Make get_mac_from_arp take an arp_path for testability (default unchanged), and
add tests for get_client_ip (X-Forwarded-For vs remote_addr), ARP MAC
resolution (match/no-match/missing), SAIP decode-unavailable, and the
SAIP_ASN_PATH override. Coverage: utils 100%, overall 93%; 108 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Provisioning bodies are tiny; set MAX_CONTENT_LENGTH=16 KiB so oversized POSTs
are rejected with 413 rather than buffered. Tests: +1; 99 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/make_profile.py generates a profile (v2 JSON or SAIP DER) from config.yaml
to a file or stdout, or decodes and summarizes an existing SAIP profile via
--inspect. Tests: +5 (build v2/saip, custom ids, main generate/inspect); 98 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Prepend a PE-MF (referencing the MF "created by default" template,
OID 2.23.143.1.2.1) that personalizes EF.ICCID, so the profile sequence is now
header -> MF(EF.ICCID) -> USIM(EF.IMSI) -> AKA(Ki/OPc) -> End. 93 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The SAIP profile now personalizes EF.IMSI via a PE-USIM referencing the standard
"created by default" USIM template (OID 2.23.143.1.2.4), so the package carries
ICCID + IMSI + Ki/OPc. IMSI content uses the existing TS 31.102 enc_imsi.
Add decode_saip_profile(): splits the concatenated ProfileElements by DER TLV
boundaries and decodes each (asn1tools decodes only one value at a time).
Tests: full-sequence decode ([header, usim, akaParameter, end]) and IMSI-in-USIM
round-trip; 93 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New server/saip_profile.py encodes a DER ProfileElement sequence (ProfileHeader
with ICCID + Milenage AKA parameters carrying Ki/OPc) using asn1tools against
the official PE_Definitions SAIP ASN.1 schema. It locates the schema from an
installed osmocom pySim (or SAIP_ASN_PATH) via find_spec WITHOUT importing
pySim's Python package, so it avoids the pyscard/smpp card-reader stack — the
only runtime dep is asn1tools.
Selectable via profile.format ("v2" default | "saip"); the app falls back to
profile-package-v2 with a warning when SAIP prerequisites are absent. IMSI and
other EFs (USIM-template PEs) are the documented next layer.
Add requirements-saip.txt, pytest.ini (silence asn1tools warnings), README and
config updates. Tests: +6 (encode/round-trip/credentials, app emit + fallback);
92 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/api/export returns every subscriber's Ki/OPc and was reachable unauthenticated
by any WiFi client (and directly, since Flask binds 0.0.0.0). It now requires
server.admin_token via the X-Admin-Token header (constant-time compare) and is
disabled entirely when no token is configured.
Add admin_token to config.yaml.example. Tests: +2 (disabled/401/200); 86 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- get_connection sets PRAGMA busy_timeout so concurrent writers under a
threaded server wait instead of hitting "database is locked".
- Provision retries credential generation on IMSI/ICCID collision (up to 5x)
instead of surfacing a duplicate as a 500.
- Guard the module-level profile cache with a threading.Lock.
- Captive portal disables the activate button while a request is in flight to
avoid double provisioning.
Tests: +2 (collision retry + give-up); 84 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Fix FileNotFoundError when database.path has no directory component
(os.makedirs(os.path.dirname(path)) with path="subscribers.db" raised).
Add ensure_parent_dir helper; use it in app.py and scripts/init_db.py.
- Open5GS/free5gc adapters now use profile.apn for the core session/DNN name
instead of a hardcoded "internet"; apn is threaded through get_adapter.
Tests: +4 (ensure_parent_dir, adapter APN); 82 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security:
- Serve generated profiles at /api/profile/<random-token> instead of
/api/profile/<sequential-int>. Profiles carry Ki/OPc, so the enumerable id
scheme allowed anyone on the WiFi to harvest all subscriber keys. Unknown
tokens return a plain 404 so they can't be probed.
Robustness:
- Open5GS/free5gc adapters use short MongoDB timeouts so an unreachable core
fails provisioning fast instead of blocking ~30s on the default.
- Profile cache is now a size-capped LRU (OrderedDict) to prevent unbounded
memory growth.
- load_config rejects empty/non-mapping YAML and validates network.op_key is a
16-byte hex string.
Tests: +25 (test_app.py API coverage, test_utils.py); 78 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Upgrade create_esim_profile from a loose JSON mock to a structured
profile-package-v2 that embeds real 3GPP field encodings:
- enc_iccid: EF_ICCID nibble-swapped BCD, 10-byte 0xF-padded (TS 31.102 4.2.1)
- enc_imsi: EF_IMSI length octet + parity nibble + nibble-swapped BCD (4.2.2)
- build_lpa_activation_code: SGP.22 LPA:1$<smdp>$<matching-id> string
Wire apn and smdp_address through config into the provisioning call; add
smdp_address to config.yaml.example. Add CHANGELOG.md.
Full SGP.22 SAIP/ASN.1 UPP generation via osmocom pySim remains a follow-up
(not on PyPI; needs SM-DP+/LPA for OTA install) and is noted in the changelog.
Tests: +9 (encoders, round-trips, activation code); 53 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Full working closed-loop eSIM provisioning stack (spec in claude.md / plan/):
Flask API, SQLite subscriber store, credential/profile generator, Open5GS
and free5gc core adapters, captive portal, operational scripts, systemd
units, network configs, and a 44-test suite.
Profile generation currently returns a mock JSON profile; real SGP.22
generation via pySim is the planned Phase-2 upgrade.
Fixes two bugs found while getting the suite green:
- generate_imsi hardcoded a 10-digit MSIN, producing 16-digit IMSIs for a
3-digit MNC; MSIN length is now 15 - len(mcc) - len(mnc).
- check_rate_limit compared timestamps as strings across mismatched formats
(SQLite CURRENT_TIMESTAMP vs Python isoformat); both sides now normalized
via SQLite datetime() so the window check is chronologically correct.
Add .gitignore for venv, caches, runtime config.yaml, and databases.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>