Chrome Participated Tamper Detect

components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h

Index: components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h
diff --git a/components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h b/components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h
new file mode 100644
index 0000000000000000000000000000000000000000..ab50070057baf7aaca9793d172e724b16674e655
--- /dev/null
+++ b/components/data_reduction_proxy/browser/data_reduction_proxy_tamper_detect.h
@@ -0,0 +1,124 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_DATA_REDUCTION_PROXY_BROWSER_DATA_REDUCTION_PROXY_TAMPER_DETECT_H_
+#define COMPONENTS_DATA_REDUCTION_PROXY_BROWSER_DATA_REDUCTION_PROXY_TAMPER_DETECT_H_
+
+#include "components/data_reduction_proxy/common/data_reduction_proxy_headers.h"
+
+#include "net/http/http_response_headers.h"
+
+namespace data_reduction_proxy {
+
+// The class for detecting tampering.
+// For each type of fingerprint, we have a pair of functions:
+//    * checking function:  returns true if such fingerprint got tampered;
+//                          (function name Is...Tampered)
+//    * reporting function: reporting tampering to corresponding UMA.
+//                          (function name Report...TamperedUMA)
+class DataReductionProxyTamperDetect {
+ public:
+  DataReductionProxyTamperDetect(
+      const net::HttpResponseHeaders* response_headers,
+      bool is_secure_scheme,
+      unsigned mcc_mnc,
+      std::vector<std::string>* chrome_proxy_header_values);
+
+  virtual ~DataReductionProxyTamperDetect();
+
+  // The main function for detecting tampering, which takes two parameters:
+  //   1. a pointer to HttpResponseHeaders,
+  //   2. a boolean variable that indicates whether the connection between
+  //      Chrome and data reduction proxy is on HTTPS or HTTP.
+  // The function checks whether there is a tamper detect request
+  // (i.e., contains fingerprints) from data reduction proxy, if so, it checks
+  // whether there are tampers and report the results to UMA.
+  static void CheckResponseFingerprint(const net::HttpResponseHeaders*, bool);

[bolian, 2014/07/09 22:51:06]

Name the parameters.

[xingx, 2014/07/10 03:07:41]

Done.

+
+ private:
+  friend class DataReductionProxyTamperDetectTest;
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           TestFingerprintCommon);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           ChromeProxy);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           Via);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           OtherHeaders);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           ContentLength);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           Parsing);
+  FRIEND_TEST_ALL_PREFIXES(DataReductionProxyTamperDetectTest,
+                           Completed);
+
+  // Enum for each fingerprint type.
+  enum FingerprintCode { CHROMEPROXY,
+                         VIA,
+                         OTHERHEADERS,
+                         CONTENTLENGTH,
+                         NONEXIST };
+
+  // Returns true if the Chrome-Proxy header has been tampered.
+  bool IsChromeProxyHeaderTampered(const std::string& fingerprint) const;
+
+  // Returns true if the Via header has been tampered.
+  bool IsViaHeaderTampered(const std::string& fingerprint) const;
+  // Report UMA for tampering of the Via header.

[bolian, 2014/07/09 22:51:06]

s/Report/Reports/ here and below.

[xingx, 2014/07/10 03:07:41]

Done.

+  void ReportViaHeaderTamperedUMA() const;
+
+  // Returns true if other headers (a list of headers) have been tampered.

[bolian, 2014/07/09 22:51:06]

How about

// Returns true if a list of server defined headers have been tampered.

[xingx, 2014/07/10 03:07:41]

Done.

+  bool AreOtherHeadersTampered(const std::string& fingerprint) const;
+  // Report UMA for tampering of values of the list of headers.
+  void ReportOtherHeadersTamperedUMA() const;
+
+  // Returns true if Content-Length has been tampered.
+  bool IsContentLengthHeaderTampered(const std::string& fingerprint) const;
+  // Report UMA for tampering of Content-Length.
+  void ReportContentLengthHeaderTamperedUMA() const;
+
+  // Return fingerprint code (enum) for the given fingerprint tag.

[bolian, 2014/07/09 22:51:06]

Returns

[xingx, 2014/07/10 03:07:41]

Done.

+  FingerprintCode GetFingerprintCode(const std::string& fingerprint_tag);
+
+  // Utility function. Check whether values of a header field |values| contains
+  // the Chrome-Proxy header's fingerprint. If it does, return true, and save
+  // Chrome-Proxy header's fingerprint to |chrome_proxy_fingerprint|; also save
+  // other fingerprints to |other_fingerprints|. Return false if there is no
+  // Chrome-Proxy header fingerprint found.
+  static bool ContainsTamperDetectFingerprints(std::vector<std::string>* values,
+      std::string* chrome_proxy_fingerprint,
+      std::string* other_fingerprints);
+
+  // Utility function. Return string of sorted values of |values|.
+  static std::string ValuesToSortedString(std::vector<std::string> &values);
+
+  // Utility function. Return MD5 hash value for a given string |input|.
+  // We need raw MD5 hash value so it's different to MD5String which is base16
+  // encoded. It's similar to MD5Sum but with digest converted to string.
+  static std::string GetMD5(const std::string& input);
+
+  // Utility function. Return all the values of a header field |header_name|
+  // of the response header |headers|, as a vector.
+  static std::vector<std::string> GetHeaderValues(
+      const net::HttpResponseHeaders* headers, const std::string& header_name);
+
+  const net::HttpResponseHeaders* response_headers;
+
+  // The communication to data reduction proxy is on HTTPS or not.
+  const bool is_secure_scheme;

[bolian, 2014/07/09 22:51:06]

// If true, the connection to the data reduction proxy is over HTTPS.

[bolian, 2014/07/09 22:51:06]

Add trailing "_" to all private member vars.

[xingx, 2014/07/10 03:07:41]

Done.

[xingx, 2014/07/10 03:07:41]

Done.

+
+  // Carrier ID.
+  const unsigned mcc_mnc;
+
+  // Values for Chrome-Proxy header, with its fingerprint value removed.
+  // Save it as temporary result so we don't need to parse Chrome-Proxy header
+  // twice.
+  std::vector<std::string>* clean_chrome_proxy_header_values;
+
+  // Map a fingerprint tag (string) to a fingerprint code (enum).
+  std::map<std::string, FingerprintCode> fingperprint_tag_code_map;
+};
+
+}  // namespace data_reduction_proxy
+#endif  // COMPONENTS_DATA_REDUCTION_PROXY_BROWSER_DATA_REDUCTION_PROXY_TAMPER_DETECT_H_