420 lines
13 KiB
JSON
420 lines
13 KiB
JSON
{
|
|
"date": "2026-10-10",
|
|
"block": "12.5.111",
|
|
"runtime": {
|
|
"backend": "ux-id111",
|
|
"frontend": "ux-a11y101"
|
|
},
|
|
"nativeBefore": {
|
|
"date": "2026-10-10",
|
|
"block": "12.5.111",
|
|
"name": "mm-ipsec111-1791600431289",
|
|
"cn": "mm-ipsec111-1791600431289",
|
|
"observations": [
|
|
{
|
|
"serverId": 1,
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "CN=mm-ipsec111-1791600431289",
|
|
"state": "established",
|
|
"dynamic-address": "198.18.111.250",
|
|
"remote-address": "104.165.244.7",
|
|
"uptime": "1s"
|
|
}
|
|
],
|
|
"catalog": [
|
|
{
|
|
"name": "CN=mm-ipsec111-1791600431289",
|
|
"commonName": "CN=mm-ipsec111-1791600431289",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600431289",
|
|
"commonName": "mm-ipsec111-1791600431289",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"serverId": 2,
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "194.226.121.150",
|
|
"state": "established",
|
|
"remote-address": "194.226.121.150",
|
|
"uptime": "1s"
|
|
}
|
|
],
|
|
"catalog": []
|
|
}
|
|
],
|
|
"cleanup": [
|
|
{
|
|
"serverId": 1,
|
|
"/system/logging": true,
|
|
"/ip/ipsec/identity": true,
|
|
"/ip/ipsec/peer": true,
|
|
"/ip/ipsec/policy": true,
|
|
"/ip/ipsec/policy/group": true,
|
|
"/ip/ipsec/mode-config": true,
|
|
"/ip/ipsec/proposal": true,
|
|
"/ip/ipsec/profile": true,
|
|
"/certificate": true,
|
|
"/file": true,
|
|
"/ip/address": true,
|
|
"/ip/route": true,
|
|
"/ip/firewall/nat": true
|
|
},
|
|
{
|
|
"serverId": 2,
|
|
"/system/logging": true,
|
|
"/ip/ipsec/identity": true,
|
|
"/ip/ipsec/peer": true,
|
|
"/ip/ipsec/policy": true,
|
|
"/ip/ipsec/policy/group": true,
|
|
"/ip/ipsec/mode-config": true,
|
|
"/ip/ipsec/proposal": true,
|
|
"/ip/ipsec/profile": true,
|
|
"/certificate": true,
|
|
"/file": true,
|
|
"/ip/address": true,
|
|
"/ip/route": true,
|
|
"/ip/firewall/nat": true
|
|
}
|
|
],
|
|
"databaseWrites": false,
|
|
"certificate": {
|
|
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
|
"common-name": "mm-ipsec111-1791600431289",
|
|
"ca": "mm-ipsec111-1791600431289-ca",
|
|
"key-usage": "digital-signature,key-encipherment,tls-client"
|
|
},
|
|
"certificates": [
|
|
[
|
|
{
|
|
"name": "mm-ipsec111-1791600431289-ca",
|
|
"trusted": "true",
|
|
"trust-store": "all",
|
|
"invalid-before": "2026-10-10 05:47:12",
|
|
"invalid-after": "2026-10-12 05:47:12",
|
|
"common-name": "mm-ipsec111-1791600431289-CA"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600431289-server",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600431289-ca",
|
|
"invalid-before": "2026-10-10 05:47:14",
|
|
"invalid-after": "2026-10-12 05:47:14",
|
|
"common-name": "194.226.121.150"
|
|
},
|
|
{
|
|
"name": "ipsec-user-mm-ipsec111-1791600431289",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600431289-ca",
|
|
"invalid-before": "2026-10-10 05:47:15",
|
|
"invalid-after": "2026-10-12 05:47:15",
|
|
"common-name": "mm-ipsec111-1791600431289"
|
|
},
|
|
{
|
|
"name": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600431289-ca",
|
|
"invalid-before": "2026-10-10 05:47:16",
|
|
"invalid-after": "2026-10-12 05:47:16",
|
|
"common-name": "CN=mm-ipsec111-1791600431289"
|
|
}
|
|
],
|
|
[
|
|
{
|
|
"name": "mm-ipsec111-1791600431289-client-imported",
|
|
"trusted": "true",
|
|
"trust-store": "ipsec",
|
|
"invalid-before": "2026-10-10 04:47:15",
|
|
"invalid-after": "2026-10-12 04:47:15",
|
|
"common-name": "mm-ipsec111-1791600431289"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600431289-ca-imported",
|
|
"trusted": "true",
|
|
"trust-store": "ipsec",
|
|
"invalid-before": "2026-10-10 04:47:12",
|
|
"invalid-after": "2026-10-12 04:47:12",
|
|
"common-name": "mm-ipsec111-1791600431289-CA"
|
|
}
|
|
]
|
|
],
|
|
"catalogCorrect": true,
|
|
"dnPhase": {
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "CN=mm-ipsec111-1791600431289",
|
|
"state": "established",
|
|
"dynamic-address": "198.18.111.250",
|
|
"remote-address": "104.165.244.7",
|
|
"uptime": "1s"
|
|
}
|
|
],
|
|
"clients": [
|
|
{
|
|
"name": "CN=mm-ipsec111-1791600431289",
|
|
"commonName": "CN=mm-ipsec111-1791600431289",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600431289",
|
|
"commonName": "mm-ipsec111-1791600431289",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600431289",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
}
|
|
],
|
|
"decoyOnline": true
|
|
},
|
|
"error": "DN-looking literal CN inherited another certificate session\n\ntrue !== false\n"
|
|
},
|
|
"nativeAccepted": {
|
|
"date": "2026-10-10",
|
|
"block": "12.5.111",
|
|
"name": "mm-ipsec111-1791600594968",
|
|
"cn": "mm-ipsec111-1791600594968",
|
|
"observations": [
|
|
{
|
|
"serverId": 1,
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "CN=mm-ipsec111-1791600594968",
|
|
"state": "established",
|
|
"dynamic-address": "198.18.111.250",
|
|
"remote-address": "104.165.244.7",
|
|
"uptime": "0s"
|
|
}
|
|
],
|
|
"catalog": [
|
|
{
|
|
"name": "CN=mm-ipsec111-1791600594968",
|
|
"commonName": "CN=mm-ipsec111-1791600594968",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
|
"online": false
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600594968",
|
|
"commonName": "mm-ipsec111-1791600594968",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"serverId": 2,
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "194.226.121.150",
|
|
"state": "established",
|
|
"remote-address": "194.226.121.150",
|
|
"uptime": "0s"
|
|
}
|
|
],
|
|
"catalog": []
|
|
}
|
|
],
|
|
"cleanup": [
|
|
{
|
|
"serverId": 1,
|
|
"/system/logging": true,
|
|
"/ip/ipsec/identity": true,
|
|
"/ip/ipsec/peer": true,
|
|
"/ip/ipsec/policy": true,
|
|
"/ip/ipsec/policy/group": true,
|
|
"/ip/ipsec/mode-config": true,
|
|
"/ip/ipsec/proposal": true,
|
|
"/ip/ipsec/profile": true,
|
|
"/certificate": true,
|
|
"/file": true,
|
|
"/ip/address": true,
|
|
"/ip/route": true,
|
|
"/ip/firewall/nat": true
|
|
},
|
|
{
|
|
"serverId": 2,
|
|
"/system/logging": true,
|
|
"/ip/ipsec/identity": true,
|
|
"/ip/ipsec/peer": true,
|
|
"/ip/ipsec/policy": true,
|
|
"/ip/ipsec/policy/group": true,
|
|
"/ip/ipsec/mode-config": true,
|
|
"/ip/ipsec/proposal": true,
|
|
"/ip/ipsec/profile": true,
|
|
"/certificate": true,
|
|
"/file": true,
|
|
"/ip/address": true,
|
|
"/ip/route": true,
|
|
"/ip/firewall/nat": true
|
|
}
|
|
],
|
|
"databaseWrites": false,
|
|
"certificate": {
|
|
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
|
"common-name": "mm-ipsec111-1791600594968",
|
|
"ca": "mm-ipsec111-1791600594968-ca",
|
|
"key-usage": "digital-signature,key-encipherment,tls-client"
|
|
},
|
|
"certificates": [
|
|
[
|
|
{
|
|
"name": "mm-ipsec111-1791600594968-ca",
|
|
"trusted": "true",
|
|
"trust-store": "all",
|
|
"invalid-before": "2026-10-10 05:49:56",
|
|
"invalid-after": "2026-10-12 05:49:56",
|
|
"common-name": "mm-ipsec111-1791600594968-CA"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600594968-server",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600594968-ca",
|
|
"invalid-before": "2026-10-10 05:49:57",
|
|
"invalid-after": "2026-10-12 05:49:57",
|
|
"common-name": "194.226.121.150"
|
|
},
|
|
{
|
|
"name": "ipsec-user-mm-ipsec111-1791600594968",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600594968-ca",
|
|
"invalid-before": "2026-10-10 05:49:57",
|
|
"invalid-after": "2026-10-12 05:49:57",
|
|
"common-name": "mm-ipsec111-1791600594968"
|
|
},
|
|
{
|
|
"name": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
|
"trusted": "false",
|
|
"trust-store": "all",
|
|
"ca": "mm-ipsec111-1791600594968-ca",
|
|
"invalid-before": "2026-10-10 05:49:59",
|
|
"invalid-after": "2026-10-12 05:49:59",
|
|
"common-name": "CN=mm-ipsec111-1791600594968"
|
|
}
|
|
],
|
|
[
|
|
{
|
|
"name": "mm-ipsec111-1791600594968-client-imported",
|
|
"trusted": "true",
|
|
"trust-store": "ipsec",
|
|
"invalid-before": "2026-10-10 04:49:57",
|
|
"invalid-after": "2026-10-12 04:49:57",
|
|
"common-name": "mm-ipsec111-1791600594968"
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600594968-ca-imported",
|
|
"trusted": "true",
|
|
"trust-store": "ipsec",
|
|
"invalid-before": "2026-10-10 04:49:56",
|
|
"invalid-after": "2026-10-12 04:49:56",
|
|
"common-name": "mm-ipsec111-1791600594968-CA"
|
|
}
|
|
]
|
|
],
|
|
"catalogCorrect": true,
|
|
"dnPhase": {
|
|
"active": [
|
|
{
|
|
".id": "*1",
|
|
"id": "CN=mm-ipsec111-1791600594968",
|
|
"state": "established",
|
|
"dynamic-address": "198.18.111.250",
|
|
"remote-address": "104.165.244.7",
|
|
"uptime": "0s"
|
|
}
|
|
],
|
|
"clients": [
|
|
{
|
|
"name": "CN=mm-ipsec111-1791600594968",
|
|
"commonName": "CN=mm-ipsec111-1791600594968",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
|
|
"online": false
|
|
},
|
|
{
|
|
"name": "mm-ipsec111-1791600594968",
|
|
"commonName": "mm-ipsec111-1791600594968",
|
|
"certName": "ipsec-user-mm-ipsec111-1791600594968",
|
|
"online": true,
|
|
"activeAddress": "198.18.111.250"
|
|
}
|
|
],
|
|
"decoyOnline": false
|
|
},
|
|
"fqdnPhase": {
|
|
"configuredRemoteId": "fqdn:mm-ipsec111-1791600594968.example",
|
|
"nativeId": "mm-ipsec111-1791600594968.example",
|
|
"assignedAddress": "198.18.111.250",
|
|
"originalOnline": true,
|
|
"decoyOnline": false
|
|
}
|
|
},
|
|
"compiledSyntheticBefore": {
|
|
"scope": "Compiled baseline mapper with synthetic input; not native typed-ID admission",
|
|
"clients": [
|
|
{
|
|
"name": "ipsec-user-original",
|
|
"online": true
|
|
},
|
|
{
|
|
"name": "ipsec-user-typed",
|
|
"online": true
|
|
}
|
|
]
|
|
},
|
|
"compiledSyntheticAfter": {
|
|
"scope": "Compiled deployed mapper with synthetic input; not native typed-ID admission",
|
|
"clients": [
|
|
{
|
|
"name": "ipsec-user-original",
|
|
"online": true
|
|
},
|
|
{
|
|
"name": "ipsec-user-typed",
|
|
"online": false
|
|
}
|
|
]
|
|
},
|
|
"deployment": {
|
|
"imageId": "sha256:e9a5cf65433ed77b8c67991a556f3863a0e9609411a0e3e58d39463323c65414",
|
|
"tag": "ux-id111",
|
|
"revisionLabel": "id111",
|
|
"health": {
|
|
"status": "ok",
|
|
"timestamp": "2026-10-10T02:51:44.826Z",
|
|
"version": "1.0.0-test.id111",
|
|
"eventLoopDelayMs": 20,
|
|
"flowWorker": {
|
|
"alive": false,
|
|
"bound": false,
|
|
"pendingSize": 0,
|
|
"dropped": 0,
|
|
"packetsReceived": 0
|
|
}
|
|
}
|
|
},
|
|
"browserEvidence": "browser-ipsec-id-2026-10-10.json",
|
|
"limits": [
|
|
"Native DN collision and explicit certificate FQDN ID accepted",
|
|
"Typed-looking literal CN stripping tested against compiled mappers with synthetic input, not native admission of that IKE ID",
|
|
"Shared configured Remote IDs/cross-auth aliases, arbitrary ID types, client OS, PKI/restore/IPv6 remain open"
|
|
]
|
|
} |