@anonympins/fingerprint 0.3.3 → 0.3.5

package/src/php/Tests/IpReputationTest.php

@@ -0,0 +1,157 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Store\IStore;
+use Anonympins\Fingerprint\RequestContext;
+
+class IpReputationTest extends TestCase
+{
+    private $store;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
+        $this->store = new class implements IStore {
+            private array $data = [];
+            public function get(string $key) { return $this->data[$key] ?? null; }
+            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
+            public function has(string $key): bool { return isset($this->data[$key]); }
+            public function delete(string $key): void { unset($this->data[$key]); }
+        };
+
+        StoreManager::setStore($this->store);
+    }
+
+    public function testGetScoreReturnsZeroForUnknownIp(): void
+    {
+        $score = RequestUtils::getIpReputationScore('8.8.8.8');
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testUpdateScoreChangesValueCorrectly(): void
+    {
+        $ip = '8.8.4.4';
+        RequestUtils::updateIpReputationScore($ip, 45.0);
+        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -15.0);
+        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testBoundsAreClampedBetween0And100(): void
+    {
+        $ip = '1.1.1.1';
+        RequestUtils::updateIpReputationScore($ip, 120.0);
+        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -150.0);
+        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
+    {
+        $ip = '2.2.2.2';
+        $now = time();
+
+        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
+        $this->store->set("ip-reputation:{$ip}", [
+            'score' => 80.0,
+            'lastUpdate' => $now - 14400
+        ]);
+
+        $score = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(72.0, $score);
+    }
+
+    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
+    {
+        $ip = '1.2.3.4';
+        RequestUtils::updateIpReputationScore($ip, 60.0);
+
+        $weights = [
+            'ipReputationScore' => 0.5,
+            'historyScore' => 0.0,
+            'rotationScore' => 0.0,
+            'headerAnomalyScore' => 0.0,
+            'requestPatternScore' => 0.0,
+            'inconsistencyScore' => 0.0,
+            'honeypotScore' => 0.0,
+            'behaviorScore' => 0.0,
+            'botScore' => 0.0,
+            'crossLayerInconsistencyScore' => 0.0,
+            'tlsSpoofingScore' => 0.0,
+            'timeInconsistencyScore' => 0.0,
+            'clickVarianceScore' => 0.0,
+            'clientHintsInconsistencyScore' => 0.0,
+            'subnetScore' => 0.0,
+        ];
+
+        $ipRepScore = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(60.0, $ipRepScore);
+        $score = $ipRepScore * $weights['ipReputationScore'];
+        $this->assertEquals(30.0, $score);
+    }
+
+    public function testGetIpSubnetIpv4AndIpv6(): void
+    {
+        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
+        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
+
+        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
+        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
+    }
+
+    public function testGetClientHintsInconsistencyScoreMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Google Chrome";v="117"';
+            }
+            return null;
+        });
+
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetSubnetScoreCalculations(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->clientIp = '192.168.1.50';
+
+        $score = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertEquals(0.0, $score['subnetScore']);
+
+        for ($i = 1; $i <= 12; $i++) {
+            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
+        }
+
+        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
+    }
+
+    public function testTlsSpoofingScoreWithJa4(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->ja4 = 't13d1517h2_8daaf61527d5';
+        $context->ja3 = null;
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
+        });
+
+        $score = RequestUtils::getTlsSpoofingScore($context);
+        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
+    }
+}

package/src/php/Tests/Ja3AnomalyDetectorTest.php

@@ -0,0 +1,180 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Anonympins\Fingerprint\Ja3AnomalyDetector;
+
+/**
+ * Tests unitaires pour la classe Ja3AnomalyDetector.
+ */
+class Ja3AnomalyDetectorTest extends TestCase
+{
+    /**
+     * Teste le parsing d'une chaîne JA3 brute valide.
+     */
+    public function testParseJa3ValidString(): void
+    {
+        $ja3 = '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0';
+        $parsed = Ja3AnomalyDetector::parseJa3($ja3);
+
+        $this->assertNotNull($parsed);
+        $this->assertSame(771, $parsed['tlsVersion']);
+        $this->assertSame([4865, 4866, 4867], $parsed['ciphers']);
+        $this->assertSame([0, 23, 65281, 10, 11], $parsed['extensions']);
+        $this->assertSame([29, 23, 24], $parsed['curves']);
+        $this->assertSame([0], $parsed['points']);
+    }
+
+    /**
+     * Teste le parsing avec des valeurs manquantes ou malformées.
+     */
+    public function testParseJa3InvalidString(): void
+    {
+        $this->assertNull(Ja3AnomalyDetector::parseJa3(''));
+        $this->assertNull(Ja3AnomalyDetector::parseJa3('771,4865,0-23')); // Moins de 5 parties
+    }
+
+    /**
+     * Teste la détection du mécanisme GREASE.
+     */
+    public function testHasGrease(): void
+    {
+        // Contient la valeur GREASE 2570 (0x0A0A)
+        $this->assertTrue(Ja3AnomalyDetector::hasGrease([4865, 2570, 4866]));
+        // Ne contient pas de valeur GREASE
+        $this->assertFalse(Ja3AnomalyDetector::hasGrease([4865, 4866, 4867]));
+    }
+
+    /**
+     * Teste l'extraction de la famille du User-Agent.
+     */
+    public function testGetBrowserFamily(): void
+    {
+        $this->assertSame('Chrome', Ja3AnomalyDetector::getBrowserFamily('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'));
+        $this->assertSame('Edge', Ja3AnomalyDetector::getBrowserFamily('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0'));
+        $this->assertSame('Firefox', Ja3AnomalyDetector::getBrowserFamily('Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0'));
+        $this->assertSame('Safari', Ja3AnomalyDetector::getBrowserFamily('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15'));
+        $this->assertNull(Ja3AnomalyDetector::getBrowserFamily('curl/7.68.0'));
+    }
+
+    /**
+     * Teste la détection d'usurpation d'une bibliothèque connue (ex: Python/Go/curl).
+     */
+    public function testSpoofingLibraryDetected(): void
+    {
+        $pythonJa3 = '47344a349b75c4e82333475553b5f358'; // Signature Python dans DB
+        $userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore($pythonJa3, null, $userAgent, 'HTTP/2');
+
+        // Devrait retourner un score élevé (90) car une signature python se fait passer pour Chrome
+        $this->assertEquals(90, $score);
+    }
+
+    /**
+     * Teste la détection d'une incohérence de navigateur (ex: signature Firefox avec UA Chrome).
+     */
+    public function testBrowserMismatchDetected(): void
+    {
+        $firefoxJa3 = 'b386946a5a586163c7c533636b45c355'; // Signature Firefox dans DB
+        $userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore($firefoxJa3, null, $userAgent, 'HTTP/2');
+
+        $this->assertEquals(80, $score);
+    }
+
+    /**
+     * Teste la détection de stagnation de hash avec rotation d'User-Agents.
+     */
+    public function testStagnationWithRotatingUserAgents(): void
+    {
+        // Mock d'un stockage de cache minimal en mémoire
+        $cache = new class {
+            private array $store = [];
+            public function get(string $key): ?string { return $this->store[$key] ?? null; }
+            public function set(string $key, string $val, int $ttl = 0): void { $this->store[$key] = $val; }
+            public function setex(string $key, int $ttl, string $val): void { $this->store[$key] = $val; }
+        };
+
+        $unknownJa3 = '00000000000000000000000000000000';
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        $firefoxUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0';
+
+        // Premier appel avec Chrome -> pas d'anomalie de stagnation encore
+        $score1 = Ja3AnomalyDetector::getJa3AnomalyScore($unknownJa3, null, $chromeUA, 'HTTP/2', $cache);
+        $this->assertLessThan(85, $score1);
+
+        // Deuxième appel avec la même stack TLS mais un UA Firefox -> Détection de rotation !
+        $score2 = Ja3AnomalyDetector::getJa3AnomalyScore($unknownJa3, null, $firefoxUA, 'HTTP/2', $cache);
+        $this->assertEquals(85, $score2);
+    }
+
+    /**
+     * Teste l'absence de valeurs GREASE pour un navigateur Chromium.
+     */
+    public function testMissingGreaseForChrome(): void
+    {
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        // JA3 brut valide mais sans AUCUNE valeur GREASE dans les extensions ou les ciphers
+        $ja3RawWithoutGrease = '771,4865-4866,0-23-10,29,0';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore(null, $ja3RawWithoutGrease, $chromeUA, 'HTTP/2');
+        $this->assertEquals(75, $score);
+    }
+
+    /**
+     * Teste le cas légitime d'un navigateur Chromium disposant de GREASE.
+     */
+    public function testLegitimateChromeWithGrease(): void
+    {
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        // 2570 est une valeur GREASE valide
+        $ja3RawWithGrease = '771,4865-2570,0-23-10,29,0';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore(null, $ja3RawWithGrease, $chromeUA, 'HTTP/2');
+        $this->assertLessThan(75, $score);
+    }
+
+    /**
+     * Teste la détection d'absence d'ALPN lors de connexions HTTP/2.
+     */
+    public function testHttp2WithoutAlpnExtension(): void
+    {
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        // Pas d'extension 16 (ALPN) dans les extensions
+        $ja3RawNoAlpn = '771,4865-2570,0-23-10,29,0';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore(null, $ja3RawNoAlpn, $chromeUA, 'HTTP/2');
+        $this->assertEquals(70, $score);
+    }
+
+    /**
+     * Teste la présence d'ALPN lors de connexions HTTP/2 (cas normal).
+     */
+    public function testHttp2WithAlpnExtension(): void
+    {
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        // L'extension 16 est présente
+        $ja3RawWithAlpn = '771,4865-2570,0-23-10-16,29,0';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore(null, $ja3RawWithAlpn, $chromeUA, 'HTTP/2');
+        $this->assertLessThan(70, $score);
+    }
+
+    /**
+     * Teste l'utilisation d'une version obsolète de TLS par un navigateur récent.
+     */
+    public function testObsoleteTlsVersionWithModernBrowser(): void
+    {
+        $chromeUA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+        // Version TLS 769 (TLS 1.0) initiée par un Chrome récent
+        $obsoleteTlsJa3 = '769,4865-2570,0-23-10-16,29,0';
+
+        $score = Ja3AnomalyDetector::getJa3AnomalyScore(null, $obsoleteTlsJa3, $chromeUA, 'HTTP/2');
+        $this->assertEquals(80, $score);
+    }
+}

package/src/php/Utils/BigInt.php

@@ -4,59 +4,88 @@ declare(strict_types=1);
 
 namespace Anonympins\Fingerprint\Utils;
 
-/**
- * Classe d'émulation pour les opérations sur de grands entiers (BigInt),
- * similaire au BigInt de JavaScript. Utilise l'extension GMP.
- * @internal
- */
 class BigInt
 {
-    /** @var \GMP */
-    private \GMP $gmp;
+    private static bool $useGmp;
+    /** @var \GMP|string */
+    private $value;
 
     /**
-     * @param \GMP|string|int $number
+     * @param \GMP|string|int $number Le nombre initial.
      */
     public function __construct($number)
     {
-        if ($number instanceof \GMP) {
-            $this->gmp = $number;
+        if (!isset(self::$useGmp)) {
+            self::$useGmp = extension_loaded('gmp');
+        }
+
+        if (self::$useGmp) {
+            if ($number instanceof \GMP) {
+                $this->value = $number;
+            } else {
+                $this->value = gmp_init($number);
+            }
         } else {
-            $this->gmp = gmp_init($number);
+            if ($number instanceof BigInt) {
+                $this->value = $number->value;
+            } else {
+                $this->value = (string)$number;
+            }
         }
     }
 
     /**
      * Crée une instance à partir d'une chaîne hexadécimale.
      */
-    public static function fromHex(string $hex): self
+    public static function fromHex(string $hex): BigInt
     {
-        return new self(gmp_init($hex, 16));
+        if (self::$useGmp) {
+            return new self(gmp_init($hex, 16));
+        } else {
+            $dec = '0';
+            $len = strlen($hex);
+            for ($i = 0; $i < $len; $i++) {
+                $dec = bcadd(bcmul($dec, '16'), (string)hexdec($hex[$i]));
+            }
+            return new self($dec);
+        }
     }
 
     /**
      * Compare cette instance avec une autre.
      * @return int < 0 si this < other, 0 si this == other, > 0 si this > other.
      */
-    public function compareTo(self $other): int
+    public function compareTo(BigInt $other): int
     {
-        return gmp_cmp($this->gmp, $other->gmp);
+        if (self::$useGmp) {
+            return gmp_cmp($this->value, $other->value);
+        } else {
+            return bccomp($this->value, $other->value);
+        }
     }
 
     /**
      * Effectue un décalage de bits vers la gauche (<<).
      */
-    public function shiftLeft(int $bits): self
+    public function shiftLeft(int $bits): BigInt
     {
-        return new self(gmp_mul($this->gmp, gmp_pow(2, $bits)));
+        if (self::$useGmp) {
+            return new self(gmp_mul($this->value, gmp_pow("2", $bits)));
+        } else {
+            return new self(bcmul($this->value, bcpow("2", (string)$bits)));
+        }
     }
 
     /**
      * Effectue un décalage de bits vers la droite (>>).
      */
-    public function shiftRight(int $bits): self
+    public function shiftRight(int $bits): BigInt
     {
-        return new self(gmp_div_q($this->gmp, gmp_pow(2, $bits)));
+        if (self::$useGmp) {
+            return new self(gmp_div_q($this->value, gmp_pow("2", $bits)));
+        } else {
+            return new self(bcdiv($this->value, bcpow("2", (string)$bits)));
+        }
     }
 
     /**
@@ -64,7 +93,11 @@ class BigInt
      */
     public function __toString(): string
     {
-        return gmp_strval($this->gmp);
+        if (self::$useGmp) {
+            return gmp_strval($this->value);
+        } else {
+            return $this->value;
+        }
     }
 
     /**
@@ -72,31 +105,41 @@ class BigInt
      */
     public function toHex(): string
     {
-        return gmp_strval($this->gmp, 16);
-    }
-
-    /**
-     * Retourne la valeur GMP sous-jacente.
-     * @return \GMP
-     */
-    public function getGmpValue(): \GMP
-    {
-        return $this->gmp;
+        if (self::$useGmp) {
+            return gmp_strval($this->value, 16);
+        } else {
+            $hex = '';
+            $dec = $this->value;
+            while (bccomp($dec, '0') > 0) {
+                $rem = bcmod($dec, '16');
+                $hex = dechex((int)$rem) . $hex;
+                $dec = bcdiv($dec, '16');
+            }
+            return $hex ?: '0';
+        }
     }
 
     /**
      * Crée une instance à partir d'une puissance de 2.
      */
-    public static function pow(int $base, int $exp): self
+    public static function pow(int $base, int $exp): BigInt
     {
-        return new self(gmp_pow($base, $exp));
+        if (self::$useGgmp) {
+            return new self(gmp_pow((string)$base, $exp));
+        } else {
+            return new self(bcpow((string)$base, (string)$exp));
+        }
     }
 
     /**
      * Soustrait un autre BigInt.
      */
-    public function sub(self $other): self
+    public function sub(BigInt $other): BigInt
     {
-        return new self(gmp_sub($this->gmp, $other->gmp));
+        if (self::$useGmp) {
+            return new self(gmp_sub($this->value, $other->value));
+        } else {
+            return new self(bcsub($this->value, $other->value));
+        }
     }
 }