fix(ipsec): показывать подключённых клиентов и адрес mode-config

backend/src/services/ipsec-live.ts

@@ -108,6 +108,11 @@ export interface RosIpsecActivePeer {
   "remote-id"?: string
   identity?: string
   established?: string
+  id?: string
+  state?: string
+  "remote-address"?: string
+  "dynamic-address"?: string
+  uptime?: string
 }
 
 type RosCertRow = Record<string, string | undefined>
@@ -238,10 +243,15 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
 
   const activeByRemote = new Map<string, RosIpsecActivePeer>()
   for (const a of state.active) {
-    const rid = String(a["remote-id"] ?? "").trim()
+    if (a.state !== "established") continue
+    const rid = String(a.id ?? a["remote-id"] ?? "").trim()
     if (rid) activeByRemote.set(rid, a)
   }
 
+  // RouterOS 7 active-peers.id contains the received value without its configured type prefix.
+  const findActive = (remoteId: string) => activeByRemote.get(remoteId)
+    ?? activeByRemote.get(remoteId.replace(/^(key-id|fqdn|user-fqdn|address):/, ""))
+
   const identityByRemoteCert = new Map<string, RosIpsecIdentity>()
   for (const i of state.identities) {
     const rc = (i["remote-certificate"] ?? "").trim()
@@ -270,8 +280,8 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
     const comment = identity?.comment ?? ""
     const mcName = (identity?.["mode-config"] ?? "").trim()
     const cn = String(cert["common-name"] ?? "").trim()
-    const active = (cn ? activeByRemote.get(cn) : undefined)
-      ?? (identity?.["remote-id"] ? activeByRemote.get(String(identity["remote-id"]).trim()) : undefined)
+    const active = (cn ? findActive(cn) : undefined)
+      ?? (identity?.["remote-id"] ? findActive(String(identity["remote-id"]).trim()) : undefined)
     out.push({
       id: `${server.id}:${identity ? "identity" : "cert"}:${String(identity?.[".id"] ?? cert[".id"] ?? certName)}`,
       rosId: `${identity ? "identity" : "cert"}:${String(identity?.[".id"] ?? cert[".id"] ?? certName)}`,
@@ -289,8 +299,8 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
       modeConfigName: mcName || undefined,
       peerName: (identity?.peer ?? "").trim() || undefined,
       online: Boolean(active),
-      activeAddress: active?.address || undefined,
-      activeSince: active?.established || undefined,
+      activeAddress: active?.["dynamic-address"] || active?.["remote-address"] || active?.address || undefined,
+      activeSince: active?.uptime || active?.established || undefined,
       disabled: asBool(identity?.disabled),
       comment: comment || undefined,
       managed: isUser || isIpsecManagedComment(comment),
@@ -306,7 +316,7 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
     if (!managed && !isIke2RemoteAccessIdentity(i, ike2PeerNames)) continue
     const mcName = (i["mode-config"] ?? "").trim()
     const remoteId = (i["remote-id"] ?? "").trim()
-    const active = remoteId ? activeByRemote.get(remoteId) : undefined
+    const active = remoteId ? findActive(remoteId) : undefined
     out.push({
       id: `${server.id}:identity:${rosId}`,
       rosId: `identity:${rosId}`,
@@ -320,8 +330,8 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
       modeConfigName: mcName || undefined,
       peerName: (i.peer ?? "").trim() || undefined,
       online: Boolean(active),
-      activeAddress: active?.address || undefined,
-      activeSince: active?.established || undefined,
+      activeAddress: active?.["dynamic-address"] || active?.["remote-address"] || active?.address || undefined,
+      activeSince: active?.uptime || active?.established || undefined,
       disabled: asBool(i.disabled),
       comment: i.comment || undefined,
       managed,

backend/src/services/ipsec-state.test.ts

@@ -75,4 +75,21 @@ assert.equal(mapClients(state).find(c => c.certName === "client")?.name, "Existi
 let foreignCertificateWrites = 0
 await assert.rejects(removeManagedIpsecServer({ get: async (path: string) => path === "/certificate" ? [{ ".id": "*CA", name: "ipsec-ca" }, { ".id": "*FOREIGN", name: "external-client", ca: "ipsec-ca" }] : [], delete: async () => { foreignCertificateWrites++ } } as unknown as MikrotikClient, true), /чужой сертификат/)
 assert.equal(foreignCertificateWrites, 0); checks++
+const sessionState = { ...state, certs: [], identities: [{ ".id": "*SESSION", peer: "ike", "auth-method": "pre-shared-key", "remote-id": "key-id:alice", comment: ipsecManagedComment("user=Alice") }], active: [] } as typeof state
+for (const phase of ["starting", "established", "dying", undefined]) {
+  sessionState.active = [{ ".id": "*ACTIVE", id: "alice", state: phase, "remote-address": "192.0.2.2", "dynamic-address": "198.18.78.10", uptime: "1m" }]
+  const client = mapClients(sessionState)[0]!
+  assert.equal(client.online, phase === "established")
+  assert.equal(client.activeAddress, phase === "established" ? "198.18.78.10" : undefined)
+  assert.equal(client.activeSince, phase === "established" ? "1m" : undefined); checks++
+}
+sessionState.active = [{ ".id": "*ACTIVE", id: "key-id:other", state: "established", "remote-address": "192.0.2.2" }]
+assert.equal(mapClients(sessionState)[0]?.online, false); checks++
+sessionState.active = [{ ".id": "*ACTIVE", "remote-id": "key-id:alice", state: "established", "remote-address": "192.0.2.2", uptime: "2m" }]
+assert.equal(mapClients(sessionState)[0]?.activeAddress, "192.0.2.2"); checks++
+for (const prefix of ["fqdn", "user-fqdn", "address", "unknown"]) {
+  sessionState.identities[0]!["remote-id"] = prefix + ":alice"
+  sessionState.active = [{ ".id": "*ACTIVE", id: "alice", state: "established" }]
+  assert.equal(mapClients(sessionState)[0]?.online, prefix !== "unknown"); checks++
+}
 console.log(`ipsec-state: ${checks} checks passed`)