Chrome Participated Tamper Detect

components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect_unittest.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string.h>
+#include <algorithm>
+#include <vector>
+
+#include "base/base64.h"
+#include "base/md5.h"
+
+#include "components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+std::string GetEncoded(std::string input) {
+  base::MD5Context context;
+  base::MD5Init(&context);
+  base::MD5Update(&context, input);
+  base::MD5Digest new_digest;
+  base::MD5Final(&new_digest, &context);
+
+  std::string temp = std::string((char*)new_digest.a, 16);
+  std::string ret;
+  base::Base64Encode(temp, &ret);
+  return ret;
+}
+
+namespace {
+
+void HeadersToRaw(std::string* headers) {
+  std::replace(headers->begin(), headers->end(), '\n', '\0');
+  if (!headers->empty())
+    *headers += '\0';
+}
+
+struct TestCase {
+  const char* raw_header;
+  std::string received_fingerprint;
+  bool expected_result;

[bolian, 2014/06/25 18:55:56]

What does the expected_result mean? Tampered or not?  Name it expected_tampered
or something like. Variable names should be self-explaining. If names are not
enough, add comments.

+};
+
+struct TestCaseContentLength {
+  const char* raw_header;
+  std::string received_fingerprint;
+  bool expected_result;
+  std::string mime_type;
+};
+
+class DataReductionProxyTamperDetectTest : public testing::Test {
+};
+
+void TestFingerprintCommon(const TestCase& test, int fingerprintNumber) {
+  std::string raw_headers(test.raw_header);
+  HeadersToRaw(&raw_headers);
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(raw_headers));
+
+  typedef bool (*CheckHeader)(const std::string,
+                              const net::HttpResponseHeaders*);
+
+  CheckHeader checkFuncs[] = {&data_reduction_proxy::CheckHeaderChromeProxy,
+                              &data_reduction_proxy::CheckHeaderVia,
+                              &data_reduction_proxy::CheckHeaderOtherHeaders};
+
+  EXPECT_EQ(test.expected_result, checkFuncs[fingerprintNumber](
+                                  test.received_fingerprint, headers));
+}
+
+void TestFingerprintContentLength(const TestCaseContentLength& test) {
+  std::string raw_headers(test.raw_header);
+  HeadersToRaw(&raw_headers);
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(raw_headers));
+
+  std::string mime_type;
+  bool equal = data_reduction_proxy::CheckHeaderContentLength(
+      test.received_fingerprint, headers, &mime_type);
+  EXPECT_EQ(test.expected_result, equal);
+  if (!equal)
+    EXPECT_EQ(mime_type, test.mime_type);
+}
+
+void TestParsingCommon(const std::string fp) {
+  std::string raw_headers(fp);
+  HeadersToRaw(&raw_headers);
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(raw_headers));
+
+  data_reduction_proxy::CheckResponseFingerprint(headers, true);
+}
+
+TEST(DataReductionProxyTamperDetectTest, ChromeProxy) {
+  TestCase test[] = {
+      // check sorting values and decoding
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,fp=123,bbbypas=0,aaxxx=xxx,bbbloc=1\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",

[bolian, 2014/06/25 18:55:56]

Can you address my previous comment about why not have two sets of headers?  the
fp values can be computed inside the test, right?

[xingx, 2014/06/25 20:55:43]

Right now the fp value is manually input, then calculate MD5 on that manually
input value if necessary.

Compare to input header and generate fp in unittest, the good part is we don't
need to implement fp generating process again in Chromium unittest, this has
following advantages:
1. no need to write code for generating fp, of course :)
2. no need to worry about the correctness of generating fp process
3. can check edge cases, which means we don't assume the fp Chromium received
makes sense, it can be anything, say a wrongly formatted one due to following
reasons:
   a. FW's generating fp process is wrong
   b. Middlebox changed the fp
   in above cases, the unittest needs to guarantee that the program doesn't
crash


We can discuss more about this.

+          true,
+      },
+
+      // check sorting
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: a,b,c,d,e,3,2,1,fp=1231\n",
+
+          "1,2,3,a,b,c,d,e,",
+          true,
+      },
+
+      // check no Chrome-Proxy header case (should not happen)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Length: 12345\n",
+
+          "",
+          true,
+      },
+
+      // check empty Chrome-Proxy header case (should not happen)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    \n",
+
+          ",",
+          true,
+      },
+
+      // check empty Chrome-Proxy header case
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    fp=xyz\n",
+
+          "",
+          true,
+      },
+
+      // check empty Chrome-Proxy header case, with extra ","
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:   fp=abcde   ,   \n",
+
+          "",
+          true,
+      },
+
+      // check empty Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    fp=xyz\n",
+
+          ",",
+          false,
+      },
+
+      // check regular Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=2,aaxxx=xxx,bbbloc=1\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false,
+      },
+
+      // check regular Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: a,aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false,
+      },
+
+      // check regular Chrome-Proxy header, with extra " "
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aut=aauutthh    ,   bbbypas=0   ,     aaxxx=xxx"
+          "              ,bbbloc=1     \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true
+      },
+
+      // check regular Chrome-Proxy header, with extra lines and " "
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aut=aauutthh    ,   bbbypas=0   , bbbloc=1    \n"
+          "Chrome-Proxy:    aaxxx=xxx \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true
+      },
+
+      // check Chrome-Proxy header with multiple lines
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Chrome-Proxy:bbbloc=1   \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true
+      },
+
+      // check Chrome-Proxy header with multiple lines, at different position
+      // of the entire header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true
+      },
+
+      // check Chrome-Proxy header with multiple same values
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1,   fp=123    \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true
+      },
+
+      // check Chrome-Proxy header with multiple same values,
+      // but different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false,
+      },
+
+      // check Chrome-Proxy header with multiple lines,
+      // but different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false,
+      },
+
+      // check regular Chrome-Proxy header, but received fingerprint is empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "",
+          false,
+      },
+
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    test[i].received_fingerprint =
+        GetEncoded(test[i].received_fingerprint);
+    TestFingerprintCommon(test[i], 0);
+    LOG(WARNING) << "f1 " <<i;
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, Via) {
+  TestCase test[] = {
+      // check regular case, where Chrome Proxy occurs at the last
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via: a, b, c, Chrome Proxy\n",
+
+          "0",
+          true
+      },
+
+      // check when there is extra middlebox
+      // between data-reduction-proxy and phone
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via: a, b,  c,   Chrome Proxy,    xyz\n",
+
+          "0",
+          false,
+      },
+
+      // emtpy Via header, even no Chrome Proxy tag
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  \n",
+
+          "0",
+          true,
+      },
+
+      // only Chrome Proxy tag occurs in Via header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  Chrome    \n",
+
+          "0",
+          true
+      },
+
+      // there are " ", i.e., empty value after Chrome Proxy tag
+      // should not count as extra middleboxes
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  Chrome  ,  , \n",
+
+          "0",
+          true
+      },
+
+      // special case when there is no Via header
+      {
+          "HTTP/1.1    202   Accepted  \n",
+
+          "0",
+          true
+      },
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    TestFingerprintCommon(test[i], 1);
+    LOG(WARNING) << "Xing  "<<i;
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, OtherHeaders) {
+  TestCase test[] = {
+      // regular case, with correct fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "1,;2,;3,;4,;5,;:content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, with correct fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,;aaa2,;aaa3,;aaa4,;aaa5,;:content-type:cache-control:"
+                                          "etag:connection:expires",
+          true
+      },
+
+      // regular case, one header is with multiple values
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,    bbb1, ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,;aaa2,;aaa3,;aaa4,;aaa5,;:"
+          "content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, one header has multiple lines
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,;aaa3,;aaa4,;aaa5,;:"
+                   "content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, one header has multiple lines,
+      // and such multiple lines occur at different positions
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,;aaa3,;aaa4,;aaa5,;"
+          ":content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, more than one header have multiple lines,
+      // and such multiple lines occur at different positions
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;aaa5,;:"
+          "content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, response header does not have one header we need
+      // for fingerprint (expires)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:"
+          "content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, response header does not have more than one header
+      // we need for fingerprint (content-type, expires)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:content-type:cache-control:"
+          "etag:connection:expires",
+          true
+      },
+
+      // regular case, all the headers we need for fingerprint are missing
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";;;;;:content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // regular case, but differ to received fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: etag\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:"
+          "content-type:cache-control:etag:connection:expires",
+          false,
+      },
+
+      // special case, headers are not missing but some of them are empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type:   \n"
+          "Cache-Control: \n"
+          "ETag: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ",;,;,;,;5,;:content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // special case, some headers do not exist, some are of empty value.
+      // check delimiter "," and ";" work correctly.
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";,;;,;5,;:content-type:cache-control:etag:connection:expires",
+          true
+      },
+
+      // special case, check if we don't check any header, i.e.,
+      // header list is empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "",
+          true
+      },
+
+      // special case, we only want to check one header, which does not
+      // exist in received header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";:non_exist_header",
+          true
+      },
+
+      // there is only one header in our header list
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";:content-type",
+          true
+      },
+
+      // special case, if base64 decoding fails
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";:content-type",
+          true
+      },
+
+      // special case, if base64 decoding fails
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "abcde:content-type:cache-control:etag:connection:expires",
+          true
+      },
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    if (i >= ARRAYSIZE_UNSAFE(test) - 2)
+    {
+      TestFingerprintCommon(test[i], 2);
+      continue;
+    }
+    size_t delimiter_pos = test[i].received_fingerprint.find(":");
+    std::string hash, rest;
+    if (delimiter_pos == std::string::npos)
+    {
+      delimiter_pos = test[i].received_fingerprint.size();
+      rest = "";
+    }
+    else
+      rest = test[i].received_fingerprint.substr(
+          delimiter_pos,
+          test[i].received_fingerprint.size() - delimiter_pos);
+    hash = test[i].received_fingerprint.substr(0, delimiter_pos);
+    test[i].received_fingerprint = GetEncoded(hash) + rest;
+
+    TestFingerprintCommon(test[i], 2);
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, ContentLength) {
+  TestCaseContentLength test[] = {
+      // regular case, content-length is the same
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n"
+          "Content-Length: 12345\n",
+
+          "12345",
+          true,
+          "1"
+      },
+
+      // regular case, content-length is not the same
+      // also check if retrieved content-type is correct
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/html; charset=ISO-8859-4\n"
+          "Content-Length: 12345\n",
+
+          "125",
+          false,
+          "text/html"
+      },
+
+      // special case, data reduction proxy does not sent content-length
+      // i.e., content-length at data reduction proxy side is missing
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/javascript\n"
+          "Content-Length: 12345\n",
+
+          "",
+          true,
+          "text/javascript"
+      },
+
+      // special case, content-length are missing at both end
+      // i.e., both data reduction proxy and chrome
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n",
+
+          "",
+          true,
+          "1"
+      },
+
+      // special case, check when content-length is 0
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript\n"
+          "Content-Length: 0\n",
+
+          "0",
+          true,
+          "application/x-javascript"
+      },
+
+      // special case, check when data reduction proxy side's
+      // content-length is empty (header exist, but value is empty)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript\n"
+          "Content-Length: 123\n",
+
+          ",",
+          true,
+          "application/x-javascript"
+      },
+
+      // when content-length is different, check whether it recognizes image.
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: image/gif \n"
+          "Content-Length: 123\n",
+
+          "0",
+          false,
+          "image/gif"
+      },
+
+      // when content-length is different, check whether it recognizes JS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript \n"
+          "Content-Length: 0\n",
+
+          "120",
+          false,
+          "application/x-javascript"
+      },
+
+      // when content-length is different, check whether it recognizes JS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/javascript \n"
+          "Content-Length: 123\n",
+
+          "0",
+          false,
+          "text/javascript"
+      },
+
+      // when content-length is different, check whether it recognizes CSS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/css\n"
+          "Content-Length: 111\n",
+
+          "0",
+          false,
+          "text/css"
+      },
+
+      // when content-length is different (chrome side is missing),
+      // check whether it recognizes JS.
+      // (if phone side's content-length has been removed, shall we report?
+      // current implementation: not reporting.)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/javascript \n",
+
+          "123",
+          true,
+          "application/javascript"
+      },
+
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    TestFingerprintContentLength(test[i]);
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, Parsing) {
+  std::string test[] = {
+    // check normal case
+    "Chrome-Proxy: f1:f1&f2:f2&f3:f3&f4:f4\n",
+    "Chrome-Proxy: fp=aa|bb|cc|dd\n",
+    // check special case if there are more delimiters
+    "Chrome-Proxy: fp=||||||||\n",
+    "Chrome-Proxy: fp=a|a|a|a|a|a|a|\n",
+    // check if there is no Chrome-Proxy header
+    "Content-Type: text/css\n",
+    // check if there is less delimiters
+    "Chrome-Proxy: fp= a | b | cde   \n",
+    "Chrome-Proxy: a=1, b=2, c=5",
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+      TestParsingCommon(test[i]);
+  }
+}
+
+} // namespace