A
f367103ceb
Security: - Serve generated profiles at /api/profile/<random-token> instead of /api/profile/<sequential-int>. Profiles carry Ki/OPc, so the enumerable id scheme allowed anyone on the WiFi to harvest all subscriber keys. Unknown tokens return a plain 404 so they can't be probed. Robustness: - Open5GS/free5gc adapters use short MongoDB timeouts so an unreachable core fails provisioning fast instead of blocking ~30s on the default. - Profile cache is now a size-capped LRU (OrderedDict) to prevent unbounded memory growth. - load_config rejects empty/non-mapping YAML and validates network.op_key is a 16-byte hex string. Tests: +25 (test_app.py API coverage, test_utils.py); 78 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
86 lines
2.5 KiB
Python
86 lines
2.5 KiB
Python
import pytest
|
|
|
|
from server.utils import (
|
|
load_config,
|
|
normalize_mac,
|
|
validate_imsi,
|
|
validate_mac,
|
|
validate_op_key,
|
|
)
|
|
|
|
|
|
class TestMac:
|
|
def test_valid(self):
|
|
assert validate_mac("aa:bb:cc:dd:ee:ff")
|
|
|
|
def test_invalid(self):
|
|
assert not validate_mac("nope")
|
|
assert not validate_mac("")
|
|
|
|
def test_normalize_dashes_and_case(self):
|
|
assert normalize_mac("AA-BB-CC-DD-EE-FF") == "aa:bb:cc:dd:ee:ff"
|
|
|
|
def test_normalize_no_separator(self):
|
|
assert normalize_mac("aabbccddeeff") == "aa:bb:cc:dd:ee:ff"
|
|
|
|
|
|
class TestImsi:
|
|
def test_valid(self):
|
|
assert validate_imsi("302720000000001")
|
|
|
|
def test_wrong_length(self):
|
|
assert not validate_imsi("30272000000000")
|
|
|
|
def test_non_digit(self):
|
|
assert not validate_imsi("30272000000000x")
|
|
|
|
|
|
class TestOpKey:
|
|
def test_valid(self):
|
|
assert validate_op_key("63bfa50ee6523365ff14c1f45f88737d")
|
|
|
|
def test_wrong_length(self):
|
|
assert not validate_op_key("abcd")
|
|
|
|
def test_non_hex(self):
|
|
assert not validate_op_key("zz" * 16)
|
|
|
|
|
|
class TestLoadConfig:
|
|
def _base(self):
|
|
return (
|
|
"network: {mcc: '302', mnc: '720', op_key: '63bfa50ee6523365ff14c1f45f88737d'}\n"
|
|
"server: {host: '0.0.0.0', port: 5000}\n"
|
|
"database: {path: '/tmp/x.db'}\n"
|
|
"rate_limiting: {window_hours: 1}\n"
|
|
"profile: {profile_name: 'P', carrier_name: 'C'}\n"
|
|
)
|
|
|
|
def test_valid(self, tmp_path):
|
|
p = tmp_path / "c.yaml"
|
|
p.write_text(self._base())
|
|
cfg = load_config(str(p))
|
|
assert cfg["network"]["mcc"] == "302"
|
|
|
|
def test_missing_file(self):
|
|
with pytest.raises(FileNotFoundError):
|
|
load_config("/no/such/config.yaml")
|
|
|
|
def test_empty_file(self, tmp_path):
|
|
p = tmp_path / "empty.yaml"
|
|
p.write_text("")
|
|
with pytest.raises(ValueError, match="empty or not a mapping"):
|
|
load_config(str(p))
|
|
|
|
def test_missing_section(self, tmp_path):
|
|
p = tmp_path / "c.yaml"
|
|
p.write_text("network: {op_key: '63bfa50ee6523365ff14c1f45f88737d'}\n")
|
|
with pytest.raises(ValueError, match="Missing required config section"):
|
|
load_config(str(p))
|
|
|
|
def test_bad_op_key(self, tmp_path):
|
|
p = tmp_path / "c.yaml"
|
|
p.write_text(self._base().replace("63bfa50ee6523365ff14c1f45f88737d", "abcd"))
|
|
with pytest.raises(ValueError, match="op_key"):
|
|
load_config(str(p))
|