@anonympins/fingerprint 0.3.8 → 0.4.0

package/src/php/Tests/RequestUtilsTest.php

@@ -1,146 +1,254 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Utils\RequestUtils;
-use PHPUnit\Framework\TestCase;
-
-class RequestUtilsTest extends TestCase
-{
-    private function createRequestContext(array $overrides = []): RequestContext
-    {
-        $defaults = [
-            'clientIp' => '127.0.0.1',
-            'path' => '/',
-            'headers' => ['user-agent' => 'Test UA'],
-            'query' => [],
-            'body' => null,
-            'cookies' => [],
-            'httpVersion' => '1.1',
-        ];
-        $params = array_merge($defaults, $overrides);
-        return new RequestContext(
-            $params['clientIp'], $params['path'], $params['headers'],
-            $params['query'], $params['body'], $params['cookies'], $params['httpVersion']
-        );
-    }
-
-    public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
-    {
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode([])]
-        ]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsZeroForInsufficientClicks(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 10, 'y' => 10, 'targetId' => 'hash1'],
-                ['x' => 11, 'y' => 11, 'targetId' => 'hash1'],
-                ['x' => 100, 'y' => 100, 'targetId' => 'hash2']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsHighScoreForLowVariance(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 100, 'y' => 100, 'targetId' => 'hash1'],
-                ['x' => 100.1, 'y' => 100.2, 'targetId' => 'hash1'],
-                ['x' => 99.9, 'y' => 99.8, 'targetId' => 'hash1']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertGreaterThan(90, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsLowScoreForHighVariance(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 105, 'y' => 110, 'targetId' => 'hash1'],
-                ['x' => 98, 'y' => 102, 'targetId' => 'hash1'],
-                ['x' => 112, 'y' => 95, 'targetId' => 'hash1']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testSanitizeTrafficDataFiltersSybilAttacks(): void
-    {
-        $trafficData = [];
-        // Ajout de 100 logs provenant d'un attaquant (Sybil)
-        for ($i = 0; $i < 100; $i++) {
-            $trafficData[] = ['deviceId' => 'attacker_device', 'type' => 'trap_triggered'];
-        }
-        // Ajout de 10 logs d'utilisateurs légitimes distincts
-        for ($i = 0; $i < 10; $i++) {
-            $trafficData[] = ['deviceId' => "legit_device_{$i}", 'type' => 'challenge_solved'];
-        }
-
-        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
-
-        $attackerLogs = array_filter($sanitized, fn($log) => $log['deviceId'] === 'attacker_device');
-
-        // Total de 110 logs. 2% de 110 est 2.2 -> max(3, 2) = 3 logs maximum autorisés pour l'attaquant.
-        $this->assertLessThanOrEqual(3, count($attackerLogs));
-    }
-
-    public function testChallengePayloadSigningAndVerification(): void
-    {
-        $secret = 'test-fallback-dev-secret-32-chars-minimum';
-        $clientIp = '203.0.113.42';
-        $payload = [
-            'clientSecret' => 'some_client_secret',
-            'cpuTarget' => '00000000ffffffff',
-            'fingerprint' => 'os:hash|gpu:hash2',
-            'memDifficulty' => '16',
-            'originalPath' => '/submit',
-        ];
-
-        // 1. Cas nominal : Signature et vérification réussies
-        $signature = RequestUtils::signChallengePayload($secret, $payload, $clientIp);
-        $this->assertNotEmpty($signature);
-
-        $payloadWithSig = $payload;
-        $payloadWithSig['signature'] = $signature;
-
-        $isValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, $clientIp);
-        $this->assertTrue($isValid, "La signature valide doit être acceptée.");
-
-        // 2. Détection de modification (tampering) sur cpuTarget
-        $tamperedPayload = $payloadWithSig;
-        $tamperedPayload['cpuTarget'] = 'ffffffffffffffff'; // Tentative de baisse de la difficulté
-        
-        $isTamperedValid = RequestUtils::verifyChallengePayload($secret, $tamperedPayload, $clientIp);
-        $this->assertFalse($isTamperedValid, "Un payload modifié doit être rejeté.");
-
-        // 3. Détection de modification sur le fingerprint
-        $tamperedFpPayload = $payloadWithSig;
-        $tamperedFpPayload['fingerprint'] = 'os:another_hash|gpu:hash2';
-        
-        $isTamperedFpValid = RequestUtils::verifyChallengePayload($secret, $tamperedFpPayload, $clientIp);
-        $this->assertFalse($isTamperedFpValid, "Un fingerprint modifié doit être rejeté.");
-
-        // 4. Détection d'usurpation d'adresse IP (IP mismatch)
-        $isIpMismatchValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, '198.51.100.1');
-        $this->assertFalse($isIpMismatchValid, "Le payload ne doit pas être valide pour une autre adresse IP.");
-
-        // 5. Absence de signature
-        $isMissingSigValid = RequestUtils::verifyChallengePayload($secret, $payload, $clientIp);
-        $this->assertFalse($isMissingSigValid, "Un payload sans signature doit être rejeté.");
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintBuilder;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class RequestUtilsTest extends TestCase
+{
+    private function createRequestContext(array $overrides = []): RequestContext
+    {
+        $defaults = [
+            'clientIp' => '127.0.0.1',
+            'path' => '/',
+            'headers' => ['user-agent' => 'Test UA'],
+            'query' => [],
+            'body' => null,
+            'cookies' => [],
+            'httpVersion' => '1.1',
+        ];
+        $params = array_merge($defaults, $overrides);
+        return new RequestContext(
+            $params['clientIp'], $params['path'], $params['headers'],
+            $params['query'], $params['body'], $params['cookies'], $params['httpVersion']
+        );
+    }
+
+    public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
+    {
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode([])]
+        ]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsZeroForInsufficientClicks(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 10, 'y' => 10, 'targetId' => 'hash1'],
+                ['x' => 11, 'y' => 11, 'targetId' => 'hash1'],
+                ['x' => 100, 'y' => 100, 'targetId' => 'hash2']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsHighScoreForLowVariance(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 100, 'y' => 100, 'targetId' => 'hash1'],
+                ['x' => 100.1, 'y' => 100.2, 'targetId' => 'hash1'],
+                ['x' => 99.9, 'y' => 99.8, 'targetId' => 'hash1']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertGreaterThan(90, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsLowScoreForHighVariance(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 105, 'y' => 110, 'targetId' => 'hash1'],
+                ['x' => 98, 'y' => 102, 'targetId' => 'hash1'],
+                ['x' => 112, 'y' => 95, 'targetId' => 'hash1']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testSanitizeTrafficDataFiltersSybilAttacks(): void
+    {
+        $trafficData = [];
+        // Ajout de 100 logs provenant d'un attaquant (Sybil)
+        for ($i = 0; $i < 100; $i++) {
+            $trafficData[] = ['deviceId' => 'attacker_device', 'type' => 'trap_triggered'];
+        }
+        // Ajout de 10 logs d'utilisateurs légitimes distincts
+        for ($i = 0; $i < 10; $i++) {
+            $trafficData[] = ['deviceId' => "legit_device_{$i}", 'type' => 'challenge_solved'];
+        }
+
+        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
+
+        $attackerLogs = array_filter($sanitized, fn($log) => $log['deviceId'] === 'attacker_device');
+
+        // Total de 110 logs. 2% de 110 est 2.2 -> max(3, 2) = 3 logs maximum autorisés pour l'attaquant.
+        $this->assertLessThanOrEqual(3, count($attackerLogs));
+    }
+
+    public function testChallengePayloadSigningAndVerification(): void
+    {
+        $secret = 'test-fallback-dev-secret-32-chars-minimum';
+        $clientIp = '203.0.113.42';
+        $payload = [
+            'clientSecret' => 'some_client_secret',
+            'cpuTarget' => '00000000ffffffff',
+            'fingerprint' => 'os:hash|gpu:hash2',
+            'memDifficulty' => '16',
+            'originalPath' => '/submit',
+        ];
+
+        // 1. Cas nominal : Signature et vérification réussies
+        $signature = RequestUtils::signChallengePayload($secret, $payload, $clientIp);
+        $this->assertNotEmpty($signature);
+
+        $payloadWithSig = $payload;
+        $payloadWithSig['signature'] = $signature;
+
+        $isValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, $clientIp);
+        $this->assertTrue($isValid, "La signature valide doit être acceptée.");
+
+        // 2. Détection de modification (tampering) sur cpuTarget
+        $tamperedPayload = $payloadWithSig;
+        $tamperedPayload['cpuTarget'] = 'ffffffffffffffff'; // Tentative de baisse de la difficulté
+        
+        $isTamperedValid = RequestUtils::verifyChallengePayload($secret, $tamperedPayload, $clientIp);
+        $this->assertFalse($isTamperedValid, "Un payload modifié doit être rejeté.");
+
+        // 3. Détection de modification sur le fingerprint
+        $tamperedFpPayload = $payloadWithSig;
+        $tamperedFpPayload['fingerprint'] = 'os:another_hash|gpu:hash2';
+        
+        $isTamperedFpValid = RequestUtils::verifyChallengePayload($secret, $tamperedFpPayload, $clientIp);
+        $this->assertFalse($isTamperedFpValid, "Un fingerprint modifié doit être rejeté.");
+
+        // 4. Détection d'usurpation d'adresse IP (IP mismatch)
+        $isIpMismatchValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, '198.51.100.1');
+        $this->assertFalse($isIpMismatchValid, "Le payload ne doit pas être valide pour une autre adresse IP.");
+
+        // 5. Absence de signature
+        $isMissingSigValid = RequestUtils::verifyChallengePayload($secret, $payload, $clientIp);
+        $this->assertFalse($isMissingSigValid, "Un payload sans signature doit être rejeté.");
+    }
+
+    public function testGetBehaviorScoreReturnsProperScores(): void
+    {
+        $contextEmpty = $this->createRequestContext();
+        $scoreEmpty = RequestUtils::getBehaviorScore($contextEmpty);
+        $this->assertEquals(0.0, $scoreEmpty['behaviorScore']);
+
+        $metricsHoneypot = ['honeypotInteraction' => true];
+        $contextHoneypot = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsHoneypot)]
+        ]);
+        $scoreHoneypot = RequestUtils::getBehaviorScore($contextHoneypot);
+        $this->assertEquals(100.0, $scoreHoneypot['behaviorScore']);
+
+        $metricsNoActivity = ['honeypotInteraction' => false, 'mouseMovementsHistory' => [], 'keystrokeLatency' => 0];
+        $contextNoActivity = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsNoActivity)]
+        ]);
+        $scoreNoActivity = RequestUtils::getBehaviorScore($contextNoActivity);
+        $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
+    }
+
+    public function testGetTimeInconsistencyScore(): void
+    {
+        $requestTimestamp = time() * 1000;
+
+        $metricsNormal = ['clientTimestamp' => $requestTimestamp - 100];
+        $contextNormal = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsNormal)]
+        ]);
+        $contextNormal->requestTimestamp = $requestTimestamp;
+        $scoreNormal = RequestUtils::getTimeInconsistencyScore($contextNormal);
+        $this->assertEquals(0.0, $scoreNormal['timeInconsistencyScore']);
+
+        $metricsReplay = ['clientTimestamp' => $requestTimestamp - 10000];
+        $contextReplay = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsReplay)]
+        ]);
+        $contextReplay->requestTimestamp = $requestTimestamp;
+        $scoreReplay = RequestUtils::getTimeInconsistencyScore($contextReplay);
+        $this->assertGreaterThan(0.0, $scoreReplay['timeInconsistencyScore']);
+    }
+
+    public function testGetCrossLayerInconsistencyOSMismatch(): void
+    {
+        $windowsHash = FingerprintBuilder::cyrb53("Windows");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "os:{$windowsHash}",
+                'user-agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(50.0, $score['crossLayerInconsistencyScore']);
+    }
+
+    public function testGetBotScoreDetections(): void
+    {
+        $contextBot = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|bot:true']
+        ]);
+        $scoreBot = RequestUtils::getBotScore($contextBot);
+        $this->assertEquals(100.0, $scoreBot['botScore']);
+
+        $contextCdp = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|cdp:true']
+        ]);
+        $scoreCdp = RequestUtils::getBotScore($contextCdp);
+        $this->assertEquals(100.0, $scoreCdp['botScore']);
+
+        $contextClean = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|os:456']
+        ]);
+        $scoreClean = RequestUtils::getBotScore($contextClean);
+        $this->assertEquals(0.0, $scoreClean['botScore']);
+    }
+
+    public function testGetHeaderAnomaliesFirefoxTE(): void
+    {
+        $contextFirefoxNoTe = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                'accept-language' => 'en-US,en;q=0.9',
+            ]
+        ]);
+        $scoreFirefoxNoTe = RequestUtils::getHeaderAnomalies($contextFirefoxNoTe);
+        $this->assertEquals(30.0, $scoreFirefoxNoTe['headerAnomalyScore']);
+    }
+
+    public function testGetBehavioralIndicatorsRotationAndHistory(): void
+    {
+        $deviceData = [
+            'ips' => ['127.0.0.1'],
+            'lastFpHash' => 'cvs:original-canvas|gpu:original-gpu',
+            'lastChangeTimestamp' => (time() * 1000) - 500,
+            'rapidChangeCount' => 1
+        ];
+
+        $context = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'cvs:new-canvas|gpu:new-gpu']
+        ]);
+
+        $indicators = RequestUtils::getBehavioralIndicators($context, $deviceData);
+        $this->assertEquals(2, $deviceData['rapidChangeCount']);
+        $this->assertGreaterThan(0, $indicators['rotationScore']);
+    }
 }

package/src/php/Tests/TLSClientHelloParserTest.php

@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Utils\TLSClientHelloParser;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests unitaires pour le décodeur binaire TLS Client Hello.
+ */
+class TLSClientHelloParserTest extends TestCase
+{
+    /**
+     * Helper pour construire un paquet TLS Client Hello binaire valide et réaliste.
+     *
+     * @param int $sslVersion Version TLS (ex: 0x0303 pour TLS 1.2)
+     * @param array<int> $ciphers Liste des Cipher Suites
+     * @param array<array{type: int, data: string}> $extensions Liste des extensions
+     * @return string Paquet binaire brut
+     */
+    private function buildMockClientHello(int $sslVersion = 0x0303, array $ciphers = [4865, 2570], array $extensions = []): string
+    {
+        $recordType = pack('C', 0x16); // Handshake Record (22)
+        $recordVersion = pack('n', 0x0301); // TLS 1.0 record layer version
+        $recordLength = pack('n', 120); // Dummy length
+
+        $handshakeType = pack('C', 0x01); // Client Hello (1)
+        $handshakeLength = pack('C3', 0, 0, 110); // Dummy length
+
+        $clientVersion = pack('n', $sslVersion);
+        $random = str_repeat("\x00", 32); // Random de 32 octets
+        $sessionId = pack('C', 0x00); // Session ID vide (longueur 0)
+
+        // Construction des Cipher Suites
+        $ciphersBinary = '';
+        foreach ($ciphers as $cipher) {
+            $ciphersBinary .= pack('n', $cipher);
+        }
+        $ciphersPayload = pack('n', strlen($ciphersBinary)) . $ciphersBinary;
+
+        // Compression Methods (Standard: 1 méthode, valeur 0x00 = null)
+        $compression = pack('C2', 1, 0);
+
+        // Construction des Extensions
+        $extensionsBinary = '';
+        foreach ($extensions as $ext) {
+            $extensionsBinary .= pack('n', $ext['type']) . pack('n', strlen($ext['data'])) . $ext['data'];
+        }
+        $extensionsPayload = pack('n', strlen($extensionsBinary)) . $extensionsBinary;
+
+        return $recordType . $recordVersion . $recordLength . $handshakeType . $handshakeLength . $clientVersion . $random . $sessionId . $ciphersPayload . $compression . $extensionsPayload;
+    }
+
+    public function testParseValidClientHelloWithGreaseAndExtensions(): void
+    {
+        // On injecte l'extension 10 (Supported Groups / Curves)
+        // Data: 4 octets de longueur de liste + 29 (X25519) + 2570 (GREASE)
+        $extCurves = [
+            'type' => 10,
+            'data' => pack('n', 4) . pack('n2', 29, 2570)
+        ];
+
+        // On injecte l'extension 11 (EC Point Formats)
+        // Data: 1 octet de longueur de liste + 0 (uncompressed)
+        $extPoints = [
+            'type' => 11,
+            'data' => pack('C2', 1, 0)
+        ];
+
+        // On build le paquet binaire de test
+        $binary = $this->buildMockClientHello(
+            0x0303, // SSL Version: 771 (TLS 1.2)
+            [4865, 2570], // Ciphers (2570 est une valeur GREASE)
+            [$extCurves, $extPoints]
+        );
+
+        $result = TLSClientHelloParser::parse($binary);
+
+        $this->assertNotNull($result);
+        
+        // Vérifications des filtrages GREASE et de la construction de la chaîne JA3
+        // Chaîne JA3 attendue: "Version,Ciphers,Extensions,Curves,Points"
+        // - Version: 771
+        // - Ciphers: 4865 (2570 a été nettoyé car GREASE)
+        // - Extensions: 10-11
+        // - Curves: 29 (2570 a été nettoyé car GREASE)
+        // - Points: 0
+        $expectedJa3String = '771,4865,10-11,29,0';
+        $this->assertSame($expectedJa3String, $result['ja3_string']);
+        $this->assertSame(md5($expectedJa3String), $result['ja3_hash']);
+    }
+
+    public function testParseReturnsNullWhenPacketTooShort(): void
+    {
+        $shortBinary = str_repeat("\x16", 40);
+        $this->assertNull(TLSClientHelloParser::parse($shortBinary));
+    }
+
+    public function testParseReturnsNullOnInvalidRecordType(): void
+    {
+        // 0x17 au lieu de 0x16 (Application data au lieu de Handshake)
+        $invalidRecord = $this->buildMockClientHello();
+        $invalidRecord[0] = chr(0x17);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidRecord));
+    }
+
+    public function testParseReturnsNullOnInvalidHandshakeType(): void
+    {
+        // 0x02 au lieu de 0x01 (Server Hello au lieu de Client Hello)
+        $invalidHandshake = $this->buildMockClientHello();
+        $invalidHandshake[5] = chr(0x02);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidHandshake));
+    }
+}

package/src/php/Tests/problems.config.json

@@ -1,9 +1,9 @@
-[
-    {
-        "id": "problem-1",
-        "workUnit": {
-            "type": "simulated_annealing_iterations",
-            "baseIterations": 10000
-        }
-    }
+[
+    {
+        "id": "problem-1",
+        "workUnit": {
+            "type": "simulated_annealing_iterations",
+            "baseIterations": 10000
+        }
+    }
 ]