fix(ipsec): исключить чужие сессии при сопоставлении CN
This commit is contained in:
Denozordec committed
1 parent
2aa93ad365
commit
7815e00a1c
15 files changed
+604
-13
No files matched your search
@@ -0,0 +1,420 @@
|
||||
{
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"runtime": {
|
||||
"backend": "ux-id111",
|
||||
"frontend": "ux-a11y101"
|
||||
},
|
||||
"nativeBefore": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"cn": "mm-ipsec111-1791600431289",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600431289",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600431289",
|
||||
"commonName": "CN=mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"commonName": "mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"common-name": "mm-ipsec111-1791600431289",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 05:47:12",
|
||||
"invalid-after": "2026-10-12 05:47:12",
|
||||
"common-name": "mm-ipsec111-1791600431289-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:14",
|
||||
"invalid-after": "2026-10-12 05:47:14",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:15",
|
||||
"invalid-after": "2026-10-12 05:47:15",
|
||||
"common-name": "mm-ipsec111-1791600431289"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600431289-ca",
|
||||
"invalid-before": "2026-10-10 05:47:16",
|
||||
"invalid-after": "2026-10-12 05:47:16",
|
||||
"common-name": "CN=mm-ipsec111-1791600431289"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:47:15",
|
||||
"invalid-after": "2026-10-12 04:47:15",
|
||||
"common-name": "mm-ipsec111-1791600431289"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:47:12",
|
||||
"invalid-after": "2026-10-12 04:47:12",
|
||||
"common-name": "mm-ipsec111-1791600431289-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600431289",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "1s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600431289",
|
||||
"commonName": "CN=mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600431289",
|
||||
"commonName": "mm-ipsec111-1791600431289",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": true
|
||||
},
|
||||
"error": "DN-looking literal CN inherited another certificate session\n\ntrue !== false\n"
|
||||
},
|
||||
"nativeAccepted": {
|
||||
"date": "2026-10-10",
|
||||
"block": "12.5.111",
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"cn": "mm-ipsec111-1791600594968",
|
||||
"observations": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600594968",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"catalog": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600594968",
|
||||
"commonName": "CN=mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"commonName": "mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "194.226.121.150",
|
||||
"state": "established",
|
||||
"remote-address": "194.226.121.150",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"catalog": []
|
||||
}
|
||||
],
|
||||
"cleanup": [
|
||||
{
|
||||
"serverId": 1,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
},
|
||||
{
|
||||
"serverId": 2,
|
||||
"/system/logging": true,
|
||||
"/ip/ipsec/identity": true,
|
||||
"/ip/ipsec/peer": true,
|
||||
"/ip/ipsec/policy": true,
|
||||
"/ip/ipsec/policy/group": true,
|
||||
"/ip/ipsec/mode-config": true,
|
||||
"/ip/ipsec/proposal": true,
|
||||
"/ip/ipsec/profile": true,
|
||||
"/certificate": true,
|
||||
"/file": true,
|
||||
"/ip/address": true,
|
||||
"/ip/route": true,
|
||||
"/ip/firewall/nat": true
|
||||
}
|
||||
],
|
||||
"databaseWrites": false,
|
||||
"certificate": {
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"common-name": "mm-ipsec111-1791600594968",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"key-usage": "digital-signature,key-encipherment,tls-client"
|
||||
},
|
||||
"certificates": [
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-ca",
|
||||
"trusted": "true",
|
||||
"trust-store": "all",
|
||||
"invalid-before": "2026-10-10 05:49:56",
|
||||
"invalid-after": "2026-10-12 05:49:56",
|
||||
"common-name": "mm-ipsec111-1791600594968-CA"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-server",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:57",
|
||||
"invalid-after": "2026-10-12 05:49:57",
|
||||
"common-name": "194.226.121.150"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:57",
|
||||
"invalid-after": "2026-10-12 05:49:57",
|
||||
"common-name": "mm-ipsec111-1791600594968"
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"trusted": "false",
|
||||
"trust-store": "all",
|
||||
"ca": "mm-ipsec111-1791600594968-ca",
|
||||
"invalid-before": "2026-10-10 05:49:59",
|
||||
"invalid-after": "2026-10-12 05:49:59",
|
||||
"common-name": "CN=mm-ipsec111-1791600594968"
|
||||
}
|
||||
],
|
||||
[
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-client-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:49:57",
|
||||
"invalid-after": "2026-10-12 04:49:57",
|
||||
"common-name": "mm-ipsec111-1791600594968"
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968-ca-imported",
|
||||
"trusted": "true",
|
||||
"trust-store": "ipsec",
|
||||
"invalid-before": "2026-10-10 04:49:56",
|
||||
"invalid-after": "2026-10-12 04:49:56",
|
||||
"common-name": "mm-ipsec111-1791600594968-CA"
|
||||
}
|
||||
]
|
||||
],
|
||||
"catalogCorrect": true,
|
||||
"dnPhase": {
|
||||
"active": [
|
||||
{
|
||||
".id": "*1",
|
||||
"id": "CN=mm-ipsec111-1791600594968",
|
||||
"state": "established",
|
||||
"dynamic-address": "198.18.111.250",
|
||||
"remote-address": "104.165.244.7",
|
||||
"uptime": "0s"
|
||||
}
|
||||
],
|
||||
"clients": [
|
||||
{
|
||||
"name": "CN=mm-ipsec111-1791600594968",
|
||||
"commonName": "CN=mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
||||
"online": false
|
||||
},
|
||||
{
|
||||
"name": "mm-ipsec111-1791600594968",
|
||||
"commonName": "mm-ipsec111-1791600594968",
|
||||
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
||||
"online": true,
|
||||
"activeAddress": "198.18.111.250"
|
||||
}
|
||||
],
|
||||
"decoyOnline": false
|
||||
},
|
||||
"fqdnPhase": {
|
||||
"configuredRemoteId": "fqdn:mm-ipsec111-1791600594968.example",
|
||||
"nativeId": "mm-ipsec111-1791600594968.example",
|
||||
"assignedAddress": "198.18.111.250",
|
||||
"originalOnline": true,
|
||||
"decoyOnline": false
|
||||
}
|
||||
},
|
||||
"compiledSyntheticBefore": {
|
||||
"scope": "Compiled baseline mapper with synthetic input; not native typed-ID admission",
|
||||
"clients": [
|
||||
{
|
||||
"name": "ipsec-user-original",
|
||||
"online": true
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-typed",
|
||||
"online": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"compiledSyntheticAfter": {
|
||||
"scope": "Compiled deployed mapper with synthetic input; not native typed-ID admission",
|
||||
"clients": [
|
||||
{
|
||||
"name": "ipsec-user-original",
|
||||
"online": true
|
||||
},
|
||||
{
|
||||
"name": "ipsec-user-typed",
|
||||
"online": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"deployment": {
|
||||
"imageId": "sha256:e9a5cf65433ed77b8c67991a556f3863a0e9609411a0e3e58d39463323c65414",
|
||||
"tag": "ux-id111",
|
||||
"revisionLabel": "id111",
|
||||
"health": {
|
||||
"status": "ok",
|
||||
"timestamp": "2026-10-10T02:51:44.826Z",
|
||||
"version": "1.0.0-test.id111",
|
||||
"eventLoopDelayMs": 20,
|
||||
"flowWorker": {
|
||||
"alive": false,
|
||||
"bound": false,
|
||||
"pendingSize": 0,
|
||||
"dropped": 0,
|
||||
"packetsReceived": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"browserEvidence": "browser-ipsec-id-2026-10-10.json",
|
||||
"limits": [
|
||||
"Native DN collision and explicit certificate FQDN ID accepted",
|
||||
"Typed-looking literal CN stripping tested against compiled mappers with synthetic input, not native admission of that IKE ID",
|
||||
"Shared configured Remote IDs/cross-auth aliases, arbitrary ID types, client OS, PKI/restore/IPv6 remain open"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user