@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/js/tests/fingerprint.test.js

@@ -1,5 +1,5 @@
 import {afterEach, assert, beforeEach, describe, expect, it, test, vi} from 'vitest';
-import {createHash, createHmac} from 'node:crypto';
+import {createHash, createHmac, generateKeyPairSync} from 'node:crypto';
 import {solveCpuTargetInline, solveMemory} from '../pow.solver.js';
 import {readFileSync} from 'node:fs';
 import {cyrb53, FingerprintBuilder} from '../fingerprint.builder.js';
@@ -66,6 +66,18 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(FingerprintBuilder.compare(fp1, ''), "Comparison with empty string should be 0").toBe(0);
             expect(FingerprintBuilder.compare(null, fp2), "Comparison with null should be 0").toBe(0);
         });
+
+      it('should calculate a high crossLayerInconsistencyScore when viewport width exceeds screen width', () => {
+          const context = {
+              headers: {
+                  'x-device-fingerprint': `scr:${cyrb53("1920x1080_24")}`,
+                  'sec-ch-viewport-width': '2560'
+              }
+          };
+
+          const { crossLayerInconsistencyScore } = __internal.getCrossLayerInconsistency(context);
+          expect(crossLayerInconsistencyScore).toBe(20);
+      });
     });
 
     describe('JA3 Fingerprinting', () => {
@@ -1080,6 +1092,63 @@ describe('Fingerprint & PoW Security Suite', () => {
             stopThresholdAutoTuning(); // Ensure cleanup after each test
         });
 
+    test('should prune traffic data based on time, size, clearAfterTuning and invoke onCleanup', async () => {
+        const trafficData = [
+            { type: 'challenge_solved', timestamp: Date.now() - 10000 }, // 10s old
+            { type: 'challenge_solved', timestamp: Date.now() - 5000 },  // 5s old
+            { type: 'challenge_solved', timestamp: Date.now() }          // fresh
+        ];
+
+        const securityConfig = {
+            thresholds: { low: 20, medium: 45, high: 75, block: 95 },
+            weights: { historyScore: 1 },
+            patterns: {}
+        };
+
+        const cleanedLogs = [];
+        const onCleanup = (removed) => {
+            cleanedLogs.push(...removed);
+        };
+
+        // Test 1: Time-based pruning (older than 8 seconds)
+        __internal.pruneTrafficData(trafficData, 10, 8000, onCleanup);
+
+        expect(trafficData.length).toBe(2);
+        expect(cleanedLogs.length).toBe(1);
+        expect(cleanedLogs[0].timestamp).toBeLessThan(Date.now() - 8000);
+
+        // Test 2: Size-based pruning (max size = 1)
+        __internal.pruneTrafficData(trafficData, 1, 0, onCleanup);
+        expect(trafficData.length).toBe(1);
+        expect(cleanedLogs.length).toBe(2);
+
+        // Test 3: Clear after tuning
+        const autoTuningTraffic = [];
+        for (let i = 0; i < 110; i++) {
+            autoTuningTraffic.push({ type: 'challenge_solved', timestamp: Date.now(), deviceId: `dev-solved-${i}` });
+            autoTuningTraffic.push({ type: 'request_passed', timestamp: Date.now(), deviceId: `dev-passed-${i}` });
+        }
+
+        const tuningCleaned = [];
+        startThresholdAutoTuning({
+            securityConfig,
+            trafficData: autoTuningTraffic,
+            interval: 10000,
+            minDataPoints: 100,
+            maxDataPoints: 500,
+            clearAfterTuning: true,
+            onCleanup: (removed) => tuningCleaned.push(...removed)
+        });
+
+        const intervalCallback = setIntervalSpy.mock.calls[0][0];
+        intervalCallback();
+
+        expect(autoTuningTraffic.length).toBe(0);
+        expect(tuningCleaned.length).toBeGreaterThan(0);
+
+        stopThresholdAutoTuning();
+    });
+
         test('should start, run an optimization cycle, and update thresholds', () => {
             const trafficData = [];
             const securityConfig = {
@@ -1635,6 +1704,53 @@ describe('Fingerprint & PoW Security Suite', () => {
     });
 });
 
+describe('TLS Session Resumption (Cookieless Identity)', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+    });
+
+    it('should resume device ID using TLS Session ID even if cookies are cleared', async () => {
+        const securityConfig = {
+            weights: { historyScore: 1.0 },
+            thresholds: { low: 20, block: 95 }
+        };
+        const engine = new FingerprintEngine(securityConfig);
+
+        const req1 = {
+            clientIp: '1.2.3.4',
+            path: '/',
+            cookies: {},
+            headers: { 'x-tls-session-id': 'session-xyz-123', 'user-agent': 'test-agent' },
+            rawHeaders: [],
+            httpVersion: '1.1'
+        };
+        const decision1 = await engine.processRequest(req1);
+        const deviceId = decision1.newCookieForResponse.value;
+        expect(deviceId).toBeDefined();
+
+        const req2 = {
+            clientIp: '1.2.3.4',
+            path: '/',
+            cookies: {}, // Cookies cleared!
+            headers: { 'x-tls-session-id': 'session-xyz-123', 'user-agent': 'test-agent' },
+            rawHeaders: [],
+            httpVersion: '1.1'
+        };
+
+        const decision2 = await engine.processRequest(req2);
+        expect(decision2.newCookieForResponse).toBeUndefined(); // Resumed successfully, no new cookie needed
+    });
+});
+
 describe('getTlsSpoofingScore', () => {
     let getTlsFingerprintMock; // Renamed to reflect it's the mock function
     let getTlsSpoofingScore;
@@ -2367,6 +2483,80 @@ describe('Additional Suspicion Vectors Coverage', () => {
     });
 });
 
+describe('Ed25519 Asymmetric Tickets', () => {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
+        privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
+        publicKeyEncoding: { format: 'pem', type: 'spki' }
+    });
+    const privateKeyPem = privateKey;
+    const publicKeyPem = publicKey;
+
+    beforeEach(() => {
+        process.env.ED25519_PRIVATE_KEY = privateKeyPem;
+        process.env.ED25519_PUBLIC_KEY = publicKeyPem;
+    });
+
+    afterEach(() => {
+        delete process.env.ED25519_PRIVATE_KEY;
+        delete process.env.ED25519_PUBLIC_KEY;
+    });
+
+    it('should generate and validate an Ed25519 ticket successfully', async () => {
+        const payload = {
+            expiry: Date.now() + 3600000,
+            originalIp: '127.0.0.1',
+            deviceId: 'device-123',
+            deviceHash: 'hash-abc'
+        };
+
+        const ticket = fingerprint.generateStatelessTicket(payload);
+        expect(ticket).toBeDefined();
+        expect(ticket.startsWith('ed25519.')).toBe(true);
+
+        const isValid = await fingerprint.isTicketValid('127.0.0.1', ticket, 'device-123', 'hash-abc');
+        expect(isValid).toBe(true);
+
+        const isDiffIpValid = await fingerprint.isTicketValid('192.168.1.1', ticket, 'device-123', 'hash-abc', false);
+        expect(isDiffIpValid).toBe(false);
+    });
+
+    test('Cooperative PoSpace Workflow', async () => {
+        const clientIp = '127.0.0.1';
+        const nodeIdA = 'node-a';
+        const seedA = 'seed-a';
+
+        // 1. Enregistrement du nœud A (pair)
+        await __internal.registerCooperativeNode(clientIp, nodeIdA, seedA);
+
+        // 2. Recherche de pair pour le nœud B (dans le même sous-réseau)
+        const peer = await __internal.findPeerInSubnet(clientIp, 'node-b');
+        expect(peer).not.toBeNull();
+        expect(peer.nodeId).toBe(nodeIdA);
+        expect(peer.seed).toBe(seedA);
+
+        // 3. Demande de bloc du nœud B vers le nœud A
+        const paramsReq = {
+            coop_op: 'request_peer_block',
+            node_id: 'node-b',
+            peer_id: 'node-a',
+            block_idx: '42',
+            req_id: 'req-123'
+        };
+        const resReq = await __internal.handleCooperativeRequest(paramsReq, clientIp);
+        expect(resReq.status).toBe('queued');
+
+        // 4. Récupération de la demande par le nœud A
+        const paramsPoll = {
+            coop_op: 'poll_requests',
+            node_id: 'node-a'
+        };
+        const resPoll = await __internal.handleCooperativeRequest(paramsPoll, clientIp);
+        expect(resPoll.requests.length).toBe(1);
+        expect(resPoll.requests[0].req_id).toBe('req-123');
+        expect(resPoll.requests[0].block_idx).toBe(42);
+    });
+});
+
 describe('Botnet Cluster Scoring (Node.js)', () => {
     const inMemoryStore = {
         _map: new Map(),

package/src/js/tests/ja3AnomalyDetector.test.js

@@ -1,6 +1,7 @@
 import crypto from 'crypto';
 import {getTlsSpoofingScore, parseJa3} from '../fingerprint.js';
 import {vi} from 'vitest';
+import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "../../js/fingerprint.utils.js";
 
 describe('JA3 Anomaly Detector (Node.js)', () => {
     

package/src/php/AutoTuner.php

@@ -25,6 +25,11 @@ class AutoTuner
 
     private int $minDataPoints;
     private int $maxDataPoints;
+    private ?int $maxAgeMs;
+    private bool $clearAfterTuning;
+    /** @var ?callable */
+    private $onCleanup;
+    private ?string $savePath;
 
     /**
      * @var ?array<string, mixed> La dernière meilleure solution trouvée par l'optimiseur.
@@ -42,6 +47,48 @@ class AutoTuner
         $this->trafficData = &$trafficData;
         $this->minDataPoints = $options['minDataPoints'] ?? 200;
         $this->maxDataPoints = $options['maxDataPoints'] ?? 10000;
+        $this->maxAgeMs = $options['maxAgeMs'] ?? null;
+        $this->clearAfterTuning = $options['clearAfterTuning'] ?? false;
+        $this->onCleanup = $options['onCleanup'] ?? null;
+        $this->savePath = $options['savePath'] ?? null;
+    }
+
+    /**
+     * Prunes old or excess traffic logs to prevent memory leaks.
+     */
+    private function pruneTrafficData(): void
+    {
+        $now = (int)(microtime(true) * 1000);
+        $removed = [];
+
+        // 1. Expire par temps (maxAgeMs)
+        if ($this->maxAgeMs !== null && $this->maxAgeMs > 0) {
+            $threshold = $now - $this->maxAgeMs;
+            foreach ($this->trafficData as $key => $log) {
+                $logTs = $log['timestamp'] ?? $log['requestTimestamp'] ?? $now;
+                if ($logTs < $threshold) {
+                    $removed[] = $log;
+                    unset($this->trafficData[$key]);
+                }
+            }
+            $this->trafficData = array_values($this->trafficData);
+        }
+
+        // 2. Politique de taille maximale (maxDataPoints)
+        if ($this->maxDataPoints > 0 && count($this->trafficData) > $this->maxDataPoints) {
+            $overflowCount = count($this->trafficData) - $this->maxDataPoints;
+            $spliced = array_splice($this->trafficData, 0, $overflowCount);
+            $removed = array_merge($removed, $spliced);
+        }
+
+        // 3. Invocation du callback onCleanup
+        if ($this->onCleanup !== null && is_callable($this->onCleanup) && !empty($removed)) {
+            try {
+                call_user_func($this->onCleanup, $removed);
+            } catch (\Throwable $e) {
+                error_log("[AutoTuning] Error in onCleanup callback: " . $e->getMessage());
+            }
+        }
     }
 
     /**
@@ -49,6 +96,8 @@ class AutoTuner
      */
     public function runOptimizationCycle(): void
     {
+        $this->pruneTrafficData();
+
         $sanitizedData = RequestUtils::sanitizeTrafficData($this->trafficData);
 
         $highConfidenceLogs = count(array_filter(
@@ -77,7 +126,7 @@ class AutoTuner
 
         echo sprintf("[AutoTuning] Démarrage du cycle d'optimisation complet avec %d points de données assainis.\n", count($sanitizedData));
 
-        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData]);
+        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData, 'currentConfig' => $this->securityConfig], []);
 
         if (empty($paretoFront)) {
             echo "[AutoTuning] L'optimisation n'a retourné aucune solution.\n";
@@ -176,6 +225,28 @@ class AutoTuner
         echo "[AutoTuning] Nouveaux seuils : " . json_encode($this->securityConfig['thresholds']) . "\n";
         echo "[AutoTuning] Nouveaux poids : " . json_encode($this->securityConfig['weights']) . "\n";
         echo "[AutoTuning] Nouveaux patterns : " . json_encode($this->securityConfig['patterns']) . "\n";
+
+        // NOUVEAU: Sauvegarder la meilleure configuration si un chemin est fourni.
+        if ($this->savePath !== null) {
+            try {
+                file_put_contents($this->savePath, json_encode($bestSolution['solution'], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+                echo "[AutoTuning] Meilleure configuration sauvegardée dans : {$this->savePath}\n";
+            } catch (\Throwable $e) {
+                error_log("[AutoTuning] Erreur lors de la sauvegarde de la configuration optimisée : " . $e->getMessage());
+            }
+        }
+
+        if ($this->clearAfterTuning) {
+            $cleared = array_splice($this->trafficData, 0);
+            if ($this->onCleanup !== null && is_callable($this->onCleanup) && !empty($cleared)) {
+                try {
+                    call_user_func($this->onCleanup, $cleared);
+                } catch (\Throwable $e) {
+                    error_log("[AutoTuning] Error in onCleanup callback after clearing: " . $e->getMessage());
+                }
+            }
+            echo sprintf("[AutoTuning] Explicitly cleared %d processed traffic data points.\n", count($cleared));
+        }
     }
 
     /**