@anonympins/fingerprint 0.4.4 → 0.4.6

package/src/php/Tests/FingerprintEngineTest.php

@@ -10,6 +10,7 @@ use Anonympins\Fingerprint\FingerprintEngine;
 use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Challenge\ChallengeUtils;
 use PHPUnit\Framework\TestCase;
 
 class FingerprintEngineTest extends TestCase
@@ -90,6 +91,35 @@ class FingerprintEngineTest extends TestCase
         $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
     }
 
+    public function testTlsSessionResumptionCookielessTracking(): void
+    {
+        // 1. Première requête d'un client avec un ID de session TLS, sans cookie
+        $tlsSessionId = 'test-tls-1.3-session-resumption-id-12345';
+        $context1 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ]
+        ]);
+
+        $firstDecision = $this->engine->processRequest($context1);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un cookie d'identité d'appareil doit être généré.");
+        $deviceId = $firstDecision['newCookieForResponse']['value'];
+
+        // 2. Deuxième requête : le client supprime ses cookies, mais garde la même session TLS (Session Resumption / 0-RTT)
+        $context2 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ],
+            'cookies' => [] // Cookies supprimés !
+        ]);
+
+        $secondDecision = $this->engine->processRequest($context2);
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertArrayNotHasKey('newCookieForResponse', $secondDecision, "Aucun nouveau cookie d'identité ne doit être généré car la session TLS a permis de restaurer l'identité.");
+    }
+
     public function testIssuesChallengeForSuspiciousRequest(): void
     {
         // 1. First, establish a device identity to avoid the cookie-dropping penalty
@@ -294,7 +324,7 @@ class FingerprintEngineTest extends TestCase
                     'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
                     'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
                 ]),
-                80.0,
+                96.7,
                 'Should return 80 for a large version mismatch (>5).'
             ],
             'small version mismatch' => [
@@ -328,4 +358,105 @@ class FingerprintEngineTest extends TestCase
             ],
         ];
     }
+
+    public function testDetectsTcpAnomalyScore(): void
+    {
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Trame binaire TCP SYN Linux simulée (TTL=64, WS=7)
+        $linuxSynHex = '4500003c1a2b400040063c1a7f0000017f0000011f9000500000000100000000a00272103c1a0000020405b4040201030307';
+        
+        $context = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+                'x-raw-tcp-binary' => $linuxSynHex
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($context);
+
+        $this->assertEquals(80.1, $decision['vector']['tcpAnomalyScore']);
+        // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
+        $this->assertGreaterThanOrEqual(64.0, $decision['score']);
+    }
+
+    public function testDetectsAndVerifiesSpaceChallenge(): void
+    {
+        $store = StoreManager::getStore();
+        
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'enableProofOfSpace' => true,
+            'pospace' => [
+                'sizeMb' => 1,
+                'numQueries' => 5
+            ],
+            'challengeNewDevices' => false,
+        ]);
+        
+        $engine = $this->getMockBuilder(FingerprintEngine::class)
+            ->setConstructorArgs([$config])
+            ->onlyMethods(['calculateFinalScore'])
+            ->getMock();
+        $engine->method('calculateFinalScore')->willReturn(30.0);
+        
+        $headers = [
+            'user-agent' => 'A normal browser',
+            'accept-language' => 'en-US,en;q=0.9',
+        ];
+        
+        // 1. Première requête provoquant un challenge
+        $context = $this->createRequestContext([
+            'headers' => $headers
+        ]);
+        
+        $decision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $decision['action']);
+        
+        $html = $decision['body'];
+        $this->assertStringContainsString('initializeSpace', $html);
+        
+        preg_match('/const nonce = "(.*?)";/', $html, $matchesNonce);
+        preg_match('/const clientSecret = "(.*?)";/', $html, $matchesSecret);
+        preg_match('/const queries = (\[.*?\]);/', $html, $matchesQueries);
+        
+        $nonce = $matchesNonce[1];
+        $clientSecret = $matchesSecret[1];
+        $queries = json_decode($matchesQueries[1], true);
+        
+        // 2. Résoudre le challenge
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= $this->callPrivateGenerateBlock($nonce . ":" . $clientSecret, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $solution = hash('sha256', $finalBlock);
+        
+        // 3. Soumettre le challenge
+        $submitContext = $this->createRequestContext([
+            'headers' => $headers,
+            'query' => [
+                'pow_type' => 'pospace',
+                'pow_nonce' => $nonce,
+                'pow_solution_space' => $solution
+            ]
+        ]);
+        
+        $engineReal = new FingerprintEngine($config);
+        $submitDecision = $engineReal->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertEquals('pow_clearance', $submitDecision['cookie']['name']);
+    }
+
+    private function callPrivateGenerateBlock(string $seed, int $blockIndex): string
+    {
+        $ref = new \ReflectionClass(ChallengeUtils::class);
+        $method = $ref->getMethod('generateBlock');
+        return $method->invoke(null, $seed, $blockIndex);
+    }
 }

package/src/php/Tests/IpReputationTest.php

@@ -1,157 +1,176 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Store\IStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use Anonympins\Fingerprint\Utils\RequestUtils;
-use PHPUnit\Framework\TestCase;
-
-class IpReputationTest extends TestCase
-{
-    private $store;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
-        $this->store = new class implements IStore {
-            private array $data = [];
-            public function get(string $key) { return $this->data[$key] ?? null; }
-            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
-            public function has(string $key): bool { return isset($this->data[$key]); }
-            public function delete(string $key): void { unset($this->data[$key]); }
-        };
-
-        StoreManager::setStore($this->store);
-    }
-
-    public function testGetScoreReturnsZeroForUnknownIp(): void
-    {
-        $score = RequestUtils::getIpReputationScore('8.8.8.8');
-        $this->assertEquals(0.0, $score);
-    }
-
-    public function testUpdateScoreChangesValueCorrectly(): void
-    {
-        $ip = '8.8.4.4';
-        RequestUtils::updateIpReputationScore($ip, 45.0);
-        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
-
-        RequestUtils::updateIpReputationScore($ip, -15.0);
-        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
-    }
-
-    public function testBoundsAreClampedBetween0And100(): void
-    {
-        $ip = '1.1.1.1';
-        RequestUtils::updateIpReputationScore($ip, 120.0);
-        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
-
-        RequestUtils::updateIpReputationScore($ip, -150.0);
-        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
-    }
-
-    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
-    {
-        $ip = '2.2.2.2';
-        $now = time();
-
-        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
-        $this->store->set("ip-reputation:{$ip}", [
-            'score' => 80.0,
-            'lastUpdate' => $now - 14400
-        ]);
-
-        $score = RequestUtils::getIpReputationScore($ip);
-        $this->assertEquals(72.0, $score);
-    }
-
-    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
-    {
-        $ip = '1.2.3.4';
-        RequestUtils::updateIpReputationScore($ip, 60.0);
-
-        $weights = [
-            'ipReputationScore' => 0.5,
-            'historyScore' => 0.0,
-            'rotationScore' => 0.0,
-            'headerAnomalyScore' => 0.0,
-            'requestPatternScore' => 0.0,
-            'inconsistencyScore' => 0.0,
-            'honeypotScore' => 0.0,
-            'behaviorScore' => 0.0,
-            'botScore' => 0.0,
-            'crossLayerInconsistencyScore' => 0.0,
-            'tlsSpoofingScore' => 0.0,
-            'timeInconsistencyScore' => 0.0,
-            'clickVarianceScore' => 0.0,
-            'clientHintsInconsistencyScore' => 0.0,
-            'subnetScore' => 0.0,
-        ];
-
-        $ipRepScore = RequestUtils::getIpReputationScore($ip);
-        $this->assertEquals(60.0, $ipRepScore);
-        $score = $ipRepScore * $weights['ipReputationScore'];
-        $this->assertEquals(30.0, $score);
-    }
-
-    public function testGetIpSubnetIpv4AndIpv6(): void
-    {
-        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
-        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
-
-        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
-        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
-    }
-
-    public function testGetClientHintsInconsistencyScoreMismatch(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            if ($name === 'user-agent') {
-                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
-            }
-            if ($name === 'sec-ch-ua') {
-                return '"Google Chrome";v="117"';
-            }
-            return null;
-        });
-
-        $score = RequestUtils::getClientHintsInconsistencyScore($context);
-        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
-    }
-
-    public function testGetSubnetScoreCalculations(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->clientIp = '192.168.1.50';
-
-        $score = RequestUtils::getSubnetScore($context, 'device-1');
-        $this->assertEquals(0.0, $score['subnetScore']);
-
-        for ($i = 1; $i <= 12; $i++) {
-            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
-        }
-
-        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
-        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
-    }
-
-    public function testTlsSpoofingScoreWithJa4(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->ja4 = 't13d1517h2_8daaf61527d5';
-        $context->ja3 = null;
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
-        });
-
-        $score = RequestUtils::getTlsSpoofingScore($context);
-        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\IStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class IpReputationTest extends TestCase
+{
+    private $store;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
+        $this->store = new class implements IStore {
+            private array $data = [];
+            public function get(string $key) { return $this->data[$key] ?? null; }
+            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
+            public function has(string $key): bool { return isset($this->data[$key]); }
+            public function delete(string $key): void { unset($this->data[$key]); }
+        };
+
+        StoreManager::setStore($this->store);
+    }
+
+    public function testGetScoreReturnsZeroForUnknownIp(): void
+    {
+        $score = RequestUtils::getIpReputationScore('8.8.8.8');
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testUpdateScoreChangesValueCorrectly(): void
+    {
+        $ip = '8.8.4.4';
+        RequestUtils::updateIpReputationScore($ip, 45.0);
+        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -15.0);
+        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testBoundsAreClampedBetween0And100(): void
+    {
+        $ip = '1.1.1.1';
+        RequestUtils::updateIpReputationScore($ip, 120.0);
+        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -150.0);
+        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
+    {
+        $ip = '2.2.2.2';
+        $now = time();
+
+        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
+        $this->store->set("ip-reputation:{$ip}", [
+            'score' => 80.0,
+            'lastUpdate' => $now - 14400
+        ]);
+
+        $score = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(72.0, $score);
+    }
+
+    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
+    {
+        $ip = '1.2.3.4';
+        RequestUtils::updateIpReputationScore($ip, 60.0);
+
+        $weights = [
+            'ipReputationScore' => 0.5,
+            'historyScore' => 0.0,
+            'rotationScore' => 0.0,
+            'headerAnomalyScore' => 0.0,
+            'requestPatternScore' => 0.0,
+            'inconsistencyScore' => 0.0,
+            'honeypotScore' => 0.0,
+            'behaviorScore' => 0.0,
+            'botScore' => 0.0,
+            'crossLayerInconsistencyScore' => 0.0,
+            'tlsSpoofingScore' => 0.0,
+            'timeInconsistencyScore' => 0.0,
+            'clickVarianceScore' => 0.0,
+            'clientHintsInconsistencyScore' => 0.0,
+            'subnetScore' => 0.0,
+        ];
+
+        $ipRepScore = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(60.0, $ipRepScore);
+        $score = $ipRepScore * $weights['ipReputationScore'];
+        $this->assertEquals(30.0, $score);
+    }
+
+    public function testGetIpSubnetIpv4AndIpv6(): void
+    {
+        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
+        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
+
+        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
+        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
+    }
+
+    public function testGetClientHintsInconsistencyScoreMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Google Chrome";v="117"';
+            }
+            return null;
+        });
+
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetClientHintsInconsistencyFullVersionMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1.2 Safari/537.36';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"';
+            }
+            if ($name === 'sec-ch-ua-full-version-list') {
+                return '"Not_A Brand";v="8.0.0.0", "Chromium";v="120.0.1.3", "Google Chrome";v="120.0.1.3"';
+            }
+            return null;
+        });
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(85.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetSubnetScoreCalculations(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->clientIp = '192.168.1.50';
+
+        $score = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertEquals(0.0, $score['subnetScore']);
+
+        for ($i = 1; $i <= 12; $i++) {
+            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
+        }
+
+        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
+    }
+
+    public function testTlsSpoofingScoreWithJa4(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->ja4 = 't13d1517h2_8daaf61527d5';
+        $context->ja3 = null;
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
+        });
+
+        $score = RequestUtils::getTlsSpoofingScore($context);
+        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
+    }
 }

package/src/php/Tests/RequestUtilsTest.php

@@ -35,6 +35,19 @@ class RequestUtilsTest extends TestCase
         );
     }
 
+    public function testGetCrossLayerInconsistencyViewportExceedsScreen(): void
+    {
+        $scrHash = FingerprintBuilder::cyrb53("1920x1080_24");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "scr:{$scrHash}",
+                'sec-ch-viewport-width' => '2560'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
+    }
     public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
     {
         $context = $this->createRequestContext([