fix(network): исправить keepalive GRE и каталог IPsec

backend/package.json

@@ -29,7 +29,7 @@
     "test:scheduler": "tsx src/services/scheduler-running.test.ts && tsx src/services/scheduler-recorded-run.test.ts && tsx src/routes/scheduler.test.ts",
     "test:backups": "tsx src/services/backup-scheduler-run.test.ts && tsx src/services/backup-restore.test.ts && tsx src/services/backup-deletion.test.ts && tsx src/services/backup-dto.test.ts && tsx src/services/backup-storage-update.test.ts && tsx src/services/backup-job-execution.test.ts && tsx src/routes/backups-operations.test.ts && tsx src/services/s3-backup-client.test.ts",
     "test:ipsec": "tsx src/services/ipsec-config.test.ts && tsx src/services/ipsec-state.test.ts && tsx src/routes/ipsec-history.test.ts && tsx src/services/ipsec-restore.test.ts && tsx src/services/ipsec-operation.test.ts && tsx src/routes/ipsec-mutation.test.ts && tsx src/routes/ipsec-nat.test.ts && tsx src/routes/ipsec-group.test.ts",
-    "test:live-maps": "tsx src/services/gre-read.test.ts && tsx src/services/ospf-route-parse.test.ts && tsx src/services/vxlan-live.test.ts && tsx src/routes/vxlan.test.ts && tsx src/services/containers-live.test.ts && tsx src/services/firewall-poll.test.ts && tsx src/services/gre-catalog-poll.test.ts && tsx src/routes/filters-gre-catalog.test.ts && tsx src/routes/bgp-catalog.test.ts && tsx src/services/bgp-catalog-parse.test.ts && tsx src/routes/ospf-catalog.test.ts && tsx src/services/ospf-observed-values.test.ts",
+    "test:live-maps": "tsx src/services/gre-keepalive.test.ts && tsx src/services/gre-read.test.ts && tsx src/services/ospf-route-parse.test.ts && tsx src/services/vxlan-live.test.ts && tsx src/routes/vxlan.test.ts && tsx src/services/containers-live.test.ts && tsx src/services/firewall-poll.test.ts && tsx src/services/gre-catalog-poll.test.ts && tsx src/routes/filters-gre-catalog.test.ts && tsx src/routes/bgp-catalog.test.ts && tsx src/services/bgp-catalog-parse.test.ts && tsx src/routes/ospf-catalog.test.ts && tsx src/services/ospf-observed-values.test.ts",
     "test": "node scripts/test.mjs",
     "test:evolution": "tsx src/services/evobgp-catalog.test.ts && tsx src/routes/evobgp-catalog.test.ts && tsx src/routes/evobgp-settings.test.ts && tsx src/plugins/auth.evolution-settings.test.ts",
     "test:netflow-purge": "tsx src/db/operation-lock.test.ts && tsx src/services/traffic-flow-purge-execution.test.ts && tsx src/routes/traffic-flow-purge.test.ts",

backend/scripts/acceptance/gre-keepalive-sql.mjs

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import {createServer} from 'node:http'
+import {randomBytes} from 'node:crypto'
+const database=process.env.MMAPP_OWN_SQL_DB,url=new URL(process.env.DATABASE_URL)
+assert(/^mm_accept_166_\d+$/.test(database??''));assert.equal(url.pathname,'/'+database);assert.equal(url.username,database)
+process.env.AUTH_REQUIRED='true';process.env.AUTH_JWT_SECRET=randomBytes(32).toString('hex');process.env.AUTH_ISSUER='https://own210.invalid';process.env.AUTH_PORTAL_URL='https://own210.invalid'
+const {pool,closePool}=await import('/app/backend/dist/db/index.js'),{initDatabase}=await import('/app/backend/dist/db/bootstrap.js'),{buildApp}=await import('/app/backend/dist/index.js')
+assert.equal((await pool.query('SELECT current_database() AS name')).rows[0].name,database);assert(Object.values((await pool.query('SELECT rolsuper,rolcreatedb,rolcreaterole,rolbypassrls FROM pg_roles WHERE rolname=current_user')).rows[0]).every(v=>v===false))
+
+const rows=[],writes=[],cases=[];let app,serverId,nativeCalls=0;
+const native=createServer(async(req,res)=>{nativeCalls++;let text='';for await(const chunk of req)text+=chunk;const body=text?JSON.parse(text):{};res.setHeader('content-type','application/json');if(req.method==='GET'){res.end(JSON.stringify(req.url.endsWith('/interface/gre')?rows:[]));return}writes.push({method:req.method,path:req.url,body});if(req.method==='PUT'){const row={...body,'.id':'*'+(rows.length+1),running:'false'};rows.push(row);res.end(JSON.stringify(row));return}if(req.method==='PATCH'){const id=decodeURIComponent(req.url.split('/').pop()),row=rows.find(r=>r['.id']===id);assert(row);Object.assign(row,body);res.end(JSON.stringify(row));return}res.statusCode=500;res.end('{}')});await new Promise(r=>native.listen(0,'127.0.0.1',r));
+const report={date:'2026-10-13',block:'12.5.210',database,cases,scope:'Production compiled GRE create/patch using isolated PostgreSQL and native HTTP fixture',passed:false};
+try{await initDatabase();serverId=Number((await pool.query("INSERT INTO servers(name,host,port,use_ssl,enabled,username,password) VALUES('own210-native','127.0.0.1',$1,false,true,'fixture','fixture') RETURNING id",[native.address().port])).rows[0].id);app=await buildApp({logger:false,startScheduler:false});await app.ready();const token=app.jwt.sign({sub:'own210-writer',apps:['mm'],permissions:['mm:network:write'],iss:process.env.AUTH_ISSUER},{expiresIn:'5m'}),headers={authorization:'Bearer '+token};
+for(const field of ['keepaliveInterval','keepaliveRetries'])for(const value of [0,-1,1.5,4294967296]){const before=nativeCalls;const r=await app.inject({method:'POST',url:'/api/gre/tunnels',headers,payload:{serverId:String(serverId),name:'invalid',remoteAddress:'192.0.2.2',[field]:value}});assert.equal(r.statusCode,400);assert.equal(nativeCalls,before);cases.push({field,value,status:400,nativeCalls:0})}
+for(const params of [{},{keepaliveInterval:60},{keepaliveRetries:3},{keepaliveInterval:90,keepaliveRetries:7}]){const name='own210-'+rows.length;const r=await app.inject({method:'POST',url:'/api/gre/tunnels',headers,payload:{serverId:String(serverId),name,remoteAddress:'192.0.2.2',enabled:false,...params}});assert.equal(r.statusCode,201);const expected=(params.keepaliveInterval??10)+'s,'+(params.keepaliveRetries??10);assert.equal(rows.at(-1).keepalive,expected);cases.push({operation:'create',params,keepalive:expected,status:201})}
+rows[0].keepalive='1m,3';const patch=await app.inject({method:'PATCH',url:'/api/gre/tunnels',headers,payload:{serverId:String(serverId),rosId:rows[0]['.id'],comment:'own210 updated'}});assert.equal(patch.statusCode,200);assert.equal(rows[0].keepalive,'1m,3');assert.equal(rows[0].comment,'own210 updated');cases.push({operation:'patch-other-field',nativeKeepalivePreserved:'1m,3',status:200});const read=await app.inject({method:'GET',url:'/api/gre/tunnels?serverId='+serverId,headers});assert.equal(read.statusCode,200);assert.equal(read.json().tunnels.find(t=>t.name===rows[0].name).keepaliveInterval,60);cases.push({operation:'read-minutes',seconds:60,status:200});report.passed=true;report.nativeWrites=writes.length;
+}catch(e){report.errorName=e.name;fs.writeFileSync('/app/backend/acceptance/gre210-private.log',String(e.stack??e),{mode:0o600})}finally{if(app)await app.close();native.closeAllConnections();await new Promise(r=>native.close(r));await closePool();fs.writeFileSync('/app/backend/acceptance/gre210-keepalive-result.json',JSON.stringify(report,null,2));console.log(JSON.stringify(report))}if(!report.passed)process.exitCode=1;

backend/src/routes/filters.ts

@@ -5,6 +5,7 @@ import { db } from "../db/index.js"
 import { filterRules, recursiveRoutes, servers } from "../db/schema.js"
 import { MikrotikClient } from "../services/mikrotik.js"
 import { pollGreCatalog } from "../services/gre-catalog-poll.js"
+import { parseKeepalive } from "../services/gre-live.js"
 import { parseDbServerId } from "../utils/server-id.js"
 import { appendEvent } from "../modules/events/service/events-service.js"
 import { managedComment } from "../managed-markers.js"
@@ -74,17 +75,6 @@ interface ApiFilterRule {
   description: string
 }
 
-function parseKeepalive(value: string | undefined): { interval: number; retries: number } {
-  if (!value || value.toLowerCase() === "none") return { interval: 0, retries: 0 }
-  const [intervalRaw, retriesRaw] = value.split(",")
-  const interval = Number.parseInt((intervalRaw ?? "").trim(), 10)
-  const retries = Number.parseInt((retriesRaw ?? "").trim(), 10)
-  return {
-    interval: Number.isFinite(interval) ? interval : 0,
-    retries: Number.isFinite(retries) ? retries : 0,
-  }
-}
-
 function parseDscp(value: string | undefined): "inherit" | number {
   if (!value || value === "inherit") return "inherit"
   const n = Number.parseInt(value, 10)

backend/src/routes/gre.ts

@@ -43,8 +43,8 @@ const TunnelWriteSchema = z.object({
   comment: z.string().optional(),
   enabled: z.boolean().optional(),
   mtu: z.number().optional(),
-  keepaliveInterval: z.number().optional(),
-  keepaliveRetries: z.number().optional(),
+  keepaliveInterval: z.number().int().min(1).max(4294967295).optional(),
+  keepaliveRetries: z.number().int().min(1).max(4294967295).optional(),
   dscp: z.union([z.literal("inherit"), z.number(), z.string()]).optional(),
   clampTcpMss: z.boolean().optional(),
   allowFastPath: z.boolean().optional(),
@@ -84,9 +84,7 @@ function tunnelFromBody(body: z.infer<typeof TunnelWriteSchema> & { keepaliveInt
     : typeof body.dscp === "number"
       ? String(body.dscp)
       : body.dscp
-  const keepalive = body.keepaliveInterval === undefined && body.keepaliveRetries === undefined
-    ? undefined
-    : formatKeepalive(body.keepaliveInterval ?? 0, body.keepaliveRetries ?? 10)
+  const keepalive = formatKeepalive(body.keepaliveInterval ?? 10, body.keepaliveRetries ?? 10)
   return canonicalGreSnapshot({
     tunnels: [{
       name: body.name,
@@ -97,7 +95,7 @@ function tunnelFromBody(body: z.infer<typeof TunnelWriteSchema> & { keepaliveInt
       comment: body.remoteInnerIp === undefined ? body.comment ?? "" : writeGreComment(body.comment ?? "", body.remoteInnerIp),
       disabled: body.enabled === false,
       mtu: body.mtu ?? 1476,
-      keepalive: keepalive ?? "0",
+      keepalive,
       dscp,
       clampTcpMss: body.clampTcpMss,
       allowFastPath: body.allowFastPath,
@@ -173,6 +171,10 @@ const greRoutes: FastifyPluginAsyncZod = async (app) => {
         allowFastPath: body.allowFastPath ?? live.allowFastPath,
         ipsecSecret: body.ipsecSecret ?? live.ipsecSecret,
       })
+      // A patch to another field must not reformat an observed native timer.
+      if (body.keepaliveInterval === undefined && body.keepaliveRetries === undefined) {
+        merged.keepalive = original.keepalive
+      }
       merged.innerAddresses = original.innerAddresses?.map(a => ({ ...a }))
       if (body.localInnerIp !== undefined && body.localInnerIp !== original.localInnerIp) {
         merged.innerAddresses = (merged.innerAddresses ?? []).filter(a => a.address !== original.localInnerIp)

backend/src/services/gre-keepalive.test.ts

@@ -0,0 +1,9 @@
+import assert from "node:assert/strict"
+import { parseKeepalive } from "./gre-live.js"
+
+for (const [native, seconds] of [["1m,3", 60], ["1m30s,3", 90], ["00:01:00,3", 60], ["1h2m3s,3", 3723], ["10s,3", 10], ["10,3", 10]] as const) {
+  assert.deepEqual(parseKeepalive(native), { interval: seconds, retries: 3 })
+}
+assert.deepEqual(parseKeepalive("invalid,3"), { interval: 0, retries: 3 })
+assert.deepEqual(parseKeepalive("10s,3garbage"), { interval: 10, retries: 0 })
+console.log("GRE keepalive: native units and clock parsed without prefix truncation")

backend/src/services/gre-live.ts

@@ -3,6 +3,7 @@ import { db } from "../db/index.js"
 import { servers } from "../db/schema.js"
 import { MikrotikClient } from "./mikrotik.js"
 import { readGreComment } from "./gre-comment.js"
+import { observedDurationMs, observedInteger } from "./ospf-observed-values.js"
 import {
   canonicalGreSnapshot,
   greAddressPath,
@@ -69,11 +70,14 @@ export interface LiveGreTunnel {
 export function parseKeepalive(value: string | undefined): { interval: number; retries: number } {
   if (!value || value.toLowerCase() === "none") return { interval: 0, retries: 0 }
   const [intervalRaw, retriesRaw] = value.split(",")
-  const interval = Number.parseInt((intervalRaw ?? "").trim(), 10)
-  const retries = Number.parseInt((retriesRaw ?? "").trim(), 10)
+  const intervalText = intervalRaw?.trim()
+  const interval = intervalText && /^\d+$/.test(intervalText)
+    ? observedInteger(intervalText)
+    : (observedDurationMs(intervalText) ?? 0) / 1000
+  const retries = observedInteger(retriesRaw)
   return {
-    interval: Number.isFinite(interval) ? interval : 0,
-    retries: Number.isFinite(retries) ? retries : 0,
+    interval: interval ?? 0,
+    retries: retries ?? 0,
   }
 }