@anonympins/fingerprint 0.4.4 → 0.4.5

package/src/js/tests/fingerprint.client.test.js

@@ -1,105 +1,129 @@
-/**
- * @vitest-environment jsdom
- */
-
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import ClientLibrary from '../fingerprint.client.js';
-
-describe('ClientLibrary WASM Integration', () => {
-    beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
-        ClientLibrary._resetCache();
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-        vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
-        delete window.createFingerprintModule;
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
-        const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
-        };
-
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        // On simule l'injection du script en appelant directement `onload`
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
-            script.onload();
-            return script;
-        });
-
-        // 3. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 4. Vérifier que le hasher a été remplacé
-        const wasmHash = ClientLibrary._hasher("test");
-        expect(wasmHash).toBe(99999);
-        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
-        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-    });
-
-    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onerror(new Error('Script loading failed'));
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        
-        expect(jsHash).toBe(originalJsHash);
-        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
-    });
-
-    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
-        const mockWasmModule = {};
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onload();
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier le fallback
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
-        expect(console.warn).toHaveBeenCalledWith(
-            expect.stringContaining('WASM module failed to load'), 
-            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
-        );
-    });
-
-    it('should use the default JS hasher if WASM is not configured', async () => {
-        // Ensure no WASM path is provided in the config
-        ClientLibrary.initializeClient({});
-
-        // Verify that the active hasher is the original JS implementation
-        const jsHash = ClientLibrary._hasher("another test string");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
-
-        expect(jsHash).toBe(originalJsHash);
-        // Ensure no WASM-related console logs or warnings were made
-        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
-    });
+/**
+ * @vitest-environment jsdom
+ */
+
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import ClientLibrary from '../fingerprint.client.js';
+
+describe('ClientLibrary WASM Integration', () => {
+    beforeEach(() => {
+        // Réinitialise le cache et les mocks avant chaque test
+        ClientLibrary._resetCache();
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        delete window.createFingerprintModule;
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should successfully load WASM module and switch hasher', async () => {
+        // 1. Simuler un module WASM fonctionnel
+        const mockWasmModule = {
+            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+        };
+
+        // 2. Simuler le chargement du script et l'initialisation du module
+        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        // On simule l'injection du script en appelant directement `onload`
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            // Simule le chargement réussi du script
+            script.onload();
+            return script;
+        });
+
+        // 3. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 4. Vérifier que le hasher a été remplacé
+        const wasmHash = ClientLibrary._hasher("test");
+        expect(wasmHash).toBe(99999);
+        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
+        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+    });
+
+    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
+        // 1. Simuler un échec de chargement du script
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onerror(new Error('Script loading failed'));
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        
+        expect(jsHash).toBe(originalJsHash);
+        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
+    });
+
+    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
+        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        const mockWasmModule = {};
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onload();
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier le fallback
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        expect(jsHash).toBe(originalJsHash); 
+        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        expect(console.warn).toHaveBeenCalledWith(
+            expect.stringContaining('WASM module failed to load'), 
+            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
+        );
+    });
+
+    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
+        const mockWasmInstance = {
+            exports: {
+                memory: { buffer: new ArrayBuffer(65536) },
+                hash: vi.fn().mockReturnValue(123456)
+            }
+        };
+        
+        global.WebAssembly = {
+            compile: vi.fn().mockResolvedValue({}),
+            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
+        };
+        
+        global.fetch = vi.fn().mockResolvedValue({
+            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
+        });
+
+        await ClientLibrary.initializeWasm('/fp.wasm');
+
+        const hash = ClientLibrary._hasher("test");
+        expect(hash).toBe(123456);
+        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
+    });
+
+    it('should use the default JS hasher if WASM is not configured', async () => {
+        // Ensure no WASM path is provided in the config
+        ClientLibrary.initializeClient({});
+
+        // Verify that the active hasher is the original JS implementation
+        const jsHash = ClientLibrary._hasher("another test string");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
+
+        expect(jsHash).toBe(originalJsHash);
+        // Ensure no WASM-related console logs or warnings were made
+        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -2069,7 +2069,7 @@ describe('getClientHintsInconsistencyScore', () => {
             }
         };
         const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(80);
+        expect(clientHintsInconsistencyScore).toBe(97);
     });
 
     it('should return 40 for a small version mismatch', () => {
@@ -2449,3 +2449,22 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
             }
         });
 });
+
+    test('Stateless Ticket Generation and Validation', async () => {
+        const payload = {
+            expiry: Date.now() + 3600000,
+            originalIp: '127.0.0.1',
+            deviceId: 'device-123',
+            deviceHash: 'hash-abc'
+        };
+        
+        const ticket = fingerprint.generateStatelessTicket(payload);
+        expect(ticket).toBeTruthy();
+        expect(ticket.split('.').length).toBe(3);
+        
+        const isValid = await fingerprint.isTicketValid('127.0.0.1', ticket, 'device-123', 'hash-abc');
+        expect(isValid).toBe(true);
+
+        const isDiffIpValid = await fingerprint.isTicketValid('192.168.1.1', ticket, 'device-123', 'hash-abc', false);
+        expect(isDiffIpValid).toBe(false);
+    });

package/src/js/tests/ip-reputation.test.js

@@ -1,132 +1,142 @@
-import {beforeEach, describe, expect, it} from 'vitest';
-import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
-
-describe('IP Reputation Local System (Node.js)', () => {
-    let mockStore;
-
-    beforeEach(() => {
-        mockStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-            async has(key) { return this._map.has(key); },
-            async delete(key) { this._map.delete(key); }
-        };
-        configureStore(mockStore);
-    });
-
-    it('should return a default score of 0 for unknown IPs', async () => {
-        const score = await __internal.getIpReputationScore('1.1.1.1');
-        expect(score).toBe(0);
-    });
-
-    it('should correctly increment and decrement score values', async () => {
-        const ip = '192.168.1.1';
-        await __internal.updateIpReputationScore(ip, 30);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(30);
-
-        await __internal.updateIpReputationScore(ip, -10);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(20);
-    });
-
-    it('should clamp the reputation score within bounds [0, 100]', async () => {
-        const ip = '10.0.0.1';
-        await __internal.updateIpReputationScore(ip, 150);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(100);
-
-        await __internal.updateIpReputationScore(ip, -200);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(0);
-    });
-
-    it('should apply passive decay of 2 points per hour of inactivity', async () => {
-        const ip = '172.16.0.1';
-        const now = Date.now();
-        
-        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
-        await mockStore.set(`ip-reputation:${ip}`, {
-            score: 50,
-            lastUpdate: now - (3 * 60 * 60 * 1000)
-        });
-
-        const score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(44);
-    });
-
-    it('should integrate ipReputationScore into the final score calculation', async () => {
-        const ip = '1.2.3.4';
-        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
-
-        const mockSecurityConfig = {
-            weights: {
-                ipReputationScore: 0.5, // Give it a weight
-                historyScore: 0.0, // Other weights to 0 for isolation
-                rotationScore: 0.0,
-                headerAnomalyScore: 0.0,
-                requestPatternScore: 0.0,
-                inconsistencyScore: 0.0,
-                honeypotScore: 0.0,
-                behaviorScore: 0.0,
-                botScore: 0.0,
-                crossLayerInconsistencyScore: 0.0,
-                tlsSpoofingScore: 0.0,
-                timeInconsistencyScore: 0.0,
-                clickVarianceScore: 0.0,
-                clientHintsInconsistencyScore: 0.0,
-                subnetScore: 0.0,
-            },
-            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
-        };
-
-        const ipRepScore = await __internal.getIpReputationScore(ip);
-        const suspicionVector = { ipReputationScore: ipRepScore };
-
-        const engine = new FingerprintEngine(mockSecurityConfig);
-        const finalScore = engine.calculateFinalScore(suspicionVector);
-
-        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
-        expect(finalScore).toBe(30.0);
-    });
-
-    it('should return correct subnet for IPv4 and IPv6', async () => {
-        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
-        expect(ipv4Subnet).toBe('192.168.1.0/24');
-
-        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
-        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
-    });
-
-    it('should calculate client hints inconsistency score correctly', async () => {
-        const mockContextMismatch = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Firefox/117.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
-        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
-
-        const mockContextVersionDrift = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Chrome/110.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
-        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
-    });
-
-    it('should integrate subnet history into subnet score', async () => {
-        const mockContext = { clientIp: '192.168.1.50' };
-        let score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBe(0);
-        for (let i = 1; i <= 12; i++) {
-            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
-        }
-        score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBeGreaterThan(0);
-    });
+import {beforeEach, describe, expect, it} from 'vitest';
+import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
+
+describe('IP Reputation Local System (Node.js)', () => {
+    let mockStore;
+
+    beforeEach(() => {
+        mockStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+            async has(key) { return this._map.has(key); },
+            async delete(key) { this._map.delete(key); }
+        };
+        configureStore(mockStore);
+    });
+
+    it('should return a default score of 0 for unknown IPs', async () => {
+        const score = await __internal.getIpReputationScore('1.1.1.1');
+        expect(score).toBe(0);
+    });
+
+    it('should correctly increment and decrement score values', async () => {
+        const ip = '192.168.1.1';
+        await __internal.updateIpReputationScore(ip, 30);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(30);
+
+        await __internal.updateIpReputationScore(ip, -10);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(20);
+    });
+
+    it('should clamp the reputation score within bounds [0, 100]', async () => {
+        const ip = '10.0.0.1';
+        await __internal.updateIpReputationScore(ip, 150);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(100);
+
+        await __internal.updateIpReputationScore(ip, -200);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(0);
+    });
+
+    it('should apply passive decay of 2 points per hour of inactivity', async () => {
+        const ip = '172.16.0.1';
+        const now = Date.now();
+        
+        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
+        await mockStore.set(`ip-reputation:${ip}`, {
+            score: 50,
+            lastUpdate: now - (3 * 60 * 60 * 1000)
+        });
+
+        const score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(44);
+    });
+
+    it('should integrate ipReputationScore into the final score calculation', async () => {
+        const ip = '1.2.3.4';
+        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
+
+        const mockSecurityConfig = {
+            weights: {
+                ipReputationScore: 0.5, // Give it a weight
+                historyScore: 0.0, // Other weights to 0 for isolation
+                rotationScore: 0.0,
+                headerAnomalyScore: 0.0,
+                requestPatternScore: 0.0,
+                inconsistencyScore: 0.0,
+                honeypotScore: 0.0,
+                behaviorScore: 0.0,
+                botScore: 0.0,
+                crossLayerInconsistencyScore: 0.0,
+                tlsSpoofingScore: 0.0,
+                timeInconsistencyScore: 0.0,
+                clickVarianceScore: 0.0,
+                clientHintsInconsistencyScore: 0.0,
+                subnetScore: 0.0,
+            },
+            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
+        };
+
+        const ipRepScore = await __internal.getIpReputationScore(ip);
+        const suspicionVector = { ipReputationScore: ipRepScore };
+
+        const engine = new FingerprintEngine(mockSecurityConfig);
+        const finalScore = engine.calculateFinalScore(suspicionVector);
+
+        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
+        expect(finalScore).toBe(30.0);
+    });
+
+    it('should return correct subnet for IPv4 and IPv6', async () => {
+        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
+        expect(ipv4Subnet).toBe('192.168.1.0/24');
+
+        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
+        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
+    });
+
+    it('should calculate client hints inconsistency score correctly', async () => {
+        const mockContextMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Firefox/117.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
+        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
+
+        const mockContextVersionDrift = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Chrome/110.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
+        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
+
+        const mockContextFullVersionMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1.2 Safari/537.36',
+                'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
+                'sec-ch-ua-full-version-list': '"Not_A Brand";v="8.0.0.0", "Chromium";v="120.0.1.3", "Google Chrome";v="120.0.1.3"'
+            }
+        };
+        const scoreFullVersionMismatch = __internal.getClientHintsInconsistencyScore(mockContextFullVersionMismatch);
+        expect(scoreFullVersionMismatch.clientHintsInconsistencyScore).toBe(85);
+    });
+
+    it('should integrate subnet history into subnet score', async () => {
+        const mockContext = { clientIp: '192.168.1.50' };
+        let score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBe(0);
+        for (let i = 1; i <= 12; i++) {
+            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
+        }
+        score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBeGreaterThan(0);
+    });
 });

package/src/js/tests/tcpFingerprint.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import { __internal } from '../fingerprint.js';
+
+const { parseTcpSyn, classifyTcpOs, getTcpAnomalyScore } = __internal;
+
+describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
+    
+    // Mock d'un paquet IP + TCP SYN d'un système Linux (TTL=64, WS=7)
+    const mockLinuxSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x40, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x40 (64)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x72, 0x10, // Window=0x7210 (29200), TCP header len = 40 (0xa0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x07        // Option WS: 7
+    ]);
+
+    // Mock d'un paquet IP + TCP SYN d'un système Windows (TTL=128, WS=8)
+    const mockWindowsSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x80, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x80 (128)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfa, 0xf0, // Window=64240 (0xfaf0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x08        // Option WS: 8
+    ]);
+
+    it('should correctly parse raw TCP SYN binary packets', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(linuxFp).not.toBeNull();
+        expect(linuxFp.ttl).toBe(64);
+        expect(linuxFp.windowSize).toBe(29200);
+        expect(linuxFp.mss).toBe(1460);
+        expect(linuxFp.ws).toBe(7);
+        expect(linuxFp.sack).toBe(true);
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(windowsFp.ttl).toBe(128);
+        expect(windowsFp.windowSize).toBe(64240);
+        expect(windowsFp.ws).toBe(8);
+    });
+
+    it('should classify OS correctly based on parsed parameters', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(classifyTcpOs(linuxFp)).toBe('Linux');
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(classifyTcpOs(windowsFp)).toBe('Windows');
+    });
+
+    it('should calculate correct TCP/IP anomaly scores', () => {
+        // Cas 1 : Le User-Agent prétend être Windows, mais la pile TCP/IP est Linux
+        const contextAnomaly = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockLinuxSynPacket
+        };
+        expect(getTcpAnomalyScore(contextAnomaly).tcpAnomalyScore).toBe(80.1);
+
+        // Cas 2 : Cohérence complète (UA Windows et pile TCP/IP Windows)
+        const contextCoherent = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockWindowsSynPacket
+        };
+        expect(getTcpAnomalyScore(contextCoherent).tcpAnomalyScore).toBe(0);
+    });
+});