Make get_mac_from_arp take an arp_path for testability (default unchanged), and
add tests for get_client_ip (X-Forwarded-For vs remote_addr), ARP MAC
resolution (match/no-match/missing), SAIP decode-unavailable, and the
SAIP_ASN_PATH override. Coverage: utils 100%, overall 93%; 108 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Fix FileNotFoundError when database.path has no directory component
(os.makedirs(os.path.dirname(path)) with path="subscribers.db" raised).
Add ensure_parent_dir helper; use it in app.py and scripts/init_db.py.
- Open5GS/free5gc adapters now use profile.apn for the core session/DNN name
instead of a hardcoded "internet"; apn is threaded through get_adapter.
Tests: +4 (ensure_parent_dir, adapter APN); 82 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security:
- Serve generated profiles at /api/profile/<random-token> instead of
/api/profile/<sequential-int>. Profiles carry Ki/OPc, so the enumerable id
scheme allowed anyone on the WiFi to harvest all subscriber keys. Unknown
tokens return a plain 404 so they can't be probed.
Robustness:
- Open5GS/free5gc adapters use short MongoDB timeouts so an unreachable core
fails provisioning fast instead of blocking ~30s on the default.
- Profile cache is now a size-capped LRU (OrderedDict) to prevent unbounded
memory growth.
- load_config rejects empty/non-mapping YAML and validates network.op_key is a
16-byte hex string.
Tests: +25 (test_app.py API coverage, test_utils.py); 78 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>