@anonympins/fingerprint 0.7.4 → 0.8.0

package/CHANGELOG.md

@@ -1,3 +1,62 @@
+## Version 0.8.0
+
+- 🎟️ **Private Access Tokens (PAT / Privacy Pass) Support (RFC 9505, RFC 9577, RFC 9578)**:
+  - **Zero-Friction Cryptographic Bypass**: Integrated native validation for Privacy Pass tokens extracted from `Authorization: PrivateToken` and `Sec-Private-State-Token` headers. Clients presenting valid tokens obtain an immediate zero-friction bypass (`action: next`, `score: 0.0`) without executing CPU/Memory challenges or CAPTCHAs.
+  - **Multi-Algorithm Token Verification**: Supports Blind RSA (types `0x0001` and `0x0002` using RSA-PSS SHA-384 / SHA-256 and PKCS#1 v1.5 padding) as well as VOPRF / Ed25519 (type `0x0003`).
+  - **Anti-Replay Nonce Tracking**: Verified token nonces are indexed in the persistent datastore (`pat-nonce:{nonce}`) with configurable expiration (`pat.nonceTtl`, default 24h) to prevent token reuse.
+
+- 🔒 **TLS 1.3 Encrypted Client Hello (ECH) & RFC 9460 Validation**:
+  - Added deep inspection for ECH presence and Outer SNI discrepancies (`x-ech-outer-sni`, `x-ech-present`, `x-ech-expected`).
+  - Flags client connections where modern browsers (Chrome $\ge 119$, Firefox $\ge 118$) fail to negotiate ECH when expected on HTTPS endpoints.
+
+- 🌐 **HTTP/2 & QUIC / HTTP/3 Protocol Conformance (RFC 7540, RFC 9114, RFC 9218)**:
+  - **Hop-by-Hop Header Prohibition**: Enforced RFC 7540 and RFC 9114 constraints by heavily penalizing forbidden hop-by-hop headers (`Connection`, `Keep-Alive`, `Proxy-Connection`) on HTTP/2 and HTTP/3 multiplexed streams.
+  - **Extensible Prioritization Scheme (RFC 9218)**: Validated priority urgency bounds ($u \in [0, 7]$) and incremental flags (`i`), penalizing malformed or out-of-spec client priority frames.
+  - **HTTP/2 Stream Tree & Compression Analysis**: Added detection for stream self-dependency loops (`streamId === depStreamId`), non-browser priority frame distributions, and dynamic HPACK/QPACK table zero-entry anomalies under repeated requests.
+
+- 📡 **Passive MTU & Transport Tunnel Detection (`mtuAnomalyScore`)**:
+  - Analyzes TCP SYN parameters, Path MTU, and Don't Fragment (`DF`) flags across IPv4 and IPv6 to detect WireGuard, OpenVPN, GRE encapsulation, and residential proxy backconnects.
+  - **Dynamic Weight Amplification**: When an MTU anomaly indicates network tunneling ($\text{mtuAnomalyScore} > 50$), the engine dynamically amplifies downstream weights (`tlsSpoofingScore`, `crossLayerInconsistencyScore`, `clientHintsInconsistencyScore`, `behaviorScore`, `requestPatternScore`).
+
+- 🛠️ **WordPress Plugin: Sandbox Mode & Live Telemetry Feed**:
+  - **Dedicated Sandbox / Test Mode**: Configurable non-blocking Audit-Only mode, targeted IP whitelist filter, and diagnostic HTTP headers (`X-Fingerprint-Sandbox`, `X-Fingerprint-Score`).
+  - **Real-Time Observability**: Implemented a Server-Sent Events (SSE) streaming route (`/wp-json/fingerprint/v1/sandbox/sse`) and a REST polling endpoint (`/wp-json/fingerprint/v1/sandbox/telemetry`) to monitor challenged visitors and suspicion vector breakdowns live.
+  - **Client-Side Event Injection**: Injects `window.__FINGERPRINT_VECTOR__` and dispatches `fingerprint:suspicion` DOM CustomEvents when sandbox mode or administrative sessions are active.
+
+- 🌍 **Code Standardization & Parity**:
+  - **Python Engine Enhancements**: Merged modular architecture improvements (`feature/python_classes`) for parity with Node.js and PHP.
+  - **Java Testing**: Added comprehensive test coverage for RFC 9578 Private Access Token extraction, parsing, and anti-replay verification (`PatTest.java`).
+  - **Documentation & Localization**: Standardized code comments into English across modules and updated French/German translations in compliance with WordPress guidelines.
+
+---
+
+## Version 0.7.5
+
+- 🛡️ **Differential Privacy on Federated Threat Intelligence**:
+  - **Laplacian Noise on Federation Timestamps ($\text{Laplace}(0, b)$)**: Added mathematical perturbation to exact event timestamps in federated ban exchanges (`share_threat_intel`) parameterized by sensitivity $\Delta t = 5000\text{ms}$ and privacy budget $\epsilon$ (`differentialPrivacy.epsilon`). Timestamps are bounded within a safe $\pm 60\text{s}$ window to satisfy anti-replay checks while completely preventing malicious or compromised federation nodes from reconstructing inter-domain browsing trajectories via millisecond timing correlation.
+  - **Randomized Response Decoy Injection (Chaffing)**: Implemented randomized response logic where nodes inject and broadcast synthetic ZKP public keys generated uniformly in $\mathbb{Z}_p$ with probability $p = 1 / (1 + e^{\epsilon})$ (or customizable `dummyRate`). Due to the negligible collision probability of 256-bit keys ($\approx 2^{-256}$), decoys never reach the collaborative consensus threshold ($K \ge 3$), guaranteeing mathematical plausible deniability without causing false positives.
+  - **Multi-Runtime Parity**: Fully implemented across JavaScript (`fingerprint.js`), PHP (`FingerprintEngine.php`), Python (`engine.py`), and Java (`FingerprintEngine.java`, `FingerprintProperties.java`).
+
+- 🌐 **Network Layer Anomaly Detection**:
+  - **MTU Anomaly Scoring (`mtuAnomalyScore`)**: Introduced `mtuAnomalyScore` to the suspicion vector and configuration weights across all runtimes. Evaluates passive TCP SYN options (specifically MSS — Maximum Segment Size) to detect anomalous MTU values typical of VPN/GRE tunneling, WireGuard encapsulation, or residential proxy backconnect chains attempting to masquerade as standard domestic browser connections.
+
+- ♿ **Accessibility (a11y) & Invisible Honeypot Hardening**:
+  - **Screen-Reader Compliant Honeypot Fields**: Hardened dynamic DOM honeypot generation within `FingerprintClient` with `aria-hidden="true"`, `tabindex="-1"`, and `autocomplete="off"` attributes combined with defensive offscreen CSS positioning (`position: absolute; left: -9999px; transform: scale(0); opacity: 0; pointer-events: none;`). Ensures assistive technologies (NVDA, JAWS, VoiceOver) and browser autofill routines ignore honeypot inputs for visually impaired users while maintaining a 100% trap catch rate against automated scrapers.
+
+- 🤖 **Crawler Whitelist Updates & Multi-Language Parity**:
+  - **Meta / Facebook Whitelist Addition**: Added dedicated IP subnets and CIDR definitions for Meta and Facebook crawlers (`facebookexternalhit`, `31.13.64.0/18`, `66.220.144.0/20`, `69.63.176.0/20`, `157.240.0.0/16`) to guarantee smooth link preview generation and indexing without challenge interruptions.
+  - **Cross-Platform Whitelist Synchronization**: Standardized crawler allowlists and DNS verification workflows (Googlebot, Bingbot, Yandex, Facebook) across all supported backend engines (Node.js, PHP, Python, and Java).
+
+- 🔧 **Core Engine Refinements**:
+  - **`fingerprint.js` Updates**: Synchronized client-side metric collectors, refined behavioral input tracking, and plugged federation broadcast hooks directly into the core security pipeline.
+  - **Java Configuration Enhancements**: Added missing getters/setters and mapped configuration fields (`quicAnomalyScore`, `virtualizationScore`, `differentialPrivacy`, `federatedPeers`) in `FingerprintProperties.java`.
+  - **PHP Store Lifecycle**: Resolved initialization order edge cases for store instances during request processing in `FingerprintEngine.php`.
+
+- 📖 **Documentation**:
+  - **Configuration Options Reference (`full_options.md`)**: Documented all new settings, including `mtuAnomalyScore`, `differentialPrivacy` block (`enabled`, `epsilon`, `dummyRate`), and federated threat sharing parameters.
+
+---
+
 ## Version 0.7.4
 
 - 🛡️ **Security & Rate Limiting**:

package/README.md

@@ -91,7 +91,7 @@ In your **pom.xml**, add :
 <dependency>
     <groupId>com.anonympins</groupId>
     <artifactId>fingerprint-engine</artifactId>
-    <version>0.7.4</version>
+    <version>0.8.0</version>
 </dependency>
 ```
 ## Documentation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.7.4",
+  "version": "0.8.0",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/dynamic-wasm.js

@@ -1,219 +1,219 @@
-import crypto from "node:crypto";
-
-function encodeULEB128(val) {
-    const bytes = [];
-    let num = val >>> 0;
-    do {
-        let byte = num & 0x7f;
-        num >>>= 7;
-        if (num !== 0) byte |= 0x80;
-        bytes.push(byte);
-    } while (num !== 0);
-    return bytes;
-}
-
-function encodeSLEB128(val) {
-    const bytes = [];
-    let num = val | 0;
-    while (true) {
-        let byte = num & 0x7f;
-        num >>= 7;
-        if ((num === 0 && (byte & 0x40) === 0) || (num === -1 && (byte & 0x40) !== 0)) {
-            bytes.push(byte);
-            break;
-        }
-        bytes.push(byte | 0x80);
-    }
-    return bytes;
-}
-
-function getRandomNonTrivialOpcodes(tempLocal) {
-    const insts = [];
-    const ops = [
-        // local.get tempLocal, i32.const rand, rotl, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x77, 0x21, tempLocal],
-        // local.get tempLocal, i32.const rand, rotr, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x78, 0x21, tempLocal],
-        // local.get tempLocal, i32.const rand, xor, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(0, 10000)), 0x73, 0x21, tempLocal],
-        // local.get tempLocal, popcnt, i32.const rand, mul, local.set tempLocal
-        () => [0x20, tempLocal, 0x69, 0x41, ...encodeSLEB128(crypto.randomInt(1, 1001)), 0x6c, 0x21, tempLocal],
-        // local.get tempLocal, clz, local.get tempLocal, ctz, add, local.set tempLocal
-        () => [0x20, tempLocal, 0x67, 0x20, tempLocal, 0x68, 0x6a, 0x21, tempLocal]
-    ];
-    const count = crypto.randomInt(2, 5);
-    for (let i = 0; i < count; i++) {
-        const op = ops[crypto.randomInt(0, ops.length)];
-        insts.push(...op());
-    }
-    return insts;
-}
-
-function generatePolymorphicInstructions(stateLocal = 4, tempLocal = 5) {
-    const insts = [];
-    
-    // Initialize tempLocal with a random value
-    const initVal = crypto.randomInt(-500, 500);
-    insts.push(0x41, ...encodeSLEB128(initVal), 0x21, tempLocal);
-
-    // Initialize stateLocal to 0
-    insts.push(0x41, ...encodeSLEB128(0), 0x21, stateLocal);
-
-    // Loop & Block for state machine
-    insts.push(0x03, 0x40); // loop
-    insts.push(0x02, 0x40); // block
-
-    for (let state = 0; state < 3; state++) {
-        insts.push(0x20, stateLocal, 0x41, ...encodeSLEB128(state), 0x46); // state == expected
-        insts.push(0x04, 0x40); // if
-        insts.push(...getRandomNonTrivialOpcodes(tempLocal));
-        insts.push(0x41, ...encodeSLEB128(state + 1), 0x21, stateLocal); // transit to state + 1
-        insts.push(0x0c, ...encodeULEB128(2)); // br 2 (targets loop start)
-        insts.push(0x0b); // end if
-    }
-
-    // Fallthrough / Default break (targets block depth 0, which exits the loop)
-    insts.push(0x0c, ...encodeULEB128(0));
-
-    // end block
-    insts.push(0x0b);
-    // end loop
-    insts.push(0x0b);
-
-    return insts;
-}
-
-export class DynamicWasmGenerator {
-    /**
-     * Generates a unique polymorphic WebAssembly module containing a custom hash function
-     * with randomized constants and control flow variables.
-     * @param {object} constants - Custom seed, multiplier and adder.
-     * @returns {Buffer} Valid WebAssembly binary buffer.
-     */
-    static generate(constants) {
-        const { seed, multiplier, adder } = constants;
-
-        const preLoopPoly = generatePolymorphicInstructions(4, 5);
-        const midLoopPoly = generatePolymorphicInstructions(4, 5);
-
-        const inst = [
-            0x01, 0x06, 0x7f, // Locals: 1 entry of 6 locals of type i32
-            ...preLoopPoly,
-            // h = seed
-            0x41, ...encodeSLEB128(seed),
-            0x21, 0x03,
-            // i = 0
-            0x41, 0x00,
-            0x21, 0x02,
-
-            // block
-            0x02, 0x40,
-            // loop
-            0x03, 0x40,
-
-            // if i >= len break
-            0x20, 0x02,
-            0x20, 0x01,
-            0x4f,
-            0x0d, 0x01,
-
-            // byte = load8_u(ptr + i)
-            0x20, 0x00,
-            0x20, 0x02,
-            0x6a,
-            0x2d, 0x00, 0x00,
-
-            // h = h ^ byte
-            0x20, 0x03,
-            0x73,
-
-            // h = h * multiplier
-            0x41, ...encodeSLEB128(multiplier),
-            0x6c,
-
-            // h = h + adder
-            0x41, ...encodeSLEB128(adder),
-            0x6a,
-
-            // local.set 3
-            0x21, 0x03,
-            ...midLoopPoly,
-
-            // i = i + 1
-            0x20, 0x02,
-            0x41, 0x01,
-            0x6a,
-            0x21, 0x02,
-
-            // br 0
-            0x0c, 0x00,
-
-            0x0b, // end loop
-            0x0b, // end block
-
-            // return h
-            0x20, 0x03,
-            0x0b // end function
-        ];
-
-        const funcBody = [
-            ...encodeULEB128(inst.length),
-            ...inst
-        ];
-
-        const codeSectionPayload = [
-            ...encodeULEB128(1),
-            ...funcBody
-        ];
-
-        const codeSection = [
-            0x0a,
-            ...encodeULEB128(codeSectionPayload.length),
-            ...codeSectionPayload
-        ];
-
-        const typeSection = [
-            0x01, 0x07, 0x01, 0x60, 0x02, 0x7f, 0x7f, 0x01, 0x7f
-        ];
-
-        const funcSection = [
-            0x03, 0x02, 0x01, 0x00
-        ];
-
-        const memSection = [
-            0x05, 0x03, 0x01, 0x00, 0x01
-        ];
-
-        const exportSection = [
-            0x07, 0x11, 0x02, 0x04, 0x68, 0x61, 0x73, 0x68, 0x00, 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00
-        ];
-
-        const wasm = [
-            0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
-            ...typeSection,
-            ...funcSection,
-            ...memSection,
-            ...exportSection,
-            ...codeSection
-        ];
-
-        return Buffer.from(wasm);
-    }
-
-    /**
-     * Pure JavaScript fallback equivalent of the custom polymorphic hash.
-     * @param {string} str Input string.
-     * @param {object} constants Parameters.
-     * @returns {number} 32-bit unsigned integer hash.
-     */
-    static hashJs(str, constants) {
-        const { seed, multiplier, adder } = constants;
-        let h = seed | 0;
-        for (let i = 0; i < str.length; i++) {
-            const byte = str.charCodeAt(i) & 0xff;
-            h = h ^ byte;
-            h = Math.imul(h, multiplier) + adder;
-        }
-        return h >>> 0;
-    }
+import crypto from "node:crypto";
+
+function encodeULEB128(val) {
+    const bytes = [];
+    let num = val >>> 0;
+    do {
+        let byte = num & 0x7f;
+        num >>>= 7;
+        if (num !== 0) byte |= 0x80;
+        bytes.push(byte);
+    } while (num !== 0);
+    return bytes;
+}
+
+function encodeSLEB128(val) {
+    const bytes = [];
+    let num = val | 0;
+    while (true) {
+        let byte = num & 0x7f;
+        num >>= 7;
+        if ((num === 0 && (byte & 0x40) === 0) || (num === -1 && (byte & 0x40) !== 0)) {
+            bytes.push(byte);
+            break;
+        }
+        bytes.push(byte | 0x80);
+    }
+    return bytes;
+}
+
+function getRandomNonTrivialOpcodes(tempLocal) {
+    const insts = [];
+    const ops = [
+        // local.get tempLocal, i32.const rand, rotl, local.set tempLocal
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x77, 0x21, tempLocal],
+        // local.get tempLocal, i32.const rand, rotr, local.set tempLocal
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x78, 0x21, tempLocal],
+        // local.get tempLocal, i32.const rand, xor, local.set tempLocal
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(0, 10000)), 0x73, 0x21, tempLocal],
+        // local.get tempLocal, popcnt, i32.const rand, mul, local.set tempLocal
+        () => [0x20, tempLocal, 0x69, 0x41, ...encodeSLEB128(crypto.randomInt(1, 1001)), 0x6c, 0x21, tempLocal],
+        // local.get tempLocal, clz, local.get tempLocal, ctz, add, local.set tempLocal
+        () => [0x20, tempLocal, 0x67, 0x20, tempLocal, 0x68, 0x6a, 0x21, tempLocal]
+    ];
+    const count = crypto.randomInt(2, 5);
+    for (let i = 0; i < count; i++) {
+        const op = ops[crypto.randomInt(0, ops.length)];
+        insts.push(...op());
+    }
+    return insts;
+}
+
+function generatePolymorphicInstructions(stateLocal = 4, tempLocal = 5) {
+    const insts = [];
+    
+    // Initialize tempLocal with a random value
+    const initVal = crypto.randomInt(-500, 500);
+    insts.push(0x41, ...encodeSLEB128(initVal), 0x21, tempLocal);
+
+    // Initialize stateLocal to 0
+    insts.push(0x41, ...encodeSLEB128(0), 0x21, stateLocal);
+
+    // Loop & Block for state machine
+    insts.push(0x03, 0x40); // loop
+    insts.push(0x02, 0x40); // block
+
+    for (let state = 0; state < 3; state++) {
+        insts.push(0x20, stateLocal, 0x41, ...encodeSLEB128(state), 0x46); // state == expected
+        insts.push(0x04, 0x40); // if
+        insts.push(...getRandomNonTrivialOpcodes(tempLocal));
+        insts.push(0x41, ...encodeSLEB128(state + 1), 0x21, stateLocal); // transit to state + 1
+        insts.push(0x0c, ...encodeULEB128(2)); // br 2 (targets loop start)
+        insts.push(0x0b); // end if
+    }
+
+    // Fallthrough / Default break (targets block depth 0, which exits the loop)
+    insts.push(0x0c, ...encodeULEB128(0));
+
+    // end block
+    insts.push(0x0b);
+    // end loop
+    insts.push(0x0b);
+
+    return insts;
+}
+
+export class DynamicWasmGenerator {
+    /**
+     * Generates a unique polymorphic WebAssembly module containing a custom hash function
+     * with randomized constants and control flow variables.
+     * @param {object} constants - Custom seed, multiplier and adder.
+     * @returns {Buffer} Valid WebAssembly binary buffer.
+     */
+    static generate(constants) {
+        const { seed, multiplier, adder } = constants;
+
+        const preLoopPoly = generatePolymorphicInstructions(4, 5);
+        const midLoopPoly = generatePolymorphicInstructions(4, 5);
+
+        const inst = [
+            0x01, 0x06, 0x7f, // Locals: 1 entry of 6 locals of type i32
+            ...preLoopPoly,
+            // h = seed
+            0x41, ...encodeSLEB128(seed),
+            0x21, 0x03,
+            // i = 0
+            0x41, 0x00,
+            0x21, 0x02,
+
+            // block
+            0x02, 0x40,
+            // loop
+            0x03, 0x40,
+
+            // if i >= len break
+            0x20, 0x02,
+            0x20, 0x01,
+            0x4f,
+            0x0d, 0x01,
+
+            // byte = load8_u(ptr + i)
+            0x20, 0x00,
+            0x20, 0x02,
+            0x6a,
+            0x2d, 0x00, 0x00,
+
+            // h = h ^ byte
+            0x20, 0x03,
+            0x73,
+
+            // h = h * multiplier
+            0x41, ...encodeSLEB128(multiplier),
+            0x6c,
+
+            // h = h + adder
+            0x41, ...encodeSLEB128(adder),
+            0x6a,
+
+            // local.set 3
+            0x21, 0x03,
+            ...midLoopPoly,
+
+            // i = i + 1
+            0x20, 0x02,
+            0x41, 0x01,
+            0x6a,
+            0x21, 0x02,
+
+            // br 0
+            0x0c, 0x00,
+
+            0x0b, // end loop
+            0x0b, // end block
+
+            // return h
+            0x20, 0x03,
+            0x0b // end function
+        ];
+
+        const funcBody = [
+            ...encodeULEB128(inst.length),
+            ...inst
+        ];
+
+        const codeSectionPayload = [
+            ...encodeULEB128(1),
+            ...funcBody
+        ];
+
+        const codeSection = [
+            0x0a,
+            ...encodeULEB128(codeSectionPayload.length),
+            ...codeSectionPayload
+        ];
+
+        const typeSection = [
+            0x01, 0x07, 0x01, 0x60, 0x02, 0x7f, 0x7f, 0x01, 0x7f
+        ];
+
+        const funcSection = [
+            0x03, 0x02, 0x01, 0x00
+        ];
+
+        const memSection = [
+            0x05, 0x03, 0x01, 0x00, 0x01
+        ];
+
+        const exportSection = [
+            0x07, 0x11, 0x02, 0x04, 0x68, 0x61, 0x73, 0x68, 0x00, 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00
+        ];
+
+        const wasm = [
+            0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+            ...typeSection,
+            ...funcSection,
+            ...memSection,
+            ...exportSection,
+            ...codeSection
+        ];
+
+        return Buffer.from(wasm);
+    }
+
+    /**
+     * Pure JavaScript fallback equivalent of the custom polymorphic hash.
+     * @param {string} str Input string.
+     * @param {object} constants Parameters.
+     * @returns {number} 32-bit unsigned integer hash.
+     */
+    static hashJs(str, constants) {
+        const { seed, multiplier, adder } = constants;
+        let h = seed | 0;
+        for (let i = 0; i < str.length; i++) {
+            const byte = str.charCodeAt(i) & 0xff;
+            h = h ^ byte;
+            h = Math.imul(h, multiplier) + adder;
+        }
+        return h >>> 0;
+    }
 }