[CacheStorage] Pad and bin opaque resource sizes.

content/browser/cache_storage/cache_storage.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage.h"
 
 #include <stddef.h>
 
 #include <set>
 #include <string>
@@ skipping 14 matching lines @@
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/cache_storage/cache_storage.pb.h"
 #include "content/browser/cache_storage/cache_storage_cache.h"
 #include "content/browser/cache_storage/cache_storage_cache_handle.h"
 #include "content/browser/cache_storage/cache_storage_index.h"
 #include "content/browser/cache_storage/cache_storage_scheduler.h"
 #include "content/public/browser/browser_thread.h"
+#include "crypto/symmetric_key.h"
 #include "net/base/directory_lister.h"
 #include "net/base/net_errors.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
 
+using crypto::SymmetricKey;
+
 namespace content {
 
 namespace {
 
+const SymmetricKey::Algorithm kPaddingKeyAlgorithm = SymmetricKey::AES;
+
 std::string HexedHash(const std::string& value) {
   std::string value_hash = base::SHA1HashString(value);
   std::string valued_hexed_hash = base::ToLowerASCII(
       base::HexEncode(value_hash.c_str(), value_hash.length()));
   return valued_hexed_hash;
 }
 
 void SizeRetrievedFromAllCaches(std::unique_ptr<int64_t> accumulator,
                                 const CacheStorage::SizeCallback& callback) {
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::Bind(callback, *accumulator));
 }
 
 void DoNothingWithBool(bool success) {}
 
+std::unique_ptr<SymmetricKey> GeneratePaddingKey() {

[jkarlin, 2017/06/13 12:53:35]

We want a single key per browser sesssion, not a key per-cache. Having one
per-cache means the attacker can get extra samples for a url by creating new
caches.

[cmumford, 2017/06/13 22:50:42]

Doh - of course <sigh>

+  return SymmetricKey::GenerateRandomKey(kPaddingKeyAlgorithm, 128);
+}
+
+std::unique_ptr<SymmetricKey> ImportPaddingKey(const std::string& raw_key) {
+  return SymmetricKey::Import(kPaddingKeyAlgorithm, raw_key);
+}
+
 }  // namespace
 
 const char CacheStorage::kIndexFileName[] = "index.txt";
 constexpr int64_t CacheStorage::kSizeUnknown;
 
 struct CacheStorage::CacheMatchResponse {
   CacheMatchResponse() = default;
   ~CacheMatchResponse() = default;
 
   CacheStorageError error;
@@ skipping 25 matching lines @@
         origin_(origin) {
     DCHECK(!origin_.is_empty());
   }
 
   virtual ~CacheLoader() {}
 
   // Creates a CacheStorageCache with the given name. It does not attempt to
   // load the backend, that happens lazily when the cache is used.
   virtual std::unique_ptr<CacheStorageCache> CreateCache(
       const std::string& cache_name,
-      int64_t cache_size) = 0;
+      int64_t cache_size,
+      int64_t cache_padding,
+      std::unique_ptr<SymmetricKey> cache_padding_key) = 0;
 
   // Deletes any pre-existing cache of the same name and then loads it.
   virtual void PrepareNewCacheDestination(const std::string& cache_name,
                                           const CacheCallback& callback) = 0;
 
   // After the backend has been deleted, do any extra house keeping such as
   // removing the cache's directory.
   virtual void CleanUpDeletedCache(CacheStorageCache* cache) = 0;
 
   // Writes the cache index to disk if applicable.
@@ skipping 41 matching lines @@
                base::WeakPtr<storage::BlobStorageContext> blob_context,
                CacheStorage* cache_storage,
                const GURL& origin)
       : CacheLoader(cache_task_runner,
                     request_context,
                     quota_manager_proxy,
                     blob_context,
                     cache_storage,
                     origin) {}
 
-  std::unique_ptr<CacheStorageCache> CreateCache(const std::string& cache_name,
-                                                 int64_t cache_size) override {
+  std::unique_ptr<CacheStorageCache> CreateCache(
+      const std::string& cache_name,
+      int64_t cache_size,
+      int64_t cache_padding,
+      std::unique_ptr<SymmetricKey> cache_padding_key) override {
     return CacheStorageCache::CreateMemoryCache(
         origin_, cache_name, cache_storage_, request_context_getter_,
-        quota_manager_proxy_, blob_context_);
+        quota_manager_proxy_, blob_context_, GeneratePaddingKey());
   }
 
   void PrepareNewCacheDestination(const std::string& cache_name,
                                   const CacheCallback& callback) override {
     std::unique_ptr<CacheStorageCache> cache =
-        CreateCache(cache_name, 0 /*cache_size*/);
+        CreateCache(cache_name, 0 /*cache_size*/, 0 /* cache_padding */,
+                    GeneratePaddingKey());
     callback.Run(std::move(cache));
   }
 
   void CleanUpDeletedCache(CacheStorageCache* cache) override {}
 
   void WriteIndex(const CacheStorageIndex& index,
                   const BoolCallback& callback) override {
     callback.Run(true);
   }
 
@@ skipping 37 matching lines @@
                     const GURL& origin)
       : CacheLoader(cache_task_runner,
                     request_context,
                     quota_manager_proxy,
                     blob_context,
                     cache_storage,
                     origin),
         origin_path_(origin_path),
         weak_ptr_factory_(this) {}
 
-  std::unique_ptr<CacheStorageCache> CreateCache(const std::string& cache_name,
-                                                 int64_t cache_size) override {
+  std::unique_ptr<CacheStorageCache> CreateCache(
+      const std::string& cache_name,
+      int64_t cache_size,
+      int64_t cache_padding,
+      std::unique_ptr<SymmetricKey> cache_padding_key) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     DCHECK(base::ContainsKey(cache_name_to_cache_dir_, cache_name));
 
     std::string cache_dir = cache_name_to_cache_dir_[cache_name];
     base::FilePath cache_path = origin_path_.AppendASCII(cache_dir);
     return CacheStorageCache::CreatePersistentCache(
         origin_, cache_name, cache_storage_, cache_path,
         request_context_getter_, quota_manager_proxy_, blob_context_,
-        cache_size);
+        cache_size, cache_padding, std::move(cache_padding_key));
   }
 
   void PrepareNewCacheDestination(const std::string& cache_name,
                                   const CacheCallback& callback) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
     PostTaskAndReplyWithResult(
         cache_task_runner_.get(), FROM_HERE,
         base::Bind(&SimpleCacheLoader::PrepareNewCacheDirectoryInPool,
                    origin_path_),
@@ skipping 16 matching lines @@
 
   void PrepareNewCacheCreateCache(const std::string& cache_name,
                                   const CacheCallback& callback,
                                   const std::string& cache_dir) {
     if (cache_dir.empty()) {
       callback.Run(std::unique_ptr<CacheStorageCache>());
       return;
     }
 
     cache_name_to_cache_dir_[cache_name] = cache_dir;
-    callback.Run(CreateCache(cache_name, CacheStorage::kSizeUnknown));
+    callback.Run(CreateCache(cache_name, CacheStorage::kSizeUnknown,
+                             CacheStorage::kSizeUnknown, GeneratePaddingKey()));
   }
 
   void CleanUpDeletedCache(CacheStorageCache* cache) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     DCHECK(base::ContainsKey(doomed_cache_to_path_, cache));
 
     base::FilePath cache_path =
         origin_path_.AppendASCII(doomed_cache_to_path_[cache]);
     doomed_cache_to_path_.erase(cache);
 
@@ skipping 72 matching lines @@
 
     std::unique_ptr<std::set<std::string>> cache_dirs(
         new std::set<std::string>);
 
     auto index = base::MakeUnique<CacheStorageIndex>();
     for (int i = 0, max = protobuf_index.cache_size(); i < max; ++i) {
       const proto::CacheStorageIndex::Cache& cache = protobuf_index.cache(i);
       DCHECK(cache.has_cache_dir());
       int64_t cache_size =
           cache.has_size() ? cache.size() : CacheStorage::kSizeUnknown;
-      index->Insert(CacheStorageIndex::CacheMetadata(cache.name(), cache_size));
+      int64_t cache_padding =
+          cache.has_padding() ? cache.padding() : CacheStorage::kSizeUnknown;
+      std::string cache_padding_key = cache.has_padding_key()
+                                          ? cache.padding_key()
+                                          : GeneratePaddingKey()->key();
+
+      index->Insert(CacheStorageIndex::CacheMetadata(
+          cache.name(), cache_size, cache_padding,
+          std::move(cache_padding_key)));
       cache_name_to_cache_dir_[cache.name()] = cache.cache_dir();
       cache_dirs->insert(cache.cache_dir());
     }
 
     cache_task_runner_->PostTask(
         FROM_HERE, base::Bind(&DeleteUnreferencedCachesInPool, origin_path_,
                               base::Passed(&cache_dirs)));
     callback.Run(std::move(index));
   }
 
@@ skipping 386 matching lines @@
 
   if (!cache) {
     callback.Run(std::unique_ptr<CacheStorageCacheHandle>(),
                  CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
   CacheStorageCache* cache_ptr = cache.get();
 
   cache_map_.insert(std::make_pair(cache_name, std::move(cache)));
-  cache_index_->Insert(
-      CacheStorageIndex::CacheMetadata(cache_name, cache_ptr->cache_size()));
+  cache_index_->Insert(CacheStorageIndex::CacheMetadata(
+      cache_name, cache_ptr->cache_size(), cache_ptr->cache_padding(),
+      cache_ptr->cache_padding_key()->key()));
 
   cache_loader_->WriteIndex(
       *cache_index_, base::Bind(&CacheStorage::CreateCacheDidWriteIndex,
                                 weak_factory_.GetWeakPtr(), callback,
                                 base::Passed(CreateCacheHandle(cache_ptr))));
 
   cache_loader_->NotifyCacheCreated(cache_name, CreateCacheHandle(cache_ptr));
 }
 
 void CacheStorage::CreateCacheDidWriteIndex(
@@ skipping 225 matching lines @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(initialized_);
 
   CacheMap::iterator map_iter = cache_map_.find(cache_name);
   if (map_iter == cache_map_.end())
     return std::unique_ptr<CacheStorageCacheHandle>();
 
   CacheStorageCache* cache = map_iter->second.get();
 
   if (!cache) {
+    const CacheStorageIndex::CacheMetadata* metadata =
+        cache_index_->FindMetadata(cache_name);
+    DCHECK(metadata);
     std::unique_ptr<CacheStorageCache> new_cache = cache_loader_->CreateCache(
-        cache_name, cache_index_->GetCacheSize(cache_name));
+        cache_name, metadata->size, metadata->padding,
+        ImportPaddingKey(metadata->padding_key));
     CacheStorageCache* cache_ptr = new_cache.get();
     map_iter->second = std::move(new_cache);
 
     return CreateCacheHandle(cache_ptr);
   }
 
   return CreateCacheHandle(cache);
 }
 
 void CacheStorage::SizeRetrievedFromCache(
@@ skipping 25 matching lines @@
                                        weak_factory_.GetWeakPtr(),
                                        base::Passed(std::move(cache_handle)),
                                        barrier_closure, accumulator_ptr));
   }
 }
 
 void CacheStorage::SizeImpl(const SizeCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(initialized_);
 
-  if (cache_index_->GetStorageSize() != kSizeUnknown) {
+  if (cache_index_->GetPaddedStorageSize() != kSizeUnknown) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::Bind(callback, cache_index_->GetStorageSize()));
+        FROM_HERE, base::Bind(callback, cache_index_->GetPaddedStorageSize()));
     return;
   }
 
   std::unique_ptr<int64_t> accumulator(new int64_t(0));
   int64_t* accumulator_ptr = accumulator.get();
 
   base::Closure barrier_closure = base::BarrierClosure(
       cache_index_->num_entries(),
       base::Bind(&SizeRetrievedFromAllCaches,
                  base::Passed(std::move(accumulator)), callback));
 
   for (const auto& cache_metadata : cache_index_->ordered_cache_metadata()) {
     if (cache_metadata.size != CacheStorage::kSizeUnknown) {
       *accumulator_ptr += cache_metadata.size;
       barrier_closure.Run();
       continue;
     }
     std::unique_ptr<CacheStorageCacheHandle> cache_handle =
         GetLoadedCache(cache_metadata.name);
     CacheStorageCache* cache = cache_handle->value();
     cache->Size(base::Bind(&CacheStorage::SizeRetrievedFromCache,
                            weak_factory_.GetWeakPtr(),
                            base::Passed(std::move(cache_handle)),
                            barrier_closure, accumulator_ptr));
   }
 }
 
 }  // namespace content