@anonympins/fingerprint 0.4.4 → 0.4.5

package/src/php/Challenge/ChallengeUtils.php

@@ -35,6 +35,52 @@ class ChallengeUtils
         return $secret ?: "fallback-dev-secret-32-chars-minimum";
     }
 
+    /**
+     * Génère un ticket stateless chiffré et signé contenant le contexte d'autorisation.
+     * @param array $payload
+     * @return string
+     */
+    public static function generateStatelessTicket(array $payload): string
+    {
+        $key = hash('sha256', self::getPowSecret(), true);
+        $iv = random_bytes(16);
+        $encrypted = openssl_encrypt(json_encode($payload), 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        $signature = hash_hmac('sha256', $iv . $encrypted, $key, true);
+        
+        return rtrim(strtr(base64_encode($iv), '+/', '-_'), '=') . '.' .
+               rtrim(strtr(base64_encode($encrypted), '+/', '-_'), '=') . '.' .
+               rtrim(strtr(base64_encode($signature), '+/', '-_'), '=');
+    }
+
+    /**
+     * Décode et valide un ticket stateless chiffré et signé.
+     * @param string $ticket
+     * @return array|null
+     */
+    public static function parseStatelessTicket(string $ticket): ?array
+    {
+        $parts = explode('.', $ticket);
+        if (count($parts) !== 3) {
+            return null;
+        }
+        $base64UrlDecode = function ($input) {
+            return base64_decode(strtr($input, '-_', '+/'));
+        };
+        $iv = $base64UrlDecode($parts[0]);
+        $encrypted = $base64UrlDecode($parts[1]);
+        $signature = $base64UrlDecode($parts[2]);
+        if (!$iv || !$encrypted || !$signature || strlen($iv) !== 16) {
+            return null;
+        }
+        $key = hash('sha256', self::getPowSecret(), true);
+        $expectedSignature = hash_hmac('sha256', $iv . $encrypted, $key, true);
+        if (!hash_equals($expectedSignature, $signature)) {
+            return null;
+        }
+        $decrypted = openssl_decrypt($encrypted, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        return $decrypted !== false ? json_decode($decrypted, true) : null;
+    }
+
     /**
      * Vérifie si un ticket de passage est valide (supporte les tickets opaques via store et le fallback legacy).
      */
@@ -49,6 +95,31 @@ class ChallengeUtils
             return false;
         }
 
+        // Tentative de validation stateless d'abord
+        $ticketData = self::parseStatelessTicket($ticket);
+        if ($ticketData !== null) {
+            $expiry = $ticketData['expiry'] ?? null;
+            $originalIp = $ticketData['originalIp'] ?? null;
+            $storedDeviceId = $ticketData['deviceId'] ?? '';
+            $storedDeviceHash = $ticketData['deviceHash'] ?? '';
+
+            if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
+                return false;
+            }
+            if ($ip === $originalIp) {
+                return true;
+            }
+            $currentSubnet = RequestUtils::getIpSubnet($ip);
+            $originalSubnet = RequestUtils::getIpSubnet($originalIp);
+            if ($currentSubnet !== null && $originalSubnet !== null && $currentSubnet === $originalSubnet) {
+                return true;
+            }
+            if (!$allowCrossNetworkRoaming) {
+                return false;
+            }
+            return !empty($deviceId) && $deviceId === $storedDeviceId && !empty($deviceHash) && $deviceHash === $storedDeviceHash;
+        }
+
         $store = StoreManager::getStore();
         $ticketData = $store->get("ticket:{$ticket}");
 
@@ -152,27 +223,21 @@ class ChallengeUtils
         $finalBlock = $baseBlock . $solution;
         $hash = hash('sha256', $finalBlock);
 
-        $hashAsInt = BigInt::fromHex($hash);
-        $targetAsInt = BigInt::fromHex($cpuTargetHex);
-
-        $isValid = $hashAsInt->compareTo($targetAsInt) < 0;
+        // Pad target to 64 hex characters to allow direct O(1) lexicographical comparison
+        $paddedTarget = str_pad($cpuTargetHex, 64, '0', STR_PAD_LEFT);
+        $isValid = strcmp($hash, $paddedTarget) < 0;
 
         if ($isValid) {
             error_log('[FP Server Verify] CPU PoW verification PASSED.');
             
-            // Génération d'un jeton opaque et unique
-            $ticketId = bin2hex(random_bytes(16));
             $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
-            
-            $store = StoreManager::getStore();
-            $store->set("ticket:{$ticketId}", [
+            $payload = [
                 'expiry' => $expiry,
                 'originalIp' => $clientIp,
                 'deviceId' => $deviceId,
                 'deviceHash' => $deviceHash
-            ], (int)ceil($ticketTtl / 1000));
-            
-            return $ticketId;
+            ];
+            return self::generateStatelessTicket($payload);
         }
 
         // Log details on failure

package/src/php/Config/SecurityProfiles.php

@@ -40,6 +40,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.6, // Poids pour la variance des clics
                 'subnetScore' => 0.5, // Pénalise les sous-réseaux IP avec une activité suspecte agrégée
                 'botnetClusterScore' => 0.6, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
             'patterns' => [
@@ -84,6 +86,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.7, // High weight for click variance
                 'subnetScore' => 0.7, // Poids plus élevé en mode strict
                 'botnetClusterScore' => 0.8, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
             'patterns' => [
@@ -128,6 +132,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.3, // Low weight as not applicable to APIs
                 'subnetScore' => 0.8, // Très important pour les API pour détecter les botnets
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
             'patterns' => [
@@ -174,6 +180,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.5, // Moderate weight for click variance
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
             'patterns' => [
@@ -219,6 +227,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.8, // Very high weight for click variance
                 'subnetScore' => 0.9, // Crucial contre les attaques de scalping distribuées
                 'botnetClusterScore' => 0.9, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],
             'patterns' => [

package/src/php/FingerprintEngine.php

@@ -425,6 +425,9 @@
          // NOUVEAU: Score de réputation du sous-réseau IP
          $subnetScore = RequestUtils::getSubnetScore($context, $deviceId);
 
+         // Score d'anomalie de pile TCP/IP
+         $tcpAnomaly = RequestUtils::getTcpAnomalyScore($context);
+
          // Assemblage du vecteur de suspicion final
          $suspicionVector = array_merge($suspicionVector, [
              'inconsistencyScore' => $inconsistencyScore,
@@ -443,6 +446,7 @@
              'clientHintsInconsistencyScore' => $clientHintsInconsistency['clientHintsInconsistencyScore'],
              'subnetScore' => $subnetScore['subnetScore'],
              'botnetClusterScore' => $botnetCluster['botnetClusterScore'],
+             'tcpAnomalyScore' => $tcpAnomaly['tcpAnomalyScore'],
          ]);
  
          // Sauvegarder l'état mis à jour de l'appareil dans le store

package/src/php/Tests/FingerprintEngineTest.php

@@ -294,7 +294,7 @@ class FingerprintEngineTest extends TestCase
                     'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
                     'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
                 ]),
-                80.0,
+                96.7,
                 'Should return 80 for a large version mismatch (>5).'
             ],
             'small version mismatch' => [
@@ -328,4 +328,30 @@ class FingerprintEngineTest extends TestCase
             ],
         ];
     }
+
+    public function testDetectsTcpAnomalyScore(): void
+    {
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Trame binaire TCP SYN Linux simulée (TTL=64, WS=7)
+        $linuxSynHex = '4500003c1a2b400040063c1a7f0000017f0000011f9000500000000100000000a00272103c1a0000020405b4040201030307';
+        
+        $context = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+                'x-raw-tcp-binary' => $linuxSynHex
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($context);
+
+        $this->assertEquals(80.1, $decision['vector']['tcpAnomalyScore']);
+        // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
+        $this->assertGreaterThanOrEqual(64.0, $decision['score']);
+    }
 }

package/src/php/Tests/IpReputationTest.php

@@ -1,157 +1,176 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Store\IStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use Anonympins\Fingerprint\Utils\RequestUtils;
-use PHPUnit\Framework\TestCase;
-
-class IpReputationTest extends TestCase
-{
-    private $store;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
-        $this->store = new class implements IStore {
-            private array $data = [];
-            public function get(string $key) { return $this->data[$key] ?? null; }
-            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
-            public function has(string $key): bool { return isset($this->data[$key]); }
-            public function delete(string $key): void { unset($this->data[$key]); }
-        };
-
-        StoreManager::setStore($this->store);
-    }
-
-    public function testGetScoreReturnsZeroForUnknownIp(): void
-    {
-        $score = RequestUtils::getIpReputationScore('8.8.8.8');
-        $this->assertEquals(0.0, $score);
-    }
-
-    public function testUpdateScoreChangesValueCorrectly(): void
-    {
-        $ip = '8.8.4.4';
-        RequestUtils::updateIpReputationScore($ip, 45.0);
-        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
-
-        RequestUtils::updateIpReputationScore($ip, -15.0);
-        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
-    }
-
-    public function testBoundsAreClampedBetween0And100(): void
-    {
-        $ip = '1.1.1.1';
-        RequestUtils::updateIpReputationScore($ip, 120.0);
-        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
-
-        RequestUtils::updateIpReputationScore($ip, -150.0);
-        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
-    }
-
-    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
-    {
-        $ip = '2.2.2.2';
-        $now = time();
-
-        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
-        $this->store->set("ip-reputation:{$ip}", [
-            'score' => 80.0,
-            'lastUpdate' => $now - 14400
-        ]);
-
-        $score = RequestUtils::getIpReputationScore($ip);
-        $this->assertEquals(72.0, $score);
-    }
-
-    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
-    {
-        $ip = '1.2.3.4';
-        RequestUtils::updateIpReputationScore($ip, 60.0);
-
-        $weights = [
-            'ipReputationScore' => 0.5,
-            'historyScore' => 0.0,
-            'rotationScore' => 0.0,
-            'headerAnomalyScore' => 0.0,
-            'requestPatternScore' => 0.0,
-            'inconsistencyScore' => 0.0,
-            'honeypotScore' => 0.0,
-            'behaviorScore' => 0.0,
-            'botScore' => 0.0,
-            'crossLayerInconsistencyScore' => 0.0,
-            'tlsSpoofingScore' => 0.0,
-            'timeInconsistencyScore' => 0.0,
-            'clickVarianceScore' => 0.0,
-            'clientHintsInconsistencyScore' => 0.0,
-            'subnetScore' => 0.0,
-        ];
-
-        $ipRepScore = RequestUtils::getIpReputationScore($ip);
-        $this->assertEquals(60.0, $ipRepScore);
-        $score = $ipRepScore * $weights['ipReputationScore'];
-        $this->assertEquals(30.0, $score);
-    }
-
-    public function testGetIpSubnetIpv4AndIpv6(): void
-    {
-        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
-        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
-
-        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
-        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
-    }
-
-    public function testGetClientHintsInconsistencyScoreMismatch(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            if ($name === 'user-agent') {
-                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
-            }
-            if ($name === 'sec-ch-ua') {
-                return '"Google Chrome";v="117"';
-            }
-            return null;
-        });
-
-        $score = RequestUtils::getClientHintsInconsistencyScore($context);
-        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
-    }
-
-    public function testGetSubnetScoreCalculations(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->clientIp = '192.168.1.50';
-
-        $score = RequestUtils::getSubnetScore($context, 'device-1');
-        $this->assertEquals(0.0, $score['subnetScore']);
-
-        for ($i = 1; $i <= 12; $i++) {
-            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
-        }
-
-        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
-        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
-    }
-
-    public function testTlsSpoofingScoreWithJa4(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->ja4 = 't13d1517h2_8daaf61527d5';
-        $context->ja3 = null;
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
-        });
-
-        $score = RequestUtils::getTlsSpoofingScore($context);
-        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\IStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class IpReputationTest extends TestCase
+{
+    private $store;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
+        $this->store = new class implements IStore {
+            private array $data = [];
+            public function get(string $key) { return $this->data[$key] ?? null; }
+            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
+            public function has(string $key): bool { return isset($this->data[$key]); }
+            public function delete(string $key): void { unset($this->data[$key]); }
+        };
+
+        StoreManager::setStore($this->store);
+    }
+
+    public function testGetScoreReturnsZeroForUnknownIp(): void
+    {
+        $score = RequestUtils::getIpReputationScore('8.8.8.8');
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testUpdateScoreChangesValueCorrectly(): void
+    {
+        $ip = '8.8.4.4';
+        RequestUtils::updateIpReputationScore($ip, 45.0);
+        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -15.0);
+        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testBoundsAreClampedBetween0And100(): void
+    {
+        $ip = '1.1.1.1';
+        RequestUtils::updateIpReputationScore($ip, 120.0);
+        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -150.0);
+        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
+    {
+        $ip = '2.2.2.2';
+        $now = time();
+
+        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
+        $this->store->set("ip-reputation:{$ip}", [
+            'score' => 80.0,
+            'lastUpdate' => $now - 14400
+        ]);
+
+        $score = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(72.0, $score);
+    }
+
+    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
+    {
+        $ip = '1.2.3.4';
+        RequestUtils::updateIpReputationScore($ip, 60.0);
+
+        $weights = [
+            'ipReputationScore' => 0.5,
+            'historyScore' => 0.0,
+            'rotationScore' => 0.0,
+            'headerAnomalyScore' => 0.0,
+            'requestPatternScore' => 0.0,
+            'inconsistencyScore' => 0.0,
+            'honeypotScore' => 0.0,
+            'behaviorScore' => 0.0,
+            'botScore' => 0.0,
+            'crossLayerInconsistencyScore' => 0.0,
+            'tlsSpoofingScore' => 0.0,
+            'timeInconsistencyScore' => 0.0,
+            'clickVarianceScore' => 0.0,
+            'clientHintsInconsistencyScore' => 0.0,
+            'subnetScore' => 0.0,
+        ];
+
+        $ipRepScore = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(60.0, $ipRepScore);
+        $score = $ipRepScore * $weights['ipReputationScore'];
+        $this->assertEquals(30.0, $score);
+    }
+
+    public function testGetIpSubnetIpv4AndIpv6(): void
+    {
+        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
+        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
+
+        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
+        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
+    }
+
+    public function testGetClientHintsInconsistencyScoreMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Google Chrome";v="117"';
+            }
+            return null;
+        });
+
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetClientHintsInconsistencyFullVersionMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1.2 Safari/537.36';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"';
+            }
+            if ($name === 'sec-ch-ua-full-version-list') {
+                return '"Not_A Brand";v="8.0.0.0", "Chromium";v="120.0.1.3", "Google Chrome";v="120.0.1.3"';
+            }
+            return null;
+        });
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(85.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetSubnetScoreCalculations(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->clientIp = '192.168.1.50';
+
+        $score = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertEquals(0.0, $score['subnetScore']);
+
+        for ($i = 1; $i <= 12; $i++) {
+            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
+        }
+
+        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
+    }
+
+    public function testTlsSpoofingScoreWithJa4(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->ja4 = 't13d1517h2_8daaf61527d5';
+        $context->ja3 = null;
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
+        });
+
+        $score = RequestUtils::getTlsSpoofingScore($context);
+        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
+    }
 }