@anonympins/fingerprint 0.5.2 → 0.5.4

package/src/php/Tests/DnsCircuitBreakerTest.php

@@ -0,0 +1,106 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintEngine;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+
+class DnsCircuitBreakerTest extends TestCase
+{
+    private ReflectionClass $reflection;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->reflection = new ReflectionClass(FingerprintEngine::class);
+
+        // Réinitialise l'état statique du disjoncteur avant chaque test
+        $this->setCircuitBreakerState([
+            'state' => 'CLOSED',
+            'failureCount' => 0,
+            'lastStateChange' => 0,
+            'threshold' => 5,
+            'cooldown' => 1, // 1 seconde de cooldown pour accélérer le test
+        ]);
+    }
+
+    private function getCircuitBreakerState(): array
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        return $property->getValue();
+    }
+
+    private function setCircuitBreakerState(array $state): void
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        $property->setValue(null, $state);
+    }
+
+    private function invokeMethod(string $methodName, array $args = [])
+    {
+        $method = $this->reflection->getMethod($methodName);
+        if (PHP_VERSION_ID < 80100) { // PHP 8.1.0
+            $method->setAccessible(true);
+        }
+        return $method->invokeArgs(null, $args);
+    }
+
+    public function testInitialStateIsClosed(): void
+    {
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+    }
+
+    public function testFailureThresholdTripsBreaker(): void
+    {
+        for ($i = 0; $i < 4; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+            $this->assertTrue($this->invokeMethod('canAttemptDns'));
+            $state = $this->getCircuitBreakerState();
+            $this->assertSame('CLOSED', $state['state']);
+        }
+
+        $this->invokeMethod('recordDnsFailure');
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('OPEN', $state['state']);
+    }
+
+    public function testCooldownTransitionsToHalfOpen(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+
+        usleep(1100000); // 1.1s
+
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('HALF-OPEN', $state['state']);
+    }
+
+    public function testSuccessOnHalfOpenResetsBreaker(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        usleep(1100000);
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+
+        $this->invokeMethod('recordDnsSuccess');
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+        $this->assertSame(0, $state['failureCount']);
+    }
+}

package/src/php/Tests/IpReputationTest.php

@@ -106,7 +106,7 @@ class IpReputationTest extends TestCase
         $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
 
         $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
-        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
+        $this->assertEquals('2001:0db8:abcd:0000:0000:0000:0000:0000/48', $ipv6Subnet);
     }
 
     public function testGetClientHintsInconsistencyScoreMismatch(): void

package/src/php/Tests/PowTest.php

@@ -23,7 +23,7 @@ class PowTest extends TestCase
 
         // 2. Initialiser le ProblemManager avec une configuration et un store valides.
         // C'est l'étape cruciale qui manquait.
-        $configPath = dirname(__FILE__) . '/problems.config.json';
+        $configPath = dirname(__FILE__) . '/config/problems.config.json';
         ProblemManager::getInstance($configPath, $store);
 
         // 3. Créer l'instance du moteur.

package/src/php/Tests/RequestUtilsTest.php

@@ -141,6 +141,35 @@ class RequestUtilsTest extends TestCase
         $this->assertLessThanOrEqual(3, count($attackerLogs));
     }
 
+    public function testSanitizeTrafficDataFiltersHardwareClusters(): void
+    {
+        $trafficData = [];
+        // Simulated attacker rotating deviceId and IP, but keeping identical hardware fingerprint
+        for ($i = 0; $i < 100; $i++) {
+            $trafficData[] = [
+                'deviceId' => "attacker_device_{$i}",
+                'clientIp' => "192.168.1.{$i}",
+                'type' => 'trap_triggered',
+                'fingerprint' => 'gpu:heavy_nvidia_hash|cvs:canvas_hash_1'
+            ];
+        }
+        // Legit users with unique hardware fingerprints
+        for ($i = 0; $i < 10; $i++) {
+            $trafficData[] = [
+                'deviceId' => "legit_device_{$i}",
+                'clientIp' => "10.0.0.{$i}",
+                'type' => 'challenge_solved',
+                'fingerprint' => "gpu:legit_gpu_{$i}|cvs:legit_cvs_{$i}"
+            ];
+        }
+
+        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
+        $attackerLogs = array_filter($sanitized, fn($log) => str_starts_with($log['deviceId'], 'attacker_device_'));
+
+        // Max limit of 2% of 110 total = 2.2 -> max(3, 2) = 3 logs allowed for this hardware cluster
+        $this->assertLessThanOrEqual(3, count($attackerLogs));
+    }
+
     public function testChallengePayloadSigningAndVerification(): void
     {
         $secret = 'test-fallback-dev-secret-32-chars-minimum';

package/src/php/Tests/TLSClientHelloParserTest.php

@@ -1,118 +1,178 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Utils\TLSClientHelloParser;
-use PHPUnit\Framework\TestCase;
-
-/**
- * Tests unitaires pour le décodeur binaire TLS Client Hello.
- */
-class TLSClientHelloParserTest extends TestCase
-{
-    /**
-     * Helper pour construire un paquet TLS Client Hello binaire valide et réaliste.
-     *
-     * @param int $sslVersion Version TLS (ex: 0x0303 pour TLS 1.2)
-     * @param array<int> $ciphers Liste des Cipher Suites
-     * @param array<array{type: int, data: string}> $extensions Liste des extensions
-     * @return string Paquet binaire brut
-     */
-    private function buildMockClientHello(int $sslVersion = 0x0303, array $ciphers = [4865, 2570], array $extensions = []): string
-    {
-        $recordType = pack('C', 0x16); // Handshake Record (22)
-        $recordVersion = pack('n', 0x0301); // TLS 1.0 record layer version
-        $recordLength = pack('n', 120); // Dummy length
-
-        $handshakeType = pack('C', 0x01); // Client Hello (1)
-        $handshakeLength = pack('C3', 0, 0, 110); // Dummy length
-
-        $clientVersion = pack('n', $sslVersion);
-        $random = str_repeat("\x00", 32); // Random de 32 octets
-        $sessionId = pack('C', 0x00); // Session ID vide (longueur 0)
-
-        // Construction des Cipher Suites
-        $ciphersBinary = '';
-        foreach ($ciphers as $cipher) {
-            $ciphersBinary .= pack('n', $cipher);
-        }
-        $ciphersPayload = pack('n', strlen($ciphersBinary)) . $ciphersBinary;
-
-        // Compression Methods (Standard: 1 méthode, valeur 0x00 = null)
-        $compression = pack('C2', 1, 0);
-
-        // Construction des Extensions
-        $extensionsBinary = '';
-        foreach ($extensions as $ext) {
-            $extensionsBinary .= pack('n', $ext['type']) . pack('n', strlen($ext['data'])) . $ext['data'];
-        }
-        $extensionsPayload = pack('n', strlen($extensionsBinary)) . $extensionsBinary;
-
-        return $recordType . $recordVersion . $recordLength . $handshakeType . $handshakeLength . $clientVersion . $random . $sessionId . $ciphersPayload . $compression . $extensionsPayload;
-    }
-
-    public function testParseValidClientHelloWithGreaseAndExtensions(): void
-    {
-        // On injecte l'extension 10 (Supported Groups / Curves)
-        // Data: 4 octets de longueur de liste + 29 (X25519) + 2570 (GREASE)
-        $extCurves = [
-            'type' => 10,
-            'data' => pack('n', 4) . pack('n2', 29, 2570)
-        ];
-
-        // On injecte l'extension 11 (EC Point Formats)
-        // Data: 1 octet de longueur de liste + 0 (uncompressed)
-        $extPoints = [
-            'type' => 11,
-            'data' => pack('C2', 1, 0)
-        ];
-
-        // On build le paquet binaire de test
-        $binary = $this->buildMockClientHello(
-            0x0303, // SSL Version: 771 (TLS 1.2)
-            [4865, 2570], // Ciphers (2570 est une valeur GREASE)
-            [$extCurves, $extPoints]
-        );
-
-        $result = TLSClientHelloParser::parse($binary);
-
-        $this->assertNotNull($result);
-        
-        // Vérifications des filtrages GREASE et de la construction de la chaîne JA3
-        // Chaîne JA3 attendue: "Version,Ciphers,Extensions,Curves,Points"
-        // - Version: 771
-        // - Ciphers: 4865 (2570 a été nettoyé car GREASE)
-        // - Extensions: 10-11
-        // - Curves: 29 (2570 a été nettoyé car GREASE)
-        // - Points: 0
-        $expectedJa3String = '771,4865,10-11,29,0';
-        $this->assertSame($expectedJa3String, $result['ja3_string']);
-        $this->assertSame(md5($expectedJa3String), $result['ja3_hash']);
-    }
-
-    public function testParseReturnsNullWhenPacketTooShort(): void
-    {
-        $shortBinary = str_repeat("\x16", 40);
-        $this->assertNull(TLSClientHelloParser::parse($shortBinary));
-    }
-
-    public function testParseReturnsNullOnInvalidRecordType(): void
-    {
-        // 0x17 au lieu de 0x16 (Application data au lieu de Handshake)
-        $invalidRecord = $this->buildMockClientHello();
-        $invalidRecord[0] = chr(0x17);
-
-        $this->assertNull(TLSClientHelloParser::parse($invalidRecord));
-    }
-
-    public function testParseReturnsNullOnInvalidHandshakeType(): void
-    {
-        // 0x02 au lieu de 0x01 (Server Hello au lieu de Client Hello)
-        $invalidHandshake = $this->buildMockClientHello();
-        $invalidHandshake[5] = chr(0x02);
-
-        $this->assertNull(TLSClientHelloParser::parse($invalidHandshake));
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Utils\TLSClientHelloParser;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests unitaires pour le décodeur binaire TLS Client Hello.
+ */
+class TLSClientHelloParserTest extends TestCase
+{
+    /**
+     * Helper pour construire un paquet TLS Client Hello binaire valide et réaliste.
+     *
+     * @param int $sslVersion Version TLS (ex: 0x0303 pour TLS 1.2)
+     * @param array<int> $ciphers Liste des Cipher Suites
+     * @param array<array{type: int, data: string}> $extensions Liste des extensions
+     * @return string Paquet binaire brut
+     */
+    private function buildMockClientHello(int $sslVersion = 0x0303, array $ciphers = [4865, 2570], array $extensions = []): string
+    {
+        $recordType = pack('C', 0x16); // Handshake Record (22)
+        $recordVersion = pack('n', 0x0301); // TLS 1.0 record layer version
+        $recordLength = pack('n', 120); // Dummy length
+
+        $handshakeType = pack('C', 0x01); // Client Hello (1)
+        $handshakeLength = pack('C3', 0, 0, 110); // Dummy length
+
+        $clientVersion = pack('n', $sslVersion);
+        $random = str_repeat("\x00", 32); // Random de 32 octets
+        $sessionId = pack('C', 0x00); // Session ID vide (longueur 0)
+
+        // Construction des Cipher Suites
+        $ciphersBinary = '';
+        foreach ($ciphers as $cipher) {
+            $ciphersBinary .= pack('n', $cipher);
+        }
+        $ciphersPayload = pack('n', strlen($ciphersBinary)) . $ciphersBinary;
+
+        // Compression Methods (Standard: 1 méthode, valeur 0x00 = null)
+        $compression = pack('C2', 1, 0);
+
+        // Construction des Extensions
+        $extensionsBinary = '';
+        foreach ($extensions as $ext) {
+            $extensionsBinary .= pack('n', $ext['type']) . pack('n', strlen($ext['data'])) . $ext['data'];
+        }
+        $extensionsPayload = pack('n', strlen($extensionsBinary)) . $extensionsBinary;
+
+        return $recordType . $recordVersion . $recordLength . $handshakeType . $handshakeLength . $clientVersion . $random . $sessionId . $ciphersPayload . $compression . $extensionsPayload;
+    }
+
+    public function testParseValidClientHelloWithGreaseAndExtensions(): void
+    {
+        // On injecte l'extension 10 (Supported Groups / Curves)
+        // Data: 4 octets de longueur de liste + 29 (X25519) + 2570 (GREASE)
+        $extCurves = [
+            'type' => 10,
+            'data' => pack('n', 4) . pack('n2', 29, 2570)
+        ];
+
+        // On injecte l'extension 11 (EC Point Formats)
+        // Data: 1 octet de longueur de liste + 0 (uncompressed)
+        $extPoints = [
+            'type' => 11,
+            'data' => pack('C2', 1, 0)
+        ];
+
+        // On build le paquet binaire de test
+        $binary = $this->buildMockClientHello(
+            0x0303, // SSL Version: 771 (TLS 1.2)
+            [4865, 2570], // Ciphers (2570 est une valeur GREASE)
+            [$extCurves, $extPoints]
+        );
+
+        $result = TLSClientHelloParser::parse($binary);
+
+        $this->assertNotNull($result);
+        
+        // Vérifications des filtrages GREASE et de la construction de la chaîne JA3
+        // Chaîne JA3 attendue: "Version,Ciphers,Extensions,Curves,Points"
+        // - Version: 771
+        // - Ciphers: 4865 (2570 a été nettoyé car GREASE)
+        // - Extensions: 10-11
+        // - Curves: 29 (2570 a été nettoyé car GREASE)
+        // - Points: 0
+        $expectedJa3String = '771,4865,10-11,29,0';
+        $this->assertSame($expectedJa3String, $result['ja3_string']);
+        $this->assertSame(md5($expectedJa3String), $result['ja3_hash']);
+    }
+
+        public function testParseValidClientHelloWithJa4(): void
+        {
+            // On injecte l'extension 0 (SNI) avec données vides
+            $extSni = [
+                'type' => 0,
+                'data' => pack('n', 0)
+            ];
+
+            // On injecte l'extension 16 (ALPN)
+            // Data: list len (3) + str len (2) + "h2"
+            $extAlpn = [
+                'type' => 16,
+                'data' => pack('n', 3) . pack('C', 2) . 'h2'
+            ];
+
+            // On injecte l'extension 13 (Signature Algorithms)
+            // Data: list len (4) + 2 sig algs (0x0401, 0x0804)
+            $extSigAlgs = [
+                'type' => 13,
+                'data' => pack('n', 4) . pack('n2', 0x0401, 0x0804)
+            ];
+
+            // On injecte l'extension 43 (Supported Versions) pour forcer la version TLS 1.3 (0x0304)
+            // Data: list len (4) + 2 versions (0x0304, 0x0303)
+            $extSupportedVersions = [
+                'type' => 43,
+                'data' => pack('C', 4) . pack('n2', 0x0304, 0x0303)
+            ];
+
+            // On build le paquet binaire de test
+            $binary = $this->buildMockClientHello(
+                0x0303, // Version de base
+                [4865, 2570], // Ciphers (2570 est GREASE, sera ignoré dans les comptes)
+                [$extSni, $extAlpn, $extSigAlgs, $extSupportedVersions]
+            );
+
+            $result = TLSClientHelloParser::parse($binary);
+
+            $this->assertNotNull($result);
+            $this->assertArrayHasKey('ja4_raw', $result);
+
+            // Version la plus haute: 0x0304 -> "13"
+            // SNI présent: "d"
+            // Nombre de ciphers (hors GREASE): 4865 (0x1301) -> 1 -> "01"
+            // Nombre d'extensions (hors GREASE): 0, 13, 16, 43 -> 4 -> "04"
+            // ALPN: "h2"
+            // Partie A attendue: "t13d0104h2"
+            $this->assertStringStartsWith('t13d0104h2', $result['ja4_raw']);
+
+            // Partie B: hash sha256 de "1301" haché en hexadécimal et tronqué à 12 caractères
+            $expectedJa4b = substr(hash('sha256', '1301'), 0, 12);
+            $this->assertStringContainsString($expectedJa4b, $result['ja4_raw']);
+
+            // Partie C: extensions triées et hachées: "0000,000d,0010,002b_0401,0804"
+            $extensionsString = '0000,000d,0010,002b';
+            $sigAlgsString = '0401,0804';
+            $expectedJa4c = substr(hash('sha256', $extensionsString . '_' . $sigAlgsString), 0, 12);
+            $this->assertStringEndsWith($expectedJa4c, $result['ja4_raw']);
+        }
+
+    public function testParseReturnsNullWhenPacketTooShort(): void
+    {
+        $shortBinary = str_repeat("\x16", 40);
+        $this->assertNull(TLSClientHelloParser::parse($shortBinary));
+    }
+
+    public function testParseReturnsNullOnInvalidRecordType(): void
+    {
+        // 0x17 au lieu de 0x16 (Application data au lieu de Handshake)
+        $invalidRecord = $this->buildMockClientHello();
+        $invalidRecord[0] = chr(0x17);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidRecord));
+    }
+
+    public function testParseReturnsNullOnInvalidHandshakeType(): void
+    {
+        // 0x02 au lieu de 0x01 (Server Hello au lieu de Client Hello)
+        $invalidHandshake = $this->buildMockClientHello();
+        $invalidHandshake[5] = chr(0x02);
+
+        $this->assertNull(TLSClientHelloParser::parse($invalidHandshake));
+    }
 }