 +18,13 @@ export function generateGreRsc(t: GreTunnel, servers: Record<string, Server>): s
   const lines = ["# GRE — " + commentLine(t.name)]
   if (server) lines.push("# Сервер: " + commentLine(server.name) + " (" + commentLine(server.host) + ")")
   lines.push("# Фрагмент интерфейса и локального IP; удалённая сторона и маршруты не включены", "")
+  if (!validKeepalive(t)) lines.push("# Шаблон: задайте KEEPALIVE_SECONDS и KEEPALIVE_RETRIES — целые значения от 1 до 4294967295.")
+  if (t.ipsec && t.allowFastPath) lines.push("# Шаблон: IPsec несовместим с FastPath. Проверьте ALLOW_FAST_PATH перед применением.")
   const args = [
     "name=" + quoteRosString(t.name), "remote-address=" + quoteRosString(t.remoteAddress),
-    "mtu=" + t.mtu, "keepalive=" + (t.keepaliveInterval > 0 ? t.keepaliveInterval + "s," + t.keepaliveRetries : "0"),
+    "mtu=" + t.mtu, "keepalive=" + (validKeepalive(t) ? t.keepaliveInterval + "s," + t.keepaliveRetries : "<KEEPALIVE_SECONDS>s,<KEEPALIVE_RETRIES>"),
     "dscp=" + t.dscp, "clamp-tcp-mss=" + (t.clampTcpMss ? "yes" : "no"),
-    "allow-fast-path=" + (t.allowFastPath ? "yes" : "no"), "disabled=" + (t.enabled ? "no" : "yes"),
+    "allow-fast-path=" + (t.ipsec && t.allowFastPath ? "<ALLOW_FAST_PATH>" : t.allowFastPath ? "yes" : "no"), "disabled=" + (t.enabled ? "no" : "yes"),
     "comment=" + quoteRosString(t.comment),
   ]
   if (t.localAddress && t.localAddress !== "0.0.0.0") args.push("local-address=" + quoteRosString(t.localAddress))