@anonympins/fingerprint 0.5.2 → 0.5.4

package/src/php/FingerprintEngine.php

@@ -31,6 +31,137 @@
      private static ?array $yandexEntries = null;
      private static ?array $bingbotEntries = null;
 
+     private static array $dnsCircuitBreaker = [
+         'state' => 'CLOSED',
+         'failureCount' => 0,
+         'lastStateChange' => 0,
+         'threshold' => 5,
+         'cooldown' => 30, // seconds
+     ];
+
+     private static function recordDnsSuccess(): void
+     {
+         self::$dnsCircuitBreaker['failureCount'] = 0;
+         self::$dnsCircuitBreaker['state'] = 'CLOSED';
+     }
+
+     private static function recordDnsFailure(): void
+     {
+         self::$dnsCircuitBreaker['failureCount']++;
+         if (self::$dnsCircuitBreaker['failureCount'] >= self::$dnsCircuitBreaker['threshold']) {
+             self::$dnsCircuitBreaker['state'] = 'OPEN';
+             self::$dnsCircuitBreaker['lastStateChange'] = microtime(true);
+         }
+     }
+
+     private static function canAttemptDns(): bool
+     {
+         if (self::$dnsCircuitBreaker['state'] === 'CLOSED') {
+             return true;
+         }
+         if (self::$dnsCircuitBreaker['state'] === 'OPEN') {
+             if (microtime(true) - self::$dnsCircuitBreaker['lastStateChange'] >= self::$dnsCircuitBreaker['cooldown']) {
+                 self::$dnsCircuitBreaker['state'] = 'HALF-OPEN';
+                 return true;
+             }
+             return false;
+         }
+         return true; // HALF-OPEN
+     }
+
+     private static function getReverseDnsName(string $ip): ?string
+     {
+         if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+             return implode('.', array_reverse(explode('.', $ip))) . '.in-addr.arpa';
+         } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+             $hex = bin2hex((string)inet_pton($ip));
+             return implode('.', array_reverse(str_split($hex))) . '.ip6.arpa';
+         }
+         return null;
+     }
+
+     private static function dnsResolveUdp(string $query, string $type, float $timeout = 0.5): ?array
+     {
+         $dnsServer = '8.8.8.8';
+         $port = 53;
+         $fp = @stream_socket_client("udp://$dnsServer:$port", $errno, $errstr, $timeout);
+         if (!$fp) return null;
+         stream_set_timeout($fp, 0, (int)($timeout * 1000000));
+         
+         $id = rand(10000, 65000);
+         $header = pack('n6', $id, 0x0100, 1, 0, 0, 0);
+         
+         $qType = ($type === 'PTR') ? 12 : (($type === 'AAAA') ? 28 : 1);
+         $parts = explode('.', $query);
+         $qName = '';
+         foreach ($parts as $part) {
+             $qName .= chr(strlen($part)) . $part;
+         }
+         $qName .= chr(0);
+         $question = $qName . pack('n2', $qType, 1);
+         
+         if (!@fwrite($fp, $header . $question)) {
+             fclose($fp);
+             return null;
+         }
+         
+         $response = @fread($fp, 512);
+         fclose($fp);
+         if (!$response || strlen($response) < 12) return null;
+         
+         $resHeader = unpack('n6', substr($response, 0, 12));
+         if ($resHeader[1] !== $id) return null;
+         
+         $answersCount = $resHeader[4];
+         if ($answersCount <= 0) return [];
+         
+         $offset = 12 + strlen($question);
+         $results = [];
+         for ($i = 0; $i < $answersCount; $i++) {
+             if ($offset + 12 > strlen($response)) break;
+             if ((ord($response[$offset]) & 0xc0) === 0xc0) {
+                 $offset += 2;
+             } else {
+                 while ($offset < strlen($response) && ord($response[$offset]) !== 0) {
+                     $offset += 1 + ord($response[$offset]);
+                 }
+                 $offset++;
+             }
+             if ($offset + 10 > strlen($response)) break;
+             $typeAndClass = unpack('n2type_class/Nttl/nlen', substr($response, $offset, 10));
+             $rType = $typeAndClass['type_class1'];
+             $rLen = $typeAndClass['len'];
+             $offset += 10;
+             if ($offset + $rLen > strlen($response)) break;
+             $rData = substr($response, $offset, $rLen);
+             $offset += $rLen;
+             
+             if ($rType === 12) {
+                 $ptrName = '';
+                 $p = 0;
+                 while ($p < strlen($rData)) {
+                     $l = ord($rData[$p]);
+                     if ($l === 0) break;
+                     if (($l & 0xc0) === 0xc0) {
+                         break;
+                     }
+                     $ptrName .= substr($rData, $p + 1, $l) . '.';
+                     $p += 1 + $l;
+                 }
+                 $results[] = rtrim($ptrName, '.');
+             } elseif ($rType === 1) {
+                 if ($rLen === 4) {
+                     $results[] = long2ip(unpack('N', $rData)[1]);
+                 }
+             } elseif ($rType === 28) {
+                 if ($rLen === 16) {
+                     $results[] = inet_ntop($rData);
+                 }
+             }
+         }
+         return $results;
+     }
+
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
@@ -387,13 +518,19 @@
 
              $deviceId = bin2hex(random_bytes(16)); // UUID-like
 
+             $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
+                 (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
+                 ($context->getHeader('x-forwarded-proto') === 'https');
+             $secureOption = $isHttps || $this->isProduction;
+
              // Préparer le cookie à envoyer
              $newCookie = [
                  'name' => 'device_id',
                  'value' => $deviceId,
                  'options' => [
                      'httponly' => true,
-                     'secure' => $this->isProduction,
+                     'secure' => $secureOption,
+                     'partitioned' => $secureOption,
                      'samesite' => 'Strict',
                      'path' => '/',
                  ]
@@ -852,7 +989,7 @@
                              ]);
                              if (json_last_error() === JSON_ERROR_NONE) {
                                  // @phpstan-ignore-next-line - L'instance est gérée par le singleton
-                                $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                            $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
                                 $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                  // FIX: La solution est directement le $workResult, pas une sous-propriété.
@@ -871,15 +1008,31 @@
                  if ($isValid) {
                      $store->delete("secret:{$powNonce}");
                      $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
-                    MetricsManager::incrementCounter('challenges_solved_total');
+                     MetricsManager::incrementCounter('challenges_solved_total');
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
- 
+
+                     $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
+                         (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
+                         ($context->getHeader('x-forwarded-proto') === 'https');
+                     $secureOption = $isHttps || $this->isProduction;
+
                      return [
                          'action' => 'redirect',
                          'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
                          'score' => 0.0,
                          'vector' => ['challenge_solved' => 100],
-                         'cookie' => ['name' => 'pow_clearance', 'value' => $ticket, 'options' => ['httponly' => true, 'secure' => $this->isProduction, 'expires' => time() + ($ticketTtl / 1000), 'path' => '/']]
+                         'cookie' => [
+                             'name' => 'pow_clearance',
+                             'value' => $ticket,
+                             'options' => [
+                                 'httponly' => true,
+                                 'secure' => $secureOption,
+                                 'samesite' => 'Strict',
+                                 'expires' => time() + ($ticketTtl / 1000),
+                                 'path' => '/',
+                                 'partitioned' => $secureOption,
+                             ]
+                         ]
                      ];
                  }
              }
@@ -888,7 +1041,7 @@
              $this->log('Challenge solution invalid or context expired', ['nonce' => $powNonce], 'warn');
              $suspicionVector['honeypotScore'] = 100.0;
          }
- 
+
          // 3. Vérifier un ticket existant
          $hasValidTicket = false;
          $powCookie = $context->cookies['pow_clearance'] ?? null;
@@ -903,7 +1056,7 @@
              // $this->log('Valid clearance ticket found');
              // return ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100]];
          }
- 
+
          // 4. Calculer le vecteur et le score de suspicion
          // Résoudre l'identité et vérifier le statut "condamné"
          $store = StoreManager::getStore();
@@ -934,7 +1087,7 @@
             RequestUtils::updateSubnetMetrics($context, $deviceId, $finalScore);
             MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'high_score_subnet_update']);
          }
- 
+
          // Logique pour challenger les nouveaux appareils (déplacée ici pour avoir le score final)
          $isNewDevice = $identity['newCookie'] !== null;
          if ($isNewDevice && ($this->securityConfig['challengeNewDevices'] ?? false) && $finalScore < $thresholds['low']) {
@@ -944,7 +1097,7 @@
              ]);
              $finalScore = (float)$thresholds['low'];
          }
- 
+
          // Vérifier les URL pièges (après calcul du score)
          $lastNonce = $deviceData['lastChallengeNonce'] ?? null;
          if ($lastNonce && ChallengeUtils::verifyTrapUrl($context->path, $context->query['sig'] ?? '', $lastNonce)) {
@@ -963,7 +1116,7 @@
              }
              return $decision;
          }
- 
+
          // 5. Prendre une décision basée sur le score - Vérifier le blocage d'abord.
          $blockThreshold = $thresholds['block'] ?? 95;
          if ($finalScore >= $blockThreshold) {
@@ -1001,13 +1154,13 @@
 
              $highThreshold = $thresholds['high'] ?? 75;
              $mustReChallenge = $finalScore >= $highThreshold && $hasValidTicket;
- 
+
              $lowThreshold = $thresholds['low'] ?? 20;
              if (($finalScore >= $lowThreshold && !$hasValidTicket) || $mustReChallenge) {
                  if ($mustReChallenge) {
                      $this->log('High suspicion score detected - overriding valid ticket to re-issue challenge', ['finalScore' => $finalScore, 'deviceId' => $deviceId]);
                  }
- 
+
                  // --- AJOUT: Limiteur de débit (Token Bucket) ---
                  $rateLimitPassed = ChallengeUtils::checkChallengeRateLimit($context->clientIp);
                  if (!$rateLimitPassed) {
@@ -1027,9 +1180,9 @@
                      }
                      return $decision;
                  }
- 
+
                  $decision = ['action' => 'challenge', 'score' => $finalScore, 'vector' => $suspicionVector, 'status' => 403];
- 
+
                  if ($this->dryRun) {
                     MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_challenge']);
                      $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
@@ -1038,10 +1191,10 @@
                      unset($decision['status']);
                      return $decision;
                  }
- 
+
                 MetricsManager::incrementCounter('requests_total', ['status' => 'challenged']);
                  $this->log('Suspicious request - selecting challenge type', ['finalScore' => $finalScore]);
- 
+
                  $nonce = bin2hex(random_bytes(16));
                  $clientSecret = bin2hex(random_bytes(16));
                  $highThreshold = $thresholds['high'] ?? 75;
@@ -1062,7 +1215,7 @@
 
                  if ($shouldUseUsefulWork) {
                      $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                    $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                      $work = $problemManager->dispatchWork($finalScore);
@@ -1143,10 +1296,10 @@
                  // Alignement linéaire parfait du ratio d'effort CPU/Mémoire
                  $memActivationFactor = $suspicionFactor;
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
- 
+
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
                  $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
- 
+
                  $challengeContext = [
                      'clientSecret' => $clientSecret,
                      'cpuTarget' => $cpuChallengeDetails['target'],
@@ -1156,22 +1309,22 @@
                      'baseBlock' => $baseBlock,
                      'originalPath' => $context->path,
                  ];
- 
+
                  $store->set("secret:{$nonce}", $challengeContext, $this->securityConfig['challengeTtl'] ?? 300);
- 
+
                  // Associer le nonce au device pour la vérification des URL pièges
                  if ($deviceData) {
                      $deviceData['lastChallengeNonce'] = $nonce;
                      $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
                  }
- 
+
                  $trapUrls = [ChallengeUtils::generateTrapUrl($nonce), ChallengeUtils::generateTrapUrl($nonce)];
                  $this->log('Challenge issued', ['nonce' => $nonce, 'ttl' => $this->securityConfig['challengeTtl'] ?? 300]);
- 
+
                  if ($this->logger) {
                      $this->logger->log('info', 'challenge_issued', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
                  }
- 
+
                  // Pour les API, retourner un challenge JSON
                  if ($isApiRequest) {
                      $challengePayload = [
@@ -1188,7 +1341,7 @@
                  } else {
                      // Pour les navigateurs, retourner une page HTML
                      $pageBody = ChallengeUtils::generateCombinedPoWChallengePage(
-                         $cpuChallengeDetails, $memDifficulty, $clientSecret, 
+                         $cpuChallengeDetails, $memDifficulty, $clientSecret,
                          $this->securityConfig, $trapUrls, $originalFingerprint
                      );
                      $decision['body'] = $pageBody;
@@ -1210,12 +1363,12 @@
                  $response = ['action' => 'next', 'score' => $finalScore, 'vector' => $suspicionVector, 'intendedAction' => 'next'];
              }
          }
- 
+
          // Si un nouveau cookie d'identification a été généré, on l'ajoute à la réponse.
          if (isset($context->newCookieForResponse)) {
              $response['newCookieForResponse'] = $context->newCookieForResponse;
          }
- 
+
          return $response;
      }
 
@@ -1227,7 +1380,7 @@
          if (empty($operationType) || empty($operationName)) {
              return false;
          }
- 
+
          $whitelistRules = $this->securityConfig['whitelist'] ?? [];
          $graphqlRule = null;
          foreach ($whitelistRules as $rule) {
@@ -1236,23 +1389,23 @@
                  break;
              }
          }
- 
+
          if (empty($graphqlRule['entries'])) {
              return false;
          }
- 
+
          foreach ($graphqlRule['entries'] as $entry) {
              [$entryType, $entryName] = explode(':', $entry, 2);
              if ($entryType !== $operationType) continue;
- 
+
              if ($entryName === $operationName || $entryName === '*') return true;
- 
+
              if (str_ends_with($entryName, '*') && str_starts_with($operationName, substr($entryName, 0, -1))) return true;
          }
- 
+
          return false;
      }
- 
+
      /**
       * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
       * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.
@@ -1284,44 +1437,67 @@
          if ($cachedStatus === 'verified') return true;
          if ($cachedStatus === 'failed') return false;
 
+         if (!self::canAttemptDns()) {
+             return false;
+         }
+
          try {
-             // 1. Reverse DNS lookup. gethostbyaddr peut être lent, mais c'est la méthode standard.
-             // @ pour supprimer les warnings si l'IP n'a pas de PTR record.
-             $hostname = @gethostbyaddr($context->clientIp);
-             if ($hostname === false || $hostname === $context->clientIp) {
-                 $store->set($cacheKey, 'failed', 86400);
+             // 1. Reverse DNS lookup with strict 500ms timeout using our custom UDP DNS Client
+             $revName = self::getReverseDnsName($context->client_ip);
+             if (!$revName) {
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
+             }
+             $hostnames = self::dnsResolveUdp($revName, 'PTR', 0.5);
+             if ($hostnames === null || empty($hostnames)) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
                  return false;
              }
 
              $validHostname = null;
-             if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
-                 $validHostname = $hostname;
+             foreach ($hostnames as $hostname) {
+                 if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
+                     $validHostname = $hostname;
+                     break;
+                 }
              }
 
              if ($validHostname === null) {
-                 $store->set($cacheKey, 'failed', 86400);
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
                  return false;
              }
- 
-             // 2. Forward DNS lookup
-             $addresses = array_merge(dns_get_record($validHostname, DNS_A) ?: [], dns_get_record($validHostname, DNS_AAAA) ?: []);
+
+             // 2. Forward DNS lookup with strict 500ms timeout
              $ips = [];
-             foreach ($addresses as $address) {
-                 if (isset($address['ip'])) {
-                     $ips[] = $address['ip'];
-                 }
-                 if (isset($address['ipv6'])) {
-                     $ips[] = $address['ipv6'];
-                 }
+             $resolvedA = self::dnsResolveUdp($validHostname, 'A', 0.5);
+             if ($resolvedA === null) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
              }
- 
-             if (in_array($context->clientIp, $ips, true)) {
+             $ips = array_merge($ips, $resolvedA);
+
+             $resolvedAaaa = self::dnsResolveUdp($validHostname, 'AAAA', 0.5);
+             if ($resolvedAaaa === null) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
+             }
+             $ips = array_merge($ips, $resolvedAaaa);
+
+             if (in_array($context->client_ip, $ips, true)) {
+                 self::recordDnsSuccess();
                  $store->set($cacheKey, 'verified', 86400);
                  return true;
              }
-         } catch (\Exception $e) { /* DNS errors */ }
+         } catch (\Exception $e) {
+             self::recordDnsFailure();
+             $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+             return false;
+         }
 
-         $store->set($cacheKey, 'failed', 86400);
+         $store->set($cacheKey, 'failed', 300); // 5 min negative caching
          return false;
      }
 

package/src/php/Optimization/Optimization.php

@@ -224,31 +224,38 @@ class Optimization
      */
     public static function benfordTest(array $numbers): float // Rendre la méthode publique et statique
     {
-        if (count($numbers) < 10) {
-            return 0.0; // Pas assez de données
-        }
-
-        $leadingDigits = array_map(function ($n) {
-            $str = ltrim((string)$n, '0.');
-            return $str[0] ?? '';
-        }, $numbers);
-
-        $leadingDigits = array_filter($leadingDigits, fn ($d) => $d >= '1' && $d <= '9');
+        $counts = array_fill(1, 9, 0);
+        $validCount = 0;
 
-        if (count($leadingDigits) < 10) {
-            return 0.0;
+        foreach ($numbers as $n) {
+            if (is_string($n)) {
+                $n = (float)$n;
+            }
+            if (!is_numeric($n)) {
+                continue;
+            }
+            $val = abs((float)$n);
+            if ($val == 0.0) {
+                continue;
+            }
+            $log = log10($val);
+            $factor = pow(10, (int)floor($log));
+            $digit = (int)floor($val / $factor);
+            if ($digit >= 1 && $digit <= 9) {
+                $counts[$digit]++;
+                $validCount++;
+            }
         }
 
-        $counts = array_fill(1, 9, 0);
-        foreach ($leadingDigits as $digit) {
-            $counts[(int)$digit]++;
+        if ($validCount < 10) {
+            return 0.0;
         }
 
         $benfordDistribution = [1 => 30.1, 2 => 17.6, 3 => 12.5, 4 => 9.7, 5 => 7.9, 6 => 6.7, 7 => 5.8, 8 => 5.1, 9 => 4.6];
 
         $totalDeviation = 0.0;
         for ($i = 1; $i <= 9; $i++) {
-            $observedFrequency = ($counts[$i] / count($leadingDigits)) * 100;
+            $observedFrequency = ($counts[$i] / $validCount) * 100.0;
             $expectedFrequency = $benfordDistribution[$i];
             $totalDeviation += pow($observedFrequency - $expectedFrequency, 2);
         }

package/src/php/Optimization/OptimizationOperators.php

@@ -9,6 +9,33 @@ namespace Anonympins\Fingerprint\Optimization;
  */
 class OptimizationOperators
 {
+    /**
+     * Crée une fonction de sélection par tournoi pour un algorithme génétique.
+     * @param array $options Options pour le tournoi.
+     * @return callable Une fonction de sélection.
+     */
+    public static function createTournamentSelection(array $options = []): callable
+    {
+        $tournamentSize = $options['size'] ?? 5;
+
+        return function (array $population) use ($tournamentSize) {
+            $best = null;
+            $count = count($population);
+
+            for ($i = 0; $i < $tournamentSize; $i++) {
+                $individual = $population[random_int(0, $count - 1)];
+                $individualFitness = $individual['fitness'] ?? (isset($individual['objectives']) ? array_sum($individual['objectives']) : INF);
+                $bestFitness = $best !== null ? ($best['fitness'] ?? (isset($best['objectives']) ? array_sum($best['objectives']) : INF)) : INF;
+
+                if ($best === null || $individualFitness < $bestFitness) {
+                    $best = $individual;
+                }
+            }
+
+            return $best ?? $population[random_int(0, $count - 1)];
+        };
+    }
+
     /**
      * Génère un nombre flottant aléatoire cryptographiquement sûr entre 0 (inclus) et 1 (exclus).
      */

package/src/php/ProblemManager.php

@@ -36,7 +36,7 @@ class ProblemManager
     {
         if (self::$instance === null) {
             if ($configPath === null) {
-                $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
                 $configPath = file_exists($defaultPath) ? $defaultPath : null;
             }
             // Si on essaie d'obtenir l'instance sans l'initialiser d'abord, c'est une erreur.