[CacheStorage] Pad and bin opaque resource sizes.

content/browser/cache_storage/cache_storage_cache.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage_cache.h"
 
 #include <stddef.h>
 #include <algorithm>
+#include <functional>
 #include <limits>
 #include <memory>
 #include <string>
 #include <utility>
 
 #include "base/barrier_closure.h"
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/guid.h"
+#include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/cache_storage/cache_storage.pb.h"
 #include "content/browser/cache_storage/cache_storage_blob_to_disk_cache.h"
 #include "content/browser/cache_storage/cache_storage_cache_handle.h"
 #include "content/browser/cache_storage/cache_storage_cache_observer.h"
 #include "content/browser/cache_storage/cache_storage_scheduler.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/referrer.h"
+#include "crypto/hmac.h"
+#include "crypto/random.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/blob/blob_url_request_job_factory.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
@@ skipping 206 matching lines @@
       metadata.response().status_text(),
       ProtoResponseTypeToWebResponseType(metadata.response().response_type()),
       std::move(headers), "", 0, blink::kWebServiceWorkerResponseErrorUnknown,
       base::Time::FromInternalValue(metadata.response().response_time()),
       true /* is_in_cache_storage */, cache_name,
       base::MakeUnique<ServiceWorkerHeaderList>(
           metadata.response().cors_exposed_header_names().begin(),
           metadata.response().cors_exposed_header_names().end()));
 }
 
+// The size of opaque (non-cors) resource responses are padded in order
+// to obfuscate their actual size.
+bool ShouldPadResourceSize(const ServiceWorkerResponse& response) {
+  return (response.response_type ==
+              blink::kWebServiceWorkerResponseTypeOpaque ||

[jkarlin, 2017/06/09 15:26:20]

Let's change this to a switch on response.response_type so we can be sure that
if anyone updates the enum that they'll have to update this too.

e.g.,

switch(response.response_type) {
 case blink::kWebServiceWorkerResponseTypeBasic:
 case blink::kWebServiceWorkerResponseTypeCORS:
 case blink::kWebServiceWorkerResponseTypeDefault:
 case blink::kWebServiceWorkerResponseTypeError:
    return false;
 case blink::kWebServiceWorkerResponseTypeOpaque:
 case blink::kWebServiceWorkerResponseTypeOpaqueRedirect:
    return !response.url_list.empty();
}
NOTREACHED();
return blink::kWebServiceWorkerResponseTypeOpaque; 

[cmumford, 2017/06/12 18:09:31]

Done.

+          response.response_type ==
+              blink::kWebServiceWorkerResponseTypeOpaqueRedirect) &&
+         !response.url_list.empty();
+}
+
+// Return a hash of the |response| values to be used for the resource padding
+// calculation.
+std::string CalculateResponsePaddingHash(
+    const ServiceWorkerResponse& response) {
+  DCHECK(!response.url_list.empty());
+
+  size_t h = std::hash<std::string>{}(response.url_list.back().spec());

[jkarlin, 2017/06/09 15:26:20]

std::hash isn't meant for security. In fact, I don't think this function is
necessary, we want to pass the url to the HMAC.sign() (the document was wrong).

+  return std::string(reinterpret_cast<const char*>(&h), sizeof(h));
+}
+
+class PaddingHMACKey : public std::string {

[jkarlin, 2017/06/09 15:26:20]

Let's use crypto::SymmetricKey to generate and serialize/deserialize the key
instead of making a new class. The HMAC algorithm takes a SymmetricKey as an
argument.

+ public:
+  PaddingHMACKey() {
+    const size_t kKeyLen = 20;
+    reserve(kKeyLen);
+    crypto::RandBytes(&(*this)[0], capacity());
+  }
+};
+
+std::string CalculatePaddingHMAC(const std::string& value,

[jkarlin, 2017/06/09 15:26:20]

Since we never use the full length of the result, how about we just return a
uint64_t here?

[cmumford, 2017/06/12 18:09:31]

Done.

+                                 const std::string& hmac_key) {
+  crypto::HMAC hmac(crypto::HMAC::SHA256);
+  std::string result(hmac.DigestLength(), '\0');

[jkarlin, 2017/06/09 15:26:20]

Rather than a string, how about a vector<uint8_t>?


How about using a std::ByteVector, as such:

  vector<uint8_t> result(hmac.DigestLength());
  ...
  if (!hmac.Sign(data, &result[0], result.size()))

[cmumford, 2017/06/12 18:09:31]

Done.

+  if (!hmac.Init(hmac_key) ||
+      !hmac.Sign(value, reinterpret_cast<uint8_t*>(&result[0]),
+                 result.length())) {
+    LOG(FATAL) << "Failed to calculate HMAC.";
+  }
+  return result;

[jkarlin, 2017/06/09 15:26:20]

Rather than return the result, we could return the first 8 bytes:

return *(reinterpret_cast<uint64_t*>(&result[0]))

[cmumford, 2017/06/12 18:09:32]

Done.

+}
+
+// Converts the |response_hmac| bytes into a value from the random distribution
+// determined by threat analysis.
+int64_t ResponsePaddingDistribution(const std::string& response_hmac) {

[jkarlin, 2017/06/09 15:26:20]

If response_hmac turns into a uint64_t, then this function is just:

return response_hmac % kPaddingRange;

[cmumford, 2017/06/12 18:09:31]

Done - I collapsed these functions into
CacheStorageCache::CalculateResponsePadding as I felt it was cleaner.

+  size_t response_hash = std::hash<std::string>{}(response_hmac);
+  const size_t kPaddingRange = 400 * 1024;
+  return response_hash % kPaddingRange;
+}
+
 }  // namespace
 
 // The state needed to pass between CacheStorageCache::Put callbacks.
 struct CacheStorageCache::PutContext {
   PutContext(std::unique_ptr<ServiceWorkerFetchRequest> request,
              std::unique_ptr<ServiceWorkerResponse> response,
              std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
              const CacheStorageCache::ErrorCallback& callback)
       : request(std::move(request)),
         response(std::move(response)),
@@ skipping 17 matching lines @@
   std::unique_ptr<ServiceWorkerFetchRequest> request;
   std::unique_ptr<ServiceWorkerResponse> response;
   std::unique_ptr<storage::BlobDataHandle> blob_handle;
   disk_cache::ScopedEntryPtr entry;
   base::Time entry_time;
 };
 
 struct CacheStorageCache::QueryCacheContext {
   QueryCacheContext(std::unique_ptr<ServiceWorkerFetchRequest> request,
                     const CacheStorageCacheQueryParams& options,
-                    const QueryCacheCallback& callback)
+                    const QueryCacheCallback& callback,
+                    uint32_t query_types)
       : request(std::move(request)),
         options(options),
         callback(callback),
+        query_types(query_types),
         matches(base::MakeUnique<QueryCacheResults>()) {}
 
   ~QueryCacheContext() {
     // If the CacheStorageCache is deleted before a backend operation to open
     // an entry completes, the callback won't be run and the resulting entry
     // will be leaked unless we close it here.
     if (enumerated_entry) {
       enumerated_entry->Close();
       enumerated_entry = nullptr;
     }
   }
 
   // Input to QueryCache
   std::unique_ptr<ServiceWorkerFetchRequest> request;
   CacheStorageCacheQueryParams options;
   QueryCacheCallback callback;
-  QueryCacheType query_type;
+  uint32_t query_types = 0x0;
   size_t estimated_out_bytes = 0;
 
   // Iteration state
   std::unique_ptr<disk_cache::Backend::Iterator> backend_iterator;
   disk_cache::Entry* enumerated_entry = nullptr;
 
   // Output of QueryCache
   std::unique_ptr<std::vector<QueryCacheResult>> matches;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(QueryCacheContext);
 };
 
 // static
 std::unique_ptr<CacheStorageCache> CacheStorageCache::CreateMemoryCache(
     const GURL& origin,
     const std::string& cache_name,
     CacheStorage* cache_storage,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, base::FilePath(), cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, 0 /* cache_size */);
+      blob_context, 0 /* cache_size */, 0 /* cache_padding */,
+      SessionPaddingHMACKey());
   cache->SetObserver(cache_storage);
   cache->InitBackend();
   return base::WrapUnique(cache);
 }
 
 // static
 std::unique_ptr<CacheStorageCache> CacheStorageCache::CreatePersistentCache(
     const GURL& origin,
     const std::string& cache_name,
     CacheStorage* cache_storage,
     const base::FilePath& path,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size) {
+    int64_t cache_size,
+    int64_t cache_padding,
+    const std::string& cache_padding_key) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, path, cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, cache_size);
+      blob_context, cache_size, cache_padding, cache_padding_key);
   cache->SetObserver(cache_storage), cache->InitBackend();
   return base::WrapUnique(cache);
 }
 
+// static
+const std::string& CacheStorageCache::SessionPaddingHMACKey() {
+  static base::LazyInstance<PaddingHMACKey>::Leaky s_key =
+      LAZY_INSTANCE_INITIALIZER;
+  return s_key.Get();
+}
+
 base::WeakPtr<CacheStorageCache> CacheStorageCache::AsWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
 void CacheStorageCache::Match(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
     const ResponseCallback& callback) {
   if (backend_state_ == BACKEND_CLOSED) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
@@ skipping 207 matching lines @@
 }
 
 CacheStorageCache::CacheStorageCache(
     const GURL& origin,
     const std::string& cache_name,
     const base::FilePath& path,
     CacheStorage* cache_storage,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size)
+    int64_t cache_size,
+    int64_t cache_padding,
+    const std::string& cache_padding_key)
     : origin_(origin),
       cache_name_(cache_name),
       path_(path),
       cache_storage_(cache_storage),
       request_context_getter_(std::move(request_context_getter)),
       quota_manager_proxy_(std::move(quota_manager_proxy)),
       blob_storage_context_(blob_context),
       scheduler_(
           new CacheStorageScheduler(CacheStorageSchedulerClient::CLIENT_CACHE)),
       cache_size_(cache_size),
+      cache_padding_(cache_padding),
+      cache_padding_key_(cache_padding_key),
       max_query_size_bytes_(kMaxQueryCacheResultBytes),
       cache_observer_(nullptr),
       memory_only_(path.empty()),
       weak_ptr_factory_(this) {
   DCHECK(!origin_.is_empty());
   DCHECK(quota_manager_proxy_.get());
 
   quota_manager_proxy_->NotifyOriginInUse(origin_);
 }
 
 void CacheStorageCache::QueryCache(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& options,
-    QueryCacheType query_type,
+    uint32_t query_types,
     const QueryCacheCallback& callback) {
-  DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
-  if (backend_state_ != BACKEND_OPEN) {
+  DCHECK_NE(
+      QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES,
+      query_types & (QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES));
+  if (backend_state_ == BACKEND_CLOSED) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
                  std::unique_ptr<QueryCacheResults>());
     return;
   }
 
   if (!options.ignore_method && request && !request->method.empty() &&
       request->method != "GET") {
     callback.Run(CACHE_STORAGE_OK, base::MakeUnique<QueryCacheResults>());
     return;
   }
 
   ServiceWorkerFetchRequest* request_ptr = request.get();
-  std::unique_ptr<QueryCacheContext> query_cache_context(
-      new QueryCacheContext(std::move(request), options, callback));
-  query_cache_context->query_type = query_type;
+  std::unique_ptr<QueryCacheContext> query_cache_context(new QueryCacheContext(
+      std::move(request), options, callback, query_types));
 
   if (query_cache_context->request &&
       !query_cache_context->request->url.is_empty() && !options.ignore_search) {
     // There is no need to scan the entire backend, just open the exact
     // URL.
     disk_cache::Entry** entry_ptr = &query_cache_context->enumerated_entry;
     net::CompletionCallback open_entry_callback =
         base::Bind(&CacheStorageCache::QueryCacheDidOpenFastPath,
                    weak_ptr_factory_.GetWeakPtr(),
                    base::Passed(std::move(query_cache_context)));
@@ skipping 60 matching lines @@
   if (rv < 0) {
     QueryCacheCallback callback = query_cache_context->callback;
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
                  std::move(query_cache_context->matches));
     return;
   }
 
   disk_cache::ScopedEntryPtr entry(query_cache_context->enumerated_entry);
   query_cache_context->enumerated_entry = nullptr;
 
-  if (backend_state_ != BACKEND_OPEN) {
+  if (backend_state_ == BACKEND_CLOSED) {
     QueryCacheCallback callback = query_cache_context->callback;
     callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND,
                  std::move(query_cache_context->matches));
     return;
   }
 
   if (query_cache_context->request &&
       !query_cache_context->request->url.is_empty()) {
     GURL requestURL = query_cache_context->request->url;
     GURL cachedURL = GURL(entry->GetKey());
@@ skipping 41 matching lines @@
 
   if (query_cache_context->request &&
       !query_cache_context->options.ignore_vary &&
       !VaryMatches(query_cache_context->request->headers,
                    match->request->headers, match->response->headers)) {
     query_cache_context->matches->pop_back();
     QueryCacheOpenNextEntry(std::move(query_cache_context));
     return;
   }
 
-  if (query_cache_context->query_type == QueryCacheType::CACHE_ENTRIES) {
+  if (query_cache_context->query_types & QUERY_CACHE_ENTRIES)
+    match->entry = std::move(entry);
+
+  if (query_cache_context->query_types & QUERY_CACHE_REQUESTS) {
+    query_cache_context->estimated_out_bytes +=
+        match->request->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+  } else {
     match->request.reset();
-    match->response.reset();
-    match->entry = std::move(entry);
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
   }
 
-  query_cache_context->estimated_out_bytes +=
-      match->request->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
+  if (query_cache_context->query_types & QUERY_CACHE_RESPONSES_WITH_BODIES) {
+    query_cache_context->estimated_out_bytes +=
+        match->response->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+    if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
+      QueryCacheOpenNextEntry(std::move(query_cache_context));
+      return;
+    }
+
+    if (!blob_storage_context_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+
+    std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
+        PopulateResponseBody(std::move(entry), match->response.get());
+    match->blob_handle = std::move(blob_data_handle);
+  } else if (!(query_cache_context->query_types &
+               QUERY_CACHE_RESPONSES_NO_BODIES)) {
+    match->response.reset();
   }
 
-  if (query_cache_context->query_type == QueryCacheType::REQUESTS) {
-    match->response.reset();
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
-
-  DCHECK_EQ(QueryCacheType::REQUESTS_AND_RESPONSES,
-            query_cache_context->query_type);
-
-  query_cache_context->estimated_out_bytes +=
-      match->response->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
-  }
-
-  if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
-
-  if (!blob_storage_context_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
-                                      base::MakeUnique<QueryCacheResults>());
-    return;
-  }
-
-  std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
-      PopulateResponseBody(std::move(entry), match->response.get());
-  match->blob_handle = std::move(blob_data_handle);
-
   QueryCacheOpenNextEntry(std::move(query_cache_context));
 }
 
 // static
 bool CacheStorageCache::QueryCacheResultCompare(const QueryCacheResult& lhs,
                                                 const QueryCacheResult& rhs) {
   return lhs.entry_time < rhs.entry_time;
 }
 
+// static
+int64_t CacheStorageCache::CalculateResponsePadding(
+    const ServiceWorkerResponse& response,
+    const std::string& padding_key) {
+  if (!ShouldPadResourceSize(response))
+    return 0;
+  return ResponsePaddingDistribution(CalculatePaddingHMAC(
+      CalculateResponsePaddingHash(response), padding_key));

[jkarlin, 2017/06/09 15:26:20]

Ah, the document was wrong. You don't want to hash the response url before
passing it to the HMAC algorithm. You want to pass the whole URL.

[cmumford, 2017/06/12 18:09:32]

Done.

+}
+
 void CacheStorageCache::MatchImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
     const ResponseCallback& callback) {
   MatchAllImpl(std::move(request), match_params,
                base::Bind(&CacheStorageCache::MatchDidMatchAll,
                           weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::MatchDidMatchAll(
@@ skipping 26 matching lines @@
     const CacheStorageCacheQueryParams& options,
     const ResponsesCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE, std::unique_ptr<Responses>(),
                  std::unique_ptr<BlobDataHandles>());
     return;
   }
 
   QueryCache(std::move(request), options,
-             QueryCacheType::REQUESTS_AND_RESPONSES,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,
              base::Bind(&CacheStorageCache::MatchAllDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::MatchAllDidQueryCache(
     const ResponsesCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
     callback.Run(error, std::unique_ptr<Responses>(),
@@ skipping 168 matching lines @@
                  base::Passed(std::move(put_context))));
 }
 
 void CacheStorageCache::PutImpl(std::unique_ptr<PutContext> put_context) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
-  std::string key = put_context->request->url.spec();
+  // Explicitly delete the incumbent resource (which may not exist). This is
+  // only done so that it's padding will be decremented from the calculated
+  // cache padding.
+  auto delete_request = base::MakeUnique<ServiceWorkerFetchRequest>(
+      put_context->request->url, "", ServiceWorkerHeaderMap(), Referrer(),
+      false);
 
-  net::CompletionCallback callback = base::Bind(
-      &CacheStorageCache::PutDidDoomEntry, weak_ptr_factory_.GetWeakPtr(),
-      base::Passed(std::move(put_context)));
-
-  int rv = backend_->DoomEntry(key, callback);
-  if (rv != net::ERR_IO_PENDING)
-    callback.Run(rv);
+  CacheStorageCacheQueryParams query_options;
+  query_options.ignore_method = true;
+  query_options.ignore_vary = true;
+  DeleteImpl(std::move(delete_request), query_options,
+             base::Bind(&CacheStorageCache::PutDidDeleteEntry,
+                        weak_ptr_factory_.GetWeakPtr(),
+                        base::Passed(std::move(put_context))));
 }
 
-void CacheStorageCache::PutDidDoomEntry(std::unique_ptr<PutContext> put_context,
-                                        int rv) {
+void CacheStorageCache::PutDidDeleteEntry(
+    std::unique_ptr<PutContext> put_context,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
   if (backend_state_ != BACKEND_OPEN) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
-  // |rv| is ignored as doom entry can fail if the entry doesn't exist.
+  if (error != CACHE_STORAGE_OK && error != CACHE_STORAGE_ERROR_NOT_FOUND) {
+    cache_padding_ -=
+        CalculateResponsePadding(*put_context->response, cache_padding_key_);
+    put_context->callback.Run(error);
+    return;
+  }
 
   std::unique_ptr<disk_cache::Entry*> scoped_entry_ptr(
       new disk_cache::Entry*());
   disk_cache::Entry** entry_ptr = scoped_entry_ptr.get();
   ServiceWorkerFetchRequest* request_ptr = put_context->request.get();
   disk_cache::Backend* backend_ptr = backend_.get();
 
   net::CompletionCallback create_entry_callback = base::Bind(
       &CacheStorageCache::PutDidCreateEntry, weak_ptr_factory_.GetWeakPtr(),
       base::Passed(std::move(scoped_entry_ptr)),
       base::Passed(std::move(put_context)));
 
-  int create_rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
-                                           create_entry_callback);
+  int rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
+                                    create_entry_callback);
 
-  if (create_rv != net::ERR_IO_PENDING)
-    create_entry_callback.Run(create_rv);
+  if (rv != net::ERR_IO_PENDING)
+    create_entry_callback.Run(rv);
 }
 
 void CacheStorageCache::PutDidCreateEntry(
     std::unique_ptr<disk_cache::Entry*> entry_ptr,
     std::unique_ptr<PutContext> put_context,
     int rv) {
   put_context->cache_entry.reset(*entry_ptr);
 
   if (rv != net::OK) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_EXISTS);
@@ skipping 64 matching lines @@
     int expected_bytes,
     int rv) {
   if (rv != expected_bytes) {
     put_context->cache_entry->Doom();
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
   if (rv > 0)
     storage::RecordBytesWritten(kRecordBytesLabel, rv);
+  cache_padding_ +=
+      CalculateResponsePadding(*put_context->response, cache_padding_key_);
 
   // The metadata is written, now for the response content. The data is streamed
   // from the blob into the cache entry.
 
   if (put_context->response->blob_uuid.empty()) {
     UpdateCacheSize(base::Bind(put_context->callback, CACHE_STORAGE_OK));
     return;
   }
 
   DCHECK(put_context->blob_data_handle);
@@ skipping 29 matching lines @@
 
   if (!success) {
     put_context->cache_entry->Doom();
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
   UpdateCacheSize(base::Bind(put_context->callback, CACHE_STORAGE_OK));
 }
 
+void CacheStorageCache::CalculateCacheSizePadding(
+    const SizePaddingCallback& got_sizes_callback) {
+  net::CompletionCallback got_size_callback =
+      base::Bind(&CacheStorageCache::CalculateCacheSizePaddingGotSize,
+                 weak_ptr_factory_.GetWeakPtr(), std::move(got_sizes_callback));
+
+  int rv = backend_->CalculateSizeOfAllEntries(got_size_callback);
+  if (rv != net::ERR_IO_PENDING)
+    got_size_callback.Run(rv);
+}
+
+void CacheStorageCache::CalculateCacheSizePaddingGotSize(
+    const SizePaddingCallback& callback,
+    int cache_size) {
+  // Enumerating entries is only done during cache initialization.
+  DCHECK_EQ(backend_state_, BACKEND_UNINITIALIZED);
+  std::unique_ptr<ServiceWorkerFetchRequest> request;
+  CacheStorageCacheQueryParams options;
+  options.ignore_search = true;
+  QueryCache(std::move(request), options,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,
+             base::Bind(&CacheStorageCache::PaddingDidQueryCache,
+                        weak_ptr_factory_.GetWeakPtr(), std::move(callback),
+                        cache_size));
+}
+
+void CacheStorageCache::PaddingDidQueryCache(
+    const SizePaddingCallback& callback,
+    int cache_size,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_cache_results) {
+  int64_t cache_padding = 0;
+  if (error == CACHE_STORAGE_OK) {
+    for (const auto& result : *query_cache_results)
+      cache_padding +=
+          CalculateResponsePadding(*result.response, cache_padding_key_);
+  }
+
+  callback.Run(cache_size, cache_padding);
+}
+
+void CacheStorageCache::CalculateCacheSize(
+    const net::CompletionCallback& callback) {
+  int rv = backend_->CalculateSizeOfAllEntries(callback);
+  if (rv != net::ERR_IO_PENDING)
+    callback.Run(rv);
+}
+
 void CacheStorageCache::UpdateCacheSize(const base::Closure& callback) {
   if (backend_state_ != BACKEND_OPEN)
     return;
 
   // Note that the callback holds a cache handle to keep the cache alive during
   // the operation since this UpdateCacheSize is often run after an operation
   // completes and runs its callback.
-  int rv = backend_->CalculateSizeOfAllEntries(
-      base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
-                 weak_ptr_factory_.GetWeakPtr(),
-                 base::Passed(CreateCacheHandle()), callback));
-
-  if (rv != net::ERR_IO_PENDING)
-    UpdateCacheSizeGotSize(CreateCacheHandle(), callback, rv);
+  CalculateCacheSize(base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
+                                weak_ptr_factory_.GetWeakPtr(),
+                                base::Passed(CreateCacheHandle()), callback));
 }
 
 void CacheStorageCache::UpdateCacheSizeGotSize(
     std::unique_ptr<CacheStorageCacheHandle> cache_handle,
     const base::Closure& callback,
     int current_cache_size) {
   DCHECK_NE(current_cache_size, CacheStorage::kSizeUnknown);
-  int64_t old_cache_size = cache_size_;
   cache_size_ = current_cache_size;
-
-  int64_t size_delta = current_cache_size - old_cache_size;
+  int64_t size_delta = PaddedCacheSize() - last_reported_size_;
+  last_reported_size_ = PaddedCacheSize();
 
   quota_manager_proxy_->NotifyStorageModified(
       storage::QuotaClient::kServiceWorkerCache, origin_,
       storage::kStorageTypeTemporary, size_delta);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, current_cache_size);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
 
 void CacheStorageCache::Delete(const CacheStorageBatchOperation& operation,
                                const ErrorCallback& callback) {
   DCHECK(BACKEND_OPEN == backend_state_ || initializing_);
   DCHECK_EQ(CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE,
             operation.operation_type);
 
   std::unique_ptr<ServiceWorkerFetchRequest> request(
       new ServiceWorkerFetchRequest(
           operation.request.url, operation.request.method,
           operation.request.headers, operation.request.referrer,
           operation.request.is_reload));
 
+  QueryCacheCallback delete_callback =
+      base::Bind(&CacheStorageCache::DeleteDidDelete,
+                 weak_ptr_factory_.GetWeakPtr(), callback);
+
   scheduler_->ScheduleOperation(
       base::Bind(&CacheStorageCache::DeleteImpl, weak_ptr_factory_.GetWeakPtr(),
                  base::Passed(std::move(request)), operation.match_params,
-                 scheduler_->WrapCallbackToRunNext(callback)));
+                 scheduler_->WrapCallbackToRunNext(delete_callback)));
+}
+
+void CacheStorageCache::DeleteDidDelete(
+    const ErrorCallback& callback,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
+  callback.Run(error);
 }
 
 void CacheStorageCache::DeleteImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
-    const ErrorCallback& callback) {
+    const QueryCacheCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
-    callback.Run(CACHE_STORAGE_ERROR_STORAGE);
+    callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                 base::MakeUnique<QueryCacheResults>());
     return;
   }
 
-  QueryCache(std::move(request), match_params, QueryCacheType::CACHE_ENTRIES,
+  QueryCache(std::move(request), match_params,
+             QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_NO_BODIES,
              base::Bind(&CacheStorageCache::DeleteDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::DeleteDidQueryCache(
-    const ErrorCallback& callback,
+    const QueryCacheCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
-    callback.Run(error);
+    callback.Run(error, std::move(query_cache_results));
     return;
   }
 
   if (query_cache_results->empty()) {
-    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND);
+    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND, std::move(query_cache_results));
     return;
   }
 
   for (auto& result : *query_cache_results) {
     disk_cache::ScopedEntryPtr entry = std::move(result.entry);
+    cache_padding_ -=
+        CalculateResponsePadding(*result.response, cache_padding_key_);
     entry->Doom();
   }
 
-  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK));
+  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK,
+                             base::Passed(std::move(query_cache_results))));
 }
 
 void CacheStorageCache::KeysImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& options,
     const RequestsCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE, std::unique_ptr<Requests>());
     return;
   }
 
-  QueryCache(std::move(request), options, QueryCacheType::REQUESTS,
+  QueryCache(std::move(request), options, QUERY_CACHE_REQUESTS,
              base::Bind(&CacheStorageCache::KeysDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::KeysDidQueryCache(
     const RequestsCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
     callback.Run(error, std::unique_ptr<Requests>());
@@ skipping 12 matching lines @@
   DCHECK_NE(BACKEND_CLOSED, backend_state_);
 
   backend_state_ = BACKEND_CLOSED;
   backend_.reset();
   callback.Run();
 }
 
 void CacheStorageCache::SizeImpl(const SizeCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
 
-  int64_t size = backend_state_ == BACKEND_OPEN ? cache_size_ : 0;
+  // TODO(cmumford): Can CacheStorage::kSizeUnknown be returned instead of zero?
+  if (backend_state_ != BACKEND_OPEN) {
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  base::Bind(callback, 0));
+    return;
+  }
+
+  int64_t size = backend_state_ == BACKEND_OPEN ? PaddedCacheSize() : 0;
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
                                                 base::Bind(callback, size));
 }
 
 void CacheStorageCache::GetSizeThenCloseDidGetSize(const SizeCallback& callback,
                                                    int64_t cache_size) {
   CloseImpl(base::Bind(callback, cache_size));
 }
 
 void CacheStorageCache::CreateBackend(const ErrorCallback& callback) {
@@ skipping 72 matching lines @@
   // Now that we know the cache size either 1) the cache size should be unknown
   // (which is why the size was calculated), or 2) it must match the current
   // size. If the sizes aren't equal then there is a bug in how the cache size
   // is saved in the store's index.
   if (cache_size_ != CacheStorage::kSizeUnknown) {
     LOG_IF(ERROR, cache_size_ != cache_size)
         << "Cache size: " << cache_size
         << " does not match size from index: " << cache_size_;
     UMA_HISTOGRAM_COUNTS_10M("ServiceWorkerCache.IndexSizeDifference",
                              std::abs(cache_size_ - cache_size));
-    // Disabled for crbug.com/681900.
-    // DCHECK_EQ(cache_size_, cache_size);
+    if (cache_size_ != cache_size) {
+      // If the actual size doesn't match the cached size, then assume the
+      // cached padding is also incorrect and recalculate.
+      CalculateCacheSizePaddingGotSize(
+          base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                     weak_ptr_factory_.GetWeakPtr(), callback,
+                     cache_create_error),
+          cache_size);
+      return;
+    }
   }
+
+  if (cache_padding_ == CacheStorage::kSizeUnknown || cache_padding_ < 0) {
+    CalculateCacheSizePaddingGotSize(
+        base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                   weak_ptr_factory_.GetWeakPtr(), callback,
+                   cache_create_error),
+        cache_size);
+    return;
+  }
+
+  // If cached size matches actual size then assume cached padding is still
+  // correct.
+  InitGotCacheSizeAndPadding(callback, cache_create_error, cache_size,
+                             cache_padding_);
+}
+
+void CacheStorageCache::InitGotCacheSizeAndPadding(
+    const base::Closure& callback,
+    CacheStorageError cache_create_error,
+    int64_t cache_size,
+    int64_t cache_padding) {
   cache_size_ = cache_size;
+  cache_padding_ = cache_padding;
+
   initializing_ = false;
   backend_state_ = (cache_create_error == CACHE_STORAGE_OK && backend_ &&
                     backend_state_ == BACKEND_UNINITIALIZED)
                        ? BACKEND_OPEN
                        : BACKEND_CLOSED;
 
   UMA_HISTOGRAM_ENUMERATION("ServiceWorkerCache.InitBackendResult",
                             cache_create_error, CACHE_STORAGE_ERROR_LAST + 1);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, cache_size_);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
 
 std::unique_ptr<storage::BlobDataHandle>
 CacheStorageCache::PopulateResponseBody(disk_cache::ScopedEntryPtr entry,
                                         ServiceWorkerResponse* response) {
   DCHECK(blob_storage_context_);
 
   // Create a blob with the response body data.
   response->blob_size = entry->GetDataSize(INDEX_RESPONSE_BODY);
   response->blob_uuid = base::GenerateGUID();
   storage::BlobDataBuilder blob_data(response->blob_uuid);
 
   disk_cache::Entry* temp_entry = entry.get();
   blob_data.AppendDiskCacheEntryWithSideData(
       new CacheStorageCacheDataHandle(CreateCacheHandle(), std::move(entry)),
       temp_entry, INDEX_RESPONSE_BODY, INDEX_SIDE_DATA);
   return blob_storage_context_->AddFinishedBlob(&blob_data);
 }
 
 std::unique_ptr<CacheStorageCacheHandle>
 CacheStorageCache::CreateCacheHandle() {
   return cache_storage_->CreateCacheHandle(this);
 }
 
+int64_t CacheStorageCache::PaddedCacheSize() const {
+  if (cache_size_ == CacheStorage::kSizeUnknown ||
+      cache_padding_ == CacheStorage::kSizeUnknown) {
+    return CacheStorage::kSizeUnknown;
+  }
+  return cache_size_ + cache_padding_;
+}
+
 }  // namespace content