fix(gre): экспортировать поддерживаемые параметры и очищать PSK

lib/gre-export.test.ts

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict"
+import type { GreTunnel } from "./data"
+import { generateGreRsc } from "./gre-export"
+import { quoteRosString } from "./vxlan-export"
+
+const tunnel: GreTunnel = { id: "*1", serverId: "1", name: 'gre "edge" $name\n/system reboot', localAddress: "0.0.0.0", remoteAddress: "192.0.2.1", localInnerIp: "10.0.0.1/30", remoteInnerIp: "10.0.0.2/30", poolId: "live", ipsec: { secret: 'key"\\$value\n/system reboot', encAlg: "aes-256", authAlg: "sha256", ikeVersion: "ikev2" }, mtu: 1476, keepaliveInterval: 10, keepaliveRetries: 3, dscp: "inherit", clampTcpMss: true, allowFastPath: false, comment: 'quoted "comment"\n/system reboot', enabled: false, status: "down" }
+const code = generateGreRsc(tunnel, {})
+const commands = code.split("\n").filter(line => line.startsWith("/"))
+assert.equal(commands.length, 2)
+assert.ok(commands[0].includes("name=" + quoteRosString(tunnel.name)))
+assert.ok(commands[0].includes("ipsec-secret=" + quoteRosString(tunnel.ipsec!.secret)))
+assert.ok(commands[0].includes("comment=" + quoteRosString(tunnel.comment)))
+assert.ok(commands[0].includes("keepalive=10s,3 dscp=inherit clamp-tcp-mss=yes allow-fast-path=no disabled=yes"))
+assert.ok(commands[1].includes('address="10.0.0.1/30" interface=' + quoteRosString(tunnel.name)))
+for (const unsupported of ["/ip ipsec peer add", "/ip/ipsec/peer/add", "proposal add", "policy add", "exchange-mode=", "local-address=", "\n/system reboot", "10.0.0.2/30"]) assert.ok(!code.includes(unsupported), unsupported)
+const noInner = generateGreRsc({ ...tunnel, localInnerIp: "", ipsec: null, localAddress: "192.0.2.10", keepaliveInterval: 0, dscp: 12, enabled: true }, {})
+assert.equal(noInner.split("\n").filter(line => line.startsWith("/")).length, 1)
+assert.ok(noInner.includes('local-address="192.0.2.10"'))
+assert.ok(noInner.includes("keepalive=0 dscp=12"))
+assert.ok(!noInner.includes("ipsec-secret="))
+console.log("gre-export: escaped strings, observed GRE/PSK only, optional IP and no duplicate IPsec passed")

lib/gre-export.ts

@@ -0,0 +1,26 @@
+import type { GreTunnel, Server } from "./data"
+import { quoteRosString } from "./vxlan-export"
+
+const commentLine = (value: string) => value.replace(/[\r\n\x00-\x1f\x7f]/g, " ")
+
+/** GRE/PSK fragment: https://help.mikrotik.com/docs/spaces/ROS/pages/24805531/GRE */
+export function generateGreRsc(t: GreTunnel, servers: Record<string, Server>): string {
+  const server = servers[t.serverId]
+  const lines = ["# GRE — " + commentLine(t.name)]
+  if (server) lines.push("# Сервер: " + commentLine(server.name) + " (" + commentLine(server.host) + ")")
+  lines.push("# Фрагмент интерфейса и локального IP; удалённая сторона и маршруты не включены", "")
+  const args = [
+    "name=" + quoteRosString(t.name), "remote-address=" + quoteRosString(t.remoteAddress),
+    "mtu=" + t.mtu, "keepalive=" + (t.keepaliveInterval > 0 ? t.keepaliveInterval + "s," + t.keepaliveRetries : "0"),
+    "dscp=" + t.dscp, "clamp-tcp-mss=" + (t.clampTcpMss ? "yes" : "no"),
+    "allow-fast-path=" + (t.allowFastPath ? "yes" : "no"), "disabled=" + (t.enabled ? "no" : "yes"),
+    "comment=" + quoteRosString(t.comment),
+  ]
+  if (t.localAddress && t.localAddress !== "0.0.0.0") args.push("local-address=" + quoteRosString(t.localAddress))
+  if (t.ipsec) args.push("ipsec-secret=" + quoteRosString(t.ipsec.secret))
+  lines.push("/interface/gre/add " + args.join(" "))
+  if (t.localInnerIp) lines.push("/ip/address/add address=" + quoteRosString(t.localInnerIp) + " interface=" + quoteRosString(t.name))
+  if (t.ipsec) lines.push("# Peer/policy создаёт RouterOS по ipsec-secret; ручные объекты IPsec не экспортируются")
+  if (t.ipsec && t.allowFastPath) lines.push("# В снимке включён FastPath: для GRE с IPsec документация RouterOS требует allow-fast-path=no")
+  return lines.join("\n") + "\n"
+}