Chrome Participated Tamper Detect

components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect_unittest.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string.h>
+#include <algorithm>
+#include <vector>
+
+#include "base/base64.h"
+#include "base/md5.h"
+
+#include "components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+std::string GetEncoded(std::string input) {
+  base::MD5Context context;
+  base::MD5Init(&context);
+  base::MD5Update(&context, input);
+  base::MD5Digest new_digest;
+  base::MD5Final(&new_digest, &context);

[bolian, 2014/06/27 00:49:02]

use GetMD5 in your cc file.

+
+  std::string temp = std::string((char*)new_digest.a, 16);
+  std::string ret;
+  base::Base64Encode(temp, &ret);
+  return ret;
+}
+
+namespace {
+
+void HeadersToRaw(std::string* headers) {
+  std::replace(headers->begin(), headers->end(), '\n', '\0');
+  if (!headers->empty())
+    *headers += '\0';
+}
+
+struct TestCase {
+  const char* raw_header;

[bolian, 2014/06/27 02:16:58]

s/const char*/std::string/ ?

[xingx, 2014/06/27 16:34:38]

Done.

+  std::string received_fingerprint;
+  bool expected_result;

[bolian, 2014/06/27 02:16:58]

the var name is not clear, whether you expect tampered or not tampered. Rename
it expect_tampered.

[xingx, 2014/06/27 16:34:38]

Done.

+};
+
+class DataReductionProxyTamperDetectTest : public testing::Test {
+};
+
+void TestFingerprintCommon(const TestCase& test, int fingerprintNumber) {
+  std::string raw_headers(test.raw_header);
+  HeadersToRaw(&raw_headers);
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(raw_headers));
+
+  typedef bool (*CheckHeader)(const std::string,
+                              const net::HttpResponseHeaders*);
+
+  CheckHeader checkFuncs[] = {&data_reduction_proxy::CheckHeaderChromeProxy,

[bolian, 2014/06/27 02:16:58]

this table should be outside the func.

[xingx, 2014/06/27 16:34:37]

Done.

+                              &data_reduction_proxy::CheckHeaderVia,
+                              &data_reduction_proxy::CheckHeaderOtherHeaders,
+                              &data_reduction_proxy::CheckHeaderContentLength};
+
+  EXPECT_EQ(test.expected_result, checkFuncs[fingerprintNumber](

[bolian, 2014/06/27 00:49:02]

use enum instead of int for func index.

[xingx, 2014/06/27 16:34:37]

Done.

+                                  test.received_fingerprint, headers));
+}
+
+void TestParsingCommon(const std::string fp) {
+  std::string raw_headers(fp);
+  HeadersToRaw(&raw_headers);
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(raw_headers));
+
+  data_reduction_proxy::CheckResponseFingerprint(headers, false);
+}
+
+TEST(DataReductionProxyTamperDetectTest, ChromeProxy) {
+  TestCase test[] = {
+      // check sorting values and decoding
+      {
+          "HTTP/1.1    202   Accepted  \n"

[bolian, 2014/06/27 02:16:58]

why 202?

+          "Chrome-Proxy: aut=aauutthh,fp=123,bbbypas=0,aaxxx=xxx,bbbloc=1\n",

[bolian, 2014/06/27 02:16:58]

Either 
1) Make it real. replace 123 with the value computed in your test.  You can use
%s here and sprintf.
or
2) Comment that the fp value here is not the one being tested because ... 

+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false,
+      },
+
+      // check sorting
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: a,b,c,d,e,3,2,1,fp=1231\n",
+
+          "1,2,3,a,b,c,d,e,",
+          false,
+      },
+
+      // check no Chrome-Proxy header case (should not happen)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Length: 12345\n",
+
+          "",
+          false,
+      },
+
+      // check empty Chrome-Proxy header case (should not happen)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    \n",
+
+          ",",
+          false,
+      },
+
+      // check empty Chrome-Proxy header case
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    fp=xyz\n",
+
+          "",
+          false,
+      },
+
+      // check empty Chrome-Proxy header case, with extra ","
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:   fp=abcde   ,   \n",
+
+          "",
+          false,
+      },
+
+      // check empty Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:    fp=xyz\n",
+
+          ",",
+          true,
+      },
+
+      // check regular Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=2,aaxxx=xxx,bbbloc=1\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true,
+      },
+
+      // check regular Chrome-Proxy header, different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: a,aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true,
+      },
+
+      // check regular Chrome-Proxy header, with extra " "
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aut=aauutthh    ,   bbbypas=0   ,     aaxxx=xxx"
+          "              ,bbbloc=1     \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false
+      },
+
+      // check regular Chrome-Proxy header, with extra lines and " "
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aut=aauutthh    ,   bbbypas=0   , bbbloc=1    \n"
+          "Chrome-Proxy:    aaxxx=xxx \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false
+      },
+
+      // check Chrome-Proxy header with multiple lines
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Chrome-Proxy:bbbloc=1   \n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false
+      },
+
+      // check Chrome-Proxy header with multiple lines, at different position
+      // of the entire header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false
+      },
+
+      // check Chrome-Proxy header with multiple same values
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1,   fp=123    \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          false
+      },
+
+      // check Chrome-Proxy header with multiple same values,
+      // but different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true,
+      },
+
+      // check Chrome-Proxy header with multiple lines,
+      // but different fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "aaxxx=xxx,aaxxx=xxx,aut=aauutthh,bbbloc=1,bbbypas=0,",
+          true,
+      },
+
+      // check regular Chrome-Proxy header, but received fingerprint is empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Chrome-Proxy:    aut=aauutthh\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Chrome-Proxy:    bbbypas=0\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Chrome-Proxy:    bbbloc=1\n"
+          "Chrome-Proxy:     aaxxx=xxx   \n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "",
+          true,
+      },
+
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    test[i].received_fingerprint =

[bolian, 2014/06/27 02:16:58]

don't rewrite the test field. Rename the field and pass the fingerprint to your
test helper.

+        GetEncoded(test[i].received_fingerprint);
+    TestFingerprintCommon(test[i], 0);
+    LOG(WARNING) << "f1 " <<i;
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, Via) {
+  TestCase test[] = {
+      // check regular case, where Chrome Proxy occurs at the last
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via: a, b, c, Chrome Proxy\n",

[bolian, 2014/06/27 02:16:58]

use the actual data reduction proxy via header value. Expose the value from
components/data_reduction_proxy/common/data_reduction_proxy_headers.cc and use
it here.

+
+          "0",
+          false
+      },
+
+      // check when there is extra middlebox
+      // between data-reduction-proxy and phone
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via: a, b,  c,   Chrome Proxy,    xyz\n",
+
+          "0",
+          true,
+      },
+
+      // emtpy Via header, even no Chrome Proxy tag
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  \n",
+
+          "0",
+          false,
+      },
+
+      // only Chrome Proxy tag occurs in Via header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  Chrome    \n",
+
+          "0",
+          false
+      },
+
+      // there are " ", i.e., empty value after Chrome Proxy tag
+      // should not count as extra middleboxes
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Via:  Chrome  ,  , \n",
+
+          "0",
+          false
+      },
+
+      // special case when there is no Via header
+      {
+          "HTTP/1.1    202   Accepted  \n",
+
+          "0",
+          false
+      },
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    TestFingerprintCommon(test[i], 1);
+    LOG(WARNING) << "Xing  "<<i;
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, OtherHeaders) {
+  TestCase test[] = {
+      // regular case, with correct fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "1,;2,;3,;4,;5,;:content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, with correct fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,;aaa2,;aaa3,;aaa4,;aaa5,;:content-type:cache-control:"
+                                          "etag:connection:expires",
+          false
+      },
+
+      // regular case, one header is with multiple values
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,    bbb1, ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,;aaa2,;aaa3,;aaa4,;aaa5,;:"
+          "content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, one header has multiple lines
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,;aaa3,;aaa4,;aaa5,;:"
+                   "content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, one header has multiple lines,
+      // and such multiple lines occur at different positions
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: aaa2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,;aaa3,;aaa4,;aaa5,;"
+          ":content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, more than one header have multiple lines,
+      // and such multiple lines occur at different positions
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Expires: aaa5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;aaa5,;:"
+          "content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, response header does not have one header we need
+      // for fingerprint (expires)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:"
+          "content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, response header does not have more than one header
+      // we need for fingerprint (content-type, expires)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: aaa3\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:content-type:cache-control:"
+          "etag:connection:expires",
+          false
+      },
+
+      // regular case, all the headers we need for fingerprint are missing
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";;;;;:content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // regular case, but differ to received fingerprint
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: aaa1,   ccc1\n"
+          "Cache-Control: ccc2    , bbb2\n"
+          "ETag: etag\n"
+          "Content-Type: xxx1,    bbb1, ccc1\n"
+          "Connection: aaa4\n"
+          "Cache-Control: aaa2   \n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "aaa1,bbb1,ccc1,ccc1,xxx1,;aaa2,bbb2,ccc2,;aaa3,;aaa4,;;:"
+          "content-type:cache-control:etag:connection:expires",
+          true,
+      },
+
+      // special case, headers are not missing but some of them are empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type:   \n"
+          "Cache-Control: \n"
+          "ETag: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ",;,;,;,;5,;:content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // special case, some headers do not exist, some are of empty value.
+      // check delimiter "," and ";" work correctly.
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";,;;,;5,;:content-type:cache-control:etag:connection:expires",
+          false
+      },
+
+      // special case, check if we don't check any header, i.e.,
+      // header list is empty
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          "",
+          false
+      },
+
+      // special case, we only want to check one header, which does not
+      // exist in received header
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Chrome-Proxy: aut=aauutthh,bbbypas=0,aaxxx=xxx,bbbloc=1\n"
+          "Content-Type: 1\n"
+          "Cache-Control: 2\n"
+          "ETag: 3\n"
+          "Connection: 4\n"
+          "Expires: 5\n"
+          "Via:   \n"
+          "Content-Length: 12345\n",
+
+          ";:non_exist_header",
+          false
+      },
+
+      // there is only one header in our header list
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";:content-type",
+          false
+      },
+
+      // special case, if base64 decoding fails
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          ";:content-type",
+          false
+      },
+
+      // special case, if base64 decoding fails
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Cache-Control: \n"
+          "Connection: \n"
+          "Expires: 5\n"
+          "Via: \n"
+          "Content-Length: 12345\n",
+
+          "abcde:content-type:cache-control:etag:connection:expires",
+          false
+      },
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    if (i >= ARRAYSIZE_UNSAFE(test) - 2)
+    {
+      TestFingerprintCommon(test[i], 2);
+      continue;
+    }
+    size_t delimiter_pos = test[i].received_fingerprint.find(":");
+    std::string hash, rest;
+    if (delimiter_pos == std::string::npos)
+    {
+      delimiter_pos = test[i].received_fingerprint.size();
+      rest = "";
+    }
+    else
+      rest = test[i].received_fingerprint.substr(
+          delimiter_pos,
+          test[i].received_fingerprint.size() - delimiter_pos);
+    hash = test[i].received_fingerprint.substr(0, delimiter_pos);
+    test[i].received_fingerprint = GetEncoded(hash) + rest;
+
+    TestFingerprintCommon(test[i], 2);
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, ContentLength) {
+  TestCase test[] = {
+      // regular case, content-length is the same
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n"
+          "Content-Length: 12345\n",
+
+          "12345",
+          false,
+      },
+
+      // regular case, content-length is not the same
+      // also check if retrieved content-type is correct
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/html; charset=ISO-8859-4\n"
+          "Content-Length: 12345\n",
+
+          "125",
+          true,
+      },
+
+      // special case, data reduction proxy does not sent content-length
+      // i.e., content-length at data reduction proxy side is missing
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/javascript\n"
+          "Content-Length: 12345\n",
+
+          "",
+          false,
+      },
+
+      // special case, content-length are missing at both end
+      // i.e., both data reduction proxy and chrome
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: 1\n",
+
+          "",
+          false,
+      },
+
+      // special case, check when content-length is 0
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript\n"
+          "Content-Length: 0\n",
+
+          "0",
+          false,
+      },
+
+      // special case, check when data reduction proxy side's
+      // content-length is empty (header exist, but value is empty)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript\n"
+          "Content-Length: 123\n",
+
+          ",",
+          false,
+      },
+
+      // when content-length is different, check whether it recognizes image.
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: image/gif \n"
+          "Content-Length: 123\n",
+
+          "0",
+          true,
+      },
+
+      // when content-length is different, check whether it recognizes JS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/x-javascript \n"
+          "Content-Length: 0\n",
+
+          "120",
+          true,
+      },
+
+      // when content-length is different, check whether it recognizes JS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/javascript \n"
+          "Content-Length: 123\n",
+
+          "0",
+          true,
+      },
+
+      // when content-length is different, check whether it recognizes CSS
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: text/css\n"
+          "Content-Length: 111\n",
+
+          "0",
+          true,
+      },
+
+      // when content-length is different (chrome side is missing),
+      // check whether it recognizes JS.
+      // (if phone side's content-length has been removed, shall we report?
+      // current implementation: not reporting.)
+      {
+          "HTTP/1.1    202   Accepted  \n"
+          "Content-Type: application/javascript \n",
+
+          "123",
+          false,
+      },
+
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+    TestFingerprintCommon(test[i], 3);
+  }
+}
+
+TEST(DataReductionProxyTamperDetectTest, Parsing) {
+  std::string test[] = {
+    // check normal case
+    "Chrome-Proxy: f1:f1&f2:f2&f3:f3&f4:f4\n",
+    "Chrome-Proxy: fp=aa|bb|cc|dd\n",
+    // check special case if there are more delimiters
+    "Chrome-Proxy: fp=||||||||\n",
+    "Chrome-Proxy: fp=a|a|a|a|a|a|a|\n",
+    // check if there is no Chrome-Proxy header
+    "Content-Type: text/css\n",
+    // check if there is less delimiters
+    "Chrome-Proxy: fp= a | b | cde   \n",
+    "Chrome-Proxy: a=1, b=2, c=5",
+  };
+
+  for (size_t i=0; i<ARRAYSIZE_UNSAFE(test); ++i) {
+      TestParsingCommon(test[i]);
+  }
+}
+
+} // namespace