media: Add MediaDrmStorage

components/cdm/browser/media_drm_storage_impl.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/cdm/browser/media_drm_storage_impl.h"
+
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/optional.h"
+#include "components/pref_registry/pref_registry_syncable.h"
+#include "components/prefs/pref_service.h"
+#include "components/prefs/scoped_user_pref_update.h"
+#include "content/public/browser/browser_thread.h"
+
+// The storage will be managed by PrefService. All data will be stored in a
+// dictionary under the key "media.media_drm_storage". The dictionary is
+// structured as follows:
+//
+// {
+//     $origin: {
+//         "origin_id": $origin_id
+//         "creation_time": $creation_time
+//         "sessions" : {
+//             $session_id: {
+//                 "key_set_id": $key_set_id,
+//                 "mime_type": $mime_type,
+//                 "creation_time": $creation_time
+//             },
+//             # more session_id map...
+//         }
+//     },
+//     # more origin map...
+// }
+
+namespace cdm {
+
+namespace {
+
+const char kMediaDrmStorage[] = "media.media_drm_storage";
+
+}  // namespace
+
+// static
+void MediaDrmStorageImpl::RegisterProfilePrefs(
+    user_prefs::PrefRegistrySyncable* registry) {
+  registry->RegisterDictionaryPref(kMediaDrmStorage,
+                                   new base::DictionaryValue());
+}
+
+MediaDrmStorageImpl::MediaDrmStorageImpl(PrefService* pref_service)
+    : pref_service_(pref_service), weak_factory_(this) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(pref_service_);
+}
+
+MediaDrmStorageImpl::~MediaDrmStorageImpl() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+}
+
+void MediaDrmStorageImpl::Initialize(const url::Origin& origin) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(!origin.unique());
+  origin_ = origin.Serialize();

[dcheng, 2017/03/29 01:17:23]

Rather than passing the origin over Mojo, can we just get it from the
RenderFrameHost?

(This also means we need to close the pipe on navigation)

[xhwang, 2017/03/29 20:47:25]

Yeah, that's what we chat about before and proposed in the permission bug. But
see my question here:
https://bugs.chromium.org/p/chromium/issues/detail?id=698985#c11
as it's not super clear to me how to handle navigation etc.

This whole CL is behind a flag for prototyping/development. Can we land this
first and then iterate on it later?

Added a TODO in media_drm_storage.h

[dcheng, 2017/03/29 21:15:12]

I think I'm missing something: the GPU process is calling this interface? How
does it know the origin?

[xhwang, 2017/03/29 21:30:44]

We have many out-of-process media components. For example, hardware decoders
running in the GPU process, or CDM running in the PPAPI process. Even though
they run in a separate process, they still belong to the media pipeline running
in the render process, which belongs to a frame (with an origin). When we create
a CDM, we pass the origin from the render process to the remote process (e.g.
GPU).

I agree that the |origin| cannot be trusted, which is why I chat with you about
browser side origin validation, or getting the origin from the browser directly.

[dcheng, 2017/03/30 00:29:15]

There are some complexities with plumbing here, but how about:

- Have the factory create the impl with an origin from GetLastCommittedOrigin().
- Use WebContentsObserver::DidFinishNavigation(), and delete the impl (and the
observer) if it's not a same-page navigation

This should address the concerns about the untrusted origin being sent from the
renderer, as well as the concerns about the origin becoming stale.

(I know this is somewhat experimental, but I'm hoping we can get a good pattern
for this set up)

+}
+
+void MediaDrmStorageImpl::OnProvisioned(const OnProvisionedCallback& callback) {
+  DVLOG(2) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(!origin_.empty());

[dcheng, 2017/03/29 01:17:23]

Note that we shouldn't be DCHECKing these sorts of things: it's very possible
that a malicious renderer could simply not call Initialize(), hence my comment
about initializing origin from the RFH.

[xhwang, 2017/03/29 20:47:25]

FWIW, the CDM (MediaDrm) is actually running in the GPU process which is
trusted. But given the flexibility of Mojo Media, it's totally possible to run
the CDM (MediaDrm) in a untrusted process. So your comment is right.

Updated the code to explicitly check whether origin has been set.

+
+  NOTIMPLEMENTED();

[xhwang, 2017/03/24 21:22:38]

Partial implementation of these functions and some test code in MediaDrmBridge
can be found in PS2.

I removed them so we can focus on plumbing in this CL. In the next CL, I'll
implement this class and add unit tests.

+  callback.Run(false);
+}
+
+void MediaDrmStorageImpl::SavePersistentSession(
+    const std::string& session_id,
+    const std::vector<uint8_t>& key_set_id,
+    const std::string& mime_type,
+    const SavePersistentSessionCallback& callback) {
+  DVLOG(2) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(!origin_.empty());
+
+  NOTIMPLEMENTED();
+  callback.Run(false);
+}
+
+void MediaDrmStorageImpl::LoadPersistentSession(
+    const std::string& session_id,
+    const LoadPersistentSessionCallback& callback) {
+  DVLOG(2) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(!origin_.empty());
+
+  NOTIMPLEMENTED();
+  callback.Run(false, {}, "");
+}
+
+void MediaDrmStorageImpl::RemovePersistentSession(
+    const std::string& session_id,
+    const RemovePersistentSessionCallback& callback) {
+  DVLOG(2) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(!origin_.empty());
+
+  NOTIMPLEMENTED();
+  callback.Run(false);
+}
+
+}  // namespace cdm