fix(ipsec): исключить чужие сессии при сопоставлении CN
This commit is contained in:
Denozordec committed
1 parent
2aa93ad365
commit
7815e00a1c
15 files changed
+604
-13
No files matched your search
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"runtime": {
|
||||
"backend": "ux-id111",
|
||||
"frontend": "ux-a11y101"
|
||||
},
|
||||
"httpMocks": false,
|
||||
"cases": [
|
||||
{
|
||||
"theme": "dark",
|
||||
"width": 1280,
|
||||
"rootThemeConfirmed": true,
|
||||
"unconnectedCertificateOffline": true,
|
||||
"onlineAddressConfirmed": true,
|
||||
"reloadConfirmed": true,
|
||||
"noPageOverflow": true
|
||||
},
|
||||
{
|
||||
"theme": "dark",
|
||||
"width": 320,
|
||||
"rootThemeConfirmed": true,
|
||||
"unconnectedCertificateOffline": true,
|
||||
"onlineAddressConfirmed": true,
|
||||
"reloadConfirmed": true,
|
||||
"noPageOverflow": true
|
||||
},
|
||||
{
|
||||
"theme": "light",
|
||||
"width": 1280,
|
||||
"rootThemeConfirmed": true,
|
||||
"unconnectedCertificateOffline": true,
|
||||
"onlineAddressConfirmed": true,
|
||||
"reloadConfirmed": true,
|
||||
"noPageOverflow": true
|
||||
},
|
||||
{
|
||||
"theme": "light",
|
||||
"width": 320,
|
||||
"rootThemeConfirmed": true,
|
||||
"unconnectedCertificateOffline": true,
|
||||
"onlineAddressConfirmed": true,
|
||||
"reloadConfirmed": true,
|
||||
"noPageOverflow": true
|
||||
}
|
||||
],
|
||||
"pageErrors": [],
|
||||
"applicationWrites": [],
|
||||
"scope": "Real explicit FQDN certificate client status/address and unconnected DN-looking CN, reload, desktop/mobile, two themes"
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"baseCommit": "2aa93ad",
|
||||
"baseContext": "build-dn110",
|
||||
"context": "build-id111",
|
||||
"source": "Audited dn110 context plus two explicit working-file overrides; revision label id111 is not a Git SHA",
|
||||
"files": [
|
||||
{
|
||||
"path": "backend/src/services/ipsec-live.ts",
|
||||
"sha256": "2c4717b570077cfa931697ff5fcc9cb5c825dd683265d2757f305807a924cc13",
|
||||
"contextByteHashMatches": true
|
||||
},
|
||||
{
|
||||
"path": "backend/src/services/ipsec-state.test.ts",
|
||||
"sha256": "e13f2d801b9eb250bd6da3f8c0de1c306008a36df1c2393e344c86157e57f133",
|
||||
"contextByteHashMatches": true
|
||||
}
|
||||
],
|
||||
"compiled": {
|
||||
"path": "backend/dist/services/ipsec-live.js",
|
||||
"sha256": "7e379bc5b08ecf745e9c77e0cc8cce557383dae13c6cfebc6d90f46998611774",
|
||||
"containerByteHashMatches": true
|
||||
},
|
||||
"deployment": {
|
||||
"imageId": "sha256:e9a5cf65433ed77b8c67991a556f3863a0e9609411a0e3e58d39463323c65414",
|
||||
"tag": "ux-id111",
|
||||
"revisionLabel": "id111",
|
||||
"health": {
|
||||
"status": "ok",
|
||||
"timestamp": "2026-10-10T02:51:44.826Z",
|
||||
"version": "1.0.0-test.id111",
|
||||
"eventLoopDelayMs": 20,
|
||||
"flowWorker": {
|
||||
"alive": false,
|
||||
"bound": false,
|
||||
"pendingSize": 0,
|
||||
"dropped": 0,
|
||||
"packetsReceived": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,420 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"runtime": {
|
||||
"backend": "ux-id111",
|
||||
"frontend": "ux-a11y101"
|
||||
},
|
||||
"nativeBefore": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"cn": "mm-ipsec111-1791600431289",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600431289",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600431289",
|
||||
"commonName": "CN=mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"commonName": "mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"common-name": "mm-ipsec111-1791600431289",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 05:47:12",
|
||||
"invalid-after": "2026-10-12 05:47:12",
|
||||
"common-name": "mm-ipsec111-1791600431289-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:14",
|
||||
"invalid-after": "2026-10-12 05:47:14",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:15",
|
||||
"invalid-after": "2026-10-12 05:47:15",
|
||||
"common-name": "mm-ipsec111-1791600431289"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:16",
|
||||
"invalid-after": "2026-10-12 05:47:16",
|
||||
"common-name": "CN=mm-ipsec111-1791600431289"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:47:15",
|
||||
"invalid-after": "2026-10-12 04:47:15",
|
||||
"common-name": "mm-ipsec111-1791600431289"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:47:12",
|
||||
"invalid-after": "2026-10-12 04:47:12",
|
||||
"common-name": "mm-ipsec111-1791600431289-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600431289",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600431289",
|
||||
"commonName": "CN=mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"commonName": "mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": true
|
||||
},
|
||||
"error": "DN-looking literal CN inherited another certificate session\n\ntrue !== false\n"
|
||||
},
|
||||
"nativeAccepted": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"cn": "mm-ipsec111-1791600594968",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600594968",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600594968",
|
||||
"commonName": "CN=mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"commonName": "mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"common-name": "mm-ipsec111-1791600594968",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 05:49:56",
|
||||
"invalid-after": "2026-10-12 05:49:56",
|
||||
"common-name": "mm-ipsec111-1791600594968-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:57",
|
||||
"invalid-after": "2026-10-12 05:49:57",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:57",
|
||||
"invalid-after": "2026-10-12 05:49:57",
|
||||
"common-name": "mm-ipsec111-1791600594968"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:59",
|
||||
"invalid-after": "2026-10-12 05:49:59",
|
||||
"common-name": "CN=mm-ipsec111-1791600594968"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:49:57",
|
||||
"invalid-after": "2026-10-12 04:49:57",
|
||||
"common-name": "mm-ipsec111-1791600594968"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:49:56",
|
||||
"invalid-after": "2026-10-12 04:49:56",
|
||||
"common-name": "mm-ipsec111-1791600594968-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600594968",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600594968",
|
||||
"commonName": "CN=mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"commonName": "mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec111-1791600594968.example",
|
||||
"nativeId": "mm-ipsec111-1791600594968.example",
|
||||
"assignedAddress": "198.18.111.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
}
|
||||
},
|
||||
"compiledSyntheticBefore": {
|
||||
"scope": "Compiled baseline mapper with synthetic input; not native typed-ID admission",
|
||||
"clients": [
|
||||
{
|
||||
"name": "ipsec-user-original",
|
||||
"online": true
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-typed",
|
||||
"online": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"compiledSyntheticAfter": {
|
||||
"scope": "Compiled deployed mapper with synthetic input; not native typed-ID admission",
|
||||
"clients": [
|
||||
{
|
||||
"name": "ipsec-user-original",
|
||||
"online": true
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-typed",
|
||||
"online": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"deployment": {
|
||||
"imageId": "sha256:e9a5cf65433ed77b8c67991a556f3863a0e9609411a0e3e58d39463323c65414",
|
||||
"tag": "ux-id111",
|
||||
"revisionLabel": "id111",
|
||||
"health": {
|
||||
"status": "ok",
|
||||
"timestamp": "2026-10-10T02:51:44.826Z",
|
||||
"version": "1.0.0-test.id111",
|
||||
"eventLoopDelayMs": 20,
|
||||
"flowWorker": {
|
||||
"alive": false,
|
||||
"bound": false,
|
||||
"pendingSize": 0,
|
||||
"dropped": 0,
|
||||
"packetsReceived": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"browserEvidence": "browser-ipsec-id-2026-10-10.json",
|
||||
"limits": [
|
||||
"Native DN collision and explicit certificate FQDN ID accepted",
|
||||
"Typed-looking literal CN stripping tested against compiled mappers with synthetic input, not native admission of that IKE ID",
|
||||
"Shared configured Remote IDs/cross-auth aliases, arbitrary ID types, client OS, PKI/restore/IPv6 remain open"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user