denozord/MikrotikManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 98 Wiki Activity

fix(ipsec): требовать пароль .p12 не короче 8 символов

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Denozordec
2026-09-13 00:10:10 +07:00
co-authored by Cursor
parent a3502b9755
commit c5bd12f48f
4 changed files with 58 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/ipsec.ts
+20 -3
View File
@@ -1,6 +1,7 @@
import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
import type { FastifyReply } from "fastify"
import {
IPSEC_MIN_PASSPHRASE,
ipsecCertDeleteRequestSchema,
ipsecCertExportByNameRequestSchema,
ipsecCertExportRequestSchema,
@@ -97,6 +98,22 @@ function errReply(reply: FastifyReply, e: unknown) {
return reply.status(502).send({ error: `RouterOS: ${msg}` })
}
/**
* 400 по невалидному телу. Для короткого пароля .p12 — понятный текст вместо generic-сообщения:
* RouterOS отклоняет `export-passphrase` короче 8 символов.
*/
function badBodyReply(reply: FastifyReply, error: z.ZodError) {
const shortPassphrase = error.issues.some(
(issue) => issue.path[0] === "passphrase" && issue.code === "too_small",
)
if (shortPassphrase) {
return reply.status(400).send({
error: `Пароль архива .p12 должен быть не короче ${IPSEC_MIN_PASSPHRASE} символов (требование RouterOS)`,
})
}
return reply.status(400).send({ error: "Некорректное тело запроса", details: error.flatten() })
}
async function recordIpsec(
server: NonNullable<Awaited<ReturnType<typeof getEnabledIpsecServerById>>>,
source: ConfigRevisionSource,
@@ -243,7 +260,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
app.post("/ipsec/users", async (req, reply) => {
const parsed = ipsecUserCreateRequestSchema.safeParse(req.body ?? {})
if (!parsed.success) {
return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
return badBodyReply(reply, parsed.error)
}
const body = parsed.data
const server = await getEnabledIpsecServerById(body.serverId)
@@ -608,7 +625,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
const { serverId, rosId } = req.params as { serverId: string; rosId: string }
const parsed = ipsecCertExportRequestSchema.safeParse({ ...(req.body as object), serverId, clientId: rosId })
if (!parsed.success) {
return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
return badBodyReply(reply, parsed.error)
}
const body = parsed.data
const server = await getEnabledIpsecServerById(serverIdParam(serverId))
@@ -667,7 +684,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
const { serverId } = req.params as { serverId: string }
const parsed = ipsecCertExportByNameRequestSchema.safeParse(req.body ?? {})
if (!parsed.success) {
return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
return badBodyReply(reply, parsed.error)
}
const { name, passphrase } = parsed.data
const server = await getEnabledIpsecServerById(serverIdParam(serverId))
components/ipsec/ipsec-cert-sheet.tsx
+16 -4
View File
@@ -1,7 +1,7 @@
"use client"
import { useEffect, useMemo, useState } from "react"
import type { IpsecCertBundle } from "@mmapp/contracts/ipsec"
import { IPSEC_MIN_PASSPHRASE, type IpsecCertBundle } from "@mmapp/contracts/ipsec"
import { FormField, SectionTitle } from "@/components/form-kit"
import { Button } from "@/components/ui/button"
import { Input } from "@/components/ui/input"
@@ -33,7 +33,8 @@ function downloadB64(filename: string, b64: string, mime: string) {
}
function randomPassphrase(): string {
const bytes = new Uint8Array(9)
// RouterOS требует ≥ IPSEC_MIN_PASSPHRASE символов
const bytes = new Uint8Array(IPSEC_MIN_PASSPHRASE + 1)
crypto.getRandomValues(bytes)
let s = ""
for (const b of bytes) s += "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789"[b % 56]
@@ -62,7 +63,10 @@ function IpsecCertSheet({
queueMicrotask(() => setPassphrase(initial))
}, [open, bundle])
const canDownload = useMemo(() => Boolean(bundle && passphrase.trim().length >= 4), [bundle, passphrase])
const canDownload = useMemo(
() => Boolean(bundle && passphrase.trim().length >= IPSEC_MIN_PASSPHRASE),
[bundle, passphrase],
)
return (
<Sheet open={open} onOpenChange={onOpenChange}>
@@ -83,7 +87,15 @@ function IpsecCertSheet({
<>
<div className="flex flex-col gap-4">
<SectionTitle>Пароль архива .p12</SectionTitle>
<FormField label="Passphrase" required hint="Нужна при импорте .p12 на устройстве">
<FormField
label="Passphrase"
required
hint={
passphrase.trim().length > 0 && passphrase.trim().length < IPSEC_MIN_PASSPHRASE
? `Минимум ${IPSEC_MIN_PASSPHRASE} символов — требование RouterOS`
: `Нужна при импорте .p12 на устройстве (минимум ${IPSEC_MIN_PASSPHRASE} символов)`
}
>
<div className="flex gap-2">
<Input
className="font-mono"
components/ipsec/ipsec-user-sheet.tsx
+12 -2
View File
@@ -1,7 +1,7 @@
"use client"
import { useEffect, useMemo, useState } from "react"
import type { IpsecClientDto } from "@mmapp/contracts/ipsec"
import { IPSEC_MIN_PASSPHRASE, type IpsecClientDto } from "@mmapp/contracts/ipsec"
import { FormField, FormToggle, SectionTitle } from "@/components/form-kit"
import { Button } from "@/components/ui/button"
import { Input } from "@/components/ui/input"
@@ -91,6 +91,9 @@ function IpsecUserSheet({
if (!form.name.trim()) return false
if (!editing && form.authMethod === "pre-shared-key" && form.psk.trim().length < 8) return false
if (form.useStaticIp && form.staticIp.trim() && !/^\d{1,3}(?:\.\d{1,3}){3}$/.test(form.staticIp.trim())) return false
// RouterOS отклоняет export-passphrase короче 8 символов
const passphrase = form.passphrase.trim()
if (!editing && passphrase.length > 0 && passphrase.length < IPSEC_MIN_PASSPHRASE) return false
return true
}, [form, editing])
@@ -201,7 +204,14 @@ function IpsecUserSheet({
</>
) : (
!editing ? (
<FormField label="Пароль архива .p12" hint="Пусто — сгенерируем автоматически">
<FormField
label="Пароль архива .p12"
hint={
form.passphrase.trim().length > 0 && form.passphrase.trim().length < IPSEC_MIN_PASSPHRASE
? `Минимум ${IPSEC_MIN_PASSPHRASE} символов — требование RouterOS`
: `Пусто — сгенерируем автоматически (минимум ${IPSEC_MIN_PASSPHRASE} символов)`
}
>
<Input
className="font-mono"
placeholder="например MySecret123"
packages/contracts/src/ipsec.ts
+10 -4
View File
@@ -2,6 +2,12 @@ import { z } from "zod"
export const ipsecAuthMethodSchema = z.enum(["certificate", "pre-shared-key"])
/**
* Минимальная длина пароля .p12. Ограничение RouterOS REST:
* `Failure: If used, passphrase must be at least 8 chars long!` (см. /certificate/export-certificate).
*/
export const IPSEC_MIN_PASSPHRASE = 8
/** Клиент IKEv2 — /ip/ipsec/identity (+ опциональный персональный mode-config). */
export const ipsecClientDtoSchema = z.object({
id: z.string().min(1),
@@ -166,8 +172,8 @@ export const ipsecUserCreateRequestSchema = z.object({
remoteId: z.string().optional(),
/** Конкретный IP клиента; без — выдаётся из пула. */
staticIp: z.string().optional(),
/** Пароль на экспортируемый .p12. */
passphrase: z.string().min(4).optional(),
/** Пароль на экспортируемый .p12 (RouterOS требует ≥ IPSEC_MIN_PASSPHRASE). */
passphrase: z.string().min(IPSEC_MIN_PASSPHRASE).optional(),
daysValid: z.number().int().positive().optional(),
})
@@ -183,13 +189,13 @@ export const ipsecUserPatchSchema = z.object({
export const ipsecCertExportRequestSchema = z.object({
serverId: z.union([z.string(), z.number()]),
clientId: z.string().min(1),
passphrase: z.string().min(4),
passphrase: z.string().min(IPSEC_MIN_PASSPHRASE),
})
/** Экспорт .p12 существующего клиентского сертификата по имени (client1/anakondra и т.п.). */
export const ipsecCertExportByNameRequestSchema = z.object({
name: z.string().min(1),
passphrase: z.string().min(4),
passphrase: z.string().min(IPSEC_MIN_PASSPHRASE),
})
/** Бандл для авторизации клиента: .p12 (+ strongSwan .sswan + инструкция). */